# =====================================================================
# A&B Hub — public/.htaccess
# This IS the web server's DocumentRoot.
# =====================================================================

<IfModule mod_rewrite.c>
    RewriteEngine On

    # If the request is for a real file or directory that exists inside
    # /public (CSS, JS, images, favicon...), serve it directly.
    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^ - [L]

    # Everything else goes through the front controller.
    RewriteRule ^ index.php [L]
</IfModule>

# Never allow direct HTTP access to .env, composer files, or version
# control metadata even if something is ever copied into /public by mistake.
<FilesMatch "^(\.env.*|composer\.(json|lock)|\.gitignore|\.gitattributes)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order deny,allow
        Deny from all
    </IfModule>
</FilesMatch>

<FilesMatch "\.(sql|log|md)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order deny,allow
        Deny from all
    </IfModule>
</FilesMatch>

# Baseline security headers (Response::send() also sets these per-request
# for anything served through PHP — this covers static assets too).
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "DENY"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# Disable directory listing.
Options -Indexes

# Reasonable upload ceiling matching config/security.php's uploads.max_size_bytes (15MB).
<IfModule mod_php.c>
    php_value upload_max_filesize 16M
    php_value post_max_size 18M
</IfModule>
