RewriteEngine On
DirectoryIndex index.php

# Hide .php from public student-facing page URLs.
# API/admin/cron endpoints are intentionally left untouched to protect POST/AJAX behaviour.
RewriteCond %{THE_REQUEST} \s/+student/index\.php(?:[?\s]) [NC]
RewriteRule ^index\.php$ ./ [R=302,L,NE]

RewriteCond %{THE_REQUEST} \s/+student/([A-Za-z0-9_-]+)\.php(?:[?\s]) [NC]
RewriteRule ^([A-Za-z0-9_-]+)\.php$ $1 [R=302,L,NE]

# Internally map /student/dashboard -> /student/dashboard.php, etc.
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME}.php -f
RewriteRule ^([A-Za-z0-9_-]+)/?$ $1.php [L,QSA]

# PWA metadata must revalidate, including on fresh Android installations.
<IfModule mod_mime.c>
    AddType application/manifest+json .webmanifest
</IfModule>
<IfModule mod_headers.c>
    <FilesMatch "^manifest\.webmanifest$">
        Header set Content-Type "application/manifest+json; charset=utf-8"
        Header set Cache-Control "no-cache, max-age=0, must-revalidate"
        Header unset Expires
    </FilesMatch>
    <FilesMatch "^sw\.js$">
        Header set Cache-Control "no-cache, max-age=0, must-revalidate"
    </FilesMatch>
</IfModule>
