# Flora and Creations — API front controller
# Place this file at: api/.htaccess
#
# Routes every request under /api/* to index.php, which hands off to
# Router.php (see Router::dispatch() — it reads $_SERVER['REQUEST_URI']
# directly and strips the "/api" prefix itself, so no PATH_INFO or
# query-string rewriting is needed here).
#
# Real files/directories (e.g. assets/uploads/products/*.jpg served
# directly by Apache) are left alone — only requests that don't match
# an existing file or directory fall through to index.php.

<IfModule mod_rewrite.c>
    RewriteEngine On

    # If this file were ever accessed outside an /api/ alias, keep the
    # base pinned to this directory.
    RewriteBase /

    # Let real files and directories (uploaded images, etc.) be served
    # as-is instead of being routed through PHP.
    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^ - [L]

    # Everything else goes through the front controller.
    RewriteRule ^ index.php [L]
</IfModule>

# ---------------------------------------------------------------------
# Security hardening
# ---------------------------------------------------------------------

# Never serve the DB credentials file directly, however it's requested.
<FilesMatch "^config\.php$">
    Require all denied
</FilesMatch>

# Block direct access to source PHP classes — only index.php should be
# hit directly; everything else is loaded via the autoloader.
<FilesMatch "\.(php)$">
    <If "%{REQUEST_URI} !~ m#^/(api/)?index\.php$#">
        Require all denied
    </If>
</FilesMatch>
<IfModule !mod_authz_core.c>
    # Apache 2.2 fallback for the block above
    <FilesMatch "\.(php)$">
        Order allow,deny
        Deny from all
    </FilesMatch>
    <Files "index.php">
        Order allow,deny
        Allow from all
    </Files>
</IfModule>

# Turn off directory listing.
Options -Indexes

# Don't let uploaded files be executed as scripts.
<IfModule mod_php.c>
    <Directory "assets/uploads">
        php_flag engine off
    </Directory>
</IfModule>
<FilesMatch "\.(php|phtml|php3|php4|php5|phar)$">
    <If "%{REQUEST_URI} =~ m#^/(api/)?assets/uploads/#">
        Require all denied
    </If>
</FilesMatch>