Options -Indexes

# Block direct web access to config (included by PHP only)
<IfModule mod_authz_core.c>
    <FilesMatch "^(db_connect|session_config|auth_validation|app)\.php$">
        Require all denied
    </FilesMatch>
</IfModule>

# Web entry is index.php only (generator requires session)
DirectoryIndex index.php

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /signature/

    # Block direct access to internal views (generator markup is served via index.php only)
    RewriteRule ^views/ - [F,L]

    # Legacy .html auth URLs → .php (canonical)
    RewriteRule ^login\.html$ login.php [R=301,L]
    RewriteRule ^register\.html$ login.php [R=301,L]
    RewriteRule ^register\.php$ login.php [R=301,L]
    RewriteRule ^forgot-password\.html$ forgot-password.php [R=301,L]
    RewriteRule ^reset-password\.html$ reset-password.php [R=301,L]

    # Auth pages (GET): show forms from auth/pages/
    RewriteCond %{REQUEST_METHOD} !POST
    RewriteRule ^login\.php$ auth/pages/login.php [L]
    RewriteCond %{REQUEST_METHOD} !POST
    RewriteRule ^forgot-password\.php$ auth/pages/forgot-password.php [L]

    # Auth handlers (POST login/forgot; GET+POST reset / verify / session)
    RewriteCond %{REQUEST_METHOD} POST
    RewriteRule ^login\.php$ auth/handlers/login.php [L]
    RewriteCond %{REQUEST_METHOD} POST
    RewriteRule ^forgot-password\.php$ auth/handlers/forgot-password.php [L]

    RewriteRule ^reset-password\.php$ auth/handlers/reset-password.php [L]
    RewriteRule ^verify-security\.php$ auth/handlers/verify-security.php [L]
    RewriteRule ^logout\.php$ auth/handlers/logout.php [L]
    RewriteRule ^session_status\.php$ auth/handlers/session_status.php [L]
    RewriteRule ^check_login\.php$ auth/handlers/check_login.php [L]

    # Legacy stylesheet paths (moved from styles/ to asset/css/)
    RewriteRule ^styles/(.+\.css)$ asset/css/$1 [L]

    # Legacy auth asset paths (cached bookmarks)
    RewriteRule ^asset/public-auth\.css$ asset/css/public-auth.css [L]
    RewriteRule ^asset/auth-login-glue\.js$ asset/js/auth-login-glue.js [L]
    RewriteRule ^asset/auth-forgot-glue\.js$ asset/js/auth-forgot-glue.js [L]
    RewriteRule ^asset/auth-session\.js$ asset/js/auth-session.js [L]

    # Site root and legacy generator URLs → index.php
    RewriteRule ^$ index.php [L]
    RewriteRule ^index\.html$ index.php [R=301,L]
    RewriteRule ^dashboard\.html$ index.php [R=301,L]
</IfModule>

<IfModule mod_headers.c>
    Header always set X-Frame-Options "DENY"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>
