Options -Indexes
ServerSignature Off

# ─── Force HTTPS ────────────────────────────────────────────
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# ─── Security Headers ───────────────────────────────────────
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "DENY"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>

# ─── Block direct access to sensitive files ─────────────────
<FilesMatch "\.(sql|log|env|ini|sh|git)$">
    Order allow,deny
    Deny from all
</FilesMatch>

# ─── Block access to config/ and logs/ ──────────────────────
RewriteRule ^(config|logs|database)/.*$ - [F,L]

# ─── API URL Routing ─────────────────────────────────────────
# /api/auth/login     → /api/auth.php
# /api/wallet/balance → /api/wallet.php
# /api/transfer/send  → /api/transfer.php
# /api/airtime/buy    → /api/airtime.php
# /api/bills/pay      → /api/bills.php
# /api/webhooks/nomba → /webhooks/nomba.php
# /api/webhooks/rizpay→ /webhooks/rizpay.php
# /admin/*            → /admin/index.php

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d

RewriteRule ^api/auth/(.+)$       api/auth.php    [L,QSA]
RewriteRule ^api/wallet/(.+)$     api/wallet.php  [L,QSA]
RewriteRule ^api/transfer/(.+)$   api/transfer.php [L,QSA]
RewriteRule ^api/airtime/(.+)$    api/airtime.php [L,QSA]
RewriteRule ^api/bills/(.+)$      api/bills.php   [L,QSA]
RewriteRule ^api/webhooks/nomba$  webhooks/nomba.php [L,QSA]
RewriteRule ^api/webhooks/rizpay$ webhooks/rizpay.php [L,QSA]
RewriteRule ^admin(.*)$           admin/index.php  [L,QSA]

# ─── PHP Settings ────────────────────────────────────────────
<IfModule mod_php.c>
    php_value upload_max_filesize 10M
    php_value post_max_size 10M
    php_value max_execution_time 60
    php_value memory_limit 256M
</IfModule>