deckhearth/pages/api/cards/[id]/decks.js

import { sql } from '../../../../lib/sql.js';
import { getUserFromRequest } from '../../../../lib/permission-middleware';

export default async function handler(req, res) {
  const { id } = req.query;

  if (req.method === 'GET') {
    try {
      // Get authenticated user
      const user = await getUserFromRequest(req);
      if (!user) {
        return res.status(401).json({ error: 'Authentication required' });
      }

      // Get decks that contain this card and belong to the user
      const result = await sql`
        SELECT DISTINCT
          d.id,
          d.name,
          d.description,
          dc.quantity
        FROM decks d
        JOIN deck_cards dc ON d.id = dc.deck_id
        WHERE dc.card_id = ${id}
          AND d.user_id = ${user.userId}
        ORDER BY d.name
      `;

      res.status(200).json(result.rows);
    } catch (error) {
      console.error('Error fetching card decks:', error);
      res.status(500).json({ error: 'Failed to fetch card decks' });
    }
  } else if (req.method === 'POST') {
    try {
      // Get authenticated user
      const user = await getUserFromRequest(req);
      if (!user) {
        return res.status(401).json({ error: 'Authentication required' });
      }

      const { deckId } = req.body;

      // Check if user owns this deck
      const deckCheck = await sql`
        SELECT id, name
        FROM decks
        WHERE id = ${deckId} AND user_id = ${user.userId}
      `;

      if (deckCheck.rows.length === 0) {
        return res.status(403).json({ error: 'Deck not found or access denied' });
      }

      // Add card to deck
      await sql`
        INSERT INTO deck_cards (deck_id, card_id, quantity)
        VALUES (${deckId}, ${id}, 1)
        ON CONFLICT (deck_id, card_id)
        DO UPDATE SET quantity = deck_cards.quantity + 1
      `;

      res.status(200).json({
        success: true,
        message: 'Card added to deck'
      });
    } catch (error) {
      console.error('Error adding card to deck:', error);
      res.status(500).json({ error: 'Failed to add card to deck' });
    }
  } else {
    res.status(405).json({ error: 'Method not allowed' });
  }
}