# dashboard.ficertech.com — clean URLs
Options -Indexes

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /

    # Force HTTPS (uncomment after SSL is active on cPanel)
    # RewriteCond %{HTTPS} off
    # RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

    # Block sensitive files
    RewriteRule ^(config|includes)/ - [F,L]
    RewriteRule \.(sql|env|log|ini|md)$ - [F,L]

    # Pass through real files, directories, API endpoints, and setup script
    RewriteCond %{REQUEST_URI} ^/api/ [NC,OR]
    RewriteCond %{REQUEST_URI} ^/cpanel_setup\.php [NC,OR]
    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^ - [L]

    # Old /admin/... bookmarks → clean URLs
    RewriteRule ^admin/login\.php$ /login [L,R=301]
    RewriteRule ^admin/dashboard\.php$ /dashboard [L,R=301]
    RewriteRule ^admin/logout\.php$ /logout [L,R=301]
    RewriteRule ^admin/403\.php$ /403 [L,R=301]
    RewriteRule ^admin/settings/index\.php$ /settings/ [L,R=301]
    RewriteRule ^admin/(services|blogs|timeline|team-members|portfolio|related-stories|contact-messages|job-applications|internships|users|roles)/(index\.php)?$ /$1/ [L,R=301]
    RewriteRule ^admin/(services|blogs|timeline|team-members|portfolio|related-stories|contact-messages|job-applications|internships|users|roles)/([a-z0-9-]+)\.php$ /$1/$2 [L,R=301,QSA]

    # Root → login
    RewriteRule ^$ /login [L,R=302]

    # Top-level pages
    RewriteRule ^login/?$ admin/login.php [L,QSA]
    RewriteRule ^dashboard/?$ admin/dashboard.php [L,QSA]
    RewriteRule ^logout/?$ admin/logout.php [L,QSA]
    RewriteRule ^403/?$ admin/403.php [L,QSA]

    # AJAX (used by dashboard search/charts)
    RewriteRule ^ajax/([a-z0-9-]+)/?$ admin/ajax/$1.php [L,QSA]

    # Module index: /services → /services/
    RewriteRule ^(services|blogs|timeline|team-members|portfolio|related-stories|contact-messages|job-applications|internships|users|roles|settings|messages|team)$ /$1/ [L,R=301]

    # Module index: /services/
    RewriteRule ^(services|blogs|timeline|team-members|portfolio|related-stories|contact-messages|job-applications|internships|users|roles|settings|messages|team)/$ admin/$1/index.php [L,QSA]

    # Relative .php links under clean module URLs (e.g. /services/add.php)
    RewriteRule ^(services|blogs|timeline|team-members|portfolio|related-stories|contact-messages|job-applications|internships|users|roles)/(index)\.php$ /$1/ [L,R=301,QSA]
    RewriteRule ^(services|blogs|timeline|team-members|portfolio|related-stories|contact-messages|job-applications|internships|users|roles)/([a-z0-9-]+)\.php$ admin/$1/$2.php [L,QSA]

    # Module actions: /services/add, /services/view, etc.
    RewriteRule ^(services|blogs|timeline|team-members|portfolio|related-stories|contact-messages|job-applications|internships|users|roles)/(add|edit|view|delete|update-status)/?$ admin/$1/$2.php [L,QSA]

    # Allow real files/dirs under admin/ and uploads/ to pass through
    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^ - [L]
</IfModule>

<FilesMatch "\.(sql|env|log|ini)$">
    Require all denied
</FilesMatch>
