<IfModule mod_rewrite.c>
    RewriteEngine On

    # Prevent direct access to sensitive files and folders
    RewriteRule ^(\.env|\.git|\.github|composer\.(json|lock)|package\.(json|lock)|vite\.config\.js|artisan|phpunit\.xml) - [F,L,NC]
    RewriteRule ^(app|bootstrap|config|database|resources|routes|storage|tests|vendor|node_modules)/ - [F,L,NC]

    # Redirect /public/xxx to /xxx to avoid duplicate URLs
    RewriteCond %{THE_REQUEST} /public/([^\s?]*) [NC]
    RewriteRule ^ %1 [L,NE,R=301]

    # Send all other requests to the public/ folder
    RewriteCond %{REQUEST_URI} !^/public/
    RewriteRule ^(.*)$ public/$1 [L,QSA]
</IfModule>

# Disable Directory Browsing
<IfModule mod_autoindex.c>
    Options -Indexes
</IfModule>
