# ShopSync API - Apache front controller rules.
#
# Point the DocumentRoot of the virtual host at this `public/` directory so
# that application code, the .env file and the vendor directory are never
# exposed over HTTP.

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /

    # Handle Authorization header (some CGI setups strip it).
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # If the request maps to an existing file/directory, serve it directly.
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^ index.php [QSA,L]
</IfModule>

<IfModule mod_headers.c>
    # Never let the browser guess the content type.
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# Block access to dot files (e.g. .env) if they ever end up inside public/.
<FilesMatch "^\.">
    Require all denied
</FilesMatch>
