# ---------------------------------------------------------------------------
# Root .htaccess — for hosting where you cannot point the document root at
# public/. It forwards every request into public/ and blocks direct access to
# everything above it.
#
# Pointing the document root at public/ is still better, and on cPanel it takes
# three clicks in Domains. Use this only if that is not available to you.
# ---------------------------------------------------------------------------

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Never serve these, whatever else happens.
    RewriteRule ^(\.env|\.env\..*|composer\.(json|lock|phar)|artisan|phpunit\.xml|package\.json)$ - [F,L]
    RewriteRule ^(app|bootstrap|config|database|resources|routes|storage|tests|vendor|docs)/ - [F,L]

    RewriteCond %{REQUEST_URI} !^/public/
    RewriteRule ^(.*)$ public/$1 [L]
</IfModule>

<IfModule mod_authz_core.c>
    <FilesMatch "^\.env|composer\.(json|lock|phar)|artisan$">
        Require all denied
    </FilesMatch>
</IfModule>

<IfModule mod_autoindex.c>
    Options -Indexes
</IfModule>
