# ---------------------------------------------------------------------------
# API Games Engine - public web root (cPanel: this folder's contents go into
# public_html; everything else in backend/ stays one level ABOVE it).
# ---------------------------------------------------------------------------

Options -Indexes -MultiViews
DirectoryIndex index.php

# --- Hard block on any database artefact that ever lands in the web root ----
<FilesMatch "\.(sqlite|sqlite3|db|db3|sqlite-wal|sqlite-shm|env|ini|log|sql)$">
    Require all denied
</FilesMatch>

# --- Block direct access to the bridge bootstrap (include-only) -------------
<FilesMatch "^mnex-bridge-bootstrap\.php$">
    Require all denied
</FilesMatch>

# Apache 2.2 fallback
<IfModule !mod_authz_core.c>
    <FilesMatch "\.(sqlite|sqlite3|db|db3|sqlite-wal|sqlite-shm|env|ini|log|sql)$">
        Order allow,deny
        Deny from all
    </FilesMatch>
    <FilesMatch "^mnex-bridge-bootstrap\.php$">
        Order allow,deny
        Deny from all
    </FilesMatch>
</IfModule>

# --- Front controller -------------------------------------------------------
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /

    # Let the Authorization header through (CGI/FastCGI strips it by default).
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # Force HTTPS in production.
    RewriteCond %{HTTPS} off
    RewriteCond %{HTTP:X-Forwarded-Proto} !https
    RewriteCond %{HTTP_HOST} !^(localhost|127\.0\.0\.1)
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^ index.php [QSA,L]
</IfModule>

# --- Baseline security headers ---------------------------------------------
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "DENY"
    Header always set Referrer-Policy "no-referrer"
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
    Header always unset X-Powered-By
</IfModule>

ServerSignature Off
