# --- Force HTTPS ---
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP:X-Forwarded-Proto} !=https
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# --- Raise PHP limits for 100 MB uploads (Hostinger allows this on most plans;
#     if your plan blocks php_value, set these in hPanel > Advanced > PHP Configuration). ---
php_value upload_max_filesize 110M
php_value post_max_size       115M
php_value max_execution_time  300
php_value max_input_time      300
php_value memory_limit        128M

# --- Pass Authorization header through to PHP (some Hostinger setups strip it) ---
RewriteCond %{HTTP:Authorization} ^(.+)$
RewriteRule ^ - [E=HTTP_AUTHORIZATION:%1]

# --- Block the chunked-upload staging directory from web access ---
RewriteRule ^\.uploads(/|$) - [F,L]

# --- Public landing grid at /video/ ---
DirectoryIndex index.php

# --- Routes ---
RewriteRule ^login/?$                     login.php                   [L]
RewriteRule ^admin/?$                     admin.php                   [L]
# Old path → new path (keeps existing bookmarks working).
RewriteRule ^upload/?$                    /video/admin                [R=301,L]
RewriteRule ^api/upload/?$                api/upload.php              [L]
RewriteRule ^api/list/?$                  api/list.php                [L]
RewriteRule ^api/delete/?$                api/delete.php              [L]
RewriteRule ^api/chunked/init/?$          api/chunked/init.php        [L]
RewriteRule ^api/chunked/put/?$           api/chunked/put.php         [L]
RewriteRule ^api/chunked/finalize/?$      api/chunked/finalize.php    [L]
RewriteRule ^api/chunked/abort/?$         api/chunked/abort.php       [L]
RewriteRule ^([a-f0-9]{10})/embed/?$      embed.php?id=$1             [L]
RewriteRule ^([a-f0-9]{10})/?$            play.php?id=$1              [L]

# --- Hardening ---
Options -Indexes
<FilesMatch "\.(htaccess|md|log)$">
  Require all denied
</FilesMatch>
