<IfModule mod_rewrite.c>
    RewriteEngine On

    # Force HTTPS for production domains.
    RewriteCond %{HTTPS} !=on
    RewriteCond %{HTTP_HOST} !^(localhost|127\.0\.0\.1)(:[0-9]+)?$ [NC]
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

    # Never expose Laravel internals when the project root is uploaded to public_html.
    RewriteRule (^|/)(\.env|\.git|composer\.(json|lock)|package(-lock)?\.json|artisan|phpunit\.xml|webpack\.mix\.js)$ - [F,L,NC]
    RewriteRule ^(app|bootstrap|config|database|resources|routes|storage|tests|vendor)(/|$) - [F,L,NC]

    # Serve real public files such as assets, storage symlinks, robots.txt, and favicon.
    RewriteCond %{DOCUMENT_ROOT}/public%{REQUEST_URI} -f [OR]
    RewriteCond %{DOCUMENT_ROOT}/public%{REQUEST_URI} -d
    RewriteRule ^(.*)$ public/$1 [L]

    # Send application requests to Laravel's front controller.
    RewriteRule ^ public/index.php [L]
</IfModule>

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    # Face verification uses the camera on same-origin cashout/settings pages.
    Header always set Permissions-Policy "camera=(self), microphone=(), geolocation=()"
</IfModule>
