# Fleet Management System - Root .htaccess
# Used when the web server DocumentRoot is pointed to the project root (e.g., public_html) instead of /public.
Options -Indexes

<IfModule mod_rewrite.c>
    RewriteEngine On

    # 1. Deny direct web access to sensitive backend directories
    RewriteRule ^(src|config|storage|database|tools|templates|lang|MEMORY|documents|tests|updates)(/|$) - [F,L]
    RewriteRule ^\.env - [F,L]

    # 2. If the request already targets /public/, allow through directly
    RewriteCond %{REQUEST_URI} ^.*/public/ [NC]
    RewriteRule ^ - [L]

    # 3. Friendly shortcuts: redirect /admin, /form, /assets, /uploads, and /login into /public/
    RewriteRule ^admin$ public/admin/ [R=302,L]
    RewriteRule ^admin/$ public/admin/ [R=302,L]
    RewriteRule ^admin/(.*)$ public/admin/$1 [R=302,L]

    RewriteRule ^form$ public/form/ [R=302,L]
    RewriteRule ^form/$ public/form/ [R=302,L]
    RewriteRule ^form/(.*)$ public/form/$1 [R=302,L]

    RewriteRule ^assets/(.*)$ public/assets/$1 [R=302,L]
    RewriteRule ^uploads/(.*)$ public/uploads/$1 [R=302,L]
    RewriteRule ^login/?$ public/admin/login.php [R=302,L]
    RewriteRule ^migrate/?$ public/migrate.php [R=302,L]

    # 4. Redirect bare root domain to /public/
    RewriteRule ^$ public/ [R=302,L]

    # 5. Transparent fallback: route any non-existent path into public/ if matching file/dir exists there
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^(.*)$ public/$1 [L,QSA]
</IfModule>

<FilesMatch "(^\.env|\.(sqlite|sqlite-wal|sqlite-shm|db|sql|log|md|py|bak)$)">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>
