# See https://www.robotstxt.org/robotstxt.html for documentation on how to use the robots.txt file
#
# NOTE: robots.txt only stops well-behaved crawlers from fetching these paths.
# It is not access control — every path below is (and must stay) protected by
# authentication or a signed token in the app itself.

User-agent: *

# Admin — all admin UIs, including the WPS Pages page/media builder
# (/admin/media, /admin/pages) and WPS Mailer (/admin/mailer).
Disallow: /admin
Disallow: /admin/

# Madmin + operational dashboards (Mission Control jobs, Sidekiq, Flipper)
Disallow: /system
Disallow: /system/

# Token-addressed public order pages: order details, funding approve/deny,
# customer cancellation. Unguessable, but must never be crawled or indexed.
Disallow: /orders/

# Token-addressed waitlist invitation confirmation
Disallow: /waitlist/

# Signed-in customer / support coordinator / parent-caregiver portals
Disallow: /users/
Disallow: /user/
Disallow: /account/
Disallow: /accounts/
Disallow: /agreements
Disallow: /notifications
Disallow: /sudo

# Billing, checkout and cart flows
Disallow: /billing
Disallow: /billing/
Disallow: /checkout
Disallow: /checkout/
Disallow: /cart
Disallow: /cart/

# Booking / waitlist funnels hanging off public event pages.
# The event pages themselves stay crawlable.
Disallow: /events/*/bookings
Disallow: /events/*/waitlist_entries

# APIs, tokens and webhooks
Disallow: /api/
Disallow: /api_tokens
Disallow: /webhooks/
Disallow: /action_text/

# Internal lookups and legacy redirects into private areas
Disallow: /plan-managers/
Disallow: /plan_manager/

# Rails internals, Active Storage blobs, health check, error pages
Disallow: /rails/
Disallow: /up
Disallow: /404
Disallow: /500

# Dev-only engines (never mounted in production, blocked as a safety net)
Disallow: /jumpstart
Disallow: /mailbin

Sitemap: https://johnnyh.com.au/sitemap.xml