# Raiju CMS - .htaccess
# Apache mod_rewrite required
#
# Dynamic content routing lives in route.php. Apache security, aliases and
# file/directory precedence live here; see ROUTING.md before changing them.
# These core rules are language-agnostic with respect to SITE_LANG_DEFAULT.

RewriteEngine On
Options -MultiViews

# ============================================
# Security - Protect sensitive files
# ============================================

# Deny access to config files
<FilesMatch "(?i)^(config\.php|smtp-config\.php)$">
    Order allow,deny
    Deny from all
</FilesMatch>

# Deny access to JSON content files, backups, trash directories and the local working folder
RewriteRule ^(content|backups|tests|cli|not-for-git)/ - [F,L,NC]
RewriteRule (^|/)[^/]*-trash(/|$) - [F,L,NC]
# Never expose VCS, environment or local tooling files. Keep ACME available.
RewriteRule (^|/)\.(?!well-known(?:/|$)) - [F,L,NC]

# Route news detail URLs before Apache can resolve language-local
# listing templates such as de/news.php or es/news.php.
RewriteRule ^([a-z]{2}/)?news/[a-z0-9-]+/?$ /route.php [END,QSA]

# ============================================
# Upload limits (optional)
# ============================================
# PHP caps every upload with upload_max_filesize and post_max_size; the media
# library's image limit (Settings → Modules → Media library) cannot exceed them.
# On hosts that run PHP as an Apache module, uncomment to raise them here; on
# PHP-FPM hosts use .user.ini or the hosting panel instead (the system status
# in the dashboard shows the values in effect).
# php_value upload_max_filesize 20M
# php_value post_max_size 25M
# php_value memory_limit 256M

# ============================================
# Static files & directories
# ============================================

# Route-specific canonical URLs; mirror includes/routing-helper.php.
# /login is a compatibility entry point, never a second asset base directory.
RewriteRule ^login/?$ /admin/ [R=308,L]

# PHP endpoints win over same-named directories (e.g. dashboard.php alongside
# dashboard/scripts/). A new implementation directory must not break its URL.
RewriteCond %{DOCUMENT_ROOT}/$1.php -f
RewriteCond %{DOCUMENT_ROOT}/$1 -d
RewriteRule ^(.+?)/?$ /$1.php [R=308,L]

# Slash variants of existing PHP scripts use an explicit file URL.
RewriteCond %{DOCUMENT_ROOT}/$1.php -f
RewriteRule ^(.+)/$ /$1.php [R=308,L]

# Directory entry points need a slash for relative assets. 308 preserves POSTs.
RewriteCond %{REQUEST_FILENAME} -d
RewriteCond %{REQUEST_FILENAME}/index.php -f
RewriteRule ^(.*[^/])$ /$1/ [R=308,L]

# Serve existing files directly (CSS, JS, images, fonts, etc.)
RewriteCond %{REQUEST_FILENAME} -f
RewriteRule ^ - [L]

# Serve directories that have an index.php (e.g. /admin/)
RewriteCond %{REQUEST_FILENAME} -d
RewriteCond %{REQUEST_FILENAME}/index.php -f
RewriteRule ^ - [L]

# Clean URLs: if slug.php exists as a file, serve it directly
RewriteCond %{REQUEST_FILENAME}.php -f
RewriteRule ^(.+)$ /$1.php [END]

# ============================================
# Front Controller
# ============================================

# Everything else goes to route.php (language routing, news, JSON pages).
# Use an absolute target and END so requests below real language
# directories (/de/..., /es/...) cannot enter another per-directory
# rewrite round.
RewriteRule ^ /route.php [END,QSA]

# ============================================
# Error Pages
# ============================================
ErrorDocument 404 /404.php
ErrorDocument 410 /410.php