# ==========================================================
# .htaccess - Clean URL + proteksi file sensitif
# Aplikasi Perawat RS BaliMed
# ==========================================================

Options -Indexes
RewriteEngine On
RewriteBase /

# Proteksi file/folder sensitif dari akses publik.
<FilesMatch "^(\.env|\.env\..*|composer\.(json|lock)|\.cpanel\.yml.*|README.*)$">
    Require all denied
</FilesMatch>

RedirectMatch 403 ^/(\.git|app|config|database|docs|storage|sql)(/|$)
RedirectMatch 403 ^/.*\.(bak|backup|old|orig|save|sql|log|ini|env)$

# Paksa akses login.php tampil sebagai /login pada address bar.
RewriteCond %{THE_REQUEST} \s/+login\.php[\s?] [NC]
RewriteRule ^login\.php$ /login [R=301,L]

# /login diarahkan internal ke login.php.
RewriteRule ^login/?$ login.php [L,QSA]

# Clean URL umum: /nama-file -> nama-file.php jika file PHP tersedia.
# Contoh: /logout -> logout.php, /index -> index.php
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME}\.php -f
RewriteRule ^(.+?)/?$ $1.php [L,QSA]

# Default homepage.
DirectoryIndex index.php
