# LiveSmart Studio — routing and basic Apache hardening
Options -Indexes
DirectoryIndex index.php

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Explicit endpoints that are called by overlay/connector/payment gateway.
    RewriteRule ^api/state/?$ api/state.php [QSA,L]
    RewriteRule ^api/ingest/?$ api/ingest.php [QSA,L]
    RewriteRule ^api/ipaymu-callback/?$ api/ipaymu_callback.php [QSA,L]

    # Public and user-owned route shortcuts.
    RewriteRule ^overlay/([A-Fa-f0-9]{64})/?$ index.php?page=overlay&token=$1 [QSA,L]
    RewriteRule ^order/([0-9]+)/?$ index.php?page=order&id=$1 [QSA,L]
    RewriteRule ^project/new/?$ index.php?page=project&id=0 [QSA,L]
    RewriteRule ^project/([0-9]+)/?$ index.php?page=project&id=$1 [QSA,L]
    RewriteRule ^tip/([A-Za-z0-9_-]+)/?$ index.php?page=tip&slug=$1 [QSA,L]
    RewriteRule ^proof/([0-9]+)/?$ index.php?page=proof&id=$1 [QSA,L]

    # Do not rewrite physical files/directories (including install/).
    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^ - [L]
    RewriteRule ^(.*)$ index.php?page=$1 [QSA,L]
</IfModule>

# Protect secrets, database schema, and internal project documentation even if
# a child-directory .htaccess is accidentally removed. Apache 2.4 syntax.
<FilesMatch "(?i)^(?:\.env|\.installed|config\.php|.*\.sql|composer\.(?:json|lock)|README\.md|SECURITY\.md|CHANGELOG\.md)$">
    Require all denied
</FilesMatch>
