# POS Backend API — cPanel/LiteSpeed safe rules for /dis2/api/
Options -Indexes

# Enable CORS for production domain, Lovable preview, and local development
<IfModule mod_headers.c>
    SetEnvIfNoCase Origin "^https?://(([a-zA-Z0-9-]+\.)*jopython\.(com|work)|.*\.lovable\.app|.*\.lovableproject\.com|localhost(:[0-9]+)?|127\.0\.0\.1(:[0-9]+)?)$" CORS_ALLOW=$0

    Header always set Access-Control-Allow-Origin "%{CORS_ALLOW}e" env=CORS_ALLOW
    Header always set Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS" env=CORS_ALLOW
    Header always set Access-Control-Allow-Headers "Content-Type, Authorization, X-Requested-With, If-None-Match" env=CORS_ALLOW
    Header always set Access-Control-Max-Age "86400" env=CORS_ALLOW
    Header always merge Vary "Origin"
</IfModule>

# Enable GZIP Compression
<IfModule mod_deflate.c>
    # Compress JSON responses
    AddOutputFilterByType DEFLATE application/json
    AddOutputFilterByType DEFLATE text/plain
    AddOutputFilterByType DEFLATE text/html
    AddOutputFilterByType DEFLATE text/xml
    AddOutputFilterByType DEFLATE application/xml
    AddOutputFilterByType DEFLATE application/javascript
    AddOutputFilterByType DEFLATE text/css
    
    # Don't compress images
    SetEnvIfNoCase Request_URI \.(?:gif|jpe?g|png|ico)$ no-gzip
</IfModule>

# Browser Caching for static files
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType application/json "access plus 5 minutes"
    ExpiresByType image/jpeg "access plus 1 month"
    ExpiresByType image/png "access plus 1 month"
    ExpiresByType image/gif "access plus 1 month"
</IfModule>

# Rewrite rules: pass Authorization to PHP and answer OPTIONS before PHP
<IfModule mod_rewrite.c>
    RewriteEngine On

    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    RewriteCond %{REQUEST_METHOD} OPTIONS
    RewriteRule ^ - [R=204,L]
</IfModule>

# Increase limits only when PHP runs as mod_php; prevents 500 on CGI/FPM/LiteSpeed
<IfModule mod_php.c>
    php_value upload_max_filesize 10M
    php_value post_max_size 12M
    php_value max_execution_time 60
    php_value max_input_time 60
</IfModule>

# Security headers
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set X-XSS-Protection "1; mode=block"
</IfModule>

# Protect sensitive files
<FilesMatch "^(db\.php)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>
