RewriteEngine On
RewriteBase /

# Join page routing
RewriteRule ^join/([a-zA-Z0-9]+)/?$ /join/index.php?token=$1 [QSA,L]

# API routing
RewriteRule ^api/auth/(.*)$         /api/auth/$1     [QSA,L]
RewriteRule ^api/staff/?$           /api/staff/index.php  [QSA,L]
RewriteRule ^api/attendance/?$      /api/attendance/index.php [QSA,L]
RewriteRule ^api/salary/?$          /api/salary/index.php [QSA,L]
RewriteRule ^api/expense/?$         /api/expense/index.php [QSA,L]
RewriteRule ^api/income/?$          /api/expense/index.php?entity=income [QSA,L]
RewriteRule ^api/food/?$            /api/food/index.php [QSA,L]
RewriteRule ^api/advance/?$         /api/advance/index.php [QSA,L]
RewriteRule ^api/leave/?$           /api/advance/index.php?entity=leave [QSA,L]
RewriteRule ^api/dashboard/?$       /api/dashboard/index.php [QSA,L]
RewriteRule ^api/notification/?$    /api/notification/index.php [QSA,L]
RewriteRule ^api/company/?$         /api/company/index.php [QSA,L]
RewriteRule ^api/dept/?$            /api/dept/index.php [QSA,L]
RewriteRule ^api/trade/?$           /api/dept/index.php?entity=trade [QSA,L]

# Block direct PHP access
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ index.php [QSA,L]
