# ENCY TV STORE — root .htaccess
Options -Indexes

# ---------------- Pretty (SEO) URLs ----------------
<IfModule mod_rewrite.c>
  RewriteEngine On

  # /ads.txt -> served from Admin settings (AdSense requires it)
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteRule ^ads\.txt$ ads_txt.php [L]

  # /app/{app-name}  ->  app.php?slug=app-name
  RewriteRule ^app/([A-Za-z0-9\-]+)/?$ app.php?slug=$1 [QSA,L]

  # /download/{app-name}  ->  go.php?u=app-name  (multi-page countdown)
  RewriteRule ^download/([A-Za-z0-9\-]+)/?$ go.php?u=$1 [QSA,L]

  # Admin panel without .php — /admin/dashboard -> /admin/dashboard.php
  # (only when the target .php file actually exists)
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteCond %{REQUEST_FILENAME}.php -f
  RewriteRule ^(.+)$ $1.php [L]
</IfModule>

# Protect the data folder (SQLite database + DB config)
<FilesMatch "^(store\.db|store\.db-wal|store\.db-shm|installed\.lock|config\.php)$">
  Require all denied
</FilesMatch>

# Block direct access to includes
<FilesMatch "^(init|seed_apps)\.php$">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
</FilesMatch>

# Basic hardening
<IfModule mod_headers.c>
  Header set X-Content-Type-Options "nosniff"
  Header set X-Frame-Options "SAMEORIGIN"
  Header set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# Default charset
AddDefaultCharset UTF-8
