DirectoryIndex index.php

<IfModule mod_rewrite.c>
    Options -Indexes -MultiViews
    RewriteEngine On

    # Pass Authorization header to PHP for mobile/desktop Bearer JWTs
    RewriteCond %{HTTP:Authorization} ^(.*)
    RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]

    # Block direct web access to internal application directories and files
    RewriteRule ^(?:app|cli|config|database|deploy|desktop-app|docs|lang|mobile-app|routes|storage|tests|vendor)(?:/|$) - [F,L]
    RewriteRule ^(?:composer\.(?:json|lock)|phpunit\.xml|README\.md|.*\.(?:sql|log|env|example))$ - [F,L]

    # Serve static assets and uploads from public/ directory
    RewriteRule ^(assets/.*|uploads/.*|favicon\.ico|sw\.js|offline\.html)$ public/$1 [L]

    # Route everything else through the front controller
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^ index.php [L,QSA]
</IfModule>

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

<FilesMatch "(^\.|\.(sql|log|env|example|lock|md)$|^composer\.json$|^phpunit\.xml$)">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>
