1<?php
2require_once __DIR__ . '/../includes/bootstrap.php';
3if (!$USER) json_out(['error'=>'Not logged in'],401);
4if (!csrf_ok()) json_out(['error'=>'CSRF'],403);
5$pid = (int)post('post_id');
6$post = DB::row('SELECT * FROM posts WHERE id=?',[$pid]);
7if (!$post) json_out(['error'=>'Not found'],404);
8if ($post['user_id']!==$USER['id'] && !is_admin()) json_out(['error'=>'Forbidden'],403);
9DB::run('UPDATE posts SET deleted=1 WHERE id=?',[$pid]);
10json_out(['ok'=>true]);