# Twosome API – entry-point rewrite
# All HTTP requests are funnelled to index.php; static files bypass the rule.

Options -Indexes -MultiViews

RewriteEngine On

# ── Security: block direct access to any .php file except index.php ──────────
RewriteRule ^(?!index\.php$).+\.php$ - [F,L]

# ── Route all non-file requests to index.php ─────────────────────────────────
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ index.php [QSA,L]

# ── HTTPS enforcement (cPanel AutoSSL) ───────────────────────────────────────
# Uncomment after AutoSSL is active:
# RewriteCond %{HTTPS} off
# RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
