RewriteEngine On
DirectoryIndex index.php

# Hide .php from public student-facing page URLs.
# API/admin/cron endpoints are intentionally left untouched to protect POST/AJAX behaviour.
RewriteCond %{THE_REQUEST} \s/+student/index\.php(?:[?\s]) [NC]
RewriteRule ^index\.php$ ./ [R=302,L,NE]

RewriteCond %{THE_REQUEST} \s/+student/([A-Za-z0-9_-]+)\.php(?:[?\s]) [NC]
RewriteRule ^([A-Za-z0-9_-]+)\.php$ $1 [R=302,L,NE]

# Internally map /student/dashboard -> /student/dashboard.php, etc.
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME}.php -f
RewriteRule ^([A-Za-z0-9_-]+)/?$ $1.php [L,QSA]
