# =====================================================================
#  JANMASHTAMI EARN — Root Apache Configuration
# =====================================================================
#  - Block direct web access to source, config, data and log files.
#  - Optionally force HTTPS.
#  - Do NOT break the Telegram Mini App / webhook access.
# =====================================================================

Options -Indexes -MultiViews
<IfModule mod_rewrite.c>
  RewriteEngine On

  # ---- Force HTTPS over HTTP (uncomment the 4 lines below to enable) ----
  # RewriteCond %{HTTPS} off
  # RewriteCond %{HTTP:X-Forwarded-Proto} !https
  # RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

  # ---- Block direct access to sensitive files/directories ----
  RewriteRule ^bot/config\.php$ - [F,L]
  RewriteRule ^database/ - [F,L]
  RewriteRule ^logs/ - [F,L]
  RewriteRule ^.*\.(sql|md)$ - [F,L]
  RewriteRule ^(\.env|composer\.json|composer\.lock|package\.json)$ - [F,L]
</IfModule>

# ---- PhpUnit/cache/temp protection ----
<FilesMatch "^(config\.php|composer\.(json|lock)|\..*)$">
  Require all denied
</FilesMatch>

# ---- Disable PHP execution inside static asset folders for hardened hosts ----
<IfModule mod_rewrite.c>
  RewriteRule ^miniapp/assets/.*\.(php|phtml|phar|cgi)$ - [F,L]
</IfModule>

# ---- Default content type ----
AddDefaultCharset UTF-8
