# php -- BEGIN cPanel-generated handler, do not edit
# Set the "alt-php84" package as the default "PHP" programming language.
<IfModule mime_module>
  AddHandler application/x-httpd-alt-php84 .php .php8 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit

# Everything the app needs, in one file at the folder you upload.
#
# Deliberately free of <IfModule>, <Files> and Options below this point. Those
# are container and Options-class directives that need "AllowOverride All";
# where a host grants less, Apache does not skip them — it returns 500 for
# every request, static assets included. Everything below needs only
# AllowOverride FileInfo.
#
# The cPanel block above is the one deliberate exception: cPanel's own
# MultiPHP Manager only ever writes it where the account's AllowOverride
# already supports it, so it doesn't carry that risk here. It's tied to
# whichever PHP version is currently selected on this account (alt-php84 as
# of this writing) — if that's changed again via cPanel later, update the
# version number here too, or the next re-upload will silently overwrite
# cPanel's newer block with this stale one.

RewriteEngine On

# ── one canonical host ────────────────────────────────────────────────────
# http://, https://www., and http://www. all 301 here first — before
# anything else runs — to https://radiofmlive.com. Consolidates SEO signals
# onto one URL instead of splitting them across variants, and matters for a
# reason beyond SEO: favourites/history/theme are all localStorage, which is
# scoped per *origin* (scheme+host). A visitor who first saved favourites
# under a different variant won't see them under another one — nothing
# server-side can retroactively merge storage already split that way, but
# this stops it from splitting any further from here on.
RewriteCond %{HTTP_HOST} !^radiofmlive\.com$ [NC,OR]
RewriteCond %{HTTPS} off
RewriteRule ^ https://radiofmlive.com%{REQUEST_URI} [L,R=301]

# ── cheap noise filtering ─────────────────────────────────────────────────
# Defense in depth, not a security boundary: a real attacker spoofs a normal
# method/User-Agent in minutes. This only turns away unsophisticated bots and
# scanners for free, before they reach PHP at all. Real rate limiting and
# DDoS mitigation live elsewhere — see api/*.php (RateLimit) and put a CDN
# (e.g. Cloudflare) in front for anything network-volume-based, which nothing
# at the .htaccess/PHP level can stop.
#
# The app only ever issues GET/HEAD requests — no form or fetch() here uses
# POST — so anything else is already not a real visitor.
RewriteCond %{REQUEST_METHOD} !^(GET|HEAD)$
RewriteRule ^ - [F]

# A blank User-Agent, or one of these library/scanner defaults, is almost
# never a real browser.
RewriteCond %{HTTP_USER_AGENT} ^-?$ [OR]
RewriteCond %{HTTP_USER_AGENT} (^|[^a-z])(libwww-perl|python-requests|python-urllib|scrapy|httrack|masscan|nikto|sqlmap|nmap) [NC]
RewriteRule ^ - [F]

# ── keep the private folders private ─────────────────────────────────────
# These sit under the web root in this layout, so blocking them is the only
# thing standing between the internet and an 11MB copy of the catalogue.
#
# RewriteRule, not RedirectMatch: in .htaccess these patterns match the path
# *relative to this directory*, so they hold whether the app is the domain
# root or sits in public_html/radio/. A root-anchored RedirectMatch silently
# stops matching the moment there is a subfolder prefix.
#
# These must precede the pass-through rule below, or an existing file such as
# config.php would be served before the deny is ever considered.
RewriteRule ^(data|src|bin)(/|$)                    - [F,L]
RewriteRule ^(config|router)\.php$                  - [F,L]
RewriteRule ^(README|DEPLOY)\.md$                   - [F,L]
RewriteRule ^\.gitignore$                           - [F,L]
RewriteRule (^|/)\.(git|env)                        - [F,L]
RewriteRule \.(sqlite|sqlite-wal|sqlite-shm|log|db)$ - [F,L]

# ── pretty URLs ──────────────────────────────────────────────────────────
# Real files and directories are served untouched (assets, api/*.php).
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]

RewriteRule ^robots\.txt$                   robots.php                 [L,QSA]
RewriteRule ^sitemap\.xml$                  sitemap.php                [L,QSA]
RewriteRule ^sitemap-pages\.xml$            sitemap.php?type=pages     [L,QSA]
RewriteRule ^sitemap-stations-([0-9]+)\.xml$ sitemap.php?type=stations&chunk=$1 [L,QSA]
RewriteRule ^station/([A-Za-z0-9._-]+)/?$   station.php?slug=$1        [L,QSA]
# Every non-empty combination of the three facets gets its own clean path,
# always in country/language/genre order, so which ones happen to be picked
# never determines whether the URL looks clean or falls back to a query
# string -- only an actual multi-value facet or a search does that.
#
# The country segment accepts either shape: [A-Za-z-]+ matches the old
# two-letter code (still resolved by index.php, for anything already
# indexed/bookmarked) as well as the new SEO-friendly name slug
# ("india","united-states") -- see Taxonomy::countrySlug()/countryCodeForSlug().
RewriteRule ^country/([A-Za-z-]+)/language/([a-z-]+)/genre/([a-z0-9-]+)/?$ index.php?country=$1&language=$2&genre=$3 [L,QSA]
RewriteRule ^country/([A-Za-z-]+)/language/([a-z-]+)/?$   index.php?country=$1&language=$2 [L,QSA]
RewriteRule ^country/([A-Za-z-]+)/genre/([a-z0-9-]+)/?$      index.php?country=$1&genre=$2    [L,QSA]
RewriteRule ^language/([a-z-]+)/genre/([a-z0-9-]+)/?$ index.php?language=$1&genre=$2 [L,QSA]
RewriteRule ^language/([a-z-]+)/?$          index.php?language=$1      [L,QSA]
RewriteRule ^genre/([a-z0-9-]+)/?$             index.php?genre=$1         [L,QSA]
RewriteRule ^country/([A-Za-z-]+)/?$       index.php?country=$1       [L,QSA]
RewriteRule ^favourites/?$                  index.php?library=favourites [L,QSA]
RewriteRule ^history/?$                     index.php?library=history  [L,QSA]
RewriteRule ^(privacy|terms|contact)/?$     $1.php                     [L,QSA]
RewriteRule ^$                              index.php                  [L,QSA]

# Anything else is genuinely missing — 404 rather than soft-404 the homepage.
RewriteRule ^ 404.php [L]
