# The app is served from the project root so it answers at
# http://localhost/unithink (index.php sits here rather than in public/).
# That puts every application file inside the web root, so the rules below
# do the job public/ normally does: expose only assets, block everything else.

<IfModule mod_rewrite.c>
    RewriteEngine On

    # No RewriteBase on purpose: Apache derives it from wherever this file
    # sits, so the same rules work under /unithink locally and at the domain
    # root in production. A hard-coded base breaks one of the two.

    # Built assets and uploaded files still live under public/.
    RewriteRule ^(build|storage)/(.*)$ public/$1/$2 [L]

    # Application directories are never web content.
    RewriteRule ^(app|bootstrap|config|database|node_modules|resources|routes|tests|vendor)(/|$) - [F,L]

    # Handle Authorization header (Apache strips it by default).
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # Redirect trailing slashes if not a folder.
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} (.+)/$
    RewriteRule ^ %1 [L,R=301]

    # Front controller: anything that is not a real file or directory.
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]
</IfModule>

# Independent of mod_rewrite: refuse the files that must never be served.
<FilesMatch "(?i)^(\.env.*|\.git.*|\.editorconfig|\.htaccess|composer\.(json|lock)|package(-lock)?\.json|phpunit\.xml|artisan|README\.md|vite\.config\.js)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

Options -Indexes
