# Install only as /apps/bildwerk/.htaccess after checking the target server.
# Apache 2.4 syntax; LiteSpeed compatibility and inherited headers must be tested.
# Do not copy these rules into the WordPress root .htaccess.

Options -Indexes -MultiViews
DirectoryIndex index.html
ErrorDocument 404 "Not Found"
FileETag MTime Size

<IfModule mod_mime.c>
    AddType text/javascript .js .mjs
    AddType application/wasm .wasm
    AddType application/octet-stream .onnx
    AddType font/ttf .ttf
</IfModule>

<IfModule mod_rewrite.c>
    RewriteEngine On
    # Missing assets must not fall through to a WordPress HTML response.
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^ - [R=404,END]
    RewriteRule ^ - [END]
</IfModule>

<IfModule mod_headers.c>
    Header onsuccess unset Content-Security-Policy
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' blob: data:; connect-src 'self'; worker-src 'self' blob:; font-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; form-action 'none'"
    Header always set X-Content-Type-Options "nosniff"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set X-Frame-Options "SAMEORIGIN"

    # Remove inherited Cache-Control values before setting this app's policy.
    Header onsuccess unset Cache-Control
    Header always unset Cache-Control
    Header always set Cache-Control "public, max-age=86400, must-revalidate" "expr=%{REQUEST_STATUS} < 400"

    <FilesMatch "\.html$">
        Header always set Cache-Control "no-cache" "expr=%{REQUEST_STATUS} < 400"
    </FilesMatch>
    <FilesMatch "^.+-[A-Za-z0-9_-]{8}\.(?:js|css|wasm)$">
        Header always set Cache-Control "public, max-age=31536000, immutable" "expr=%{REQUEST_STATUS} < 400"
    </FilesMatch>
    # The model URL is not content-versioned; never mark this file immutable.
    <Files "u2net.onnx">
        Header always set Cache-Control "public, max-age=86400, must-revalidate" "expr=%{REQUEST_STATUS} < 400"
    </Files>
    Header always set Cache-Control "no-store" "expr=%{REQUEST_STATUS} >= 400"
</IfModule>

<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/css text/javascript application/javascript application/json application/wasm
</IfModule>

# No global COOP/COEP or WordPress, DNS, TLS or account changes belong here.
# Missing modules must be detected by the HTTP checks; IfModule is not a pass.
