nexus

api/friend.php

<?php
require_once __DIR__ . '/../includes/bootstrap.php';
if (!$USER) json_out(['error'=>'Not logged in'],401);
if (!csrf_ok()) json_out(['error'=>'CSRF'],403);

$action   = sanitise(post('action'));
$targetId = (int)post('target_id');
if (!$targetId || $targetId === $USER['id']) json_out(['error'=>'Invalid target'],400);

$target = DB::row('SELECT id,username FROM users WHERE id=?',[$targetId]);
if (!$target) json_out(['error'=>'User not found'],404);

$uid = (int)$USER['id'];

switch ($action) {
    case 'send':
        // Send friend request
        $existing = DB::row('SELECT * FROM friends WHERE (user_id=? AND friend_id=?) OR (user_id=? AND friend_id=?)',
            [$uid,$targetId,$targetId,$uid]);
        if ($existing) json_out(['error'=>'Request already exists'],400);
        DB::insert('INSERT INTO friends (user_id,friend_id,status) VALUES (?,?,\'pending\')',[$uid,$targetId]);
        add_notification($targetId,'friend_request',[
            'from'=>$USER['username'],'from_id'=>$uid
        ]);
        json_out(['ok'=>true,'msg'=>'Friend request sent!']);
        break;

    case 'cancel':
        // Cancel outgoing request
        DB::run('DELETE FROM friends WHERE user_id=? AND friend_id=? AND status=\'pending\'',[$uid,$targetId]);
        json_out(['ok'=>true,'msg'=>'Request cancelled.']);
        break;

    case 'accept':
        // Accept incoming request
        $req = DB::row('SELECT * FROM friends WHERE user_id=? AND friend_id=? AND status=\'pending\'',[$targetId,$uid]);
        if (!$req) json_out(['error'=>'No pending request found'],404);
        DB::run("UPDATE friends SET status='accepted' WHERE id=?",[$req['id']]);
        add_notification($targetId,'friend_accepted',[
            'from'=>$USER['username'],'from_id'=>$uid
        ]);
        json_out(['ok'=>true,'msg'=>'Friend request accepted!']);
        break;

    case 'decline':
        // Decline incoming request
        DB::run('DELETE FROM friends WHERE user_id=? AND friend_id=? AND status=\'pending\'',[$targetId,$uid]);
        json_out(['ok'=>true,'msg'=>'Request declined.']);
        break;

    case 'remove':
        // Remove existing friendship
        DB::run('DELETE FROM friends WHERE (user_id=? AND friend_id=?) OR (user_id=? AND friend_id=?)',
            [$uid,$targetId,$targetId,$uid]);
        json_out(['ok'=>true,'msg'=>'Friend removed.']);
        break;

    default:
        json_out(['error'=>'Unknown action'],400);
}

1 <?php
2 require_once __DIR__ . '/../includes/bootstrap.php';
3 if (!$USER) json_out(['error'=>'Not logged in'],401);
4 if (!csrf_ok()) json_out(['error'=>'CSRF'],403);
5 
6 $action   = sanitise(post('action'));
7 $targetId = (int)post('target_id');
8 if (!$targetId || $targetId === $USER['id']) json_out(['error'=>'Invalid target'],400);
9 
10 $target = DB::row('SELECT id,username FROM users WHERE id=?',[$targetId]);
11 if (!$target) json_out(['error'=>'User not found'],404);
12 
13 $uid = (int)$USER['id'];
14 
15 switch ($action) {
16     case 'send':
17         // Send friend request
18         $existing = DB::row('SELECT * FROM friends WHERE (user_id=? AND friend_id=?) OR (user_id=? AND friend_id=?)',
19             [$uid,$targetId,$targetId,$uid]);
20         if ($existing) json_out(['error'=>'Request already exists'],400);
21         DB::insert('INSERT INTO friends (user_id,friend_id,status) VALUES (?,?,\'pending\')',[$uid,$targetId]);
22         add_notification($targetId,'friend_request',[
23             'from'=>$USER['username'],'from_id'=>$uid
24         ]);
25         json_out(['ok'=>true,'msg'=>'Friend request sent!']);
26         break;
27 
28     case 'cancel':
29         // Cancel outgoing request
30         DB::run('DELETE FROM friends WHERE user_id=? AND friend_id=? AND status=\'pending\'',[$uid,$targetId]);
31         json_out(['ok'=>true,'msg'=>'Request cancelled.']);
32         break;
33 
34     case 'accept':
35         // Accept incoming request
36         $req = DB::row('SELECT * FROM friends WHERE user_id=? AND friend_id=? AND status=\'pending\'',[$targetId,$uid]);
37         if (!$req) json_out(['error'=>'No pending request found'],404);
38         DB::run("UPDATE friends SET status='accepted' WHERE id=?",[$req['id']]);
39         add_notification($targetId,'friend_accepted',[
40             'from'=>$USER['username'],'from_id'=>$uid
41         ]);
42         json_out(['ok'=>true,'msg'=>'Friend request accepted!']);
43         break;
44 
45     case 'decline':
46         // Decline incoming request
47         DB::run('DELETE FROM friends WHERE user_id=? AND friend_id=? AND status=\'pending\'',[$targetId,$uid]);
48         json_out(['ok'=>true,'msg'=>'Request declined.']);
49         break;
50 
51     case 'remove':
52         // Remove existing friendship
53         DB::run('DELETE FROM friends WHERE (user_id=? AND friend_id=?) OR (user_id=? AND friend_id=?)',
54             [$uid,$targetId,$targetId,$uid]);
55         json_out(['ok'=>true,'msg'=>'Friend removed.']);
56         break;
57 
58     default:
59         json_out(['error'=>'Unknown action'],400);
60 }