# Set default index page
DirectoryIndex index.php

# Disable directory listing
Options -Indexes

# Enable HTTP Security Headers
<IfModule mod_headers.c>
Header set X-Frame-Options "SAMEORIGIN"
Header set X-Content-Type-Options "nosniff"
Header set X-XSS-Protection "1; mode=block"
Header set Referrer-Policy "strict-origin-when-cross-origin"
Header set Content-Security-Policy "default-src 'self' https://cdn.jsdelivr.net https://ui-avatars.com https://images.unsplash.com; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net; font-src 'self' https://cdn.jsdelivr.net; img-src 'self' data: https:; frame-src 'self';"
</IfModule>

# Hide .php extension
RewriteEngine On

# Rewrite dynamic routes
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^event/([0-9]+)(?:&(.*))?$ event_detail.php?id=$1&$2 [QSA,L]

RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^public_event/([0-9]+)(?:&(.*))?$ public_event_detail.php?id=$1&$2 [QSA,L]

RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^public_profile/([0-9]+)(?:&(.*))?$ public_profile.php?id=$1&$2 [QSA,L]

# Rewrite download route
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^download/([^/]+)(?:/)?$ download_doc.php?file=$1 [QSA,L]

# Rewrite register ref route
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^register/ref/([^/]+)(?:/)?$ register.php?ref=$1 [QSA,L]

# Rewrite invoice route
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^invoice/([0-9]+)(?:&(.*))?$ invoice.php?event_id=$1&$2 [QSA,L]

# Fallback for other extensionless php pages
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^([^\.]+)$ $1.php [NC,L]
