# ============================================================
# AVENE ESPORTS - ROOT .htaccess
# IMPORTANT: Ideally set your hosting "Document Root" to the
# /public folder. This file is a defense-in-depth fallback for
# shared hosting setups where the domain points at the project root.
# ============================================================

# Disable directory browsing
Options -Indexes

# Block access to sensitive folders even if domain root = project root
RewriteEngine On
RewriteRule ^(config|core|database|includes|storage|vendor)/ - [F,L]

# Block access to dotfiles (.env, .gitignore, .git, etc.)
<FilesMatch "^\.">
    Require all denied
</FilesMatch>

# Block access to raw .sql, .md, .log files from web
<FilesMatch "\.(sql|log|md|env)$">
    Require all denied
</FilesMatch>

# Everything else routes through the public/ front controller
RewriteCond %{REQUEST_URI} !^/public/
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ public/$1 [L]
