<IfModule mod_rewrite.c>
    <IfModule mod_negotiation.c>
        Options -MultiViews -Indexes
    </IfModule>

    RewriteEngine On

    # ----------------------------------------------------
    # ✅ CORS Headers (Must come before Laravel routing)
    # ----------------------------------------------------
<IfModule mod_headers.c>
    # Allow frontend at localhost, ecomjs.creamerz.com and ecomjs1.creamerz.com
    SetEnvIf Origin "https?://(localhost:4200|ecomjs\.creamerz\.com|ecomjs1\.creamerz\.com|productswell\.pk|www\.productswell\.pk)$" AccessControlAllowOrigin=$0

    Header always set Access-Control-Allow-Origin %{AccessControlAllowOrigin}e env=AccessControlAllowOrigin
    Header always set Access-Control-Allow-Methods "GET, POST, PUT, PATCH, DELETE, OPTIONS"
    Header always set Access-Control-Allow-Headers "Origin, Content-Type, Authorization, system-key, Accept"
    Header always set Access-Control-Allow-Credentials "true"

    # Handle OPTIONS preflight requests
    <If "%{REQUEST_METHOD} == 'OPTIONS'">
        Header always set Access-Control-Allow-Methods "GET, POST, PUT, PATCH, DELETE, OPTIONS"
        Header always set Access-Control-Allow-Headers "Origin, Content-Type, Authorization, system-key, Accept"
        Header always set Access-Control-Allow-Credentials "true"
        Header always set Access-Control-Max-Age "86400"
        Require all granted
    </If>
</IfModule>


    # ----------------------------------------------------
    # Handle Authorization Header for Laravel Passport/JWT
    # ----------------------------------------------------
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # ----------------------------------------------------
    # Redirect Trailing Slashes If Not A Folder...
    # ----------------------------------------------------
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} (.+)/$
    RewriteRule ^ %1 [L,R=301]

    # ----------------------------------------------------
    # Handle Front Controller (Laravel index.php)
    # ----------------------------------------------------
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]
</IfModule>

# ----------------------------------------------------
# Disable directory browsing
# ----------------------------------------------------
Options -Indexes

# ----------------------------------------------------
# Hide sensitive files (.env, etc.)
# ----------------------------------------------------
<FilesMatch "\.(env|json|config.js|md|gitignore|gitattributes|lock)$">
    Order allow,deny
    Deny from all
</FilesMatch>

# ----------------------------------------------------
# Expires caching rules
# ----------------------------------------------------
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType image/jpg "access plus 1 year"
    ExpiresByType image/jpeg "access plus 1 year"
    ExpiresByType image/gif "access plus 1 year"
    ExpiresByType image/png "access plus 1 year"
    ExpiresByType text/css "access plus 1 month"
    ExpiresByType text/javascript "access plus 1 month"
    ExpiresByType application/javascript "access plus 1 month"
    ExpiresByType image/x-icon "access plus 1 year"
    ExpiresDefault "access plus 1 days"
</IfModule>

# ----------------------------------------------------
# PHP handler (cPanel default)
# ----------------------------------------------------
# php -- BEGIN cPanel-generated handler, do not edit
<IfModule mime_module>
    AddHandler application/x-httpd-ea-php82 .php .php8 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit
