# ── WebPSA (cPanel single-tenant) — security + routing ───────────────────────
# Protect application internals (they live under the web root on cPanel).
RedirectMatch 403 ^/(config|core|controllers|modules|vendor|views|storage)(/|$)

Options -Indexes
Options +FollowSymLinks

# Block sensitive file types anywhere
<FilesMatch "\.(sql|log|env|bak|template|lock)$">
    Require all denied
</FilesMatch>

RewriteEngine On

# Subfolder-safe: do NOT hardcode RewriteBase. Apache resolves index.php
# relative to this .htaccess's directory, so this works at the docroot OR
# in any subfolder (e.g. /test2) with no edits.

# Serve real files directly (CSS/JS/images in /assets, etc.)
RewriteCond %{REQUEST_FILENAME} -f
RewriteRule ^ - [L]

# Serve real directories directly, EXCEPT /assets (which is also a module route)
RewriteCond %{REQUEST_FILENAME} -d
RewriteCond %{REQUEST_URI} !/assets
RewriteRule ^ - [L]

# Everything else (including /assets module route) → front controller
RewriteRule ^ index.php [QSA,L]

<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType text/css "access plus 1 month"
    ExpiresByType application/javascript "access plus 1 month"
    ExpiresByType image/png "access plus 1 month"
    ExpiresByType image/svg+xml "access plus 1 month"
</IfModule>
