From 79262f26b4514df482693e283470015cf4cb9d91 Mon Sep 17 00:00:00 2001
From: Wrongecho <wrongecho@itflow.org>
Date: Mon, 7 Sep 2026 13:46:15 +0000
Subject: [PATCH] API - Add location update, archive and delete

---
 api/v1/locations/archive.php   | 45 ++++++++++++++++++++++++++++++++++
 api/v1/locations/delete.php    | 30 +++++++++++++++++++++++
 api/v1/locations/unarchive.php | 43 ++++++++++++++++++++++++++++++++
 api/v1/locations/update.php    | 42 +++++++++++++++++++++++++++++++
 4 files changed, 160 insertions(+)
 create mode 100644 api/v1/locations/archive.php
 create mode 100644 api/v1/locations/delete.php
 create mode 100644 api/v1/locations/unarchive.php
 create mode 100644 api/v1/locations/update.php

diff --git a/api/v1/locations/archive.php b/api/v1/locations/archive.php
new file mode 100644
index 000000000..8d1e95412
--- /dev/null
+++ b/api/v1/locations/archive.php
@@ -0,0 +1,45 @@
+<?php
+
+require_once '../validate_api_key.php';
+require_once '../require_post_method.php';
+
+// Parse ID
+$location_id = intval($_POST['location_id']);
+
+// Default
+$update_count = false;
+
+if (!empty($location_id)) {
+
+    // Fetch location info
+    $row = mysqli_fetch_assoc(mysqli_query($mysqli, "
+        SELECT location_name
+        FROM locations
+        WHERE location_id = $location_id AND location_client_id = $client_id AND location_archived_at IS NULL
+        LIMIT 1
+    "));
+
+    if ($row) {
+
+        $location_name = escapeSql($row['location_name']);
+
+        // Archive location
+        $update_sql = mysqli_query($mysqli, "
+            UPDATE locations SET
+            location_primary = 0,
+            location_archived_at = NOW()
+            WHERE location_id = $location_id AND location_client_id = $client_id
+        ");
+
+        if ($update_sql) {
+            $update_count = mysqli_affected_rows($mysqli);
+
+            // Logging
+            logAudit("Location", "Archive", "$location_name archived via API ($api_key_name)", $client_id, $location_id);
+            logAudit("API", "Success", "Archived location $location_name via API ($api_key_name)", $client_id);
+        }
+    }
+}
+
+// Output
+require_once '../update_output.php';
diff --git a/api/v1/locations/delete.php b/api/v1/locations/delete.php
new file mode 100644
index 000000000..f70c35ebd
--- /dev/null
+++ b/api/v1/locations/delete.php
@@ -0,0 +1,30 @@
+<?php
+
+require_once '../validate_api_key.php';
+
+require_once '../require_post_method.php';
+
+
+// Parse ID
+$location_id = intval($_POST['location_id']);
+
+// Default
+$delete_count = false;
+
+if (!empty($location_id)) {
+    $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT location_name FROM locations WHERE location_id = $location_id AND location_client_id = $client_id AND location_archived_at IS NOT NULL LIMIT 1"));
+    $location_name = escapeSql($row['location_name'] ?? '');
+
+    $delete_sql = mysqli_query($mysqli, "DELETE FROM locations WHERE location_id = $location_id AND location_client_id = $client_id AND location_archived_at IS NOT NULL LIMIT 1");
+
+    // Check delete & get affected rows
+    if ($delete_sql && !empty($location_name)) {
+        $delete_count = mysqli_affected_rows($mysqli);
+
+        // Logging
+        logAudit("Location", "Delete", "$location_name via API ($api_key_name)", $client_id, $location_id);
+    }
+}
+
+// Output
+require_once '../delete_output.php';
\ No newline at end of file
diff --git a/api/v1/locations/unarchive.php b/api/v1/locations/unarchive.php
new file mode 100644
index 000000000..aa89b8c64
--- /dev/null
+++ b/api/v1/locations/unarchive.php
@@ -0,0 +1,43 @@
+<?php
+
+require_once '../validate_api_key.php';
+require_once '../require_post_method.php';
+
+// Parse ID
+$location_id = intval($_POST['location_id']);
+
+// Default
+$update_count = false;
+
+if (!empty($location_id)) {
+
+    // Fetch location info
+    $row = mysqli_fetch_assoc(mysqli_query($mysqli, "
+        SELECT location_name
+        FROM locations
+        WHERE location_id = $location_id AND location_client_id = $client_id AND location_archived_at IS NOT NULL
+        LIMIT 1
+    "));
+
+    if ($row) {
+
+        $location_name = escapeSql($row['location_name']);
+
+        // Unarchive location
+        $update_sql = mysqli_query($mysqli, "
+            UPDATE locations SET location_archived_at = NULL
+            WHERE location_id = $location_id AND location_client_id = $client_id
+        ");
+
+        if ($update_sql) {
+            $update_count = mysqli_affected_rows($mysqli);
+
+            // Logging
+            logAudit("Location", "Unarchive", "$location_name unarchived via API ($api_key_name)", $client_id, $location_id);
+            logAudit("API", "Success", "Unarchived location $location_name via API ($api_key_name)", $client_id);
+        }
+    }
+}
+
+// Output
+require_once '../update_output.php';
diff --git a/api/v1/locations/update.php b/api/v1/locations/update.php
new file mode 100644
index 000000000..fa1f7d0d8
--- /dev/null
+++ b/api/v1/locations/update.php
@@ -0,0 +1,42 @@
+<?php
+
+require_once '../validate_api_key.php';
+
+require_once '../require_post_method.php';
+
+
+// Parse ID
+$location_id = intval($_POST['location_id']);
+
+// Default
+$update_count = false;
+
+if (!empty($location_id)) {
+
+    $location_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM locations WHERE location_id = '$location_id' AND location_client_id = $client_id AND location_archived_at IS NULL LIMIT 1"));
+
+    // Variable assignment from POST - assigning the current database value if a value is not provided
+    require_once 'location_model.php';
+
+    if ($location_row) {
+
+        // Reset primary location
+        if ($primary == 1) {
+            mysqli_query($mysqli, "UPDATE locations SET location_primary = 0 WHERE location_client_id = $client_id");
+        }
+
+        $update_sql = mysqli_query($mysqli, "UPDATE locations SET location_name = '$name', location_description = '$description', location_country = '$country', location_address = '$address', location_city = '$city', location_state = '$state', location_zip = '$zip', location_hours = '$hours', location_notes = '$notes', location_primary = '$primary' WHERE location_id = $location_id AND location_client_id = $client_id AND location_archived_at IS NULL LIMIT 1");
+
+        // Check update & get affected rows
+        if ($update_sql) {
+            $update_count = mysqli_affected_rows($mysqli);
+
+            // Logging
+            logAudit("Location", "Edit", "$name via API ($api_key_name)", $client_id, $location_id);
+            logAudit("API", "Success", "Edited location $name via API ($api_key_name)", $client_id);
+        }
+    }
+}
+
+// Output
+require_once '../update_output.php';