# Font MIME types
AddType font/ttf   .ttf
AddType font/otf   .otf
AddType font/woff  .woff
AddType font/woff2 .woff2

# Block direct access to JSON files and underscore files
<FilesMatch "\.(json)$">
    Require all denied
</FilesMatch>

<FilesMatch "^_">
    Require all denied
</FilesMatch>

# Block direct access to sensitive directories
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /
    # Let font files pass through untouched
    RewriteRule ^font/ - [L]
    # Block sensitive dirs
    # Allow images from saved/ (logo etc)
    RewriteRule ^saved/[^/]+\.(png|jpg|jpeg|webp)$ - [L]
    # Allow receipt files (images + PDFs)
    RewriteRule ^saved/receipts/[^/]+/[^/]+\.(png|jpg|jpeg|webp|pdf)$ - [L]
    # Block everything else in saved/
    RewriteRule ^saved/ - [F,L]
    RewriteRule ^(invoices|receipts|expenses|userdata|income|si)(/|$) - [F,L]
</IfModule>
