# ============================================================
# CMC Growth Store — Apache/LiteSpeed rules.
# Place the store/ folder at the site root, so:
#   https://consciousmindconcepts.co.za/store/  ->  this folder
# The main site's existing pages are untouched.
# ============================================================

# --- protect the data directory (DB, product files, .env, logs) ---
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteRule ^(data/|includes/|views/) - [F,L]
</IfModule>

# deny direct access to dotfiles (.env etc.)
<FilesMatch "^\.">
  Require all denied
</FilesMatch>

# --- front controller: everything under /store routes to index.php ---
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteBase /store/

  # let real files (assets/store.css) through
  RewriteCond %{REQUEST_FILENAME} -f [OR]
  RewriteCond %{REQUEST_FILENAME} -d
  RewriteRule ^ - [L]

  # everything else -> index.php
  RewriteRule ^ index.php [QSA,L]
</IfModule>

# security headers (belt & braces; PHP also sends them)
<IfModule mod_headers.c>
  Header set X-Content-Type-Options "nosniff"
  Header set X-Frame-Options "SAMEORIGIN"
  Header set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# never list the data directory
Options -Indexes

# uploads: PDFs only, no script execution
<FilesMatch "\.(php|phtml|phar|php\d)$">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
</FilesMatch>
