# Technician Hub Pro - Backend Access Hardening
#
# This folder holds both public API endpoints (things the app calls, like
# get_motor_items.php) AND internal/support files that should NEVER be requested
# directly from a browser (db.php has your DB password; CloudSync.php is a class file
# with no business handling a raw request; diagnostics.php/test.php dump server info).
#
# Rule of thumb used below: block anything that isn't a normal user-facing API script.

# ---- Never allow directory listing (no browsing uploads/ or the api folder itself) ----
Options -Indexes

# ---- Block direct access to internal/config/diagnostic files ----
<FilesMatch "^(db|config|auth|CloudSync|diagnostics|test|check_columns)\.php$">
    Require all denied
</FilesMatch>

# ---- Basic security headers for every response from this API ----
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "DENY"
    Header always set Referrer-Policy "no-referrer-when-downgrade"
    Header unset X-Powered-By
    Header always unset X-Powered-By
</IfModule>
ServerSignature Off
