nexus

api/friend.php


1<?php
2require_once __DIR__ . '/../includes/bootstrap.php';
3if (!$USER) json_out(['error'=>'Not logged in'],401);
4if (!csrf_ok()) json_out(['error'=>'CSRF'],403);
5 
6$action   = sanitise(post('action'));
7$targetId = (int)post('target_id');
8if (!$targetId || $targetId === $USER['id']) json_out(['error'=>'Invalid target'],400);
9 
10$target = DB::row('SELECT id,username FROM users WHERE id=?',[$targetId]);
11if (!$target) json_out(['error'=>'User not found'],404);
12 
13$uid = (int)$USER['id'];
14 
15switch ($action) {
16    case 'send':
17        // Send friend request
18        $existing = DB::row('SELECT * FROM friends WHERE (user_id=? AND friend_id=?) OR (user_id=? AND friend_id=?)',
19            [$uid,$targetId,$targetId,$uid]);
20        if ($existing) json_out(['error'=>'Request already exists'],400);
21        DB::insert('INSERT INTO friends (user_id,friend_id,status) VALUES (?,?,\'pending\')',[$uid,$targetId]);
22        add_notification($targetId,'friend_request',[
23            'from'=>$USER['username'],'from_id'=>$uid
24        ]);
25        json_out(['ok'=>true,'msg'=>'Friend request sent!']);
26        break;
27 
28    case 'cancel':
29        // Cancel outgoing request
30        DB::run('DELETE FROM friends WHERE user_id=? AND friend_id=? AND status=\'pending\'',[$uid,$targetId]);
31        json_out(['ok'=>true,'msg'=>'Request cancelled.']);
32        break;
33 
34    case 'accept':
35        // Accept incoming request
36        $req = DB::row('SELECT * FROM friends WHERE user_id=? AND friend_id=? AND status=\'pending\'',[$targetId,$uid]);
37        if (!$req) json_out(['error'=>'No pending request found'],404);
38        DB::run("UPDATE friends SET status='accepted' WHERE id=?",[$req['id']]);
39        add_notification($targetId,'friend_accepted',[
40            'from'=>$USER['username'],'from_id'=>$uid
41        ]);
42        json_out(['ok'=>true,'msg'=>'Friend request accepted!']);
43        break;
44 
45    case 'decline':
46        // Decline incoming request
47        DB::run('DELETE FROM friends WHERE user_id=? AND friend_id=? AND status=\'pending\'',[$targetId,$uid]);
48        json_out(['ok'=>true,'msg'=>'Request declined.']);
49        break;
50 
51    case 'remove':
52        // Remove existing friendship
53        DB::run('DELETE FROM friends WHERE (user_id=? AND friend_id=?) OR (user_id=? AND friend_id=?)',
54            [$uid,$targetId,$targetId,$uid]);
55        json_out(['ok'=>true,'msg'=>'Friend removed.']);
56        break;
57 
58    default:
59        json_out(['error'=>'Unknown action'],400);
60}