RewriteEngine On
RewriteBase /server/api/admin/
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ routes.php [QSA,L]

# Ensure PHP knows this is the admin API
SetEnv ADMIN_API true

# Prevent direct access to PHP files except routes.php and AdminController.php
<FilesMatch "^(?!routes\.php$|AdminController\.php$).*\.php$">
  Require all denied
</FilesMatch>
