# Safety net for hosts where the PROJECT folder is web-served (e.g. XAMPP
# htdocs/summit) instead of public/. Point the document root at public/ in
# production; this file only stops .env, vendor/, writable/ etc. from leaking.

Options -Indexes

# Never serve dotfiles (.env, .git, .htaccess) or project metadata.
<FilesMatch "^\.|^(composer\.(json|lock)|package(-lock)?\.json|phpunit.*\.xml|spark|preload\.php|tailwind\.config\.js|README\.md|LICENSE)$">
	<IfModule authz_core_module>
		Require all denied
	</IfModule>
	<IfModule !authz_core_module>
		Deny from all
	</IfModule>
</FilesMatch>

<IfModule mod_rewrite.c>
	RewriteEngine On
	# Block everything outside public/ ...
	RewriteRule ^(app|vendor|writable|tests|build|builds|docs|resources|node_modules|\.github)(/|$) - [F,L]
	# ... and send the rest into public/.
	RewriteRule ^(?!public/)(.*)$ public/$1 [L]
</IfModule>

<IfModule !mod_rewrite.c>
	<IfModule authz_core_module>
		Require all denied
	</IfModule>
	<IfModule !authz_core_module>
		Deny from all
	</IfModule>
</IfModule>
