# ZUPCO FleetOS — root .htaccess
# On hosting where you CAN point the vhost DocumentRoot at /public directly,
# delete this file — it's only needed when you can't (common on shared
# hosting), and rewrites every request into the public/ folder instead.

RewriteEngine On
RewriteCond %{REQUEST_URI} !^/public/
RewriteRule ^(.*)$ /public/$1 [L]

# Block direct access to anything outside public/ as defense in depth,
# even though these folders normally sit outside the webroot entirely.
<IfModule mod_alias.c>
    RedirectMatch 403 ^/(app|database|scripts|storage|tests)/
</IfModule>
