<IfModule mod_rewrite.c>
    <IfModule mod_negotiation.c>
        Options -MultiViews -Indexes
    </IfModule>

    RewriteEngine On
    RewriteBase /fb/backend/public/

    # ── CORS: Handle multiple allowed origins dynamically ─────────────────────
    <IfModule mod_headers.c>
        SetEnvIf Origin "^https?://(ai\.paloyan\.net|fbai\.webcodetechnologybd\.com|fb\.webcodetechnologybd\.com|localhost(:\d+)?)$" CORS_ORIGIN=$0
        Header always set Access-Control-Allow-Origin "%{CORS_ORIGIN}e" env=CORS_ORIGIN
        Header always set Access-Control-Allow-Methods "GET, POST, PUT, PATCH, DELETE, OPTIONS"
        Header always set Access-Control-Allow-Headers "Authorization, Content-Type, X-Requested-With, X-Tenant-ID, Accept, Origin, X-CSRF-TOKEN"
        Header always set Access-Control-Allow-Credentials "true"
        Header always set Access-Control-Max-Age "86400"
        Header always set Vary "Origin"
    </IfModule>

    # ── Handle OPTIONS preflight — return immediately ─────────────────────────
    RewriteCond %{REQUEST_METHOD} OPTIONS
    RewriteRule ^(.*)$ index.php [L]

    # ── Handle Authorization Header ───────────────────────────────────────────
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # ── Redirect Trailing Slashes ─────────────────────────────────────────────
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} (.+)/$
    RewriteRule ^ %1 [L,R=301]

    # ── Send All Requests To Front Controller ─────────────────────────────────
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]

</IfModule>

