# ======================================================================
#  FinLend — public/ .htaccess
# ======================================================================

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Shared hosting strips the Authorization header before PHP sees it,
    # which silently breaks bearer-token API auth. Re-inject it.
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # Force HTTPS. Session cookies are Secure-flagged, so over plain HTTP
    # the user would simply never stay logged in.
    RewriteCond %{HTTPS} !=on
    RewriteCond %{HTTP:X-Forwarded-Proto} !https
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

    # Serve real files (assets) directly; everything else to the router.
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^ index.php [L]
</IfModule>

# Never serve a dotfile, a backup or a dump, whatever the vhost config.
<FilesMatch "(^\.|\.(env|sql|log|bak|swp|dist|md|json|lock|yml)$)">
    Require all denied
</FilesMatch>

Options -Indexes -ExecCGI
ServerSignature Off

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "DENY"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always unset X-Powered-By
</IfModule>

<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType text/css               "access plus 1 year"
    ExpiresByType application/javascript "access plus 1 year"
    ExpiresByType image/svg+xml          "access plus 1 year"
    ExpiresByType font/woff2             "access plus 1 year"
</IfModule>

php_flag  display_errors      off
php_value upload_max_filesize 10M
php_value post_max_size       12M
php_value max_execution_time  120
