RewriteEngine On

# Security Headers
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set X-XSS-Protection "1; mode=block"
Header always set Referrer-Policy "strict-origin-when-cross-origin"

# Disable directory listing
Options -Indexes

# Protect sensitive files
<FilesMatch "\.(env|sql|log|md)$">
    Order Allow,Deny
    Deny from all
</FilesMatch>

# Block access to config, includes, database.sql, and install.lock
RewriteRule ^config/ - [F,L]
RewriteRule ^includes/ - [F,L]
RewriteRule ^install/database\.sql$ - [F,L]
RewriteRule ^install/install\.lock$ - [F,L]

# Payment link routing: /pay/{token} -> /pay/index.php?token={token}
RewriteRule ^pay/([A-Za-z0-9]+)$ pay/index.php?token=$1 [L,QSA]

# API routing
RewriteRule ^api/create-order$ api/create-order.php [L,QSA]
RewriteRule ^api/check-status$ api/check-status.php [L,QSA]

# Remove .php extension
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME}\.php -f
RewriteRule ^(.*)$ $1.php [L]
