SWAMPy

✎ CARVE FLESH

EDITING: inquiries.php

<?php
// api/admin/inquiries.php
// GET           → Inquiry[]     (list all, newest first)
// GET ?id=      → Inquiry       (single)
// PATCH         → Inquiry       (update status only)
// DELETE        → { message }   (delete)
//
// Note: Inquiries are CREATED by the public contact form (separate endpoint).
//       The admin can only read, update status and delete.

declare(strict_types=1);

require_once __DIR__ . '/cors.php';
require_once __DIR__ . '/db.php';
require_once __DIR__ . '/auth_middleware.php';

require_auth();

$method = $_SERVER['REQUEST_METHOD'];
$pdo    = db();

// ── Helpers ───────────────────────────────────────────────────────────────────

function format_inquiry(array $row): array {
    return [
        'id'            => $row['id'],
        'name'          => $row['name'],
        'email'         => $row['email'],
        'phone'         => $row['phone'],
        'service'       => $row['service'],
        'message'       => $row['message'],
        'status'        => $row['status'],
        'propertyId'    => $row['property_id']    ?? null,
        'propertyTitle' => $row['property_title'] ?? null,
        'createdAt'     => $row['created_at'],
    ];
}

$allowed_statuses = ['New', 'In Progress', 'Completed', 'Archived'];

// ── GET ───────────────────────────────────────────────────────────────────────

if ($method === 'GET') {
    if (!empty($_GET['id'])) {
        $stmt = $pdo->prepare('SELECT * FROM inquiries WHERE id = ? LIMIT 1');
        $stmt->execute([$_GET['id']]);
        $row = $stmt->fetch();
        if (!$row) abort(404, 'Inquiry not found');
        json_out(format_inquiry($row));
    }

if (!empty($_GET['property_id'])) {
        $stmt = $pdo->prepare('SELECT * FROM inquiries WHERE property_id = ? ORDER BY created_at DESC');
        $stmt->execute([$_GET['property_id']]);
    } else {
        $stmt = $pdo->query('SELECT * FROM inquiries ORDER BY created_at DESC');
    }
    json_out(array_map('format_inquiry', $stmt->fetchAll()));
}

// ── PATCH (update status) ─────────────────────────────────────────────────────

if ($method === 'PATCH') {
    $data   = body();
    $id     = trim((string)($data['id']     ?? ''));
    $status = trim((string)($data['status'] ?? ''));

if ($id === '' || $status === '') abort(400, 'id and status are required');
    if (!in_array($status, $allowed_statuses, true)) abort(422, 'Invalid status value');

$stmt = $pdo->prepare('SELECT id FROM inquiries WHERE id = ? LIMIT 1');
    $stmt->execute([$id]);
    if (!$stmt->fetch()) abort(404, 'Inquiry not found');

$pdo->prepare('UPDATE inquiries SET status = ? WHERE id = ?')
        ->execute([$status, $id]);

$row = $pdo->prepare('SELECT * FROM inquiries WHERE id = ? LIMIT 1');
    $row->execute([$id]);
    json_out(format_inquiry($row->fetch()));
}

// ── DELETE ────────────────────────────────────────────────────────────────────

if ($method === 'DELETE') {
    $data = body();
    $id   = trim((string)($data['id'] ?? ''));
    if ($id === '') abort(400, 'id is required');

$stmt = $pdo->prepare('SELECT id FROM inquiries WHERE id = ? LIMIT 1');
    $stmt->execute([$id]);
    if (!$stmt->fetch()) abort(404, 'Inquiry not found');

$pdo->prepare('DELETE FROM inquiries WHERE id = ?')->execute([$id]);
    json_out(['message' => 'Inquiry deleted']);
}

abort(405, 'Method not allowed');

CANCEL

Name	Type	Size	Modified	Actions
↩ ..	DIR	—	—
📁 admin/	DIR	—	2026-10-23 13:41
📁 public/	DIR	—	2020-01-24 02:16
📄 .htaccess	HTACCESS	180 B	2026-10-23 13:34	EDIT
📄 contact.php	PHP	3.4 KB	2026-05-16 15:10	EDIT
📄 error_log	?	11.3 KB	2026-08-16 17:12	EDIT
📄 inquiries.php	PHP	3.8 KB	2026-05-16 20:25	EDIT
📄 properties.php	PHP	1.8 KB	2026-05-16 18:48	EDIT
📄 property-inquiries.php	PHP	3.9 KB	2026-06-30 13:55	EDIT