# Growzy 0.2.2 root-folder distribution. Keep this security block intact.
Require all granted
Options -Indexes -MultiViews
DirectoryIndex index.php
RewriteEngine On
# The PHP entry points require this server-side marker; HTTP headers cannot set it.
RewriteRule ^ - [E=GROWZY_ROOT_GUARD:growzy-root-0.2.2]
# Preserve Bearer authentication through Apache/FastCGI internal rewrites.
RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
# Permit only ordinary existing ACME challenge files (certificate renewal).
RewriteCond %{REQUEST_FILENAME} -f
RewriteRule ^\.well-known/acme-challenge/[A-Za-z0-9_-]+$ - [L]
# Never route backend, legacy deployment, dotfiles or executable PATH_INFO URLs.
RewriteRule ^(?:_growzy|growzy)(?:/|$) - [F,L,NC]
RewriteRule (^|/)\. - [F,L]
RewriteRule ^(?:index|install)\.php/ - [F,L,NC]
# Only these two root PHP entry points are public.
RewriteRule ^(?:index|install)\.php$ - [L]
# Existing static assets only; no executable or arbitrary uploaded files.
RewriteRule ^assets/.*\.(?:php[0-9]*|phtml|phar|cgi|pl|py|sh|shtml)(?:\.|$) - [F,L,NC]
RewriteCond %{REQUEST_FILENAME} -f
RewriteRule ^assets/[A-Za-z0-9_.-]+\.(?:css|js|svg|png|jpg|jpeg|webp|gif|ico|woff|woff2)$ - [L]
# Block all other physical files/directories, including ZIPs, logs and old deployments.
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule . - [F,L]
# Preserve pretty pages, /app/* browser APIs and /v1/* API routes.
RewriteRule ^ index.php [QSA,L]
