# ============================================================
#  ROOT .htaccess  (FIXED VERSION)
#  NOTE: This file starts with a dot. Many FTP clients hide it.
#  Make sure "show hidden files" is ON when you upload,
#  otherwise directory listing (Index of /admin/) will come back.
# ============================================================

# 1. STOP THE FILE LISTING (Security)
Options -Indexes

# 2. SET THE HOME PAGE
DirectoryIndex index.php index.html

# 3. SECURE SYSTEM FOLDERS (assets/ is intentionally NOT blocked here,
#    because it holds public files like the uploaded logo/favicon and CSS)
RewriteEngine On
RewriteRule ^(config|core)($|/) - [F,L]

# 4. BLOCK DATABASE DUMPS / BACKUPS / DOT FILES
#    The .sql dump contains the admin password hash - it must never be
#    downloadable from the browser.
<FilesMatch "\.(sql|sql\.gz|zip|tar|gz|bak|log|ini|env|old|swp)$">
    Require all denied
</FilesMatch>
<FilesMatch "^\.">
    Require all denied
</FilesMatch>

# 5. CLEAN API URL
# This allows: yourdomain.com/api/UID/KEY -> api.php
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^api/([^/]+)/([^/]+)$ api.php?uid=$1&key=$2 [L,QSA]

# 5b. OLD /admin/ FOLDER -> REAL PANEL
#     You were getting "403 Forbidden" on /admin/ because listing is off and
#     the folder index was not being served. This sends /admin/ straight to
#     the real panel instead of an error page.
RewriteRule ^admin/?$ /admin.php [R=301,L]
RewriteRule ^admin/(index|login|dashboard|users|plans|logout)\.php$ /admin.php [R=301,L]

# 6. CUSTOM ERROR PAGES (wrong/unknown URL -> nice 404 page)
ErrorDocument 400 /404.php
ErrorDocument 401 /404.php
ErrorDocument 403 /404.php
ErrorDocument 404 /404.php
ErrorDocument 500 /404.php

# 7. BASIC SECURITY HEADERS
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>
