nexus

 <?php
 /**
  * Live chat API for private messages.
  * Actions: send, poll, delete, conversations
  */
 require_once __DIR__ . '/../includes/bootstrap.php';
 must_login();
 if (!csrf_ok()) json_out(['error' => 'CSRF'], 403);
 
 $action = post('action');
 $uid    = (int)$USER['id'];
 
 /* ── Helper: build conversation_id ───────────────────── */
 function conv_id(int $a, int $b): string {
     return min($a,$b) . '-' . max($a,$b);
 }
 
 /* ── Send a message ──────────────────────────────────── */
 if ($action === 'send') {
     $toId   = (int)post('to_id');
     $body   = sanitise(post('body'));
 
     if (!$toId || $toId === $uid) json_out(['error' => 'Invalid recipient'], 400);
     if (!$body)                   json_out(['error' => 'Message is empty'], 400);
     if (mb_strlen($body) > 2000)  json_out(['error' => 'Message too long (max 2000)'], 400);
 
     $other = DB::row('SELECT id,username FROM users WHERE id=? AND suspended=0', [$toId]);
     if (!$other) json_out(['error' => 'User not found'], 404);
 
     $convId = conv_id($uid, $toId);
 
     $msgId = DB::insert(
         'INSERT INTO messages (sender_id,receiver_id,subject,body,conversation_id) VALUES (?,?,?,?,?)',
         [$uid, $toId, '', $body, $convId]
     );
 
     // Notify recipient
     add_notification($toId, 'message', [
         'from'    => $USER['username'],
         'from_id' => $uid,
         'subject' => mb_substr($body, 0, 60) . (mb_strlen($body) > 60 ? '…' : ''),
     ]);
 
     // Return the new message row for live append
     $msg = DB::row(
         'SELECT m.*, u.username AS sender_name, u.avatar AS sender_av
          FROM messages m JOIN users u ON u.id=m.sender_id
          WHERE m.id=?', [$msgId]
     );
     json_out(['ok' => true, 'message' => $msg]);
 }
 
 /* ── Poll: fetch new messages since a given id ───────── */
 if ($action === 'poll') {
     $otherId  = (int)post('other_id');
     $sinceId  = (int)post('since_id');
     if (!$otherId) json_out(['error' => 'Missing other_id'], 400);
 
     $convId = conv_id($uid, $otherId);
     $msgs   = DB::rows(
         'SELECT m.*, u.username AS sender_name, u.avatar AS sender_av
          FROM messages m JOIN users u ON u.id=m.sender_id
          WHERE m.conversation_id=? AND m.id>?
          ORDER BY m.id ASC LIMIT 50',
         [$convId, $sinceId]
     );
 
     // Mark messages from other user as read
     if ($msgs) {
         $now = DB::now();
         DB::run(
             "UPDATE messages SET is_read=1
              WHERE conversation_id=? AND receiver_id=? AND `is_read`=0",
             [$convId, $uid]
         );
     }
 
     json_out(['ok' => true, 'messages' => $msgs]);
 }
 
 /* ── Load full conversation ──────────────────────────── */
 if ($action === 'load') {
     $otherId = (int)post('other_id');
     $before  = (int)post('before_id'); // for pagination
     if (!$otherId) json_out(['error' => 'Missing other_id'], 400);
 
     $convId = conv_id($uid, $otherId);
     $params = [$convId];
     $where  = '';
     if ($before) {
         $where   = ' AND m.id < ?';
         $params[] = $before;
     }
 
     $msgs = DB::rows(
         "SELECT m.*, u.username AS sender_name, u.avatar AS sender_av
          FROM messages m JOIN users u ON u.id=m.sender_id
          WHERE m.conversation_id=? $where
          ORDER BY m.id DESC LIMIT 40",
         $params
     );
     $msgs = array_reverse($msgs); // oldest first
 
     // Mark as read
     DB::run(
         "UPDATE messages SET `is_read`=1
          WHERE conversation_id=? AND receiver_id=? AND `is_read`=0",
         [$convId, $uid]
     );
 
     $other = DB::row('SELECT id,username,avatar,role,karma,last_seen FROM users WHERE id=?', [$otherId]);
     json_out(['ok' => true, 'messages' => $msgs, 'other' => $other]);
 }
 
 /* ── List conversations ──────────────────────────────── */
 if ($action === 'conversations') {
     $convs = DB::rows(
         "SELECT m.*,
                 u.username AS other_name, u.avatar AS other_av,
                 (SELECT COUNT(*) FROM messages m2
                  WHERE m2.conversation_id=m.conversation_id
                    AND m2.receiver_id=? AND m2.is_read=0) AS unread_count
          FROM messages m
          JOIN users u ON u.id = CASE WHEN m.sender_id=? THEN m.receiver_id ELSE m.sender_id END
          WHERE m.conversation_id IN (
              SELECT conversation_id FROM messages
              WHERE sender_id=? OR receiver_id=?
          )
          AND m.id IN (
              SELECT MAX(id) FROM messages
              WHERE sender_id=? OR receiver_id=?
              GROUP BY conversation_id
          )
          ORDER BY m.created_at DESC",
         [$uid, $uid, $uid, $uid, $uid, $uid]
     );
     json_out(['ok' => true, 'conversations' => $convs]);
 }
 
 /* ── Delete a message ────────────────────────────────── */
 if ($action === 'delete') {
     $msgId = (int)post('msg_id');
     $msg   = DB::row('SELECT * FROM messages WHERE id=?', [$msgId]);
     if (!$msg) json_out(['error' => 'Not found'], 404);
     if ($msg['sender_id'] !== $uid && $msg['receiver_id'] !== $uid) json_out(['error' => 'Forbidden'], 403);
 
     if ($msg['sender_id'] === $uid)
         DB::run('UPDATE messages SET deleted_by_sender=1 WHERE id=?', [$msgId]);
     else
         DB::run('UPDATE messages SET deleted_by_receiver=1 WHERE id=?', [$msgId]);
 
     json_out(['ok' => true]);
 }
 
 json_out(['error' => 'Unknown action'], 400);