Options -Indexes
RewriteEngine On

# Security headers
<IfModule mod_headers.c>
 Header always set X-Content-Type-Options nosniff
 Header always set X-Frame-Options DENY
 Header always set Referrer-Policy strict-origin-when-cross-origin
</IfModule>

# Canonicalise the API endpoint before the general .php redirect.
RewriteCond %{THE_REQUEST} \s/+api/index\.php(?:[?\s]) [NC]
RewriteRule ^api/index\.php$ api [R=301,L,NE]

# Canonical clean URLs: /login.php -> /login. Only redirect direct browser requests.
RewriteCond %{THE_REQUEST} \s/+(.+?)\.php(?:[?\s]) [NC]
RewriteRule ^(.+?)\.php$ $1 [R=301,L,NE]

# Friendly API endpoint, retaining query parameters and request bodies.
RewriteRule ^api/?$ api/index.php [QSA,L]

# Serve existing static files and directories as-is.
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]

# Map extensionless app routes to their PHP implementation.
RewriteRule ^([A-Za-z0-9_-]+)/?$ $1.php [QSA,L]

# Root is handled by index.php, which redirects to /login.
