<IfModule mod_rewrite.c>
    RewriteEngine On

    # Route all traffic through public/
    RewriteRule ^$ public/index.php [L]

    RewriteCond %{REQUEST_URI} !^/public/
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^(.*)$ public/$1 [L]

    # Optional: force HTTPS (uncomment when TLS is enabled)
    #RewriteCond %{HTTPS} !=on
    #RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

# Deny access to sensitive files and dotfiles at the web root
<FilesMatch "^(\.env|\.git|\.gitignore|\.gitattributes|composer\.(json|lock)|phpunit\.(xml|xml\.dist)|.*\.sql|artisan)$">
    Require all denied
    Satisfy All
</FilesMatch>

# Block hidden files/folders (except well-known ACME challenge if needed)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule "(?i)/\.(?!well-known/)" - [F]
</IfModule>

# Security headers
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-XSS-Protection "0"
    Header always set Referrer-Policy "no-referrer-when-downgrade"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
    # Enable HSTS only when you serve HTTPS and are confident
    # Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
</IfModule>