# ============================================================
#  African Groceries backend — .htaccess
# ============================================================

# Block direct access to sensitive directories
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteRule ^(config|includes|database|cron)/ - [F,L]
</IfModule>

# Disable directory listing
Options -Indexes

# Security headers (also set in PHP, belt & braces)
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "DENY"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
</IfModule>

# Force correct content type for .json
AddType application/json .json

# Never allow execution of uploaded files
<FilesMatch "\.(php|phtml|phar)$">
  <If "%{REQUEST_URI} =~ m#^/african-groceries/backend/assets/uploads/#">
    Require all denied
  </If>
</FilesMatch>