# Alaminn.info — root .htaccess
# This file protects the application root directory.
# The app runs via Passenger (server.js), but these rules ensure that
# even if Apache serves files directly, sensitive items are blocked.

# Deny ALL access to the app root by default — Passenger bypasses this
# for dynamic requests, but direct file access is blocked.
# (Next.js handles all routing through server.js)

# Block dotfiles globally
<FilesMatch "^\.">
    Require all denied
</FilesMatch>

# Block .env
<Files ".env">
    Require all denied
</Files>
<Files ".env.*">
    Require all denied
</Files>

# Block config files
<FilesMatch "^(package\.json|package-lock\.json|tsconfig\.json|next\.config\.ts|tailwind\.config\.ts|postcss\.config\.mjs|eslint\.config\.mjs|components\.json|vitest\.config\.ts|bun\.lock)$">
    Require all denied
</FilesMatch>

# Block server.js source (Passenger reads it but browsers shouldn't)
<Files "server.js">
    Require all denied
</Files>

# Block prisma directory
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule ^prisma/ - [F,L]
    RewriteRule ^src/ - [F,L]
    RewriteRule ^scripts/ - [F,L]
    RewriteRule ^tests/ - [F,L]
    RewriteRule ^docs/ - [F,L]
    RewriteRule ^mini-services/ - [F,L]
    RewriteRule ^deploy/ - [F,L]
    RewriteRule ^storage/ - [F,L]
    RewriteRule ^node_modules/ - [F,L]
    RewriteRule ^\.next/ - [F,L]
    RewriteRule ^db/ - [F,L]
</IfModule>

# Disable directory listing
Options -Indexes

# Security: don't reveal server signature
ServerSignature Off
