Options +FollowSymLinks
RewriteEngine On

# ==================== SECURITY ====================

# Block access to sensitive files (credentials, setup scripts, SQL dumps)
RewriteRule ^info\.txt$ - [F,L]
RewriteRule ^setup_.*\.php$ - [F,L]
RewriteRule ^update_appointments_table\.php$ - [F,L]
RewriteRule ^add_myanmar_support\.php$ - [F,L]
RewriteRule ^autoload\.php$ - [F,L]
RewriteRule ^.*\.sql$ - [F,L]

# Block access to sensitive directories
RewriteRule ^app/ - [F,L]
RewriteRule ^database/ - [F,L]
RewriteRule ^storage/(logs|cache)/ - [F,L]

# Disable PHP execution inside uploads directory
RewriteRule ^storage/uploads/.*\.php$ - [F,L]

# ==================== ROUTING ====================

# Serve existing files/directories directly (e.g. static assets in public/)
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]

# Never rewrite the public/ and vendor/ directories
RewriteCond %{REQUEST_URI} !^/clinic-system/public/ [NC]
RewriteCond %{REQUEST_URI} !^/clinic-system/vendor/ [NC]

# Route everything else to public/ (public/.htaccess forwards to index.php).
# This is an internal rewrite (no redirect) so pretty URLs like
# /clinic-system/doctor/patients stay clean in the address bar.
# NOTE: in .htaccess (per-directory context) the RewriteRule pattern matches
# the path RELATIVE to this directory, i.e. "doctor/patients", so we match
# ^(.*)$ and map it to public/$1.
RewriteRule ^(.*)$ public/$1 [L]
