Options -Indexes
DirectoryIndex index.php index.html

RewriteEngine On

# Customer-dashboard HTML files are server-side display templates, not public
# pages. Redirect direct browser requests to the protected PHP controllers.
# Capture the current URL directory so this works both in /itsbank locally and
# at the root of the production domain without exposing a filesystem path.
RewriteCond %{REQUEST_URI} ^(.*/)(dashboard|accounts|transactions|transfer|transfer-review|transfer-success|beneficiaries|my-cards|statements|notifications|support|profile|settings|loans)\.html$ [NC]
RewriteRule ^(?:dashboard|accounts|transactions|transfer|transfer-review|transfer-success|beneficiaries|my-cards|statements|notifications|support|profile|settings|loans)\.html$ %1%2 [R=302,L,NE]

# Public marketing HTML files may still load directly. Dashboard navigation
# uses the extensionless protected routes below.

# Resolve extensionless requests to matching PHP entry points internally.
RewriteRule ^beneficiaries/?$ beneficiaries.php [L,QSA]
RewriteRule ^statements/?$ statements.php [L,QSA]

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME}.php -f
RewriteRule ^(.+?)/?$ $1.php [L,QSA]

<FilesMatch "^(\.env|\.env\..*|composer\.(json|lock)|.*\.sql)$">
    Require all denied
</FilesMatch>

<IfModule mod_headers.c>
    <FilesMatch "^(components\.js|home\.js|dashboard-data\.js|support\.js|admin\.js|notifications-page\.js|transfer\.js|main\.css|home\.css|home-sections\.css|dashboard-data\.css|support\.css|admin\.css)$">
        Header set Cache-Control "no-cache, must-revalidate"
    </FilesMatch>
</IfModule>
