# ZUPCO FleetOS — public/.htaccess
# This IS the intended DocumentRoot. If your host lets you set the vhost
# DocumentRoot to this folder directly, do that and delete the root-level
# .htaccess one level up.

RewriteEngine On

# ---------------------------------------------------------------------------
# 1. API: everything under /api/ is handled by the single front controller,
#    which does its own internal routing (see public/api/index.php).
# ---------------------------------------------------------------------------
RewriteCond %{REQUEST_URI} ^/api/
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^ api/index.php [L]

# ---------------------------------------------------------------------------
# 2. Clean URLs for web pages: /dashboard -> /dashboard.php,
#    /dispatcher/vehicles -> /dispatcher/vehicles.php, etc. Only applies
#    when a matching .php file actually exists, so /uploads/* and static
#    assets are untouched.
# ---------------------------------------------------------------------------
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME}\.php -f
RewriteRule ^(.*)$ $1.php [L]

# ---------------------------------------------------------------------------
# Security headers (defense in depth — Response.php also sets some of these
# on API responses; this covers static assets and HTML pages too).
# ---------------------------------------------------------------------------
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "DENY"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# Never serve dotfiles (.env, .git, etc.) even if one accidentally ends up
# under public/.
<FilesMatch "^\.">
    Require all denied
</FilesMatch>

# Belt-and-braces: .env must never be reachable even if misplaced here.
<Files ".env">
    Require all denied
</Files>

Options -Indexes
