# Override the project root's "deny all" safety net (see ../.htaccess) —
# this folder is the actual web root and must stay reachable.
<IfModule mod_authz_core.c>
    Require all granted
</IfModule>
<IfModule !mod_authz_core.c>
    Order allow,deny
    Allow from all
</IfModule>

RewriteEngine On

# Serve existing files/directories (css, js, images) directly.
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]

# Everything else goes through the front controller.
RewriteRule ^ index.php [L]
