Options -Indexes
RewriteEngine On

# Force HTTPS when available (uncomment if needed)
# RewriteCond %{HTTPS} !=on
# RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Protect sensitive files
<FilesMatch "(\.env|composer\.(json|lock)|package\.(json|lock)|README|.*\.sql|.*\.md)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Deny from all
    </IfModule>
</FilesMatch>

# Do not route existing files/folders
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]

# Admin clean URLs
RewriteRule ^admin/?$ admin.php [L,QSA]
RewriteRule ^admin/(.*)$ admin.php?path=$1 [L,QSA]

# Public clean URLs
RewriteRule ^(.*)$ index.php?route=$1 [L,QSA]
