# MedServ API — Apache config (AGG pattern; every line here is load-bearing)

Options -Indexes
DirectorySlash Off

# Forward the Authorization header through mod_rewrite/FastCGI — without BOTH
# of these, every authenticated endpoint silently 401s on shared cPanel.
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

<IfModule mod_rewrite.c>
    RewriteEngine On

    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # Static uploads pass through untouched
    RewriteRule ^uploads/ - [L]

    # Core/lib/bin/database are never web-servable
    RewriteRule ^core/ - [F,L]
    RewriteRule ^lib/ - [F,L]
    RewriteRule ^bin/ - [F,L]

    # ─── Roadmap 3 (Agent B): cron entry + protected runtime dirs ───
    RewriteRule ^cron/run$ cron/run.php [QSA,L]
    RewriteRule ^logs/ - [F,L]
    RewriteRule ^backups/ - [F,L]

    # Everything under /v1/ goes to the front controller
    RewriteRule ^v1/(.*)$ v1/index.php?route=$1 [QSA,L]
</IfModule>

# Secrets and non-web files: hard deny (gz = DB backups, cnf = dump creds)
<FilesMatch "\.(env|sql|md|log|bak|sh|gz|cnf)$">
    Require all denied
</FilesMatch>

# No PHP execution inside uploads (defense in depth; also enforced by random
# names + MIME sniffing in core/storage.php)
<If "%{REQUEST_URI} =~ m#/uploads/#">
    <FilesMatch "\.ph(p[0-9]?|tml|ar)$">
        Require all denied
    </FilesMatch>
</If>
