<IfModule mod_rewrite.c>
    <IfModule mod_negotiation.c>
        Options -MultiViews -Indexes
    </IfModule>

    RewriteEngine On

    # ----------------------------------------------------------------------
    # 🔒 1. BLOCK VULNERABILITY SCANNERS & BAD BOTS
    # ----------------------------------------------------------------------
    RewriteCond %{HTTP_USER_AGENT} (sqlmap|nikto|wpscan|havij|acunetix|nessus|zgrab|nmap|masscan|dirbuster|libwww-perl) [NC]
    RewriteRule .* - [F,L]

    # ----------------------------------------------------------------------
    # 🔒 2. BLOCK DIRECT ACCESS TO SENSITIVE FILES (.env, .git, .sql, logs etc.)
    # ----------------------------------------------------------------------
    <FilesMatch "^\.(env|git|htaccess|htpasswd|ini|log|sh|sql|bak|config)">
        Order allow,deny
        Deny from all
    </FilesMatch>

    RewriteRule ^\.env - [F,L,NC]
    RewriteRule ^\.git - [F,L,NC]
    RewriteRule ^composer\.(json|lock) - [F,L,NC]
    RewriteRule ^package(-lock)?\.json - [F,L,NC]
    RewriteRule ^storage/logs/.* - [F,L,NC]
    RewriteRule ^.*\.(sql|sqlite|log|env|yml|yaml|blade\.php)$ - [F,L,NC]

    # ----------------------------------------------------------------------
    # 📲 3. REDIRECT /app/ OR /hubone TO PLAYSTORE (Fixes 403 Forbidden)
    # ----------------------------------------------------------------------
    RewriteRule ^app/?$ /playstore [L,R=302]
    RewriteRule ^hubone/?$ /playstore [L,R=302]

    # Handle Authorization Header
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # Redirect Trailing Slashes If Not A Folder...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} (.+)/$
    RewriteRule ^ %1 [L,R=301]

    # Send Requests To Front Controller...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]
</IfModule>

# ----------------------------------------------------------------------
# 🛡️ 4. SECURITY HEADERS (Prevents Google Chrome Red Flag / Deceptive Warnings)
# ----------------------------------------------------------------------
<IfModule mod_headers.c>
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-Content-Type-Options "nosniff"
    Header border set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "geolocation=(), camera=(), microphone=()"
</IfModule>

# php -- BEGIN cPanel-generated handler, do not edit
# Set the “ea-php81” package as the default “PHP” programming language.
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php81 .php .php8 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit
