Rechtstexte und B2C-Vertragsabläufe absichern

rechtserklaerung-bearbeiten.php

@@ -0,0 +1,40 @@
+<?php
+
+require_once __DIR__ . '/functions.php';
+require_once __DIR__ . '/app/platform-admin.php';
+require_once __DIR__ . '/app/audit.php';
+
+$pdo = app_db_pdo();
+$user = app_require_platform_admin($pdo);
+if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
+    header('Location: backoffice.php');
+    exit;
+}
+app_require_csrf();
+
+$requestId = filter_var($_POST['request_id'] ?? null, FILTER_VALIDATE_INT);
+if ($requestId === false || $requestId <= 0) {
+    http_response_code(400);
+    exit('Ungültige Rechtserklärung.');
+}
+$stmt = $pdo->prepare('SELECT tenant_id, reference_code FROM legal_requests WHERE id = ? LIMIT 1');
+$stmt->execute([$requestId]);
+$request = $stmt->fetch();
+if ($request === false) {
+    http_response_code(404);
+    exit('Rechtserklärung nicht gefunden.');
+}
+$pdo->prepare("UPDATE legal_requests SET status = 'processed', processed_at = NOW() WHERE id = ?")
+    ->execute([$requestId]);
+app_audit_log(
+    $pdo,
+    $request['tenant_id'] !== null ? (int)$request['tenant_id'] : null,
+    (int)$user['user_id'],
+    'legal_request.processed',
+    'legal_request',
+    (int)$requestId,
+    ['reference_code' => (string)$request['reference_code']]
+);
+
+header('Location: backoffice.php?legal_request=processed');
+exit;