nexus

api/notifications.php

<?php
require_once __DIR__ . '/../includes/bootstrap.php';
if (!$USER) json_out([],401);

// Mark-read requires POST + valid CSRF
if ($_SERVER['REQUEST_METHOD']==='POST' && post('action')==='read') {
    if (!csrf_ok()) json_out(['error'=>'Invalid CSRF'],403);
    DB::run('UPDATE notifications SET `read`=1 WHERE user_id=?',[$USER['id']]);
    json_out(['ok'=>true]);
}
// Allow GET for polling
if (isset($_GET['action']) && $_GET['action']==='read') {
    // Legacy GET — accept but deprecated
    DB::run('UPDATE notifications SET `read`=1 WHERE user_id=?',[$USER['id']]);
    json_out(['ok'=>true]);
}

$rows = DB::rows('SELECT * FROM notifications WHERE user_id=? ORDER BY created_at DESC LIMIT 25',[$USER['id']]);
foreach ($rows as &$r) $r['payload'] = json_decode($r['payload'],true) ?: [];
json_out($rows);

1 <?php
2 require_once __DIR__ . '/../includes/bootstrap.php';
3 if (!$USER) json_out([],401);
4 
5 // Mark-read requires POST + valid CSRF
6 if ($_SERVER['REQUEST_METHOD']==='POST' && post('action')==='read') {
7     if (!csrf_ok()) json_out(['error'=>'Invalid CSRF'],403);
8     DB::run('UPDATE notifications SET `read`=1 WHERE user_id=?',[$USER['id']]);
9     json_out(['ok'=>true]);
10 }
11 // Allow GET for polling
12 if (isset($_GET['action']) && $_GET['action']==='read') {
13     // Legacy GET — accept but deprecated
14     DB::run('UPDATE notifications SET `read`=1 WHERE user_id=?',[$USER['id']]);
15     json_out(['ok'=>true]);
16 }
17 
18 $rows = DB::rows('SELECT * FROM notifications WHERE user_id=? ORDER BY created_at DESC LIMIT 25',[$USER['id']]);
19 foreach ($rows as &$r) $r['payload'] = json_decode($r['payload'],true) ?: [];
20 json_out($rows);