Init Git Prod Mars 2026

public/praticien/clients/ajax_supprimer_dossier.php

@@ -0,0 +1,70 @@
+<?php
+require_once __DIR__ . '/../../includes/init_praticien.php';
+header('Content-Type: application/json; charset=utf-8');
+
+function out($ok,$msg,$extra=[]){ echo json_encode(['ok'=>$ok,'message'=>$msg]+$extra); exit; }
+if (($_SERVER['REQUEST_METHOD'] ?? '') !== 'POST') out(false,'Méthode invalide');
+
+$praticien_id = (int)($_SESSION['reference_id'] ?? 0);
+$csrf = (string)($_POST['csrf'] ?? '');
+if (!$praticien_id || !hash_equals($_SESSION['cl_csrf'] ?? '', $csrf)) out(false,'CSRF/Unauthorized');
+
+$dossier_id = (int)($_POST['dossier_id'] ?? 0);
+if ($dossier_id <= 0) out(false,'Requête invalide');
+
+// Vérif propriété du dossier
+$own = $pdo->prepare("SELECT 1 FROM client_dossiers WHERE id=:d AND praticien_id=:p AND archived_at IS NULL");
+$own->execute([':d'=>$dossier_id, ':p'=>$praticien_id]);
+if (!$own->fetchColumn()) out(false,'Accès refusé');
+
+try{
+  // Récupérer chemins des fichiers pour suppression disque après commit
+  $filePaths = [];
+  $sf = $pdo->prepare("SELECT f.path
+                       FROM client_suivi_files f
+                       JOIN client_suivi s ON s.id=f.entry_id
+                       WHERE s.dossier_id=:d");
+  $sf->execute([':d'=>$dossier_id]);
+  while($r = $sf->fetch(PDO::FETCH_ASSOC)){
+    $filePaths[] = (string)$r['path'];
+  }
+
+  // Récup IDs des notes
+  $noteIds = [];
+  $sn = $pdo->prepare("SELECT id FROM client_suivi WHERE dossier_id=:d");
+  $sn->execute([':d'=>$dossier_id]);
+  while($r = $sn->fetch(PDO::FETCH_ASSOC)){
+    $noteIds[] = (int)$r['id'];
+  }
+
+  $pdo->beginTransaction();
+
+  if ($noteIds) {
+    $ph = implode(',', array_fill(0, count($noteIds), '?'));
+    $delF = $pdo->prepare("DELETE FROM client_suivi_files WHERE entry_id IN ($ph)");
+    $delF->execute($noteIds);
+
+    $delN = $pdo->prepare("DELETE FROM client_suivi WHERE id IN ($ph)");
+    $delN->execute($noteIds);
+  }
+
+  $delD = $pdo->prepare("DELETE FROM client_dossiers WHERE id=:d");
+  $delD->execute([':d'=>$dossier_id]);
+
+  $pdo->commit();
+
+  // Suppression physique (best-effort)
+  $root = rtrim((string)$_SERVER['DOCUMENT_ROOT'],'/');
+  foreach ($filePaths as $rel) {
+    $abs = $root.$rel;
+    if (is_file($abs)) @unlink($abs);
+  }
+
+  out(true,'Dossier supprimé');
+
+}catch(Throwable $e){
+  if ($pdo->inTransaction()) $pdo->rollBack();
+  error_log('ajax_supprimer_dossier: '.$e->getMessage());
+  out(false,'Erreur serveur');
+}
+