# Simple .htaccess for PHP API
# Works on both Apache (XAMPP/cPanel) and PHP built-in server

# Enable rewrite engine
<IfModule mod_rewrite.c>
    RewriteEngine On
    
    # If requested file/directory exists, serve it directly
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    
    # Otherwise route to index.php
    RewriteRule ^(.*)$ index.php?request=$1 [QSA,L]
</IfModule>

# CORS headers for development
<IfModule mod_headers.c>
    Header always set Access-Control-Allow-Origin "*"
    Header always set Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
    Header always set Access-Control-Allow-Headers "Content-Type, Authorization, X-Requested-With, Accept"
</IfModule>

# Handle OPTIONS preflight requests
<IfModule mod_rewrite.c>
    RewriteCond %{REQUEST_METHOD} OPTIONS
    RewriteRule ^(.*)$ index.php [L]
</IfModule>

# Protect sensitive files
<FilesMatch "^(\.env|\.env\.local|\.htaccess)$">
    Order allow,deny
    Deny from all
</FilesMatch>

# PHP settings
<IfModule mod_php.c>
    php_value upload_max_filesize 10M
    php_value post_max_size 10M
    php_value max_execution_time 300
    php_value max_input_time 300
</IfModule>

# Disable directory browsing
Options -Indexes
