# ScanPay at the top of a website folder (for example htdocs, or a subdomain's folder on cPanel).
# Visitors only ever reach the "public" folder; everything else here stays private.
<IfModule mod_rewrite.c>
    RewriteEngine On

    # 1. Private folders and files are never served.
    RewriteRule ^(app|bootstrap|config|database|resources|routes|storage|tests|vendor|scripts|release|node_modules|\.git|\.claude)(/|$) - [F,L]
    RewriteRule ^(\.env.*|artisan|composer\..*|package.*\.json|phpunit\.xml|vite\.config\.js|dev-router\.php|\.gitignore|\.gitattributes|\.editorconfig|README\.md)$ - [F,L]

    # 2. "page/" and "page" are one page. Done here, before the address is sent on to "public", so the redirect
    #    never shows ".../public/...". Works with ScanPay at the top of the site or in a folder of it.
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} ^(.+)/$
    RewriteRule ^(.+)/$ %1 [L,R=301]

    # 3. Other websites or folders that live beside ScanPay are served as they are.
    RewriteCond %{REQUEST_FILENAME} -d [OR]
    RewriteCond %{REQUEST_FILENAME} -f
    RewriteRule ^(?!public(/|$)). - [L]

    # 4. Everything else is ScanPay (this folder's own address included).
    RewriteRule ^$ public/ [L]
    RewriteRule ^(.*)$ public/$1 [L]
</IfModule>

# Without mod_rewrite nothing can be protected, so refuse to serve anything.
<IfModule !mod_rewrite.c>
    Require all denied
</IfModule>

Options -Indexes
