# SICMS - Apache configuration
Options -Indexes
DirectoryIndex index.php
# Folders that share a name with a URL (admin/) must fall through to the front controller
DirectorySlash Off

<IfModule mod_rewrite.c>
    RewriteEngine On
    # Internal directories with no public URL are never served
    RewriteRule ^(config|core|app|storage|themes|docs|packages)(/|$) - [F,L]
    # admin/ is also the control-panel URL: block only real files inside it (source, templates)
    RewriteCond %{REQUEST_FILENAME} -f
    RewriteRule ^(admin|lang)/ - [F,L]
    # Plugins: only their public assets are reachable
    RewriteRule ^plugins/[^/]+/(?!assets/) - [F,L]
    # Existing files are served as-is (directories are never listed; they go to the app)
    RewriteCond %{REQUEST_FILENAME} -f
    RewriteRule ^ - [L]
    # Everything else goes to the front controller
    RewriteRule ^ index.php [L,QSA]
</IfModule>

<FilesMatch "\.(json|lock|md|sql|log|sh|env|ini)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
</FilesMatch>

<IfModule mod_headers.c>
    <FilesMatch "\.(css|js|png|jpg|jpeg|gif|webp|ico|woff2?)$">
        Header set Cache-Control "public, max-age=604800"
    </FilesMatch>
</IfModule>
