# Football API v2 — Apache configuration

# ── Deny direct access to helpers ─────────────────────────────────────────────
<FilesMatch "^(bootstrap|utils|teamLogo)\.php$">
    Order Allow,Deny
    Deny from all
</FilesMatch>

# ── Security headers ───────────────────────────────────────────────────────────
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "DENY"
    Header always set Referrer-Policy "no-referrer"
</IfModule>

# ── Charset ────────────────────────────────────────────────────────────────────
AddDefaultCharset UTF-8

# ── Pass OPTIONS through for CORS pre-flight ──────────────────────────────────
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_METHOD} OPTIONS
    RewriteRule .* - [L]
</IfModule>
