# Single-root deployment: everything (PHP API, the React app's static build, and the
# installer) lives directly in this one document root, which is what most ordinary
# shared-hosting cPanel accounts give you (no custom document-root folder option).
# Sensitive PHP source (app/, config/, database/, storage/, routes/, scripts/) stays
# physically inside the web root here, so it MUST be denied from direct HTTP access --
# it's only ever reached by being require()'d from index.php/install.php, never requested.

RewriteEngine On

# Deny direct web access to PHP source/config/data folders first, unconditionally --
# they're only ever require()'d by index.php/install.php, never requested directly.
RewriteRule ^(app|config|database|routes|scripts|storage)/ - [F,L]

# /api/* goes through the PHP front controller.
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^api/ index.php [L]

# Everything else: serve the file directly if it exists (JS/CSS/images from the built
# frontend, install.php, index.php itself), otherwise fall back to index.html so React
# Router's client-side routes keep working on a hard refresh/deep link (e.g. /projects/5).
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ index.html [L]

# Never serve dotfiles (.env, .git, .installed, .install_nonce, etc.) directly.
<FilesMatch "^\.">
  Require all denied
</FilesMatch>

# Defence in depth in case mod_rewrite is ever disabled for this vhost.
<IfModule !mod_rewrite.c>
  <FilesMatch "\.(php)$">
    <If "%{REQUEST_URI} =~ m#^/(app|config|database|routes|scripts|storage)/#">
      Require all denied
    </If>
  </FilesMatch>
</IfModule>
