#!/usr/bin/env bash
# MS WORK GPS AUDIT — install private bcrypt hash; no secrets in command history.
set -euo pipefail
if [[ $EUID -ne 0 ]]; then echo 'Uruchom jako root.' >&2; exit 1; fi
install -d -o root -g www-data -m 0750 /etc/mswork
printf 'Wpisz WCZEŚNIEJ WYBRANE hasło serwisowe (nie PIN): ' >&2
IFS= read -r -s password
printf '\n' >&2
if [[ ${#password} -lt 12 ]]; then echo 'Hasło musi mieć minimum 12 znaków.' >&2; unset password; exit 1; fi
# Hash generation receives password on stdin, not as a command argument.
# Write atomically; never print the hash to terminal.
tmp=$(mktemp /etc/mswork/.gps_hash.XXXXXX)
trap 'rm -f "$tmp"' EXIT
printf '%s' "$password" | php -r '$p=stream_get_contents(STDIN); if ($p === "") exit(2); echo password_hash($p, PASSWORD_BCRYPT), PHP_EOL;' > "$tmp"
unset password
chown root:www-data "$tmp"
chmod 0640 "$tmp"
mv -f "$tmp" /etc/mswork/gps_service_password.hash
trap - EXIT
echo 'PASS: zapisano prywatny hash /etc/mswork/gps_service_password.hash'