Replace @vercel/postgres, Blob, and Upstash with lib/sql.js, MinIO object
storage, and CT 102 Redis rate limits. Add Dockerfile for Dokploy deploy,
homelab runbooks, Neon data-copy helper, and point CI smoke/visual at the
homelab URL instead of Vercel previews.
Co-authored-by: Cursor <cursoragent@cursor.com>
🚨 Fixed Major Data Leakage Issues:
- Replaced hardcoded user_id = 1 with proper JWT authentication
- Fixed collections API to filter by authenticated user
- Fixed card ownership to use user_cards table (not global cards table)
- Fixed decks API to return only user-owned decks
- Fixed card collections/decks APIs to respect user permissions
- Fixed favorites API to use user_favorites table
🛡️ Authentication & Authorization:
- All endpoints now require valid JWT tokens
- Proper user isolation across all data operations
- Collection permissions properly enforced
- User-specific data queries implemented
🔧 Database Schema Fixes:
- Card ownership now uses user_cards table
- Favorites use user_favorites table
- Decks filtered by user_id
- Collections respect ownership and permissions
⚠️ Development Note:
- Added warning for fallback authentication in dev mode
- Should be removed in production deployment
✅ Data Privacy Secured:
- Users can only see their own collections, decks, and owned cards
- Public collections visible to all (as intended)
- Shared collections respect permission levels
- No cross-user data leakage
- Updated card detail page to fetch real data from API
- Added ownership tracking with quantity management
- Added favorite system for cards
- Added collection and deck management functionality
- Created API endpoints for ownership, favorites, collections, and decks
- Added database columns for quantity and favorited status
- Shows current collections and decks the card belongs to
- Added proper error handling and loading states
- Integrated with real card data from database
- Added purchase links to TCGPlayer and eBay
