RewriteEngine On

# Pretty URLs
RewriteRule ^event/([A-Za-z0-9\-]+)/?$ event.php?slug=$1 [L,QSA]
RewriteRule ^invite/([A-Za-z0-9\-_]+)/?$ invite.php?token=$1 [L,QSA]
RewriteRule ^rsvp/([A-Za-z0-9\-_]+)/?$ rsvp.php?token=$1 [L,QSA]

# Root -> dashboard (auth.php will redirect to /login.php if not authenticated)
RewriteRule ^$ dashboard.php [L]

# Block direct access to sensitive files if ever copied into webroot
<FilesMatch "\.(sql|log|md)$">
  Require all denied
</FilesMatch>

# Security headers
<IfModule mod_headers.c>
  Header set X-Content-Type-Options "nosniff"
  Header set X-Frame-Options "SAMEORIGIN"
  Header set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

Options -Indexes
