RewriteEngine On

# Deny direct browser access to config/ and includes/ folders
RewriteRule ^config/ - [F,L]
RewriteRule ^includes/ - [F,L]

# Deny access to install/ folder after setup (uncomment once setup.php has been run and deleted)
# RewriteRule ^install/ - [F,L]

# ---- Public QR / token landing page: /cafe/{slug}/ ----
RewriteRule ^cafe/([a-z0-9-]+)/?$ public/token.php?cafe=$1 [L,QSA]
RewriteRule ^cafe/([a-z0-9-]+)/queue/?$ public/queue-display.php?cafe=$1 [L,QSA]
RewriteRule ^cafe/([a-z0-9-]+)/status/?$ public/status.php?cafe=$1 [L,QSA]
RewriteRule ^cafe/([a-z0-9-]+)/services/?$ public/services.php?cafe=$1 [L,QSA]

# ---- Cafe Admin panel: /cafe/{slug}/admin/... ----
RewriteRule ^cafe/([a-z0-9-]+)/admin/?$ cafe-admin/dashboard.php?cafe=$1 [L,QSA]
RewriteRule ^cafe/([a-z0-9-]+)/admin/login/?$ cafe-admin/login.php?cafe=$1 [L,QSA]
RewriteRule ^cafe/([a-z0-9-]+)/admin/([a-zA-Z0-9_-]+)/?$ cafe-admin/$2.php?cafe=$1 [L,QSA]

# Basic security headers
<IfModule mod_headers.c>
  Header set X-Content-Type-Options "nosniff"
  Header set X-Frame-Options "SAMEORIGIN"
  Header set X-XSS-Protection "1; mode=block"
</IfModule>

# Prevent directory listing
Options -Indexes
