Init Git Prod Mars 2026

messages/api/delete_message.php

@@ -0,0 +1,38 @@
+<?php
+// /messages/api/delete_message.php
+declare(strict_types=1);
+require_once __DIR__ . '/../_bootstrap.php';
+
+header('Content-Type: application/json; charset=utf-8');
+
+if (!hash_equals($_SESSION['_csrf'] ?? '', $_POST['_csrf'] ?? '')) {
+    json_response(['error' => 'csrf'], 419);
+}
+
+$role   = $GLOBALS['MESSAGES_CTX']['role'];   // 'praticien' | 'client'
+$meId   = $GLOBALS['MESSAGES_CTX']['me_id'];
+$msgId  = (int)($_POST['message_id'] ?? 0);
+
+if ($msgId <= 0) json_response(['error' => 'bad_params'], 400);
+
+// Récupère message + conversation et vérifie l'accès
+$sql = "SELECT m.id, m.conversation_id
+          FROM messages m
+          JOIN conversations c ON c.id = m.conversation_id
+         WHERE m.id = ?
+         LIMIT 1";
+$stmt = $pdo->prepare($sql);
+$stmt->execute([$msgId]);
+$row = $stmt->fetch(PDO::FETCH_ASSOC);
+
+if (!$row) json_response(['error' => 'not_found'], 404);
+
+// Autorisation (est-ce que je participe à cette conversation ?)
+assert_conversation_access($pdo, (int)$row['conversation_id'], $role, $meId);
+
+// Marque “supprimé pour moi” selon le rôle
+$col = ($role === 'praticien') ? 'deleted_for_praticien' : 'deleted_for_client';
+$upd = $pdo->prepare("UPDATE messages SET $col = 1 WHERE id = ?");
+$upd->execute([$msgId]);
+
+json_response(['ok' => true]);