SWAMPy

✎ CARVE FLESH

EDITING: index.php

<?php
declare(strict_types=1);

require dirname(__DIR__) . '/src/bootstrap.php';
require dirname(__DIR__) . '/src/Response.php';
require dirname(__DIR__) . '/src/Database.php';
require dirname(__DIR__) . '/src/Auth.php';

use KimahApi\Auth;
use KimahApi\Database;
use KimahApi\Response;
use function KimahApi\boot;
use function KimahApi\env;
use function KimahApi\jsonInput;
use function KimahApi\requireFields;

boot();
$pdo = Database::connection();
$method = $_SERVER['REQUEST_METHOD'] ?? 'GET';
$path = parse_url($_SERVER['REQUEST_URI'] ?? '/', PHP_URL_PATH) ?: '/';
$path = preg_replace('#^/api#', '', $path) ?: '/';

if ($path === '/health' && $method === 'GET') Response::json(['ok' => true, 'service' => 'kimah-content-api']);

if ($path === '/auth/login' && $method === 'POST') {
    $data = jsonInput();
    requireFields($data, ['email', 'password']);
    Auth::login((string) $data['email'], (string) $data['password']);
    Response::json(['user' => Auth::user(), 'csrf_token' => $_SESSION['csrf_token']]);
}
if ($path === '/auth/logout' && $method === 'POST') {
    Auth::requireAdmin(); Auth::logout(); Response::json(['ok' => true]);
}
if ($path === '/auth/me' && $method === 'GET') {
    $user = Auth::user();
    if (!$user) Response::json(['error' => 'Authentication required'], 401);
    Response::json(['user' => $user, 'csrf_token' => $_SESSION['csrf_token'] ?? null]);
}

if ($path === '/public/listings' && $method === 'GET') {
    $stmt = $pdo->query("SELECT l.*, (SELECT image_url FROM listing_images i WHERE i.listing_id=l.id ORDER BY i.sort_order, i.id LIMIT 1) AS image_url FROM listings l WHERE l.status IN ('for_sale','for_lease','investment') AND l.published_at IS NOT NULL ORDER BY l.is_featured DESC, l.sort_order, l.updated_at DESC");
    Response::json(['data' => $stmt->fetchAll()]);
}
if (preg_match('#^/public/listings/([a-z0-9-]+)$#', $path, $m) && $method === 'GET') {
    $stmt = $pdo->prepare("SELECT * FROM listings WHERE slug=? AND status IN ('for_sale','for_lease','investment') AND published_at IS NOT NULL LIMIT 1");
    $stmt->execute([$m[1]]); $listing = $stmt->fetch();
    if (!$listing) Response::notFound();
    $images = $pdo->prepare('SELECT * FROM listing_images WHERE listing_id=? ORDER BY sort_order,id'); $images->execute([$listing['id']]);
    $listing['images'] = $images->fetchAll(); Response::json(['data' => $listing]);
}
if ($path === '/public/testimonials' && $method === 'GET') {
    $stmt = $pdo->query("SELECT * FROM testimonials WHERE status='approved' AND consent_to_publish=1 AND published_at IS NOT NULL ORDER BY sort_order, published_at DESC");
    Response::json(['data' => $stmt->fetchAll()]);
}
if ($path === '/public/testimonials' && $method === 'POST') {
    $data = jsonInput(); requireFields($data, ['client_name', 'body']);
    $stmt = $pdo->prepare("INSERT INTO testimonials (client_name,client_type,city,body,rating,consent_to_publish,status) VALUES (?,?,?,?,?,?, 'pending')");
    $stmt->execute([trim($data['client_name']), $data['client_type'] ?? null, $data['city'] ?? null, trim($data['body']), max(1, min(5, (int) ($data['rating'] ?? 5))), !empty($data['consent_to_publish']) ? 1 : 0]);
    Response::json(['message' => 'Thank you. Your review is pending approval.'], 201);
}
if ($path === '/public/inquiries' && $method === 'POST') {
    $data = jsonInput(); requireFields($data, ['name', 'email', 'message']);
    if (!empty($data['website'])) Response::json(['message' => 'Your message has been received.'], 201);
    if (!filter_var($data['email'], FILTER_VALIDATE_EMAIL)) Response::json(['error' => 'Invalid email'], 422);
    $name = trim((string) $data['name']); $message = trim((string) $data['message']);
    if (strlen($name) > 160 || strlen($message) < 5 || strlen($message) > 5000) Response::json(['error' => 'Please provide a valid name and message.'], 422);
    $interest = strtolower((string) ($data['interest'] ?? 'general'));
    if (!in_array($interest, ['buy','sell','lease','invest','general'], true)) $interest = 'general';
    $stmt = $pdo->prepare("INSERT INTO inquiries (name,email,phone,interest,message) VALUES (?,?,?,?,?)");
    $stmt->execute([$name, strtolower(trim($data['email'])), trim((string) ($data['phone'] ?? '')) ?: null, $interest, $message]);
    Response::json(['message' => 'Your message has been received.'], 201);
}

if (str_starts_with($path, '/admin/')) Auth::requireAdmin();
if ($path === '/admin/listings' && $method === 'GET') {
    $stmt = $pdo->query(
        "SELECT l.*,
            (SELECT image_url FROM listing_images i WHERE i.listing_id = l.id ORDER BY i.sort_order, i.id LIMIT 1) AS image_url
         FROM listings l
         ORDER BY l.updated_at DESC"
    );
    Response::json(['data' => $stmt->fetchAll()]);
}
if ($path === '/admin/listings' && $method === 'POST') {
    $data = jsonInput(); requireFields($data, ['slug', 'title', 'city']);
    $stmt = $pdo->prepare('INSERT INTO listings (slug,title,address,city,state,postal_code,status,price,price_label,bedrooms,bathrooms,square_feet,description,is_featured,sort_order,published_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)');
    $published = !empty($data['published']) ? date('Y-m-d H:i:s') : null;
    $stmt->execute([$data['slug'],$data['title'],$data['address'] ?? null,$data['city'],$data['state'] ?? 'TX',$data['postal_code'] ?? null,$data['status'] ?? 'draft',$data['price'] ?? null,$data['price_label'] ?? null,$data['bedrooms'] ?? null,$data['bathrooms'] ?? null,$data['square_feet'] ?? null,$data['description'] ?? null,!empty($data['is_featured']) ? 1 : 0,(int) ($data['sort_order'] ?? 0),$published]);
    Response::json(['id' => (int) $pdo->lastInsertId()], 201);
}
if (preg_match('#^/admin/listings/(\d+)$#', $path, $m) && in_array($method, ['PATCH','DELETE'], true)) {
    $id = (int) $m[1];
    if ($method === 'DELETE') { $pdo->prepare('DELETE FROM listings WHERE id=?')->execute([$id]); Response::json(['ok' => true]); }
    $data = jsonInput();
    $fields = ['title','address','city','state','postal_code','status','price','price_label','bedrooms','bathrooms','square_feet','description','is_featured','sort_order'];
    $set=[]; $values=[];
    foreach ($fields as $field) if (array_key_exists($field,$data)) { $set[] = "{$field}=?"; $values[] = $data[$field]; }
    if (array_key_exists('published',$data)) { $set[]='published_at=?'; $values[]=$data['published'] ? date('Y-m-d H:i:s') : null; }
    if (!$set) Response::json(['error' => 'No fields to update'], 422);
    $values[]=$id; $pdo->prepare('UPDATE listings SET '.implode(',', $set).' WHERE id=?')->execute($values); Response::json(['ok' => true]);
}

// --- Listing images ---
if (preg_match('#^/admin/listings/(\d+)/images$#', $path, $m) && $method === 'POST') {
    $listingId = (int) $m[1];

$check = $pdo->prepare('SELECT id FROM listings WHERE id = ? LIMIT 1');
    $check->execute([$listingId]);
    if (!$check->fetch()) Response::json(['error' => 'Listing not found'], 404);

if (empty($_FILES['image']) || $_FILES['image']['error'] !== UPLOAD_ERR_OK) {
        Response::json(['error' => 'No valid image uploaded'], 422);
    }

$file = $_FILES['image'];
    $allowedMime = ['image/jpeg' => 'jpg', 'image/png' => 'png', 'image/webp' => 'webp'];
    $finfo = finfo_open(FILEINFO_MIME_TYPE);
    $mime = finfo_file($finfo, $file['tmp_name']);
    finfo_close($finfo);

if (!isset($allowedMime[$mime])) {
        Response::json(['error' => 'Only JPG, PNG, or WEBP images are allowed'], 422);
    }
    if ($file['size'] > 8 * 1024 * 1024) {
        Response::json(['error' => 'Image must be under 8MB'], 422);
    }

$ext = $allowedMime[$mime];
    $filename = bin2hex(random_bytes(16)) . '.' . $ext;

$dir = dirname(__DIR__) . "/public/uploads/listings/{$listingId}";
    if (!is_dir($dir)) mkdir($dir, 0755, true);

$destination = "{$dir}/{$filename}";
    if (!move_uploaded_file($file['tmp_name'], $destination)) {
        Response::json(['error' => 'Failed to save image'], 500);
    }

$imageUrl = "https://api.kimahtherealtor.com/uploads/listings/{$listingId}/{$filename}";

$sortStmt = $pdo->prepare('SELECT COALESCE(MAX(sort_order), -1) + 1 AS next_sort FROM listing_images WHERE listing_id = ?');
    $sortStmt->execute([$listingId]);
    $nextSort = (int) $sortStmt->fetch()['next_sort'];

$insert = $pdo->prepare('INSERT INTO listing_images (listing_id, image_url, sort_order) VALUES (?, ?, ?)');
    $insert->execute([$listingId, $imageUrl, $nextSort]);

Response::json([
        'id' => (int) $pdo->lastInsertId(),
        'listing_id' => $listingId,
        'image_url' => $imageUrl,
        'sort_order' => $nextSort,
    ], 201);
}
if (preg_match('#^/admin/listings/(\d+)/images$#', $path, $m) && $method === 'GET') {
    $stmt = $pdo->prepare('SELECT * FROM listing_images WHERE listing_id = ? ORDER BY sort_order, id');
    $stmt->execute([(int) $m[1]]);
    Response::json(['data' => $stmt->fetchAll()]);
}
if (preg_match('#^/admin/listings/images/(\d+)$#', $path, $m) && $method === 'DELETE') {
    $imageId = (int) $m[1];
    $stmt = $pdo->prepare('SELECT * FROM listing_images WHERE id = ? LIMIT 1');
    $stmt->execute([$imageId]);
    $image = $stmt->fetch();
    if (!$image) Response::json(['error' => 'Image not found'], 404);

$prefix = 'https://api.kimahtherealtor.com/uploads/';
    if (str_starts_with($image['image_url'], $prefix)) {
        $relative = substr($image['image_url'], strlen($prefix));
        $filePath = dirname(__DIR__) . '/public/uploads/' . $relative;
        if (is_file($filePath)) @unlink($filePath);
    }

$pdo->prepare('DELETE FROM listing_images WHERE id = ?')->execute([$imageId]);
    Response::json(['ok' => true]);
}
if (preg_match('#^/admin/listings/(\d+)/images/reorder$#', $path, $m) && $method === 'PATCH') {
    $listingId = (int) $m[1];
    $data = jsonInput();
    requireFields($data, ['order']);
    if (!is_array($data['order'])) Response::json(['error' => 'order must be an array of image IDs'], 422);

$stmt = $pdo->prepare('UPDATE listing_images SET sort_order = ? WHERE id = ? AND listing_id = ?');
    foreach (array_values($data['order']) as $index => $imageId) {
        $stmt->execute([$index, (int) $imageId, $listingId]);
    }
    Response::json(['ok' => true]);
}

if ($path === '/admin/account/password' && $method === 'PATCH') {
    $data = jsonInput();
    requireFields($data, ['current_password', 'new_password']);
    $currentPassword = (string) $data['current_password'];
    $newPassword = (string) $data['new_password'];

if (strlen($newPassword) < 8) {
        Response::json(['error' => 'New password must be at least 8 characters.'], 422);
    }

$userId = (int) Auth::user()['id'];
    $stmt = $pdo->prepare('SELECT password_hash FROM admin_users WHERE id = ? LIMIT 1');
    $stmt->execute([$userId]);
    $row = $stmt->fetch();

if (!$row || !password_verify($currentPassword, $row['password_hash'])) {
        Response::json(['error' => 'Current password is incorrect.'], 422);
    }

$newHash = password_hash($newPassword, PASSWORD_DEFAULT);
    $pdo->prepare('UPDATE admin_users SET password_hash = ? WHERE id = ?')->execute([$newHash, $userId]);

Response::json(['ok' => true]);
}

if ($path === '/admin/testimonials' && $method === 'GET') {
    $stmt = $pdo->query('SELECT * FROM testimonials ORDER BY created_at DESC'); Response::json(['data' => $stmt->fetchAll()]);
}
if (preg_match('#^/admin/testimonials/(\d+)$#', $path, $m) && $method === 'PATCH') {
    $data=jsonInput(); $allowed=['client_name','client_type','city','body','rating','consent_to_publish','status','sort_order']; $set=[]; $values=[];
    foreach($allowed as $field) if(array_key_exists($field,$data)){ $set[]="{$field}=?"; $values[]=$data[$field]; }
    if (isset($data['status']) && $data['status']==='approved') { $set[]='published_at=NOW()'; }
        if(!$set) Response::json(['error'=>'No fields to update'],422); $values[]=(int)$m[1]; $pdo->prepare('UPDATE testimonials SET '.implode(',', $set).' WHERE id=?')->execute($values); Response::json(['ok'=>true]);
}
if (preg_match('#^/public/pages/([a-z0-9_-]+)$#', $path, $m) && $method === 'GET') {
    $stmt = $pdo->prepare('SELECT section_key, content_json FROM page_content WHERE page_key=? AND is_published=1 ORDER BY section_key');
    $stmt->execute([$m[1]]); $sections = [];
    foreach ($stmt->fetchAll() as $row) $sections[$row['section_key']] = json_decode($row['content_json'], true);
    Response::json(['data' => $sections]);
}
if ($path === '/public/settings' && $method === 'GET') {
    $stmt = $pdo->query('SELECT setting_key, setting_value FROM site_settings'); $settings = [];
    foreach ($stmt->fetchAll() as $row) $settings[$row['setting_key']] = json_decode($row['setting_value'], true);
    Response::json(['data' => $settings]);
}
if ($path === '/admin/inquiries' && $method === 'GET') {
    $stmt = $pdo->query('SELECT * FROM inquiries ORDER BY created_at DESC'); Response::json(['data' => $stmt->fetchAll()]);
}
if (preg_match('#^/admin/inquiries/(\\d+)$#', $path, $m) && $method === 'PATCH') {
    $data = jsonInput(); $status = $data['status'] ?? null;
    if (!in_array($status, ['new','contacted','closed','spam'], true)) Response::json(['error'=>'Invalid inquiry status'], 422);
    // Only touch admin_notes when the client actually sent it — previously this always
    // overwrote admin_notes with NULL on every status change, silently wiping saved notes.
    if (array_key_exists('admin_notes', $data)) {
        $stmt = $pdo->prepare('UPDATE inquiries SET status=?, admin_notes=? WHERE id=?');
        $stmt->execute([$status, $data['admin_notes'], (int) $m[1]]);
    } else {
        $stmt = $pdo->prepare('UPDATE inquiries SET status=? WHERE id=?');
        $stmt->execute([$status, (int) $m[1]]);
    }
    Response::json(['ok' => true]);
}
if (preg_match('#^/admin/pages/([a-z0-9_-]+)$#', $path, $m) && $method === 'GET') {
    $stmt = $pdo->prepare('SELECT section_key, content_json, is_published FROM page_content WHERE page_key=? ORDER BY section_key'); $stmt->execute([$m[1]]); Response::json(['data'=>$stmt->fetchAll()]);
}
if (preg_match('#^/admin/pages/([a-z0-9_-]+)$#', $path, $m) && $method === 'PUT') {
    $data = jsonInput(); requireFields($data, ['section_key','content']);
    $stmt = $pdo->prepare('INSERT INTO page_content (page_key,section_key,content_json,is_published,updated_by) VALUES (?,?,?,?,?) ON DUPLICATE KEY UPDATE content_json=VALUES(content_json),is_published=VALUES(is_published),updated_by=VALUES(updated_by)');
    $stmt->execute([$m[1],$data['section_key'],json_encode($data['content']),!empty($data['is_published'])?1:0,Auth::user()['id']]); Response::json(['ok'=>true]);
}
if (preg_match('#^/admin/settings/([a-z0-9_-]+)$#', $path, $m) && $method === 'PUT') {
    $data = jsonInput(); requireFields($data, ['value']);
    $stmt = $pdo->prepare('INSERT INTO site_settings (setting_key,setting_value,updated_by) VALUES (?,?,?) ON DUPLICATE KEY UPDATE setting_value=VALUES(setting_value),updated_by=VALUES(updated_by)');
    $stmt->execute([$m[1],json_encode($data['value']),Auth::user()['id']]); Response::json(['ok'=>true]);
}
Response::notFound();

CANCEL

Name	Type	Size	Modified	Actions
↩ ..	DIR	—	—
📁 .well-known/	DIR	—	2026-10-31 14:47
📁 uploads/	DIR	—	2026-09-01 09:07
📄 .htaccess	HTACCESS	1.1 KB	2026-10-30 22:57	EDIT
📄 error_log	?	1014 B	2026-10-28 20:35	EDIT
📄 index.php	PHP	15.1 KB	2026-09-01 11:54	EDIT