Options -MultiViews
# 3.24.0: the POS folder always opens the app. Older update kits left a stray
# index.php (an old copy of the backend router) here; on a host that prefers
# index.php, or under a website whose .htaccess does, that would open instead.
DirectoryIndex index.html
RewriteEngine On
# 3.23.0: the server's own backup files are never served to a browser
RewriteRule (^|/)pos-backend/backups(/|$) - [F,L]
# Never rewrite anything inside the backend or uploads folders
RewriteCond %{REQUEST_URI} pos-backend/ [OR]
RewriteCond %{REQUEST_URI} uploads/
RewriteRule ^ - [L]
# If the request is for a real file or directory, serve it directly
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
# Otherwise show the app
RewriteRule ^ index.html [QSA,L]

# ── Cache rules (v2.9.1): app shell must always revalidate so updates appear
<IfModule mod_headers.c>
  <FilesMatch "^(index\.html|sw\.js|app\.js|app\.css)$">
    Header set Cache-Control "no-cache, must-revalidate"
  </FilesMatch>
  <FilesMatch "\.(png|jpg|jpeg|webp|ico|woff2?)$">
    Header set Cache-Control "public, max-age=604800"
  </FilesMatch>
  # 3.34.0: the app cannot be shown inside another site's frame (click-jacking)
  <FilesMatch "\.html?$">
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Content-Security-Policy "frame-ancestors 'self'; object-src 'none'; base-uri 'self'"
  </FilesMatch>
</IfModule>

# Never serve database files, docs or backups to a browser. Before this only
# config.php was blocked, and pos-backend/database.sql could be downloaded.
<FilesMatch "\.(sql|md|log|bak|example)$">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
</FilesMatch>
