# Route every request that is not a real file to the front controller.
RewriteEngine On
RewriteBase /api/

# Real files are served directly — this is what lets an uploaded product
# photo at /api/uploads/<name>.jpg be fetched normally.
RewriteCond %{REQUEST_FILENAME} -f
RewriteRule ^ - [L]

# Directories are deliberately NOT passed through. The uploads directory has
# the same name as the /uploads API route, and letting the request reach
# mod_dir made it answer a POST with a 301 to the trailing-slash form — which
# drops the request body, so every photo upload silently arrived empty.
DirectorySlash Off

RewriteRule ^ index.php [QSA,L]

# Some hosts strip the Authorization header before PHP sees it.
RewriteCond %{HTTP:Authorization} .
RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

# Never serve source or configuration, whatever the rules above do.
<FilesMatch "^(config\.php|config\.example\.php|seed\.php|lib\.php|uploads\.php)$">
    Require all denied
</FilesMatch>

# Archives, database dumps, backups and editor leftovers are never something
# a client should be able to fetch. An api.zip left in this folder after an
# upload hands out config.php — and with it the database password — to anyone
# who guesses the name.
<FilesMatch "\.(?i:zip|tar|gz|tgz|bz2|7z|rar|sql|bak|backup|old|orig|swp|log|env|ini|sh)$">
    Require all denied
</FilesMatch>

Options -Indexes
