# To prevent access to .env and other files
# <IfModule mod_rewrite.c>  
#   RewriteEngine On 
#   RewriteRule ^(.*)$ public/$1 [L]
# </IfModule>

# -------------------------------
# Root .htaccess for CodeIgniter 4
# -------------------------------

# Options -Indexes

# <IfModule mod_rewrite.c>
#     RewriteEngine On
#     RewriteCond %{REQUEST_FILENAME} !-f
#     RewriteCond %{REQUEST_FILENAME} !-d
#     RewriteRule ^(.*)$ index.php/$1 [L]
# </IfModule>

# <IfModule mod_headers.c>
#     Header always set Content-Security-Policy "frame-ancestors https://*.myshopify.com https://admin.shopify.com"
#     Header always set X-Frame-Options "ALLOWALL"
# </IfModule>

# <FilesMatch "^(\.env|config\.php)$">
#     Order allow,deny
#     Deny from all
# </FilesMatch>

# ServerSignature Off






<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} !^/public/
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^(.*)$ public/$1 [L]
</IfModule>

<Files ".env">
    Order allow,deny
    Deny from all
</Files>
<Files "config.php">
    Order allow,deny
    Deny from all
</Files>

# Optional: Remove or adjust X-Frame-Options
<IfModule mod_headers.c>
    Header unset X-Frame-Options
    # Or set to allow Shopify admin if needed
    # Header set X-Frame-Options "ALLOW-FROM https://admin.shopify.com"
</IfModule>