RewriteEngine On
# For XAMPP subfolder only (e.g. http://localhost/mysite/). Omit on production root installs.
# RewriteBase /mysite/

# Pass Authorization header to PHP (required for Shopee/Stripe/PayPal webhooks on CGI/FastCGI)
<IfModule mod_setenvif.c>
    SetEnvIf Authorization "(.+)" HTTP_AUTHORIZATION=$1
</IfModule>
<IfModule mod_authnz_fcgi.c>
    CGIPassAuth On
</IfModule>
RewriteCond %{HTTP:Authorization} .
RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

# Friendly help when PHP cannot start (suPHP rejects group-writable scripts after ZIP extract)
ErrorDocument 500 /install-help.html

# Block direct PHP execution under plugins (assets in public/ remain accessible)
RewriteRule ^content/plugins/.+\.php$ - [F,L]
RewriteRule ^content/plugins/.+\.lsphp$ - [F,L]

# Block web access to storage (sessions, cache)
RewriteRule ^storage/ - [F,L]

# Block PHP execution in uploads
RewriteRule ^uploads/.*\.php$ - [F,L]

<Files "config.php">
    Require all denied
</Files>

# Serve existing files/directories directly
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]

# Route everything else to index.php (preserve Authorization for webhook HMAC)
RewriteRule ^ index.php [L,QSA,E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

# Security headers
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
</IfModule>
