39 lines
1.3 KiB
PHP
39 lines
1.3 KiB
PHP
<?php
|
|
// /messages/api/delete_message.php
|
|
declare(strict_types=1);
|
|
require_once __DIR__ . '/../_bootstrap.php';
|
|
|
|
header('Content-Type: application/json; charset=utf-8');
|
|
|
|
if (!hash_equals($_SESSION['_csrf'] ?? '', $_POST['_csrf'] ?? '')) {
|
|
json_response(['error' => 'csrf'], 419);
|
|
}
|
|
|
|
$role = $GLOBALS['MESSAGES_CTX']['role']; // 'praticien' | 'client'
|
|
$meId = $GLOBALS['MESSAGES_CTX']['me_id'];
|
|
$msgId = (int)($_POST['message_id'] ?? 0);
|
|
|
|
if ($msgId <= 0) json_response(['error' => 'bad_params'], 400);
|
|
|
|
// Récupère message + conversation et vérifie l'accès
|
|
$sql = "SELECT m.id, m.conversation_id
|
|
FROM messages m
|
|
JOIN conversations c ON c.id = m.conversation_id
|
|
WHERE m.id = ?
|
|
LIMIT 1";
|
|
$stmt = $pdo->prepare($sql);
|
|
$stmt->execute([$msgId]);
|
|
$row = $stmt->fetch(PDO::FETCH_ASSOC);
|
|
|
|
if (!$row) json_response(['error' => 'not_found'], 404);
|
|
|
|
// Autorisation (est-ce que je participe à cette conversation ?)
|
|
assert_conversation_access($pdo, (int)$row['conversation_id'], $role, $meId);
|
|
|
|
// Marque “supprimé pour moi” selon le rôle
|
|
$col = ($role === 'praticien') ? 'deleted_for_praticien' : 'deleted_for_client';
|
|
$upd = $pdo->prepare("UPDATE messages SET $col = 1 WHERE id = ?");
|
|
$upd->execute([$msgId]);
|
|
|
|
json_response(['ok' => true]);
|