# Decasoft API — Apache/cPanel configuration
Options -Indexes -MultiViews
DirectoryIndex index.php

<IfModule mod_rewrite.c>
  RewriteEngine On
  # Force HTTPS (uncomment after installing an SSL certificate in cPanel)
  # RewriteCond %{HTTPS} off
  # RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

  # Prevent direct access to hidden files
  RewriteRule "(^|/)\.(?!well-known)" - [F]

  # Route every request to the front controller
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteRule ^ index.php [QSA,L]
</IfModule>

# Never execute scripts inside the storage directory
<IfModule mod_rewrite.c>
  RewriteRule ^storage/ - [F,L]
</IfModule>

# Security headers
<IfModule mod_headers.c>
  Header set X-Content-Type-Options "nosniff"
  Header set X-Frame-Options "SAMEORIGIN"
  Header set Referrer-Policy "no-referrer"
  Header always set Access-Control-Allow-Origin "*"
  Header always set Access-Control-Allow-Methods "GET, POST, PUT, PATCH, DELETE, OPTIONS"
  Header always set Access-Control-Allow-Headers "Content-Type, Authorization, X-Requested-With"
</IfModule>

<IfModule mod_php.c>
  php_flag display_errors Off
  php_value upload_max_filesize 6M
  php_value post_max_size 8M
</IfModule>
