Options -Indexes
RewriteEngine On

# ---------------------------------------------------------------------------
# SECURITY: never serve the flat-file datastore or sensitive files over HTTP.
# Without this, data/sessions.json (live login tokens), data/admins.json
# (password hash) and data/links.json are directly downloadable, which allows
# a full admin takeover. These rules run BEFORE the "serve existing file" rule
# below, so the static files are never reached.
# ---------------------------------------------------------------------------

# Block the entire data/ directory outright (403). mod_rewrite is available on
# every Apache that runs this app, so this is the primary guard.
RewriteRule ^data/ - [F,L]

# Defence in depth: deny direct access to data/config files by extension,
# wherever they live. Version-guarded for Apache 2.4 (Require) and 2.2 (Deny).
<FilesMatch "\.(json|sh)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# Send security response headers on every response (if mod_headers is present).
# Referrer-Policy is deliberately NOT set here: PHP adds it on HTML pages only, so
# slug redirects keep the Referer that affiliate trackers expect to see.
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "DENY"
</IfModule>

# Allow direct access to existing files and directories (assets, etc.)
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]

# Send everything else to index.php for slug routing
RewriteRule ^(.*)$ index.php [QSA,L]
