<IfModule mod_rewrite.c>
    RewriteEngine On

    # Pass Authorization header to PHP (fix for CGI/FastCGI)
    RewriteCond %{HTTP:Authorization} ^(.+)$
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # Route /api/v1/* to api.php
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^api/v1/(.*)$ api.php?route=/$1 [L,QSA]
</IfModule>

# Disable directory browsing
Options -Indexes

# Block hidden files (dot-files) from direct access
<FilesMatch "^\.">
    Require all denied
</FilesMatch>

# Block access to scratch/test directory
<IfModule mod_rewrite.c>
    RewriteRule ^scratch/ - [F,L]
</IfModule>

# Block access to config files
<FilesMatch "config\.php$">
    Require all denied
</FilesMatch>

# Suppress server version in directory listings
ServerSignature Off

# Remove Server header from responses
<IfModule mod_headers.c>
    Header unset Server
    Header always unset Server
</IfModule>

# Remove X-Powered-By header
<IfModule mod_headers.c>
    Header unset X-Powered-By
    Header always unset X-Powered-By
</IfModule>
