Init Git Prod Mars 2026

2026-03-05 10:25:39 +01:00
commit d81efe93b1
@@ -0,0 +1,79 @@
+<?php
+require_once __DIR__ . '/../../includes/init_praticien.php';
+header('Content-Type: application/json; charset=utf-8');
+
+function out($ok,$msg,$extra=[]){ echo json_encode(['ok'=>$ok,'message'=>$msg]+$extra); exit; }
+
+$praticien_id = (int)($_SESSION['reference_id'] ?? 0);
+$csrf = (string)($_POST['csrf'] ?? '');
+if (!hash_equals($_SESSION['cl_csrf'] ?? '', $csrf)) out(false, 'CSRF');
+
+$dossier_id = (int)($_POST['dossier_id'] ?? 0);
+if ($dossier_id<=0) out(false, 'Bad dossier');
+
+// Owner
+$st = $pdo->prepare("SELECT d.id, d.client_id FROM client_dossiers d WHERE d.id=:d AND d.praticien_id=:p AND d.archived_at IS NULL");
+$st->execute([':d'=>$dossier_id, ':p'=>$praticien_id]);
+$dos = $st->fetch(PDO::FETCH_ASSOC);
+if(!$dos) out(false, 'Not allowed');
+
+$date_rdv = (string)($_POST['date_rdv'] ?? '');
+$type_rdv = (string)($_POST['type_rdv'] ?? 'autre');
+$titre    = trim((string)($_POST['titre'] ?? ''));
+$notes    = trim((string)($_POST['notes'] ?? ''));
+$prochaine= trim((string)($_POST['prochaine_action'] ?? ''));
+$duree    = (int)($_POST['duree_minutes'] ?? 0);
+
+if ($titre==='' || $notes==='') out(false, 'Champs requis');
+
+try{
+  $pdo->beginTransaction();
+  $ins = $pdo->prepare("INSERT INTO client_suivi (dossier_id, rdv_id, date_rdv, type_rdv, titre, notes, prochaine_action, duree_minutes, prive)
+                        VALUES (:d, NULL, :dt, :ty, :ti, :no, :pa, :du, 1)");
+  $ins->execute([
+    ':d'=>$dossier_id,
+    ':dt'=> (new DateTime($date_rdv ?: 'now'))->format('Y-m-d H:i:s'),
+    ':ty'=> in_array($type_rdv,['online','cabinet','tel','autre'],true) ? $type_rdv : 'autre',
+    ':ti'=> $titre,
+    ':no'=> $notes,
+    ':pa'=> ($prochaine !== '' ? $prochaine : null),
+    ':du'=> ($duree > 0 ? $duree : null),
+  ]);
+  $entry_id = (int)$pdo->lastInsertId();
+
+  // Upload files
+  if (!empty($_FILES['files']) && is_array($_FILES['files']['name'])) {
+    $baseDir = $_SERVER['DOCUMENT_ROOT'].'/uploads/suivi/'. $dossier_id;
+    if (!is_dir($baseDir)) @mkdir($baseDir, 0775, true);
+
+    $allowed = ['pdf','jpg','jpeg','png','doc','docx','txt'];
+    for($i=0;$i<count($_FILES['files']['name']);$i++){
+      $err = (int)($_FILES['files']['error'][$i] ?? UPLOAD_ERR_NO_FILE);
+      if ($err !== UPLOAD_ERR_OK) continue;
+      $name = (string)($_FILES['files']['name'][$i] ?? '');
+      $tmp  = (string)($_FILES['files']['tmp_name'][$i] ?? '');
+      $size = (int)($_FILES['files']['size'][$i] ?? 0);
+      if ($size <= 0 || $size > 8*1024*1024) continue; // 8 Mo
+      $ext = strtolower(pathinfo($name, PATHINFO_EXTENSION));
+      if (!in_array($ext,$allowed,true)) continue;
+
+      $clean = preg_replace('~[^a-zA-Z0-9._-]+~','_', $name);
+      $new   = $dossier_id.'_'.time().'_'.bin2hex(random_bytes(4)).'.'.$ext;
+      $dest  = $baseDir.'/'.$new;
+      if (@move_uploaded_file($tmp, $dest)) {
+        $rel = '/uploads/suivi/'.$dossier_id.'/'.$new;
+        $mime= mime_content_type($dest) ?: null;
+
+        $pdo->prepare("INSERT INTO client_suivi_files (entry_id, path, mime, size_bytes) VALUES (:e,:p,:m,:s)")
+            ->execute([':e'=>$entry_id, ':p'=>$rel, ':m'=>$mime, ':s'=>$size]);
+      }
+    }
+  }
+
+  $pdo->commit();
+  out(true, $translations['cl_enregistre_ok'] ?? 'Note enregistrée.');
+}catch(Throwable $e){
+  if ($pdo->inTransaction()) $pdo->rollBack();
+  error_log('ajax_ajouter_note: '.$e->getMessage());
+  out(false, $translations['cl_enregistre_ko'] ?? 'Erreur lors de l’enregistrement.');
+}