# Registration API — Apache configuration.
#
# Nothing here is required for the API to work: without mod_rewrite the
# endpoint is still reachable as .../forapi/index.php. What the rewrite adds is
# the tidier .../forapi/register, and what the rest adds is a guarantee that
# the files around index.php are never served as text.

# Some CGI and FastCGI setups drop the Authorization header before PHP sees it,
# which would make every call look unauthenticated. Pass it through.
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTP:Authorization} .
    RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # Anything that is not a real file or directory is handled by the router.
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^ index.php [QSA,L]
</IfModule>

<IfModule mod_setenvif.c>
    SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
</IfModule>

# Credentials, the autoloader and the schema are not web content. A server with
# PHP disabled would otherwise hand config.php out as plain text.
<FilesMatch "^(config\.php|config\.example\.php|bootstrap\.php|schema\.sql|README\.md)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# Directory listings would reveal the layout even where the files are blocked.
Options -Indexes
