notify node: userIDguard

app/assets/utils/notify_node.php

@@ -9,15 +9,15 @@
  * @param array  $data       Payload sent to the browser
  * @param int    $company_id Scopes the broadcast to one company's room
  */
-function notify_node(string $event, array $data, int $company_id): void
+function notify_node(string $event, array $data, int $company_id, string $target = '', int $user_id = 0): void
 {
     if ($company_id <= 0) return;
 
-    $body = json_encode([
-        'event'      => $event,
-        'data'       => $data,
-        'company_id' => $company_id,
-    ]);
+    $payload = ['event' => $event, 'data' => $data, 'company_id' => $company_id];
+    if ($target)  $payload['target']  = $target;
+    if ($user_id) $payload['user_id'] = $user_id;
+
+    $body = json_encode($payload);
 
     $ch = curl_init(defined('NODE_EMIT_URL') ? NODE_EMIT_URL : 'http://127.0.0.1:3000/emit');
     curl_setopt_array($ch, [
@@ -45,6 +45,7 @@ function notify_node(string $event, array $data, int $company_id): void
  * @param string $message     Detail line, e.g. 'PO-2605-00042 has been approved.'
  * @param string $type        'success' | 'info' | 'warning' | 'danger'  (default 'info')
  */
+// Company-wide notification — all users in the company see the toast.
 function emit_notification(int $company_id, string $title, string $message, string $type = 'info'): void
 {
     notify_node('notification', [
@@ -54,6 +55,16 @@ function emit_notification(int $company_id, string $title, string $message, stri
     ], $company_id);
 }
 
+// Document notification — the acting user + all admins/owners see the toast. Other staff/viewers do not.
+function emit_notification_user(int $company_id, int $user_id, string $title, string $message, string $type = 'info'): void
+{
+    notify_node('notification', [
+        'title'   => $title,
+        'message' => $message,
+        'type'    => $type,
+    ], $company_id, 'user', $user_id);
+}
+
 function gl_posted_payload(string $doc_type, int $id, string $action, array $lines): array
 {
     $has_revenue = false;

app/include_ending.php

@@ -17,7 +17,7 @@
     if (typeof io === 'undefined') return;
 
     window._socket = io('<?php echo NODE_PUBLIC_URL; ?>', {
-        query:           { company_id: company_id },
+        query:           { company_id: company_id, user_id: user_id, role: user_role },
         reconnection:    true,
         reconnectionDelay: 2000,
     });

app/include_topbar.php

@@ -128,6 +128,7 @@ $_usage_full   = $_usage_max_pct >= 100;
 <!-- Global Variables  -->
 <div id="session-context"
   data-company-id="<?php echo htmlspecialchars($_SESSION['login_company_id'] ?? 0, ENT_QUOTES, 'UTF-8'); ?>"
+  data-user-id="<?php echo htmlspecialchars($_SESSION['login_user_id'] ?? 0, ENT_QUOTES, 'UTF-8'); ?>"
   data-otp="<?php echo htmlspecialchars($_SESSION['otp'] ?? '', ENT_QUOTES, 'UTF-8'); ?>"
   data-role="<?php echo htmlspecialchars($_SESSION['login_role'] ?? 'viewer', ENT_QUOTES, 'UTF-8'); ?>">
 </div>
@@ -276,6 +277,7 @@ var server_url = '<?php echo $server_url; ?>';
 var prop_limit = '<?php echo $prop['limit']; ?>';
 var user_role  = document.getElementById('session-context')?.dataset.role      || 'viewer';
 var company_id = parseInt(document.getElementById('session-context')?.dataset.companyId || '0', 10);
+var user_id    = parseInt(document.getElementById('session-context')?.dataset.userId    || '0', 10);
 
 // ── Bell notifications ────────────────────────────────────────────────────────
 var _notif_items  = [];