# Rapid Reward Cash — API rules
Options -Indexes

# ---------------------------------------------------------------------
# Extensionless REST paths -> .php files.
# Enables: /api/auth/login, /api/home, /api/user/profile, /api/config
# without needing ".php" in the Android Retrofit paths.
#
# Order matters: several endpoints share a name with a sub-directory
# (/api/wallet + /api/wallet/, /api/tasks + /api/tasks/, ...). The .php
# file must be preferred over the directory, otherwise the list routes
# would be served as directories and return 403.
# ---------------------------------------------------------------------
<IfModule mod_rewrite.c>
    RewriteEngine On

    # Serve existing files directly.
    RewriteCond %{REQUEST_FILENAME} -f
    RewriteRule ^ - [L]

    # Prefer a matching .php file over a same-named directory:
    #   /api/wallet       -> wallet.php      (not the wallet/ dir)
    #   /api/tasks        -> tasks.php       (not the tasks/ dir)
    #   /api/tasks/start  -> tasks/start.php
    RewriteCond %{REQUEST_FILENAME}.php -f
    RewriteRule ^(.+?)/?$ $1.php [L]

    # Otherwise serve directories as-is.
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^ - [L]
</IfModule>

# Never serve hidden files
<FilesMatch "^\.">
    Require all denied
</FilesMatch>
