# public/.htaccess - front controller routing + hardening
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /

    # HTTPS (uncomment on production with SSL)
    # RewriteCond %{HTTPS} off
    # RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

    # Serve real files/dirs directly (assets)
    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^ - [L]

    # Everything else -> index.php
    RewriteRule ^ index.php [L]
</IfModule>

Options -Indexes
ServerSignature Off

# Security headers
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set X-XSS-Protection "1; mode=block"
    Header set Permissions-Policy "geolocation=(), microphone=(), camera=()"
</IfModule>

# Block hidden / sensitive files
<FilesMatch "^\.">
    Require all denied
</FilesMatch>
<FilesMatch "\.(env|ini|log|sh|sql|md)$">
    Require all denied
</FilesMatch>
