# --------------------------------------------------------------------------
# INKRAH Web Design Open Source Project for Gallery Portal
# --------------------------------------------------------------------------
# 
# This file is part of INKRAH Web Design (https://inkrah.com/web-design).
# Specifically designed as part of the INKRAH ecosystem: 
# https://inkrah.com
# 
# @package    LibraryVault
# @author     INKRAH Web Design <webmaster@inkrah.com>
# @copyright  Copyright (c) 2026 INKRAH Web Design. All rights reserved.
# @link       https://inkrah.com/web-design/002
# @support    Phone/WhatsApp: +62 811 1345 777
# 
# LICENCE & USAGE POLICY:
# This is an open-source content management system (CMS) component. 
# By using, modifying, or distributing this software, you strictly agree 
# to use it exclusively for lawful content and purposes that are fully 
# compliant with applicable laws and moral standards (Halal usage). 
# Any unlawful, prohibited, or unethical utilization is strictly forbidden.
# --------------------------------------------------------------------------
# ==========================================================
#  Gallery Portal — root .htaccess
# ==========================================================

# ---- Disable directory listing & server signature ----------
Options -Indexes -MultiViews
ServerSignature Off

# ---- Block access to dot-files (.env, .git, .htaccess itself, etc.) ----
<FilesMatch "^\.">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order deny,allow
        Deny from all
    </IfModule>
</FilesMatch>

# ---- Block direct access to data / config file types anywhere ----------
<FilesMatch "\.(sqlite|sqlite3|db|sql|log|md|lock)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order deny,allow
        Deny from all
    </IfModule>
</FilesMatch>

# ---- Pretty / SEO-friendly URLs ------------------------------------------
<IfModule mod_rewrite.c>
    RewriteEngine On
    # RewriteBase /gallery/

    # /d/{slug}  -> detail.php?slug={slug}
    RewriteRule ^d/([a-z0-9\-]+)/?$ detail.php?slug=$1 [L,QSA,PT]

    # /watch/{slug} -> viewer/index.php?slug={slug}
    RewriteRule ^watch/([a-z0-9\-]+)/?$ viewer/index.php?slug=$1 [L,QSA,PT]

    # /category/{name} -> index.php?category={name}
    RewriteRule ^category/([a-z0-9\-]+)/?$ index.php?category=$1 [L,QSA,PT]

    # /sitemap.xml -> sitemap.php
    RewriteRule ^sitemap\.xml$ sitemap.php [L,PT]
</IfModule>

# ---- Sensible caching for static assets -----------------------------------
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType image/jpg "access plus 1 week"
    ExpiresByType image/jpeg "access plus 1 week"
    ExpiresByType image/png "access plus 1 week"
    ExpiresByType text/css "access plus 1 week"
    ExpiresByType application/javascript "access plus 1 week"
</IfModule>

# NOTE: /content/epub, /content/pdf and /content/video each carry their own
# "deny all" .htaccess so the original files can never be requested directly,
# even with a guessed or leaked URL. All viewing happens through
# /viewer/stream.php, which enforces login + per-title access grants.
