RewriteEngine On
# Keep rewrites relative to this directory so the package can move without
# rewriting a hardcoded base path.

# ----------------------------
# Public pages (GET)
# ----------------------------
RewriteRule ^$ index.php [L]
RewriteRule ^index$ index.php [L,QSA]
RewriteRule ^login$ login.php [L,QSA]
RewriteRule ^signup$ signup.php [L,QSA]
RewriteRule ^callback$ callback.php [L,QSA]
RewriteRule ^me$ me.php [L,QSA]
RewriteRule ^profile$ profile.php [L,QSA]

# ----------------------------
# BFF endpoints (POST)
# ----------------------------
# callback-process: finalize code -> /token exchange (server-side), set cookies, redirect
RewriteRule ^callback-process$ callback-process.php [L,QSA]

# exchange: refresh/rotate tokens (server-side). JS calls this endpoint.
RewriteRule ^exchange$ exchange.php [L,QSA]

# ack: commit an already-delivered pending token package (server-side).
RewriteRule ^ack$ ack.php [L,QSA]

# ----------------------------
# Optional: logout
# ----------------------------
RewriteRule ^logout$ logout.php [L,QSA]

# ----------------------------
# Block direct access to .php in root
# (allow internal rewrites)
# ----------------------------
RewriteCond %{THE_REQUEST} \s/+([^\s]+)\.php[\s?] [NC]
RewriteRule ^ - [F]

# ----------------------------
# Serve static files directly
# ----------------------------
RewriteCond %{REQUEST_FILENAME} -f
RewriteRule ^ - [L]

# ----------------------------
# Fallback: 404 (recommended)
# ----------------------------
RewriteRule ^ - [R=404,L]
