RewriteEngine On

# ---------------------------------------------------------
# Motorboy API routing and security
# Safe to append below cPanel-generated PHP INI directives.
# ---------------------------------------------------------

# Prevent direct web access to configuration, SQL, docs and lock files
<FilesMatch "^(config\.php|config\.example\.php|db\.sql|README\.md|INSTALLATION_GUIDE\.md|DEVELOPER_GUIDE\.md|API_DOCUMENTATION\.md|CHANGELOG\.md|VERSION|install\.lock)$">
    Require all denied
</FilesMatch>

# Forward Authorization header on hosts that strip it
RewriteCond %{HTTP:Authorization} .
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

# Never serve migration SQL directly
RewriteRule ^install/migrations/ - [F,L]

# Route clean API requests such as /api/v1/health to api.php
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^api/?(.*)$ api.php?route=$1 [QSA,L]
