# -----------------------------------------------------------------------------
# Yatra — Apache rewrite + hardening for the public document root.
# The web server document root MUST point at /public (never the project root).
# -----------------------------------------------------------------------------

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Serve existing files/directories directly.
    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^ - [L]

    # Route everything else through the front controller.
    RewriteRule ^ index.php [L]
</IfModule>

# Disable directory listing.
Options -Indexes

# Deny access to dotfiles (e.g. .env, .htaccess).
<FilesMatch "^\.">
    Require all denied
</FilesMatch>

# Block PHP execution inside the uploads directory (defense against malicious uploads).
<IfModule mod_rewrite.c>
    RewriteRule ^uploads/.*\.(php|phtml|phar|php[0-9])$ - [F,L,NC]
</IfModule>

# Baseline security headers (web-server layer).
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>
