<IfModule mod_rewrite.c>
    RewriteEngine On

    # Pass HTTP Authorization header to PHP CGI/FPM
    RewriteCond %{HTTP:Authorization} ^(.*)
    RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]

    # Allow physical files (assets) like style.css and app.js to bypass router, but protect index.html
    RewriteCond %{REQUEST_FILENAME} -f
    RewriteCond %{REQUEST_FILENAME} !index\.html$
    RewriteRule ^ - [L]

    # Rewrite all other requests (/, index.html, APIs) to router.php for authentication validation
    RewriteRule ^(.*)$ router.php [L,QSA]
</IfModule>
