# The whole project folder is being served (no vhost pointed at /public),
# so explicitly block direct access to anything that isn't meant to be
# web-reachable: schema/migration SQL, env files, and repo housekeeping files.
<FilesMatch "(\.sql|\.env(\.example)?|\.gitignore|\.gitkeep)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Deny from all
    </IfModule>
</FilesMatch>

# Route any request under this folder that isn't a real file or directory to
# 404.php, which sends anonymous visitors to the login page instead of a bare
# 404. A plain "ErrorDocument 404 /404.php" would need the project's URL
# prefix hardcoded (it resolves from the server's DocumentRoot, not from this
# .htaccess's own directory) and would break if the folder is ever renamed or
# deployed under a different path — mod_rewrite targets here are resolved
# relative to this directory instead, so no prefix is needed.
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^ 404.php [L]
</IfModule>
