RewriteEngine On

# Redirect direct /public/ access to clean URLs
RewriteCond %{THE_REQUEST} /public/ [NC]
RewriteRule ^public/(.*)$ /$1 [R=301,L,NE]

# Block access to hidden files and common sensitive files
RewriteRule (^|/)\.(?!well-known) - [F]
RewriteRule ^(\.env|composer\.(json|lock)|package\.json)$ - [F,NC]

# Deny direct access to internal directories if DocumentRoot is repository root
RewriteRule ^(app|resources|storage|vendor)/ - [F,NC]

# Serve uploads directly without rewriting to public/
RewriteRule ^uploads/ - [L,NC]

# Rewrite all other requests to public/ directory
RewriteRule ^(.*)$ public/$1 [L]
