# Deployed under /citpl_website/ — Apache must proxy API to the Node server.
# Requires: mod_rewrite, mod_proxy, mod_proxy_http, mod_headers
# Start Node on the host:  npm run server   (or pm2 start server/index.js)

<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteBase /citpl_website/

  # Proxy API + uploads to Express (Node) on port 3001
  RewriteRule ^api/(.*)$ http://127.0.0.1:3001/api/$1 [P,L]
  RewriteRule ^uploads/(.*)$ http://127.0.0.1:3001/uploads/$1 [P,L]
</IfModule>

# Allow admin login preview iframe (same origin)
<IfModule mod_headers.c>
  Header always edit Content-Security-Policy "frame-ancestors 'none'" "frame-ancestors 'self'"
  Header always edit X-Frame-Options "DENY" "SAMEORIGIN"

  <FilesMatch "^(preview\.html|index\.html)$">
    Header unset X-Frame-Options
    Header always unset X-Frame-Options
    Header unset Content-Security-Policy
    Header always unset Content-Security-Policy
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Content-Security-Policy "frame-ancestors 'self'"
  </FilesMatch>
</IfModule>