<IfModule mod_rewrite.c>
    <IfModule mod_negotiation.c>
        Options -MultiViews -Indexes
    </IfModule>

    RewriteEngine On

    # Force HTTPS
    RewriteCond %{HTTPS} off
    RewriteCond %{HTTP_HOST} !^localhost [NC]
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

    # Pass OPTIONS preflight to Laravel so CorsHeaders middleware can respond
    RewriteCond %{REQUEST_METHOD} OPTIONS
    RewriteRule ^ index.php [L]

    # Handle Authorization Header
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # Handle X-XSRF-Token Header
    RewriteCond %{HTTP:x-xsrf-token} .
    RewriteRule .* - [E=HTTP_X_XSRF_TOKEN:%{HTTP:X-XSRF-Token}]

    # Redirect Trailing Slashes If Not A Folder...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} (.+)/$
    RewriteRule ^ %1 [L,R=301]

    # Send Requests To Front Controller...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]
</IfModule>

# Block access to sensitive files
<FilesMatch "(^\.env|composer\.(json|lock)|package(-lock)?\.json|artisan|phpunit\.xml|\.git)">
    Require all denied
</FilesMatch>

# CORS: respond to OPTIONS preflight immediately at the rewrite level so
# LiteSpeed never gets a chance to intercept it without CORS headers.
<IfModule mod_rewrite.c>
    RewriteCond %{REQUEST_METHOD} ^OPTIONS$
    RewriteRule ^ - [R=204,L]
</IfModule>

# CORS + Security headers (Header always set = applies to ALL responses including
# the 204 above, error pages, and PHP responses).
<IfModule mod_headers.c>
    Header always set Access-Control-Allow-Origin "https://ocr.syhc.com.my"
    Header always set Access-Control-Allow-Methods "GET, POST, PUT, PATCH, DELETE, OPTIONS"
    Header always set Access-Control-Allow-Headers "Authorization, Content-Type, Accept, X-Requested-With, X-XSRF-TOKEN"
    Header always set Access-Control-Allow-Credentials "true"
    Header always set Access-Control-Max-Age "86400"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "DENY"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
    # Remove server fingerprinting headers
    Header always unset X-Powered-By
    Header always unset Server
</IfModule>

# php -- BEGIN cPanel-generated handler, do not edit
# This domain inherits the “PHP” package.
# php -- END cPanel-generated handler, do not edit

AddType application/javascript mjs

# BEGIN cPanel-generated php ini directives, do not edit
# Manual editing of this file may result in unexpected behavior.
# To make changes to this file, use the cPanel MultiPHP INI Editor (Home >> Software >> MultiPHP INI Editor)
# For more information, read our documentation (https://go.cpanel.net/EA4ModifyINI)
<IfModule php8_module>
   php_value upload_max_filesize 50M
   php_value post_max_size 55M
   php_flag display_errors Off
   php_value max_execution_time 120
   php_value max_input_time 60
   php_value max_input_vars 1000
   php_value memory_limit 256M
   php_value session.gc_maxlifetime 1440
   php_value session.save_path "/var/cpanel/php/sessions/ea-php80"
   php_flag zlib.output_compression Off
</IfModule>
<IfModule lsapi_module>
   php_value upload_max_filesize 50M
   php_value post_max_size 55M
   php_flag display_errors Off
   php_value max_execution_time 120
   php_value max_input_time 60
   php_value max_input_vars 1000
   php_value memory_limit 256M
   php_value session.gc_maxlifetime 1440
   php_value session.save_path "/var/cpanel/php/sessions/ea-php80"
   php_flag zlib.output_compression Off
</IfModule>
# END cPanel-generated php ini directives, do not edit
