RewriteEngine On

# Handle Authorization Header
RewriteCond %{HTTP:Authorization} .
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

# Accept PATH_INFO
AcceptPathInfo On

# Route all requests to api.php except existing files
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ api.php/$1 [QSA,L]

# Deny access to config and internal files
<FilesMatch "\.(php|sql)$">
    <IfModule mod_authz_core.c>
        # Apache 2.4
    </IfModule>
</FilesMatch>

# Protect sensitive directories
RewriteRule ^config/ - [F,L]
RewriteRule ^models/ - [F,L]
RewriteRule ^controllers/ - [F,L]
RewriteRule ^middleware/ - [F,L]
RewriteRule ^migrations/ - [F,L]
RewriteRule ^seeds/ - [F,L]

# Secure uploads directory
RewriteRule ^uploads/(.*)$ serve_file.php?file=$1 [QSA,L]
