# ─────────────────────────────────────────────────────────────
#  SwissPass API — public/.htaccess (Front Controller)
#  This file lives inside /public/ — it is the ONLY one Apache
#  needs when the domain root points directly at /public/.
# ─────────────────────────────────────────────────────────────
<IfModule mod_rewrite.c>
    RewriteEngine On

    # ── Set base — adjust if deployed in a subfolder ──────────
    # e.g.  RewriteBase /swisspassApi/public/
    # Leave as "/" if the domain root IS the public/ folder
    RewriteBase /

    # ── Re-export Authorization header (stripped by CGI/FastCGI)
    RewriteCond %{HTTP:Authorization} ^(.+)$
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%1]

    # ── Serve real files and directories directly ─────────────
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d

    # ── Everything else → front controller ───────────────────
    RewriteRule ^ index.php [QSA,L]
</IfModule>

# ── Security headers (guarded — mod_headers may be disabled) ─
<IfModule mod_headers.c>
    # Hide PHP version fingerprint
    Header unset X-Powered-By
    Header always unset X-Powered-By
</IfModule>

# ── Disable directory listings ────────────────────────────────
Options -Indexes
