<?php
/**
 * Password hash generator — CLI ONLY (blocked from browser access on purpose).
 *
 * Usage (SSH / cPanel Terminal):
 *   php tools/generate_password_hash.php "YourNewPassword123"
 *
 * Prints a bcrypt hash that has already been self-verified with
 * password_verify() before being shown — copy it straight into an UPDATE
 * statement:
 *
 *   UPDATE users SET password_hash = '<hash>' WHERE email = 'admin@gmail.com';
 */

if (php_sapi_name() !== 'cli') {
    http_response_code(403);
    die('This tool can only be run from the command line (SSH / cPanel Terminal), not a browser.');
}

$password = $argv[1] ?? null;

if (!$password) {
    echo "Usage: php generate_password_hash.php \"YourPassword\"\n";
    exit(1);
}

$hash = password_hash($password, PASSWORD_DEFAULT);

if (!password_verify($password, $hash)) {
    // Should never happen, but never ship an unverified hash.
    echo "ERROR: hash verification failed — do not use this output.\n";
    exit(1);
}

echo "Password:  $password\n";
echo "Hash:      $hash\n";
echo "Verified:  YES (password_verify passed)\n\n";
echo "SQL snippet:\n";
echo "UPDATE users SET password_hash = '$hash' WHERE email = 'admin@gmail.com';\n";
