# Session timeout — applies to ALL PHP requests automatically.
# 383 different files call session_start() but only 1 includes session-init.php,
# so the ini_set() values in that helper never applied across the rest. With
# Apache mod_php (verified on UAT/PROD), php_value directives here set the
# runtime ini for every request — the only place that works across all entry
# points. 28800 = 8h.
<IfModule mod_php.c>
    php_value session.gc_maxlifetime 28800
    php_value session.cookie_lifetime 28800
    php_value session.gc_probability 1
    php_value session.gc_divisor 100
    php_value session.cookie_path /
    php_value session.use_strict_mode 1
    php_value session.cookie_httponly 1
    php_value session.cookie_samesite Lax
</IfModule>
<IfModule mod_php7.c>
    php_value session.gc_maxlifetime 28800
    php_value session.cookie_lifetime 28800
</IfModule>
<IfModule mod_php8.c>
    php_value session.gc_maxlifetime 28800
    php_value session.cookie_lifetime 28800
</IfModule>

RewriteEngine On

# Handle clean candidate profile URLs
# Route /ats/public/profile/candidate-name/token to /ats/public/candidate-profile-modern.php?token=
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^profile/([^/]+)/([^/]+)/?$ candidate-profile-modern.php?token=$2 [L,QSA]

# Alternative: Just /ats/public/profile/token (without name)
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^profile/([^/]+)/?$ candidate-profile-modern.php?token=$1 [L,QSA]

# Prevent direct access to PHP files (except specific ones)
# Note: candidate-profile-modern.php is allowed for public access (needed for digest links)
RewriteCond %{THE_REQUEST} \s/+ats/public/(candidate-profile-simple|candidate-public-profile)\.php[\s?] [NC]
RewriteRule ^ - [F]