<?php
/**
 * router.php — Front-controller router for the PHP built-in dev server.
 *
 * Mirrors the production Apache .htaccess rules so the SaleOs SPA loads
 * correctly under `php -S`. The layout (views/layouts/app.php) writes
 * root-relative asset URLs like /assets/... and /public/logo.png that
 * Apache serves directly while rewriting everything else to public/index.php.
 *
 * Usage (cwd must be the project root):
 *   php -d upload_max_filesize=5M -d post_max_size=8M -S localhost:8000 router.php
 *
 * Behavior:
 *   1. Real static files on disk (assets/, public/*.png, vendor/*, etc.) are
 *      served directly by the CLI server (returning false defers to it).
 *   2. The legacy root index.php is bypassed — never served, never delegated.
 *   3. Everything else delegates to public/index.php (the canonical entry).
 */

$uri = parse_url($_SERVER['REQUEST_URI'] ?? '/', PHP_URL_PATH) ?: '/';

// Block direct access to sensitive directories (matches root .htaccess intent)
foreach (['/app/', '/vendor/', '/logs/', '/data/', '/.env', '/.git/', '/scripts/'] as $blocked) {
    if (strpos($uri, $blocked) === 0) {
        http_response_code(403);
        exit('Forbidden');
    }
}

// Resolve to a real on-disk path under the project root
$diskPath = __DIR__ . $uri;

// Serve real static files via the built-in server, but never the legacy root index.php
if ($uri !== '/' && is_file($diskPath) && basename($diskPath) !== 'index.php') {
    return false; // let PHP CLI server stream the file
}

// All other requests go through the canonical front controller
require __DIR__ . '/public/index.php';
