RewriteEngine On
RewriteBase /Backend/

# Allow Authorization header through
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule .* - [E=HTTP_AUTHORIZATION:%1]

# Route everything under /api/v1/* into api/v1/index.php
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^api/v1/?(.*)$ api/v1/index.php [L,QSA]

# Default landing
DirectoryIndex index.php

# Block direct access to sensitive files
<FilesMatch "\.(sql|json|log|env)$">
    Require all denied
</FilesMatch>
