# ─── Admin Front Controller ───
# All .php requests are routed through index.php, which
# bootstraps _init.php once and then includes the target page.

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Allow static assets (CSS / JS / images)
    RewriteRule ^assets/ - [L]

    # Block direct access to includes directory
    RewriteRule ^includes/ - [R=403,L]

    # Do not rewrite the front controller itself (prevent loop)
    RewriteRule ^index\.php$ - [L]

    # Route admin API requests through the front controller
    # Uses 'admin_route' to avoid colliding with admin pages' own ?page= params
    RewriteRule ^api/([a-zA-Z0-9_-]+)\.php$ index.php?admin_route=api/$1 [QSA,L]

    # Route all top-level .php requests through the front controller
    RewriteRule ^([a-zA-Z0-9_-]+)\.php$ index.php?admin_route=$1 [QSA,L]
</IfModule>
