# ==============================================================
# Inveetaire — Root .htaccess
# ==============================================================
# This file sits at the project root (one level above public/).
#
# Responsibilities:
#   1. Deny all direct web access to sensitive directories.
#   2. Redirect all remaining requests into public/.
#
# IMPORTANT: On shared hosting (cPanel), ensure the web server
# Document Root is pointed to public/ directly. When that is
# correctly configured, this root .htaccess acts as a safety net.
# ==============================================================

# Disable directory listing at the project root.
Options -Indexes

# ── DENY — Sensitive Directories ──────────────────────────────
# Any direct HTTP request targeting app/, config/, storage/, or
# routes/ returns 403 Forbidden — even if mod_rewrite is off.
# These directories must NEVER be web-accessible.

# Mod_rewrite rule below handles blocking direct access to sensitive directories instead.

# ── REWRITE — Redirect everything into public/ ────────────────
# If the request is not already targeting public/, redirect it.
# This ensures public/ is the effective web root.

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Block direct access to sensitive directories via rewrite.
    # Exclude virtual routes starting with app/admin, app/couple, app/crew, app/support.
    # Returns 403 Forbidden for requests like:
    #   /inveetaire/app/core/Bootstrap.php
    #   /inveetaire/storage/logs/app.log
    #   /inveetaire/config/database.php
    RewriteCond %{REQUEST_URI} !^.*/app/(admin|couple|crew|support)(/.*)?$
    RewriteRule ^(app|config|storage|routes)(/.+)?$ - [F,L]

    # Redirect root request to public/
    RewriteRule ^$ public/ [L]

    # Redirect all non-public requests to public/{path}
    # Negative lookahead ensures requests already in public/
    # are not rewritten again.
    RewriteRule ^((?!public/).+)$ public/$1 [L]
</IfModule>
