# ============================================================
# ICII 2026 Registration - Root .htaccess
# Redirects all requests to public/ directory and locks down
# every other directory.
# ============================================================

# Disable content negotiation so extensionless URLs like /register are never
# mis-handled (a common cause of 404s on POST under cPanel/LiteSpeed).
<IfModule mod_negotiation.c>
    Options -MultiViews
</IfModule>

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Block access to sensitive directories
    RewriteRule ^storage(/.*)?$ - [F,L]
    RewriteRule ^src(/.*)?$ - [F,L]
    RewriteRule ^config(/.*)?$ - [F,L]
    RewriteRule ^database(/.*)?$ - [F,L]
    RewriteRule ^templates(/.*)?$ - [F,L]
    RewriteRule ^vendor(/.*)?$ - [F,L]

    # If we've already been internally routed to the front controller, stop
    # (prevents an infinite rewrite loop).
    RewriteCond %{ENV:REDIRECT_STATUS} !^$
    RewriteRule ^ - [L]

    # Serve existing files from public/ directly (CSS, JS, images, etc.)
    RewriteRule ^(assets/.+)$ public/$1 [L]
    RewriteRule ^(favicon\.ico)$ public/$1 [L]

    # Route everything else — INCLUDING the app root "/amrf/" — to the front
    # controller. (An unconditional rule is required: a -d guard would skip the
    # root because the project folder is itself a directory, causing a 403.)
    RewriteRule ^ public/index.php [L]
</IfModule>

# ============================================================
# Block access to sensitive files
# ============================================================

# Block .env files
<FilesMatch "^\.env">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# Block SQL files
<FilesMatch "\.(sql)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# Block Markdown files
<FilesMatch "\.(md)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# Block log files
<FilesMatch "\.(log)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# Block composer files
<FilesMatch "^composer\.(json|lock)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# php -- BEGIN cPanel-generated handler, do not edit
# Set the “ea-php83” package as the default “PHP” programming language.
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php83 .php .php8 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit