.htaccess

# PICO SulTeng API Documentation Site Configuration
# Combines Vue SPA routing + COVID-19 API Reverse Proxy + Swagger UI

# Enable rewrite engine
RewriteEngine On
RewriteBase /

# =============================================================================
# API PROXY CONFIGURATION
# =============================================================================

# Proxy API requests to port 8080 (main API proxy rules)
RewriteCond %{REQUEST_URI} ^/api/v1/
RewriteRule ^api/v1/(.*)$ http://localhost:8080/api/v1/$1 [P,L]

# Handle root API endpoint
RewriteRule ^api/v1/?$ http://localhost:8080/api/v1/ [P,L]

# =============================================================================
# SWAGGER UI STATIC FILES CONFIGURATION
# =============================================================================

 # Serve Swagger UI
 RewriteRule ^swagger/?$ /dist/index.html [L]
 RewriteRule ^swagger/(.*)$ /dist/$1 [L]

 # Serve docs directory (swagger.json, swagger.yaml, swagger.html)
 RewriteRule ^docs/(.*)$ /docs/$1 [L]


# Handle docs route for Vue documentation site
RewriteRule ^docs/?$ /index.html [L]

# Redirect /api/ to Swagger UI documentation
RewriteRule ^api/?$ /swagger/ [R=302,L]

# =============================================================================
# CORS HEADERS CONFIGURATION
# =============================================================================

<IfModule mod_headers.c>
    # Handle preflight OPTIONS requests
    RewriteCond %{REQUEST_METHOD} OPTIONS
    RewriteRule ^api/v1/ [R=200,L]
    
    # Add CORS headers for API responses
    <FilesMatch "\\.(json)$">
        Header always set Access-Control-Allow-Origin "*"
        Header always set Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
        Header always set Access-Control-Allow-Headers "Content-Type, Authorization, X-Requested-With"
        Header always set Access-Control-Max-Age "86400"
    </FilesMatch>
    
    # Add CORS headers for API and Swagger routes
    <LocationMatch "^/(api/v1|swagger|docs)/">
        Header always set Access-Control-Allow-Origin "*"
        Header always set Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
        Header always set Access-Control-Allow-Headers "Content-Type, Authorization, X-Requested-With"
    </LocationMatch>
</IfModule>

# =============================================================================
# VUE SPA ROUTING CONFIGURATION (for documentation site)
# =============================================================================

# Handle Vue Router - redirect all non-file requests to index.html
# BUT exclude API and Swagger routes which are handled above
RewriteRule ^index\.html$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} !^/api/
RewriteCond %{REQUEST_URI} !^/swagger/
RewriteCond %{REQUEST_URI} !^/docs/?$
RewriteRule . /index.html [L]

# =============================================================================
# SECURITY HEADERS
# =============================================================================

<IfModule mod_headers.c>
    # Security headers for API and Swagger endpoints
    <LocationMatch "^/(api|swagger|docs)/">
        Header always set X-Content-Type-Options nosniff
        Header always set X-Frame-Options DENY
        Header always set X-XSS-Protection "1; mode=block"
        Header always set Referrer-Policy "strict-origin-when-cross-origin"
    </LocationMatch>
    
    # Security headers for documentation site
    <LocationMatch "^(?!/(api|swagger|docs)/)">
        Header always set X-Frame-Options "SAMEORIGIN"
        Header always set X-Content-Type-Options "nosniff"
        Header always set X-XSS-Protection "1; mode=block"
        Header always set Referrer-Policy "strict-origin-when-cross-origin"
    </LocationMatch>
</IfModule>

# =============================================================================
# PERFORMANCE OPTIMIZATION
# =============================================================================

# Cache static assets
<IfModule mod_expires.c>
  ExpiresActive on
  ExpiresByType text/css "access plus 1 year"
  ExpiresByType application/javascript "access plus 1 year"
  ExpiresByType image/png "access plus 1 year"
  ExpiresByType image/jpg "access plus 1 year"
  ExpiresByType image/jpeg "access plus 1 year"
  ExpiresByType image/gif "access plus 1 year"
  ExpiresByType image/svg+xml "access plus 1 year"
  ExpiresByType image/webp "access plus 1 year"
  ExpiresByType application/woff2 "access plus 1 year"
</IfModule>

# Compress text files
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/plain
    AddOutputFilterByType DEFLATE text/html
    AddOutputFilterByType DEFLATE text/xml
    AddOutputFilterByType DEFLATE text/css
    AddOutputFilterByType DEFLATE application/xml
    AddOutputFilterByType DEFLATE application/xhtml+xml
    AddOutputFilterByType DEFLATE application/rss+xml
    AddOutputFilterByType DEFLATE application/javascript
    AddOutputFilterByType DEFLATE application/x-javascript
    AddOutputFilterByType DEFLATE application/json
</IfModule>

# Serve static files for everything else
# (index.html, assets, images, etc.)
DirectoryIndex index.html

# =============================================================================
# ERROR HANDLING
# =============================================================================

# Custom error pages for API proxy failures
ErrorDocument 502 /api-down.html
ErrorDocument 503 /api-down.html

# =============================================================================
# FILE PROTECTION
# =============================================================================

# Prevent access to sensitive files
<Files ~ "^\.env">
    Order allow,deny
    Deny from all
</Files>

<Files ~ "watchdog\.log|api\.log">
    Order allow,deny
    Deny from all
</Files>

# Protect git files and other sensitive files
<Files ~ "^\.git|^\.htaccess|^\.env|\.md$">
    Order allow,deny
    Deny from all
</Files>