# This package ships flat: index.php sits in the same folder as app/, vendor/,
# .env and everything else, meant to be extracted straight into public_html
# with no document-root change. Laravel normally relies on a separate
# public/ folder for exactly the isolation these rules provide by hand —
# without them, requesting /.env or /vendor/composer.json directly would have
# Apache serve those files as plain text, since they exist as real files and
# Laravel's own routing never gets a chance to say no.
#
# Fails closed: every application directory is denied outright, and the
# handful of sensitive root files are denied by name. Only the front
# controller, the compiled assets in build/, uploaded branding in uploads/,
# and the two standard static files are reachable.

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Deny the application's own directories before anything else runs.
    RewriteRule ^(app|bootstrap|config|database|lang|resources|routes|storage|tests|vendor)(/.*)?$ - [F,L]

    <IfModule mod_negotiation.c>
        Options -MultiViews -Indexes
    </IfModule>

    # Handle Authorization Header
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # Redirect Trailing Slashes If Not A Folder...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} (.+)/$
    RewriteRule ^ %1 [L,R=301]

    # Send Requests To Front Controller...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]
</IfModule>

# Deny the sensitive root files by name — these exist as real files, so the
# rewrite rules above never even see a request for them; this is the only
# thing standing between a direct request and Apache serving them as-is.
<FilesMatch "^(\.env.*|composer\.(json|lock)|package(-lock)?\.json|vite\.config\.js|artisan|README\.md|INSTALL\.md|phpunit\.xml)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>
