# Coincorn panel - deny direct HTTP access to files that are meant to be read by
# PHP only. Service-account keys, DB dumps and debug logs all live inside the
# webroot, so without this every one of them is fetchable by URL:
#   /coincorn/service_account.json
#   /coincorn/admin/debug.log
#   /coincorn/app/debug_api.txt
#
# Rotate the Firebase / Play service-account keys as well: anything that has been
# publicly reachable should be treated as exposed. Long term these files belong
# above the document root, with the path passed in via an environment variable.

<FilesMatch "\.(json|log|lock|bak|sql|txt|ini|yml|yaml)$">
    Require all denied
</FilesMatch>

# Apache 2.2 fallback (Require is 2.4+). Harmless when mod_access_compat is absent.
<IfModule !mod_authz_core.c>
    <FilesMatch "\.(json|log|lock|bak|sql|txt|ini|yml|yaml)$">
        Order allow,deny
        Deny from all
    </FilesMatch>
</IfModule>

# The vendor tree is never served directly, at any depth.
RedirectMatch 404 ^/(.*/)?vendor/

# Directory listings would expose the same files by another route.
Options -Indexes

# Pass the Authorization header through to PHP.
#
# The app endpoints under /app/ authenticate with "Authorization: Bearer <Firebase
# ID token>". Apache does NOT expose that header to PHP by default: on this stack
# $_SERVER['HTTP_AUTHORIZATION'] comes back empty and only apache_request_headers()
# can see it, and under CGI/FastCGI/PHP-FPM even that is unavailable — which would
# 401 every signed-in user. Both rules below populate $_SERVER['HTTP_AUTHORIZATION']
# so app/firebase_auth.php finds the token whatever the SAPI is.
<IfModule mod_setenvif.c>
    SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
</IfModule>
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
</IfModule>
