# Admin panel: do NOT rewrite PHP extensions
# This prevents the parent /account/.htaccess from stripping .php and causing
# 301 redirect chains that break login POST flow, AJAX polling, and CSS loading.

RewriteEngine On

Options -Indexes

# Allow direct PHP access — no extension stripping for admin pages
RewriteCond %{REQUEST_FILENAME} -f
RewriteRule ^(.+)$ - [L]

# If the file doesn't exist but .php version does, serve that
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME}.php -f
RewriteRule ^(.+?)/?$ $1.php [L,QSA]

# Environment variables (override in server config for production)
SetEnv PADM_DB_PASS "aA@741741"
SetEnv PADM_ENCRYPT_KEY "r3ch4rg3d1$htv@2026!s3cur3k3y"
SetEnv PADM_JWT_SECRET "RdTV_Adm!n_M0b1l3_@pp_S3cr3t_K3y_2026#xZ9qW"

DirectoryIndex index.php login.php

# Deny access to config and includes directories via direct URL
<FilesMatch "^config\.php$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Deny from all
    </IfModule>
</FilesMatch>

