# =============================================================================
#  cdn.hamrahang.ir  —  .htaccess of the admin single page app (index.php)
#  Server  : LiteSpeed / Apache, PHP 7.2+
#  Purpose : - serve the SPA (index.php) as the default document
#            - allow JSON send/receive with https://hamrahang.ir/
#            - keep the static media (thumb/image/mp3) rules of the CDN
#  NOTE    : this file belongs to cdn.hamrahang.ir only.
#            hamrahang.ir keeps its own .htaccess (the one with ha.php routing).
# =============================================================================


# -----------------------------------------------------------------------------
# 1) Old TV browsers: force HTTP/1.1 (kept from the original file)
# -----------------------------------------------------------------------------
<IfModule mod_headers.c>
    Header unset Upgrade
    Header set Connection "keep-alive"
</IfModule>

<IfModule mod_http2.c>
    Protocols http/1.1
</IfModule>


# -----------------------------------------------------------------------------
# 2) Encoding + default document
#    index.php wins over the old index.html that still lives on this host
# -----------------------------------------------------------------------------
AddDefaultCharset utf-8
DirectoryIndex index.php index.html

AddType application/x-httpd-php .php


# -----------------------------------------------------------------------------
# 3) HTTPS only
# -----------------------------------------------------------------------------
<IfModule mod_rewrite.c>
    RewriteEngine On

    RewriteCond %{HTTPS} !=on
    RewriteCond %{HTTP:X-Forwarded-Proto} !https
    RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]
</IfModule>


# -----------------------------------------------------------------------------
# 4) CORS — JSON exchange between hamrahang.ir and cdn.hamrahang.ir
#    Only our own properties are allowed to read these responses.
# -----------------------------------------------------------------------------
<IfModule mod_headers.c>
    SetEnvIf Origin "^https://([a-z0-9-]+\.)*hamrahang\.ir$" CORS_ORIGIN=$0

    Header always set Access-Control-Allow-Origin      "%{CORS_ORIGIN}e" env=CORS_ORIGIN
    Header always set Access-Control-Allow-Credentials "true"            env=CORS_ORIGIN
    Header always set Access-Control-Allow-Methods     "GET, POST, PUT, PATCH, DELETE, OPTIONS" env=CORS_ORIGIN
    Header always set Access-Control-Allow-Headers     "Content-Type, Authorization, X-Requested-With, X-Admin-Token" env=CORS_ORIGIN
    Header always set Access-Control-Max-Age           "86400"           env=CORS_ORIGIN
    Header always merge  Vary "Origin"

    # generic hardening
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# answer every preflight (OPTIONS) immediately, PHP never sees it
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_METHOD} =OPTIONS
    RewriteRule ^(.*)$ $1 [R=200,L]
</IfModule>


# -----------------------------------------------------------------------------
# 5) Never expose includes, secrets, logs or editor leftovers
#    (require_once still works, these are only blocked for HTTP clients)
# -----------------------------------------------------------------------------
<IfModule mod_rewrite.c>
    RewriteEngine On

    RewriteRule ^(db|auth|head_inc|config|conf)\.php$ - [F,L]
    RewriteRule \.(log|sql|bak|ini|env|sh|md|old)$   - [F,L]
    RewriteRule ^\.(git|env|htpasswd|htaccess)       - [F,L]
    RewriteRule ^(x@|rText|myText|x~)\.txt$          - [F,L]
</IfModule>


# -----------------------------------------------------------------------------
# 6) Static media stored on this CDN (rules kept from the original file)
# -----------------------------------------------------------------------------
RewriteRule ^advertisment/(.*)$ /ads_fld/$1?&%{QUERY_STRING} [L]
RewriteRule ^thumb/(.+)$ thumb/$1 [L,NC]
RewriteRule ^image/(.*)$ /img/$1 [L]
RewriteRule ^getid3/(.*)$ /getid3/$1 [L]
RewriteRule ^mp3/(.*)$ /mp3/$1 [L]


# -----------------------------------------------------------------------------
# 7) JSON gateway of the SPA
#    POST https://cdn.hamrahang.ir/api/<endpoint>?p=..&q1=..&_qjs=..
#    is forwarded server side to https://hamrahang.ir/ha.php
#    (an administrator session + X-Admin-Token are required by index.php)
# -----------------------------------------------------------------------------
RewriteRule ^api/(.+)$ index.php?mode=query&qjs=$1 [L,QSA]


# -----------------------------------------------------------------------------
# 8) SPA fallback — every unknown path renders index.php (hash router inside)
# -----------------------------------------------------------------------------
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php [L]


# php -- BEGIN cPanel-generated handler, do not edit
# Set the “ea-php74” package as the default “PHP” programming language.
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php74 .php .php7 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit