# Route everything through index.php (Apache / shared hosting)
RewriteEngine On

# --- Pass the Authorization header through to PHP ---------------------------
# Many cPanel / FastCGI / PHP-FPM setups strip the "Authorization: Bearer ..."
# header before PHP ever sees it. That makes every logged-in request come back
# 401, which the app reads as "session expired" and logs you straight back out
# a second after signing in. Forwarding it here fixes that. (The built-in PHP
# dev server passes it automatically, which is why this only bites on real
# hosting — both directives are here because different hosts honor different ones.)
RewriteCond %{HTTP:Authorization} .
RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

# --- Front controller: route everything else through index.php -------------
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ index.php [QSA,L]
