Options -Indexes
DirectoryIndex index.php

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "same-origin"
  Header always set Permissions-Policy "camera=(self), microphone=(), geolocation=(self)"
</IfModule>

<FilesMatch "^(\.env|\.installed|composer\.(json|lock)|package(-lock)?\.json|README.*|INSTALL.*)$">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
</FilesMatch>

<FilesMatch "\.(sql|sqlite|bak|backup|dump|log|gz|tgz|tar|zip|sha256)$">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
</FilesMatch>

<IfModule mod_rewrite.c>
  RewriteEngine On

  # Canonicalize accidental repeated slashes directly after the hostname.
  RewriteCond %{THE_REQUEST} "\s/{2,}([^\s?]*)" [NC]
  RewriteRule ^ /%1 [R=302,L,NE]

  RewriteRule ^$ index.php [L]

  RewriteRule ^(?:config|database|includes)(?:/|$) - [F,L,NC]
  RewriteRule ^storage(?:/|$) - [F,L,NC]

  # Authentication routes also have physical index.php wrappers. These rules
  # provide a fallback if a hosting upload omits an empty/route directory.
  RewriteRule ^login/?$ login.php [L,QSA]
  RewriteRule ^logout/?$ logout.php [L,QSA]
  RewriteRule ^register/?$ register.php [L,QSA]
  RewriteRule ^forgot-password/?$ forgot-password.php [L,QSA]
  RewriteRule ^reset-password/?$ reset-password.php [L,QSA]
  RewriteRule ^verify-email/?$ verify-email.php [L,QSA]

  RewriteRule ^(dashboard|classes|subjects|schedules|materials|tasks|quiz|questions|gradebook|curriculum|attendance|calendar|discussion|analytics|ai|library|parents|files|integrations|security|features|settings)/?$ app.php [L,QSA]
  RewriteRule ^reports/?$ report.php [L,QSA]
  RewriteRule ^profile/?$ profile.php [L,QSA]
  RewriteRule ^school-settings/?$ school-settings.php [L,QSA]
  RewriteRule ^registrations/?$ registrations.php [L,QSA]
  RewriteRule ^maintenance/?$ maintenance.php [L,QSA]
  RewriteRule ^access-control/?$ access-control.php [L,QSA]
  RewriteRule ^developer/?$ developer.php [L,QSA]
  RewriteRule ^users/?$ access-control.php?tab=users [L,QSA]
  RewriteRule ^roles/?$ access-control.php?tab=roles [L,QSA]
  RewriteRule ^attendance-qr/?$ attendance-qr.php [L,QSA]
</IfModule>
