<IfModule mod_rewrite.c>
    <IfModule mod_negotiation.c>
        Options -MultiViews -Indexes
    </IfModule>

    RewriteEngine On

    # The app is served from the project root (no /public in the URL), so
    # app/, bootstrap/, config/, storage/, vendor/, etc. all sit next to
    # index.php inside the web-served folder. Block direct access to
    # anything that isn't a public asset before it can be served as a
    # static file or executed as PHP.
    RewriteRule (^|/)\.(?!well-known) - [F,L]
    RewriteRule ^(app|bootstrap|config|database|lang|routes|tests|vendor|node_modules)(/|$) - [F,L]
    RewriteRule ^(composer\.(json|lock)|package(-lock)?\.json|artisan|phpunit\.xml|vite\.config\.js|webpack\.mix\.js|README\.md)$ - [F,L]

    # Block direct access to storage internals (framework state, logs,
    # anything under storage/app that isn't the public disk) before the
    # public-disk rewrite below gets a chance to touch them.
    RewriteRule ^storage/(framework|logs|app/(?!public/))(/|$) - [F,L]

    # Serve the public storage disk (uploaded files) at /storage/... from
    # storage/app/public/... without needing a symlink named "storage",
    # since that name is already the real framework storage directory.
    # The negative lookahead stops this from re-matching its own output:
    # per-directory .htaccess rewriting re-runs the whole ruleset against
    # the substituted URI, so without it storage/x.png would become
    # storage/app/public/x.png and then storage/app/public/app/public/x.png.
    RewriteRule ^storage/(?!app/public/)(.*)$ storage/app/public/$1 [L]

    # Handle Authorization Header
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # Handle X-XSRF-Token Header
    RewriteCond %{HTTP:x-xsrf-token} .
    RewriteRule .* - [E=HTTP_X_XSRF_TOKEN:%{HTTP:X-XSRF-Token}]

    # Redirect Trailing Slashes If Not A Folder...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} (.+)/$
    RewriteRule ^ %1 [L,R=301]

    # Send Requests To Front Controller...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]
</IfModule>
