SWDB/application/API/v1/profile/DELETE.php

<?php
    /**
     * Profile deleter script.
     *
     * Exposes an API to update an existing profile.
     *
     * It also saves the data to a JSON file in the data directory.
     *
     * Mandatory query parameters are:
     *  - id: Player ID.
     *
     * Mandatory DELETE parameters are:
     *  - key: User API key.
     *
     * @category API
     */

    global $db;

    try{

        header("Content-type: application/json; charset=utf-8");

        // Get put data
        $_DELETE = [];
        parse_str(file_get_contents("php://input"), $_DELETE);

        // Get profile ID
        /** @var mixed $query Request parameters, from API_CONTROLLER*/
        if (count($query) > 0){
            $id = $query[0];
        }
        else{
            // ID is mandatory
            header("HTTP/1.1 400 User ID not received.");
            syslog(LOG_INFO, "[APIv1] HTTP/1.1 400 User ID not received.");
            return 400;
        }

        // Check API key.
        $api_key = $_DELETE["key"];
        if ($api_key == null || $api_key == false){
            header("HTTP/1.1 400 API key not received.");
            syslog(LOG_INFO, "[APIv1] HTTP/1.1 400 API key not received.");
            return 400;
        }

        // Authenticate
        $statement = $db->prepare("SELECT COUNT(uid) AS c FROM player WHERE uid = :uid AND api_key = :api_key;");
        $statement->bindValue(":uid", $id, SQLITE3_INTEGER);
        $statement->bindValue(":api_key", $api_key, SQLITE3_TEXT);
        if (1 != $statement->execute()->fetchArray(SQLITE3_ASSOC)["c"]){
            header("HTTP/1.1 401 Invalid credentials.");
            syslog(LOG_INFO, "[APIv1] HTTP/1.1 401 Invalid credentials.");
            return 401;
        }

        $statement = $db->prepare("
          DELETE FROM data.player
          WHERE
            uid = :uid AND
            id IN (
              SELECT player.id
              FROM
                data.player player,
                data.user user
              WHERE
                player.user = user.id AND
                user.api_key = :api_key
            );
        ");
        $statement->bindValue(":uid", $id, SQLITE3_INTEGER);
        $statement->bindValue(":api_key", $api_key, SQLITE3_TEXT);
        $statement->execute();

        header("HTTP/1.1 204 Profile deleted.");
        syslog(LOG_INFO, "[APIv1] HTTP/1.1 204 Profile deleted.");
        return 204;
    }
    catch(Exception $e) {
        header("HTTP/1.1 500 Unexpeced error: " . $e->getMessage());
        syslog(LOG_ERR, "[APIv1] HTTP/1.1 500 Unexpected error: " . $e->getMessage());
        return 500;
    }
?>