Options -Indexes

RewriteEngine On

# CORS headers para todos los requests
Header always set Access-Control-Allow-Origin "*"
Header always set Access-Control-Allow-Methods "GET, POST, PUT, DELETE, PATCH, OPTIONS"
Header always set Access-Control-Allow-Headers "Content-Type, Authorization"
Header always set Access-Control-Max-Age "86400"

# Responder OK a preflight OPTIONS sin pasar a PHP
RewriteCond %{REQUEST_METHOD} OPTIONS
RewriteRule ^(.*)$ $1 [R=200,L]

# Bloquear acceso directo a uploads que no sean imágenes
RewriteRule ^uploads/.*(?<!\.webp)$ - [F,L]

# Proteger config.php y middleware.php de acceso directo
RewriteRule ^api/config\.php$ - [F,L]
RewriteRule ^api/middleware\.php$ - [F,L]
