# Front-controller routing: send every request that isn't a real file/dir to
# index.php so Slim can route it. Works both in an XAMPP subfolder
# (http://localhost/magnus/apicdbms/api/forms/...) and at a domain root.
<IfModule mod_rewrite.c>
    RewriteEngine On

    # Keep the query string, and don't rewrite existing files/directories.
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^ index.php [QSA,L]
</IfModule>

# Never serve dotfiles (.env, .env.production, .git, etc.).
<FilesMatch "^\.">
    Require all denied
</FilesMatch>

# Never serve source/config/doc files directly. Responses are generated by
# index.php (PHP), so no static file of these types should ever be downloadable
# — this keeps composer.*, README.md, and the Postman collection (which carries
# the API key) private even if they end up in the web root.
<FilesMatch "\.(json|lock|phar|md|dist|example|sh|log|ini|yml|yaml|sql|bak)$">
    Require all denied
</FilesMatch>

# Block direct access to source/vendor/config directories just in case.
RedirectMatch 403 ^/.*/(src|vendor|routes)/
