DirectoryIndex index.php

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Prevent directory browsing
    Options -Indexes

    # Fix subfolder trailing slash redirect for directories (e.g. /AI/admin -> /AI/admin/)
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteCond %{REQUEST_URI} !/$
    RewriteRule ^(.*)$ %{REQUEST_URI}/ [R=301,L]

    # Route clean auth URLs to index.php
    RewriteRule ^auth/callback/?$ index.php?action=callback [QSA,L]
    RewriteRule ^auth/?$ index.php?action=install [QSA,L]

    # Route /admin to admin/index.php
    RewriteRule ^admin/?$ admin/index.php [QSA,L]

    # Route /portal to portal/index.php
    RewriteRule ^portal/?$ portal/index.php [QSA,L]

    # Route /check to check.php
    RewriteRule ^check/?$ check.php [QSA,L]

    # Alias assets for portal and admin subpaths if requested relatively
    RewriteRule ^portal/assets/(.*)$ assets/$1 [L]
    RewriteRule ^admin/assets/(.*)$ assets/$1 [L]

    # Handle standard router fallback
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^(.*)$ index.php [QSA,L]
</IfModule>

# Security Headers & CORS
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-XSS-Protection "1; mode=block"
    Header set Access-Control-Allow-Origin "*"
    Header set Access-Control-Allow-Methods "GET, POST, OPTIONS"
    Header set Access-Control-Allow-Headers "Content-Type, Authorization"
</IfModule>
