From dd2ee5c93f3a0c6e80fba4f6db0d26287c8a0f6e Mon Sep 17 00:00:00 2001
From: Wrongecho <wrongecho@itflow.org>
Date: Thu, 10 Sep 2026 14:19:00 +0000
Subject: [PATCH] API - Add Vendor create, update, archive endpoints

---
 api/v1/vendors/archive.php      |  33 ++++++++++
 api/v1/vendors/create.php       |  29 +++++++++
 api/v1/vendors/unarchive.php    |  33 ++++++++++
 api/v1/vendors/update.php       |  35 +++++++++++
 api/v1/vendors/vendor_model.php | 107 ++++++++++++++++++++++++++++++++
 5 files changed, 237 insertions(+)
 create mode 100644 api/v1/vendors/archive.php
 create mode 100644 api/v1/vendors/create.php
 create mode 100644 api/v1/vendors/unarchive.php
 create mode 100644 api/v1/vendors/update.php
 create mode 100644 api/v1/vendors/vendor_model.php

diff --git a/api/v1/vendors/archive.php b/api/v1/vendors/archive.php
new file mode 100644
index 000000000..97d831cff
--- /dev/null
+++ b/api/v1/vendors/archive.php
@@ -0,0 +1,33 @@
+<?php
+
+require_once '../validate_api_key.php';
+require_once '../require_post_method.php';
+
+// Parse ID
+$vendor_id = intval($_POST['vendor_id']);
+
+// Default
+$update_count = false;
+
+if (!empty($vendor_id)) {
+
+    // Fetch vendor info
+    $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT vendor_name FROM vendors WHERE vendor_id = $vendor_id AND vendor_client_id = $client_id AND vendor_archived_at IS NULL LIMIT 1"));
+
+    if ($row) {
+        $vendor_name = escapeSql($row['vendor_name']);
+
+        // Archive vendor
+        $update_sql = mysqli_query($mysqli, "UPDATE vendors SET vendor_archived_at = NOW() WHERE vendor_id = $vendor_id AND vendor_client_id = $client_id AND vendor_archived_at IS NULL");
+
+        if ($update_sql) {
+            $update_count = mysqli_affected_rows($mysqli);
+
+            // Logging
+            logAudit("Vendor", "Archive", "$vendor_name archived via API ($api_key_name)", $client_id, $vendor_id);
+        }
+    }
+}
+
+// Output
+require_once '../update_output.php';
\ No newline at end of file
diff --git a/api/v1/vendors/create.php b/api/v1/vendors/create.php
new file mode 100644
index 000000000..6ce73a5f2
--- /dev/null
+++ b/api/v1/vendors/create.php
@@ -0,0 +1,29 @@
+<?php
+
+require_once '../validate_api_key.php';
+
+require_once '../require_post_method.php';
+
+// Parse Info
+require_once 'vendor_model.php';
+
+// Default
+$insert_id = false;
+
+if (!empty($name)) {
+
+    // Insert vendor
+    $insert_sql = mysqli_query($mysqli, "INSERT INTO vendors SET vendor_name = '$name', vendor_description = '$description', vendor_contact_name = '$contact_name', vendor_phone_country_code = '$phone_country_code', vendor_phone = '$phone', vendor_extension = '$extension', vendor_email = '$email', vendor_website = '$website', vendor_hours = '$hours', vendor_sla = '$sla', vendor_code = '$code', vendor_account_number = '$account_number', vendor_notes = '$notes', vendor_client_id = $client_id");
+
+    // Check insert & get insert ID
+    if ($insert_sql) {
+        $insert_id = mysqli_insert_id($mysqli);
+
+        // Logging
+        logAudit("Vendor", "Create", "$name via API ($api_key_name)", $client_id, $insert_id);
+        logAudit("API", "Success", "Created vendor $name via API ($api_key_name)", $client_id, $insert_id);
+    }
+}
+
+// Output
+require_once '../create_output.php';
\ No newline at end of file
diff --git a/api/v1/vendors/unarchive.php b/api/v1/vendors/unarchive.php
new file mode 100644
index 000000000..6b409375f
--- /dev/null
+++ b/api/v1/vendors/unarchive.php
@@ -0,0 +1,33 @@
+<?php
+
+require_once '../validate_api_key.php';
+require_once '../require_post_method.php';
+
+// Parse ID
+$vendor_id = intval($_POST['vendor_id']);
+
+// Default
+$update_count = false;
+
+if (!empty($vendor_id)) {
+
+    // Fetch vendor info
+    $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT vendor_name FROM vendors WHERE vendor_id = $vendor_id AND vendor_client_id = $client_id AND vendor_archived_at IS NOT NULL LIMIT 1"));
+
+    if ($row) {
+        $vendor_name = escapeSql($row['vendor_name']);
+
+        // Un-archive vendor
+        $update_sql = mysqli_query($mysqli, "UPDATE vendors SET vendor_archived_at = NULL WHERE vendor_id = $vendor_id AND vendor_client_id = $client_id AND vendor_archived_at IS NOT NULL");
+
+        if ($update_sql) {
+            $update_count = mysqli_affected_rows($mysqli);
+
+            // Logging
+            logAudit("Vendor", "Unarchive", "$vendor_name unarchived via API ($api_key_name)", $client_id, $vendor_id);
+        }
+    }
+}
+
+// Output
+require_once '../update_output.php';
\ No newline at end of file
diff --git a/api/v1/vendors/update.php b/api/v1/vendors/update.php
new file mode 100644
index 000000000..ed3b6bb8a
--- /dev/null
+++ b/api/v1/vendors/update.php
@@ -0,0 +1,35 @@
+<?php
+
+require_once '../validate_api_key.php';
+
+require_once '../require_post_method.php';
+
+// Parse ID
+$vendor_id = intval($_POST['vendor_id']);
+
+// Default
+$update_count = false;
+
+if (!empty($vendor_id)) {
+
+    $vendor_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_id = $vendor_id AND vendor_client_id = $client_id AND vendor_archived_at IS NULL LIMIT 1"));
+
+    // Variable assignment from POST - assigning the current database value if a value is not provided
+    require_once 'vendor_model.php';
+
+    if ($vendor_row) {
+        $update_sql = mysqli_query($mysqli, "UPDATE vendors SET vendor_name = '$name', vendor_description = '$description', vendor_contact_name = '$contact_name', vendor_phone_country_code = '$phone_country_code', vendor_phone = '$phone', vendor_extension = '$extension', vendor_email = '$email', vendor_website = '$website', vendor_hours = '$hours', vendor_sla = '$sla', vendor_code = '$code', vendor_account_number = '$account_number', vendor_notes = '$notes' WHERE vendor_id = $vendor_id AND vendor_client_id = $client_id AND vendor_archived_at IS NULL LIMIT 1");
+
+        // Check update & get affected rows
+        if ($update_sql) {
+            $update_count = mysqli_affected_rows($mysqli);
+
+            // Logging
+            logAudit("Vendor", "Edit", "$name via API ($api_key_name)", $client_id, $vendor_id);
+            logAudit("API", "Success", "Edited vendor $name via API ($api_key_name)", $client_id, $vendor_id);
+        }
+    }
+}
+
+// Output
+require_once '../update_output.php';
\ No newline at end of file
diff --git a/api/v1/vendors/vendor_model.php b/api/v1/vendors/vendor_model.php
new file mode 100644
index 000000000..8ba3d3ac6
--- /dev/null
+++ b/api/v1/vendors/vendor_model.php
@@ -0,0 +1,107 @@
+<?php
+
+// Variable assignment from POST (or: blank/from DB is updating)
+
+if (isset($_POST['vendor_name'])) {
+    $name = escapeSql($_POST['vendor_name']);
+} elseif ($vendor_row) {
+    $name = mysqli_real_escape_string($mysqli, $vendor_row['vendor_name']);
+} else {
+    $name = '';
+}
+
+if (isset($_POST['vendor_description'])) {
+    $description = escapeSql($_POST['vendor_description']);
+} elseif ($vendor_row) {
+    $description = mysqli_real_escape_string($mysqli, $vendor_row['vendor_description']);
+} else {
+    $description = '';
+}
+
+if (isset($_POST['vendor_account_number'])) {
+    $account_number = escapeSql($_POST['vendor_account_number']);
+} elseif ($vendor_row) {
+    $account_number = mysqli_real_escape_string($mysqli, $vendor_row['vendor_account_number']);
+} else {
+    $account_number = '';
+}
+
+if (isset($_POST['vendor_contact_name'])) {
+    $contact_name = escapeSql($_POST['vendor_contact_name']);
+} elseif ($vendor_row) {
+    $contact_name = mysqli_real_escape_string($mysqli, $vendor_row['vendor_contact_name']);
+} else {
+    $contact_name = '';
+}
+
+if (isset($_POST['vendor_phone_country_code'])) {
+    $phone_country_code = preg_replace("/[^0-9]/", '', $_POST['vendor_phone_country_code']);
+} elseif ($vendor_row) {
+    $phone_country_code = mysqli_real_escape_string($mysqli, $vendor_row['vendor_phone_country_code']);
+} else {
+    $phone_country_code = '';
+}
+
+if (isset($_POST['vendor_phone'])) {
+    $phone = preg_replace("/[^0-9]/", '', $_POST['vendor_phone']);
+} elseif ($vendor_row) {
+    $phone = mysqli_real_escape_string($mysqli, $vendor_row['vendor_phone']);
+} else {
+    $phone = '';
+}
+
+if (isset($_POST['vendor_extension'])) {
+    $extension = preg_replace("/[^0-9]/", '', $_POST['vendor_extension']);
+} elseif ($vendor_row) {
+    $extension = mysqli_real_escape_string($mysqli, $vendor_row['vendor_extension']);
+} else {
+    $extension = '';
+}
+
+if (isset($_POST['vendor_email'])) {
+    $email = escapeSql($_POST['vendor_email']);
+} elseif ($vendor_row) {
+    $email = mysqli_real_escape_string($mysqli, $vendor_row['vendor_email']);
+} else {
+    $email = '';
+}
+
+if (isset($_POST['vendor_website'])) {
+    $website = preg_replace("(^https?://)", "", escapeSql($_POST['vendor_website']));
+} elseif ($vendor_row) {
+    $website = mysqli_real_escape_string($mysqli, $vendor_row['vendor_website']);
+} else {
+    $website = '';
+}
+
+if (isset($_POST['vendor_hours'])) {
+    $hours = escapeSql($_POST['vendor_hours']);
+} elseif ($vendor_row) {
+    $hours = mysqli_real_escape_string($mysqli, $vendor_row['vendor_hours']);
+} else {
+    $hours = '';
+}
+
+if (isset($_POST['vendor_sla'])) {
+    $sla = escapeSql($_POST['vendor_sla']);
+} elseif ($vendor_row) {
+    $sla = mysqli_real_escape_string($mysqli, $vendor_row['vendor_sla']);
+} else {
+    $sla = '';
+}
+
+if (isset($_POST['vendor_code'])) {
+    $code = escapeSql($_POST['vendor_code']);
+} elseif ($vendor_row) {
+    $code = mysqli_real_escape_string($mysqli, $vendor_row['vendor_code']);
+} else {
+    $code = '';
+}
+
+if (isset($_POST['vendor_notes'])) {
+    $notes = escapeSql($_POST['vendor_notes']);
+} elseif ($vendor_row) {
+    $notes = mysqli_real_escape_string($mysqli, $vendor_row['vendor_notes']);
+} else {
+    $notes = '';
+}
\ No newline at end of file