deckhearth/pages/api/cards/[id]/collections.js

import { sql } from '@vercel/postgres';
import { getUserFromRequest } from '../../../../lib/permission-middleware';

export default async function handler(req, res) {
  const { id } = req.query;

  if (req.method === 'GET') {
    try {
      // Get authenticated user
      const user = await getUserFromRequest(req);
      if (!user) {
        return res.status(401).json({ error: 'Authentication required' });
      }

      // Get collections that contain this card and the user has access to
      const result = await sql`
        SELECT DISTINCT
          c.id,
          c.name,
          c.description,
          cc.quantity
        FROM collections c
        JOIN collection_cards cc ON c.id = cc.collection_id
        LEFT JOIN collection_permissions cp ON c.id = cp.collection_id AND cp.user_id = ${user.userId}
        WHERE cc.card_id = ${id}
          AND (
            c.user_id = ${user.userId} OR
            (cp.id IS NOT NULL AND cp.status = 'active') OR
            c.is_public = true
          )
        ORDER BY c.name
      `;

      res.status(200).json(result.rows);
    } catch (error) {
      console.error('Error fetching card collections:', error);
      res.status(500).json({ error: 'Failed to fetch card collections' });
    }
  } else if (req.method === 'POST') {
    try {
      // Get authenticated user
      const user = await getUserFromRequest(req);
      if (!user) {
        return res.status(401).json({ error: 'Authentication required' });
      }

      const { collectionId } = req.body;

      // Check if user has permission to add cards to this collection
      const permissionCheck = await sql`
        SELECT c.id, c.user_id, cp.role
        FROM collections c
        LEFT JOIN collection_permissions cp ON c.id = cp.collection_id AND cp.user_id = ${user.userId}
        WHERE c.id = ${collectionId}
          AND (
            c.user_id = ${user.userId} OR
            (cp.role IN ('editor', 'owner') AND cp.status = 'active')
          )
      `;

      if (permissionCheck.rows.length === 0) {
        return res.status(403).json({ error: 'Permission denied' });
      }

      // Add card to collection
      await sql`
        INSERT INTO collection_cards (collection_id, card_id, quantity)
        VALUES (${collectionId}, ${id}, 1)
        ON CONFLICT (collection_id, card_id)
        DO UPDATE SET quantity = collection_cards.quantity + 1
      `;

      res.status(200).json({
        success: true,
        message: 'Card added to collection'
      });
    } catch (error) {
      console.error('Error adding card to collection:', error);
      res.status(500).json({ error: 'Failed to add card to collection' });
    }
  } else {
    res.status(405).json({ error: 'Method not allowed' });
  }
}