# ============================================================================
# FALLBACK ONLY — use this if you cannot point the document root at public/
# ============================================================================
# Rename this file to ".htaccess" and place it in the SAME folder as
# artisan / composer.json, i.e. the application root inside public_html.
#
# Prefer Option A in DEPLOY-SPACESHIP.md (document root -> public/). That
# keeps .env, storage and vendor physically outside the web root, which is
# strictly safer than blocking them with rules. Use this only when the panel
# will not let you move the document root.
# ============================================================================

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Everything is served from public/, but the browser never sees it.
    RewriteCond %{REQUEST_URI} !^/public/
    RewriteRule ^(.*)$ public/$1 [L]
</IfModule>

# --- Block anything that must never be served -------------------------------

# Dotfiles: .env, .env.backup, .git, .gitignore, .htaccess itself
<FilesMatch "^\.">
    Require all denied
</FilesMatch>

# Application files that would leak configuration or source
<FilesMatch "(?i)\.(env|log|sqlite|sqlite3|db|lock|json|lock|md|ya?ml|ini|sh|bak|old|orig|swp)$">
    Require all denied
</FilesMatch>

# ...but composer/npm manifests inside public/build must still load.
<IfModule mod_rewrite.c>
    RewriteCond %{REQUEST_URI} ^/public/build/
    RewriteRule ^ - [L]
</IfModule>

# Directory traversal into application internals
RedirectMatch 404 (?i)^/(app|bootstrap|config|database|deploy|resources|routes|storage|tests|vendor)(/|$)

# Never list a directory
Options -Indexes

# --- Sensible security headers ----------------------------------------------

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>
