# The Node app's routes had no file extension (Express doesn't use one), and
# the already-shipped Flutter client calls them that way — e.g.
# POST /api/users/login, not /api/users/login.php. Rather than rename every
# endpoint's URL (and every call site in the app), rewrite the extensionless
# path to the identically-named .php file that implements it. Endpoint files
# themselves stay plain, ordinary PHP — this is routing only, nothing about
# how a request is handled once it arrives.
#
# A few endpoints share a name with a directory of sub-endpoints (e.g.
# api/profile.php vs. api/profile/driver-mode.php — same shape as Node's
# router mounting both "/" and "/driver-mode" under "/api/profile"). Apache's
# own DirectorySlash would otherwise redirect a request for the file to the
# directory before our rewrite ever runs, so it's turned off in favour of the
# explicit rule below.
DirectorySlash Off

# Every endpoint here requires a specific route; browsing the raw directory
# listing (api/, api/users/, api/delivery-request/, etc.) instead hands
# anyone the app's entire endpoint map for free — Apache's default when no
# index file exists and Indexes isn't explicitly disabled.
Options -Indexes

# Trailing-slash guard — must come FIRST, before any other rule.
#
# A request for "existingDir/nonexistentThing/" (trailing slash, the segment
# before it doesn't exist as a file OR a directory) sends Apache's own
# directory-slash canonicalization into a loop against this per-directory
# .htaccess, INDEPENDENTLY of whether any rule below actually matches —
# reproduced in complete isolation (a throwaway app, one fallback rule, no
# other content) and confirmed here against four different real routes
# (a plain endpoint, the delivery-requests alias, the double-numeric
# messages route, and paystack-config/verify/:reference), all hitting
# Apache's "exceeded the limit of 10 internal redirects" error instead of a
# plain 404. None of this app's real routes are ever legitimately requested
# with a trailing slash (confirmed against the Flutter client), so the fix
# is to refuse them outright, before mod_rewrite gets a chance to loop:
# real existing directories (api/, api/users/, etc.) are untouched — this
# only fires when the path is BOTH slash-terminated AND not a real directory.
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} /$
RewriteRule ^ - [R=404,L]

# Plural alias for delivery-request(s) — Node mounts the SAME router at both
# `/api/delivery-request` and `/api/delivery-requests` (some already-installed
# app builds called the plural spelling). Every variant resolves straight to
# the final .php target in ONE substitution (most-specific pattern first: with
# a numeric id, without one, then the bare path) — same reasoning as the
# numeric-id rule below: per-directory .htaccess reprocessing re-parses the
# whole ruleset on any URI change, and letting this fall through to a later
# rule (even a supposedly "final" [L] one) hit Apache's internal-redirect
# limit in practice, not just in theory.
RewriteEngine On
RewriteRule ^delivery-requests/(.+)/([0-9]+)(/.*)?$ delivery-request/$1/id$3.php?id=$2 [L,QSA]
RewriteRule ^delivery-requests/([0-9]+)(/.*)?$ delivery-request/id$2.php?id=$1 [L,QSA]
RewriteRule ^delivery-requests(/.*)?$ delivery-request$1.php [L,QSA]

# /api/paystack-config/verify/:reference — reference is a Paystack-issued
# string (not the numeric id the generic rule below assumes), so it needs its
# own rule, placed BEFORE the numeric one: a reference that happens to be
# all-digits would otherwise match the numeric rule first and get routed to
# the wrong (nonexistent) verify/id.php target instead of verify.php.
RewriteRule ^paystack-config/verify/([^/]+)$ paystack-config/verify.php?reference=$1 [L,QSA]

# /api/messages/:receiverId/:deliveryRequestId — TWO numeric segments in a
# row, unlike every other dynamic route in this app (one id, plus optional
# literal suffix). Needs its own rule, placed before the generic single-id
# rule below: that rule's greedy `(.*)` would otherwise split "messages/42/17"
# as $1="messages/42", $2="17" and rewrite to the nonexistent
# "messages/42/id.php?id=17" instead of "messages/id/id.php?id=42&deliveryRequestId=17".
RewriteRule ^messages/([0-9]+)/([0-9]+)$ messages/id/id.php?id=$1&deliveryRequestId=$2 [L,QSA]

# Express routes like `/:id/status` (a numeric path PARAMETER, not a literal
# segment) have no filesystem equivalent — there's no file named "42". Rather
# than write one physical file per delivery/vehicle/bank/etc. row, any purely
# numeric path segment is rewritten straight to the .php file with "id" in
# its place, carrying the real value through as ?id=<n>:
# /delivery-request/42/status -> /delivery-request/id/status.php?id=42, and
# the PHP file reads $_GET['id']. One rule, reused by every dynamic-id route
# in every phase.
#
# [L] here, appending .php directly in this SAME substitution, rather than
# emitting an intermediate extensionless URL for the generic rule below to
# pick up: per-directory .htaccess reprocessing re-parses the whole ruleset
# any time a rule changes the URI, and a two-step version of this (emit
# "id/status", let the next rule add ".php") hit Apache's internal-redirect
# limit ("exceeded the limit of 10 internal redirects") on that second pass.
# Resolving straight to the final physical file in one substitution avoids
# needing a second pass at all.
RewriteRule ^(.*)/([0-9]+)(/.*)?$ $1/id$3.php?id=$2 [L,QSA]

# Only rewrites when the literal path isn't already a real FILE (so this
# never touches actual static assets) AND the .php version exists. Deliberately
# does NOT exclude directories — see the profile.php/profile/ case above.
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME}\.php -f
RewriteRule ^(.*)$ $1.php [L,QSA]

# MAMP's global php.ini caps post_max_size at 8M — smaller than the 20MB
# per-image limit this app enforces itself (helpers/upload.php), which would
# make PHP silently drop any larger multipart upload (empty $_FILES, no
# catchable error) before our own size check ever runs. Scoped to this app
# only, rather than editing MAMP's shared php.ini (mod_php honours php_value
# in .htaccess — MAMP loads PHP as an Apache module, not php-fpm).
php_value post_max_size 25M
php_value upload_max_filesize 25M

# createDeliveryRequest accepts up to 10 "packageImages" files, all sent
# under the IDENTICAL field name with no "[]" suffix (matching Node's
# multer.array("packageImages", 10) — see helpers/parse_multipart.php's doc
# comment). PHP's automatic $_FILES population keeps only the LAST such part
# silently, so post-data auto-parsing is turned off for just this one file
# and helpers/parse_full_multipart_body() reads php://input by hand instead
# — which is only possible while PHP hasn't already drained it.
<Files "delivery-request.php">
    php_value enable_post_data_reading 0
</Files>
