# ============================================================
# Sudimedia Pilot - data/ directory protection
# ============================================================
#
# This directory contains the SQLite database file (pilot.sqlite),
# the initial schema (schema.sql), and auxiliary WAL/SHM files.
# NOTHING inside this directory should be accessible via HTTP,
# ever, under any circumstances.
#
# The root .htaccess already blocks this path via RedirectMatch,
# but this file provides a second, directory-level barrier
# (belt-and-braces) in case the root .htaccess is missing or
# overridden.
# ============================================================

# Apache 2.4+ syntax
<IfModule mod_authz_core.c>
    Require all denied
</IfModule>

# Apache 2.2 syntax (fallback for older hosts)
<IfModule !mod_authz_core.c>
    Order deny,allow
    Deny from all
</IfModule>

# Disable any URL rewriting that could bypass the deny rules
<IfModule mod_rewrite.c>
    RewriteEngine Off
</IfModule>

# Disable directory listing (defensive: should never be reachable)
Options -Indexes

# Deny access to every file type, not just the expected ones
<FilesMatch ".*">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order deny,allow
        Deny from all
    </IfModule>
</FilesMatch>
