<IfModule mod_rewrite.c>
    <IfModule mod_negotiation.c>
        Options -MultiViews -Indexes
    </IfModule>

    RewriteEngine On

    # -----------------------------------------------------------------------
    # IMPORTANT FOR XAMPP SUBDIRECTORY INSTALLS:
    # Set RewriteBase to match where your app lives under htdocs.
    # If your URL is http://localhost/vms/public  → use /vms/public
    # If your URL is http://localhost             → use /
    # -----------------------------------------------------------------------
    RewriteBase /vms/public

    # Handle Authorization header
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # Remove trailing slashes — use 307 (not 301) to preserve POST method.
    # 301 causes browsers to switch to GET, breaking form submissions.
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} (.+)/$
    RewriteRule ^ %1 [L,R=307]

    # Route everything through Laravel's index.php
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]

</IfModule>

# Disable directory listing
Options -Indexes

# PHP settings for XAMPP
<IfModule mod_php8.c>
    php_value upload_max_filesize 20M
    php_value post_max_size 20M
    php_value memory_limit 256M
    php_value max_execution_time 300
    php_flag display_errors Off
    php_flag log_errors On
</IfModule>

# Block sensitive files
<FilesMatch "(\.env|\.htpasswd|composer\.json|composer\.lock|package\.json)$">
    Order allow,deny
    Deny from all
</FilesMatch>

# Security headers
<IfModule mod_headers.c>
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set X-Content-Type-Options "nosniff"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>
