# ── Mirza Mini App ──────────────────────────────────────────────────────
# All URLs under /app/ are served by index.php (SPA routing).  Headers
# are kept permissive so Telegram's in-app browsers (Android WebView,
# iOS WKWebView) and the Telegram Desktop iframe can load the Mini App
# without being blocked.

<IfModule mod_headers.c>
  # Allow Telegram to embed the Mini App in its iframe / WebView.
  # SameOrigin would block it because Telegram loads from its own origin.
  Header always set X-Frame-Options "ALLOW-FROM https://web.telegram.org"
  # Content-Security-Policy: frame-ancestors is the modern equivalent of
  # X-Frame-Options and overrides it in compliant browsers.
  Header always set Content-Security-Policy "frame-ancestors https://web.telegram.org https://telegram.org https://*.telegram.org https://evrone.com https://*.evrone.com https://www.telegram-mini-apps.com https://*.telegram-mini-apps.com; default-src 'self' 'unsafe-inline' 'unsafe-eval' https:; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' https: wss:;"

  # Cache static assets aggressively (they are hashed by Vite).
  <FilesMatch "\.(js|css|woff2?|png|jpg|svg|ico)$">
    Header set Cache-Control "public, max-age=31536000, immutable"
  </FilesMatch>
</IfModule>

<IfModule !mod_headers.c>
  # Fallback: if mod_headers is not available, use a meta-tag approach via
  # index.php (already embedded).  The PHP script can also set headers.
</IfModule>

# Compress the ~540 KB of JS/CSS the Mini App ships (hashed assets, so
# compression is always safe). Wrapped in IfModule so servers without
# mod_deflate are untouched.
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/plain text/css text/javascript
  AddOutputFilterByType DEFLATE application/javascript application/x-javascript application/json
  AddOutputFilterByType DEFLATE image/svg+xml font/woff font/woff2
</IfModule>

RewriteEngine On

# Do not rewrite requests for real files or directories.
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php [L,QSA]
