# Deployed under /citpl_website/ on Apache.
# Requires: mod_rewrite, mod_headers, PHP curl
# API: PHP proxy to Node on 127.0.0.1:3001 (start with: npm run server / pm2)

<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteBase /citpl_website/

  # API -> PHP proxy (works without mod_proxy)
  RewriteRule ^api(?:/.*)?$ api/index.php [QSA,L]

  # Uploads -> PHP proxy
  RewriteRule ^uploads/(.*)$ uploads-proxy.php?file=$1 [QSA,L]
</IfModule>

# Host security headers use frame-ancestors 'none' + X-Frame-Options DENY.
# Edit them so admin can embed preview.html (same origin).
<IfModule mod_headers.c>
  Header always edit Content-Security-Policy "frame-ancestors 'none'" "frame-ancestors 'self'"
  Header always edit X-Frame-Options "DENY" "SAMEORIGIN"

  <FilesMatch "^(preview\.html|preview\.php|index\.html)$">
    Header unset X-Frame-Options
    Header always unset X-Frame-Options
    Header unset Content-Security-Policy
    Header always unset Content-Security-Policy
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Content-Security-Policy "frame-ancestors 'self'"
  </FilesMatch>
</IfModule>