# Root hardening for deployments serving the project folder directly
# (Laragon default). Sensitive directories are blocked; everything else
# routes through the front controller.
Options -Indexes

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Block sensitive paths before anything else.
    RewriteRule ^(data|src|views|dompdf|storage/pdfs|vendor)(/|$) - [F,L]

    # Let real files (logos under storage/uploads, favicon...) serve directly.
    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^ - [L]

    # Everything else goes to the front controller.
    RewriteRule ^ index.php [L]
</IfModule>

# Never expose the SQLite database or its WAL siblings.
<FilesMatch "\.(db|db-wal|db-shm|sqlite)$">
    Require all denied
</FilesMatch>
