nexus

api/notifications.php


1<?php
2require_once __DIR__ . '/../includes/bootstrap.php';
3if (!$USER) json_out([],401);
4 
5// Mark-read requires POST + valid CSRF
6if ($_SERVER['REQUEST_METHOD']==='POST' && post('action')==='read') {
7    if (!csrf_ok()) json_out(['error'=>'Invalid CSRF'],403);
8    DB::run('UPDATE notifications SET `read`=1 WHERE user_id=?',[$USER['id']]);
9    json_out(['ok'=>true]);
10}
11// Allow GET for polling
12if (isset($_GET['action']) && $_GET['action']==='read') {
13    // Legacy GET — accept but deprecated
14    DB::run('UPDATE notifications SET `read`=1 WHERE user_id=?',[$USER['id']]);
15    json_out(['ok'=>true]);
16}
17 
18$rows = DB::rows('SELECT * FROM notifications WHERE user_id=? ORDER BY created_at DESC LIMIT 25',[$USER['id']]);
19foreach ($rows as &$r) $r['payload'] = json_decode($r['payload'],true) ?: [];
20json_out($rows);