# public/.htaccess — Web Entrypoint Hardening

# Allow public access (safe for both Apache 2.2 and 2.4)
<IfModule mod_authz_core.c>
    Require all granted
</IfModule>
<IfModule !mod_authz_core.c>
    Order allow,deny
    Allow from all
</IfModule>

DirectoryIndex index.php

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Route everything except real files/directories through index.php
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^ index.php [L]
</IfModule>

# Never list directory contents
Options -Indexes

# Block access to dotfiles (e.g. .htaccess itself, .env if ever added)
<FilesMatch "^\.">
    Require all denied
</FilesMatch>
