# ============================================================
# Karvi Partner Contract — Apache (.htaccess)
# Upload to: /karvi-pro/   |  Rename htaccess.txt if needed
# ============================================================

DirectoryIndex index.php default.php index.html

Options -Indexes +FollowSymLinks

ErrorDocument 403 404.html
ErrorDocument 404 404.html

<IfModule mod_rewrite.c>
    RewriteEngine On
    # No RewriteBase — Apache auto-detects subfolder (/karvi-pro/ or /karvi-pro/invoice/)

    RewriteRule "(^|/)\." - [R=404,L]
    RewriteRule \.(env|log|sql|bak|ini|conf|sh|phar|lock|dist)$ - [R=404,L]

    # Block internal folders only — NOT /contract/{token} customer URLs
    RewriteRule ^(database|config|includes|vendor|scripts|lang|templates|pages|tools|src|deploy|controllers|services|models|views|middleware)(/|$) - [R=404,L]

    RewriteRule ^(router|composer-setup|templat_data)\.php$ - [R=404,L]
    RewriteRule ^composer\.(json|lock|phar)$ - [R=404,L]

    RewriteRule ^uploads/contracts/([a-zA-Z0-9._-]+)$ index.php [L,QSA]
    RewriteRule ^uploads/signed/([a-zA-Z0-9._-]+)$ index.php [L,QSA]
    RewriteRule ^uploads(/|$) - [R=404,L]

    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^ index.php [L,QSA]
</IfModule>

<IfModule mod_authz_core.c>
    <FilesMatch "^(composer\.(json|lock|phar)|templat_data\.txt|composer-setup\.php|router\.php)$">
        Require all denied
    </FilesMatch>
</IfModule>

<IfModule !mod_authz_core.c>
    <FilesMatch "^(composer\.(json|lock|phar)|templat_data\.txt|composer-setup\.php|router\.php)$">
        Order allow,deny
        Deny from all
    </FilesMatch>
</IfModule>
