# Ragreen - protects files that must never be served directly.
# This matters because the whole project folder is typically dropped into
# htdocs/ as one unit (see README setup instructions), which means anything
# under it is web-reachable by default unless explicitly blocked here.

# Block .env, .env.example, .git*, and any other dotfile from being downloaded.
# .php files (config.php etc.) are safe even without this - Apache executes
# them rather than serving their source - but .env is plain text and MUST
# be blocked, since it now holds real database credentials.
<FilesMatch "^\.">
    # Apache 2.4+
    Require all denied
</FilesMatch>

<IfModule !mod_authz_core.c>
    # Apache 2.2 fallback (older shared hosting)
    <FilesMatch "^\.">
        Order allow,deny
        Deny from all
    </FilesMatch>
</IfModule>

# Preserve the Authorization header for PHP - Apache/CGI setups (including
# many shared-hosting cPanel configurations using PHP-FPM/CGI handlers,
# e.g. "ea-php83") strip this header from $_SERVER before PHP ever sees
# it, unless explicitly rewritten. The mobile app authenticates via
# "Authorization: Bearer <token>" instead of a session cookie (see
# api/includes/auth.php's resolve_bearer_identity()) - without this rule,
# every authenticated mobile API call silently comes back as if logged
# out (401), even though login itself succeeds and the same account
# works fine on the web (session-cookie auth isn't affected by this).
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTP:Authorization} ^(.*)
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%1]
</IfModule>