# This application is served from the project root, so the framework internals
# (.env, vendor/, storage/, composer files, SQL dumps) sit inside the document
# root. Everything that is not the front controller must be blocked explicitly.
#
# Apache 2.4+ syntax. The deny rules are deliberately OUTSIDE <IfModule
# mod_rewrite.c> so they still apply if mod_rewrite is unavailable.
#
# On nginx these rules do nothing — see security/nginx.conf.example.

Options -Indexes -MultiViews

# --- Dotfiles: .env, .env.example, .git, .editorconfig, ... -----------------
<FilesMatch "^\.">
    Require all denied
</FilesMatch>

# --- Files that must never be served ----------------------------------------
<FilesMatch "(?i)\.(env|log|sql|sqlite|db|ini|bak|old|orig|save|swp|dist|lock|json|md|yml|yaml|sh|conf)$">
    Require all denied
</FilesMatch>

<FilesMatch "(?i)^(composer\.(json|lock|phar)|package(-lock)?\.json|artisan|phpunit\.xml|vite\.config\.js|README\.md|\.editorconfig)$">
    Require all denied
</FilesMatch>

# index.php is the front controller and must stay reachable.
<Files "index.php">
    Require all granted
</Files>

<IfModule mod_rewrite.c>
    RewriteEngine On

    # --- Block direct access to framework and dependency directories --------
    RewriteRule ^(app|bootstrap|config|database|resources|routes|storage|tests|vendor|security|SQL)(/|$) - [F,L]

    # --- Never execute PHP inside upload/asset directories -------------------
    RewriteRule ^(storage|assets)/.*\.(php[0-9]?|phtml|phar|pht|inc)$ - [F,L]

    # --- Uploads may only ever serve images ---------------------------------
    # The package shipped a Google service-account key and a 400 KB database
    # dump inside assets/upload, both downloadable. Allow-list the extensions
    # instead of trying to blocklist whatever gets uploaded next.
    RewriteCond %{REQUEST_URI} !\.(webp|avif|png|jpe?g|gif|svg|ico)$ [NC]
    RewriteRule ^assets/upload/ - [F,L]

    # Handle Authorization Header
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # Redirect Trailing Slashes If Not A Folder...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} (.+)/$
    RewriteRule ^ %1 [L,R=301]

    # Send Requests To Front Controller...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]
</IfModule>

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set X-Permitted-Cross-Domain-Policies "none"
</IfModule>

# Do not advertise PHP or leak errors to visitors.
<IfModule mod_php.c>
    php_flag display_errors off
    php_flag expose_php off
</IfModule>
