RewriteEngine On

# Prevent direct access to sensitive files
<FilesMatch "^(config\.php|config\.example\.php|db\.sql|README\.md|API_DOCUMENTATION\.md)$">
    Require all denied
</FilesMatch>

# Forward Authorization header on hosts that strip it
RewriteCond %{HTTP:Authorization} .
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

# Route API requests to api.php
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^api/?(.*)$ api.php?route=$1 [QSA,L]
