# TFB Engine — Root .htaccess
# Handles routing and hardening on shared cPanel hosting.

# Never list directory contents
Options -Indexes

# Disable MultiViews to avoid conflicts
Options -MultiViews

<IfModule mod_rewrite.c>
    RewriteEngine On

    # 1. Block direct access to sensitive system directories
    RewriteRule ^(config|src|storage|database|tests|bootstrap|bin|templates|docs)/ - [F,L]

    # 2. Block direct access to sensitive files (dotfiles, sql, log, env, bak)
    RewriteRule ^\.(git|env|htaccess) - [F,L]
    RewriteRule \.(sql|log|bak|json|yml|yaml|md)$ - [F,L]

    # 3. Route everything to the public/ folder if DocumentRoot is the project root (Mode B)
    # If the request is already going to public/, do nothing (prevent infinite loop in subdirectories)
    RewriteCond %{REQUEST_URI} public/ [NC]
    RewriteRule ^ - [L]

    # Otherwise, rewrite all requests to public/
    RewriteCond %{REQUEST_URI} !public/ [NC]
    RewriteRule ^(.*)$ public/$1 [L]
</IfModule>

# Fallback: if mod_rewrite is not available, deny direct access to non-public files
<FilesMatch "\.(sql|log|bak|env)$">
    Require all denied
    Deny from all
</FilesMatch>
