# Qorekit unpacked into a folder the web server serves directly, such as
# public_html on shared hosting. (Where you can, point the domain at public/
# instead; nginx always needs that.)
#
# Files under public/ are served from there, everything else goes to index.php,
# and the program's own files are never served.

# Even where mod_rewrite is missing or ignored: hidden files (.env) and the
# program's files at the top are never served. Its folders carry their own
# .htaccess denying everything.
<FilesMatch "^(\..*|artisan|composer\.(json|lock)|package\.json|pnpm-.*|release\.json|phpunit\.xml|phpstan\.neon|pint\.json|LICENSE|.*\.md)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order deny,allow
        Deny from all
    </IfModule>
</FilesMatch>

<IfModule mod_negotiation.c>
    Options -MultiViews -Indexes
</IfModule>

<IfModule mod_rewrite.c>
    RewriteEngine On

    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
    RewriteCond %{HTTP:x-xsrf-token} .
    RewriteRule .* - [E=HTTP_X_XSRF_TOKEN:%{HTTP:X-XSRF-Token}]

    # Certificate checks (AutoSSL, Let's Encrypt) put files under .well-known.
    RewriteCond %{REQUEST_FILENAME} -f
    RewriteRule ^\.well-known/ - [L]

    # Hidden files (.env, .git) and the program's folders and files. Everything
    # else goes to index.php below anyway; these never even get that far.
    RewriteRule ^\.(?!well-known/) - [R=404,L]
    RewriteRule ^(?:app|bootstrap|config|database|docker|domain|e2e|frontend|lang|node_modules|resources|routes|sdk|storage|tests|vendor)(?:/|$) - [R=404,L]
    RewriteRule ^(?:artisan|composer\.(?:json|lock)|package\.json|pnpm-[^/]*|phpunit\.xml|phpstan\.neon|pint\.json|playwright\.config\.ts|tsconfig[^/]*|eslint\.config\.js|[^/]+\.md|LICENSE)$ - [R=404,L]

    RewriteRule ^index\.php$ - [L]

    # What lives in public/ (the built interface, icons) is served from there.
    # Apache cannot reliably tell where this folder is on disk from inside it,
    # so the names are listed; a plugin's files will live under build/ too.
    RewriteRule ^(?:build/.+|favicon\.(?:ico|svg)|apple-touch-icon\.png|robots\.txt)$ public/$0 [L]

    # Everything else is the application.
    RewriteRule ^ index.php [L]
</IfModule>
