Options -Indexes
Options -FollowSymLinks

# ------------------------------------------------------------
# Disable LiteSpeed page caching for this app entirely.
# Every page here depends on session/role, so caching output
# by URL alone can leak one user's view (e.g. admin buttons)
# to another user (e.g. a student) who hits the same URL.
# ------------------------------------------------------------
<IfModule LiteSpeed>
    CacheLookup off
</IfModule>

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /zimba-sms/

    # Block direct access to protected folders
    RewriteRule ^(app|config|database|resources|storage)(/.*)?$ - [F,L]

    # Block sensitive file extensions
    RewriteRule \.(sql|log|env|sh|bak|ini)$ - [F,L]

    # Allow real files/dirs to load directly (css, js, images if any)
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d

    # Route everything through index.php
    RewriteRule ^ index.php [QSA,L]
</IfModule>

# Block PHP execution everywhere EXCEPT index.php in this root
<FilesMatch "\.php$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order deny,allow
        Deny from all
    </IfModule>
</FilesMatch>

<Files "index.php">
    <IfModule mod_authz_core.c>
        Require all granted
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Allow from all
    </IfModule>
</Files>

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header unset X-Powered-By
    # Belt-and-braces: also tell any proxy/browser/CDN in front of
    # this app not to cache responses, since content is per-user.
    Header always set Cache-Control "no-store, no-cache, must-revalidate, max-age=0"
    Header always set Pragma "no-cache"
    Header always set X-LiteSpeed-Cache-Control "no-cache"
</IfModule>

<IfModule mod_php.c>
    php_value upload_max_filesize 10M
    php_value post_max_size 12M
    php_flag display_errors Off
    php_value session.cookie_httponly 1
    php_value session.use_only_cookies 1
</IfModule>
