<?php

const BCRYPT_COST = 12;

$user = $_SERVER['PHP_AUTH_USER'] ?? null;
$pass = $_SERVER['PHP_AUTH_PW']   ?? null;

// Fallback for CGI / FastCGI SAPIs that don't populate PHP_AUTH_*.
// Apache: add "CGIPassAuth On" (2.4.13+) or a RewriteRule to expose
// HTTP_AUTHORIZATION; nginx+php-fpm passes it through by default.
if ($user === null || $pass === null) {
    $header = $_SERVER['HTTP_AUTHORIZATION']
        ?? $_SERVER['REDIRECT_HTTP_AUTHORIZATION']
        ?? null;

    if (is_string($header) && preg_match('/^Basic\s+(.+)$/i', $header, $m) === 1) {
        $decoded = base64_decode($m[1], true);

        // Split on the FIRST colon only: passwords may contain colons.
        if ($decoded !== false && str_contains($decoded, ':')) {
            [$user, $pass] = explode(':', $decoded, 2);
        }
    }
}

if (!is_string($user) || $user === '' || !is_string($pass) || $pass === '') {
    header('WWW-Authenticate: Basic realm="Restricted", charset="UTF-8"');
    http_response_code(401);
    header('Content-Type: text/plain; charset=utf-8');
    header('Cache-Control: no-store');
    echo 'authentication required';
    exit;
}

if (strlen($pass) > 72) {
    http_response_code(422);
    header('Content-Type: text/plain; charset=utf-8');
    header('Cache-Control: no-store');
    echo 'password exceeds the 72-byte bcrypt limit';
    exit;
}

$hash = password_hash($pass, PASSWORD_BCRYPT, ['cost' => BCRYPT_COST]);

if ($hash === false) {
    http_response_code(500);
    header('Content-Type: text/plain; charset=utf-8');
    header('Cache-Control: no-store');
    echo 'hashing failed';
    exit;
}

header('Content-Type: text/plain; charset=utf-8');
header('Cache-Control: no-store, no-cache, must-revalidate');
header('Pragma: no-cache');

echo $user . ':' . $hash;