nexus

api/karma.php


1<?php
2require_once __DIR__ . '/../includes/bootstrap.php';
3must_admin();
4if (!csrf_ok()) json_out(['error' => 'CSRF'], 403);
5 
6$uid    = (int)post('user_id');
7$action = post('action'); // set | add | subtract
8$amount = (int)post('amount');
9$reason = sanitise(post('reason'));
10 
11if (!$uid)                              json_out(['error' => 'Invalid user'],    400);
12if (!in_array($action, ['set','add','subtract'])) json_out(['error' => 'Invalid action'], 400);
13if ($amount < 0)                        json_out(['error' => 'Amount must be >= 0'], 400);
14if ($amount > 999999)                   json_out(['error' => 'Amount too large'], 400);
15 
16$user = DB::row('SELECT id, username, karma FROM users WHERE id=?', [$uid]);
17if (!$user) json_out(['error' => 'User not found'], 404);
18 
19$old = (int)$user['karma'];
20 
21switch ($action) {
22    case 'set':
23        $new = $amount;
24        DB::run('UPDATE users SET karma=? WHERE id=?', [$new, $uid]);
25        break;
26    case 'add':
27        DB::run('UPDATE users SET karma=karma+? WHERE id=?', [$amount, $uid]);
28        $new = $old + $amount;
29        break;
30    case 'subtract':
31        $new = max(0, $old - $amount);
32        DB::run('UPDATE users SET karma=? WHERE id=?', [$new, $uid]);
33        break;
34}
35 
36// Add an audit notification to the user
37if ($reason) {
38    add_notification($uid, 'karma_admin', [
39        'from'   => $USER['username'],
40        'change' => ($new - $old),
41        'new'    => $new,
42        'reason' => $reason,
43    ]);
44}
45 
46json_out(['ok' => true, 'old' => $old, 'new' => $new, 'username' => $user['username']]);