# Pass the Authorization header to PHP-FPM/CGI (cPanel/Apache 2.4.13+).
# Without this, shared hosting strips "Authorization: Bearer <token>" before
# it reaches PHP, so Sanctum sees no token and every protected route returns
# {"message":"Unauthenticated."} even though login (a public route) works.
#
# SetEnvIf is always safe (mod_setenvif is loaded everywhere). CGIPassAuth is
# the reliable fix for PHP-FPM on cPanel — it's a core directive available on
# Apache 2.4.13+. If you upload this and immediately get HTTP 500, your Apache
# is older than 2.4.13: delete the "CGIPassAuth On" line below and the SetEnvIf
# line above will still cover most cases.
<IfModule mod_setenvif.c>
    SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
</IfModule>
CGIPassAuth On

<IfModule mod_rewrite.c>
    <IfModule mod_negotiation.c>
        Options -MultiViews -Indexes
    </IfModule>

    RewriteEngine On

    # Handle Authorization Header
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # Handle X-XSRF-Token Header
    RewriteCond %{HTTP:x-xsrf-token} .
    RewriteRule .* - [E=HTTP_X_XSRF_TOKEN:%{HTTP:X-XSRF-Token}]

    # Redirect Trailing Slashes If Not A Folder...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} (.+)/$
    RewriteRule ^ %1 [L,R=301]

    # Send Requests To Front Controller...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]
</IfModule>
