<?php
// /messages/api/delete_message.php
declare(strict_types=1);
require_once __DIR__ . '/../_bootstrap.php';

header('Content-Type: application/json; charset=utf-8');

if (!hash_equals($_SESSION['_csrf'] ?? '', $_POST['_csrf'] ?? '')) {
    json_response(['error' => 'csrf'], 419);
}

$role   = $GLOBALS['MESSAGES_CTX']['role'];   // 'praticien' | 'client'
$meId   = $GLOBALS['MESSAGES_CTX']['me_id'];
$msgId  = (int)($_POST['message_id'] ?? 0);

if ($msgId <= 0) json_response(['error' => 'bad_params'], 400);

// Récupère message + conversation et vérifie l'accès
$sql = "SELECT m.id, m.conversation_id
          FROM messages m
          JOIN conversations c ON c.id = m.conversation_id
         WHERE m.id = ?
         LIMIT 1";
$stmt = $pdo->prepare($sql);
$stmt->execute([$msgId]);
$row = $stmt->fetch(PDO::FETCH_ASSOC);

if (!$row) json_response(['error' => 'not_found'], 404);

// Autorisation (est-ce que je participe à cette conversation ?)
assert_conversation_access($pdo, (int)$row['conversation_id'], $role, $meId);

// Marque “supprimé pour moi” selon le rôle
$col = ($role === 'praticien') ? 'deleted_for_praticien' : 'deleted_for_client';
$upd = $pdo->prepare("UPDATE messages SET $col = 1 WHERE id = ?");
$upd->execute([$msgId]);

json_response(['ok' => true]);