Options -Indexes

# Block direct access to environment and config files
<FilesMatch "^\.env|composer\.(json|lock)$">
    Order allow,deny
    Deny from all
</FilesMatch>

Header always set Pragma "no-cache"
Header always set Access-Control-Max-Age 86400
Header always set Access-Control-Allow-Origin "*"
Header always set Cache-Control "no-store, no-cache, must-revalidate, max-age=0"
Header always set Access-Control-Allow-Methods "POST, PUT, GET, DELETE, OPTIONS"
Header always set Access-Control-Allow-Headers "Access-Control-Allow-Headers, X-Requested-With, Content-Type, Accept, Authorization"

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTP:Authorization} ^(.*)
    RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]
    RewriteBase /

    # ---- REST-style aliases so the existing React frontend needs no changes ----
    # GET inventory-item/list            -> inventory.php?endpoint=list
    RewriteRule ^inventory-item/list/?$ inventory.php?endpoint=list [QSA,L]
    # GET inventory-item/{id}            -> inventory.php?endpoint=byid&id={id}
    RewriteRule ^inventory-item/([0-9]+)/?$ inventory.php?endpoint=byid&id=$1 [QSA,L]
    # GET inventory-item/pagedlist?PageNumber=&CategoryId=&PageSize=  -> inventory.php?endpoint=pagedlist (QSA preserves the query string)
    RewriteRule ^inventory-item/pagedlist/?$ inventory.php?endpoint=pagedlist [QSA,L]
    # GET category/list                  -> inventory.php?endpoint=categories
    RewriteRule ^category/list/?$ inventory.php?endpoint=categories [QSA,L]
    # GET unit-of-measure/list           -> inventory.php?endpoint=unitsofmeasure
    RewriteRule ^unit-of-measure/list/?$ inventory.php?endpoint=unitsofmeasure [QSA,L]
    # GET auth/me                        -> auth.php?endpoint=me
    RewriteRule ^auth/me/?$ auth.php?endpoint=me [QSA,L]
    # GET auth/roles                     -> auth.php?endpoint=roles
    RewriteRule ^auth/roles/?$ auth.php?endpoint=roles [QSA,L]
    # GET auth/rights                    -> auth.php?endpoint=rights
    RewriteRule ^auth/rights/?$ auth.php?endpoint=rights [QSA,L]

    # ---- fallback: append .php to any other clean path (matches sharepoint-api style) ----
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-l
    RewriteRule ^(.+)$ $1.php [QSA,L]
</IfModule>

# php -- BEGIN cPanel-generated handler, do not edit
# Set the “ea-php84” package as the default “PHP” programming language.
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php84 .php .php8 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit
