# Nuvio panel · NuvioTV API — Apache rewrite rules
# This directory is the docroot mapped to  https://host/api/nuvio/

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Make the Authorization: Bearer header visible to PHP under CGI/FPM.
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # Map extensionless API routes to their .php file when it exists:
    #   api/auth/login  -> api/auth/login.php
    #   api/addons      -> api/addons.php
    #   api/plugins     -> api/plugins.php
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME}.php -f
    RewriteRule ^(.+?)/?$ $1.php [L]
</IfModule>

# Fallback for servers that expose the header as REDIRECT_HTTP_AUTHORIZATION.
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

# Route PHP to PHP-FPM 8.2+ (adjust the socket path to your php-fpm version).
# Runs after the rewrites above, so extensionless API routes still resolve to
# their .php target first and are then handed to FPM.
<FilesMatch \.php$>
    SetHandler "proxy:unix:/run/php/php8.2-fpm.sock|fcgi://localhost/"
</FilesMatch>

DirectoryIndex index.php

# Never serve the SQLite file or dotfiles even if the docroot is misconfigured.
<FilesMatch "\.(sqlite|sqlite-wal|sqlite-shm|db)$">
    Require all denied
</FilesMatch>

Options -Indexes
