# 2026-08-19 security fix (pre-launch audit finding M-2): every real API
# call this app's own client-side code makes uses the clean /api/... route
# style (e.g. fetch('/traderalign/api/trades/draft', ...)), which
# index.php's router resolves via require($base . '/api/....php') — a
# filesystem-level include, completely unaffected by Apache-level access
# control on the URL. Confirmed via a full grep of every fetch()/href/
# action in this app's client-side code (public/*.php, calculator-
# source.html, landing.html, assets/js/*.js) that nothing anywhere
# constructs a literal ".../api/....php" URL — every real caller, including
# the handful of endpoints here that do their own self-contained
# session/PDO/Auth setup instead of relying on index.php's (api/trades/
# draft.php, api/trades/validate.php, api/analytics/account.php,
# api/analytics/behavior.php, api/analytics/career.php,
# api/analytics/portfolio.php), is reached exclusively through the clean
# route. Before this file existed, the root .htaccess's
# `RewriteCond %{REQUEST_FILENAME} !-f` let a direct request for any real
# file bypass the front controller (and, for the majority of api/*.php
# files that assume $auth/$pdo/$db were already constructed by index.php,
# fail with a raw, unhandled PHP fatal error disclosing full filesystem
# paths under a development-mode config) — confirmed live during the
# audit. This closes that gap with zero effect on real API traffic.
<FilesMatch "\.php$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order deny,allow
        Deny from all
    </IfModule>
</FilesMatch>

# 2026-08-19 security fix (Colex hardening pass): api/colex/knowledge.json
# and api/colex/progress-stages.json are both server-side-only reference
# files — read via file_get_contents()/require() from PHP (api/colex/
# chat.php's loadKnowledgeBase(), public/colex.php), never fetched
# directly by any client-side code (confirmed via a full grep of every
# fetch()/href/src in this app's client-side files). Confirmed live during
# a Colex-focused security review that knowledge.json was fully
# downloadable, unauthenticated, with zero access control — the .php-only
# FilesMatch block above never covered it. This matters specifically
# because knowledge.json's own "meta.pricing_status" field states its
# pricing figures are "DRAFT, NOT FINALIZED" and the system prompt built
# from it (buildColexSystemPrompt()) explicitly instructs Colex never to
# state a dollar figure to a user — instructing the AI not to reveal
# something while leaving the same data one anonymous HTTP request away
# is not a real access control, it's a bypass of the only control that
# existed. Blocked by extension (not folded into the .php FilesMatch
# above) since this app may add other legitimate server-side-only JSON
# reference files under api/ later — anything with this shape belongs
# here by default, not decided file-by-file.
<FilesMatch "\.json$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order deny,allow
        Deny from all
    </IfModule>
</FilesMatch>
