PDQ/bin/messages_post.php

<?php
require_once __DIR__ . '/../lib/identity.php';
require_once __DIR__ . '/../lib/render.php';

[$actor, $vendor_id] = resolve_request_actor();

if ($actor === 'ICG') {
    $slug = $_POST['vendor'] ?? '';
    $v = find_vendor_by_slug($slug);
    if (!$v) { http_response_code(400); echo 'Bad vendor'; exit; }
    $vendor_id = (int) $v['id'];
}

$body = trim((string) ($_POST['body'] ?? ''));
if ($body === '') {
    http_response_code(400);
    echo 'Empty message';
    exit;
}
if (strlen($body) > 4000) {
    $body = substr($body, 0, 4000);
}

$pdo = db();
$stmt = $pdo->prepare(
    'INSERT INTO messages(vendor_id, author, body) VALUES(?, ?, ?)'
);
$stmt->execute([$vendor_id, $actor, $body]);
$new_id = (int) $pdo->lastInsertId();

header('Content-Type: text/html; charset=utf-8');
header('X-Msg-Id: ' . $new_id);
echo render_messages($vendor_id, $new_id - 1);