Replace @vercel/postgres, Blob, and Upstash with lib/sql.js, MinIO object
storage, and CT 102 Redis rate limits. Add Dockerfile for Dokploy deploy,
homelab runbooks, Neon data-copy helper, and point CI smoke/visual at the
homelab URL instead of Vercel previews.
Co-authored-by: Cursor <cursoragent@cursor.com>
Extract shared 401/403 gate into permission-middleware and sweep the
four inline admin checks (import MTG/Pokemon, sync-catalog, card-submissions).
Co-authored-by: Cursor <cursoragent@cursor.com>
* Remove dead Lorcana import route and CLI script
The admin card-import UI never wired Lorcana; catalog sync uses
pages/api/admin instead. Drop the unused API route, CLI helper, and
stale docs references to import-lorcana.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Remove orphaned import-lorcana-simple CLI script.
It POSTed to the deleted /api/cards/import-lorcana endpoint; no remaining callers.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Extract ScannedCardItem with per-card metadata controls and ownership
lookup via GET /api/cards/[id]/ownership. Propagate condition, foil,
and quantity through owned/collection/deck POST paths.
Co-authored-by: Cursor <cursoragent@cursor.com>
Route Layer-2 identification through Vercel AI Gateway (AI_GATEWAY_API_KEY,
default google/gemini-2.5-flash-lite). Add Layer-1 browser Tesseract name-strip
OCR with pg_trgm fuzzy catalog match via /api/cards/identify-by-text before
escalating to vision.
Co-authored-by: Cursor <cursoragent@cursor.com>
* feat(scanner): move card identification server-side (convoy #2)
Replace browser Gemini/OCR with POST /api/scan/identify, add card_submissions
review queue, remove user-writable cards INSERT, and surface disambiguation
when catalog matching is ambiguous.
Co-authored-by: Cursor <cursoragent@cursor.com>
* ci: allowlist server-only lib/scan-gemini.js in LLM key gate
The scan pipeline helper lives under lib/ but is imported exclusively
from pages/api/scan/identify — exclude it from the client-side URL scan.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Closes P0 #6 from PARTIAL to RESOLVED. 8/8 P0s now closed. Extends lib/rate-limit.js from single-class to 5 named limiters (auth/search/upload/generate/import). Atomically gates the 3 import routes (auth + admin-role check + rate limit) and fixes pages/admin/card-import.js's missing Bearer header in the same commit (architect's critical discovery: API gating alone would have broken the admin UI). Per Decision 1 Option A. 10 files +185/-23. Local: lint 128 baseline, vitest 21/21. CI: Playwright smoke 3/3 in 3.8s, forbidden-cors-headers pass, all gates green. PR #20 architect-commit 60b842e, implementer-commit 51a3a97. Brief 4's login.js + register.js byte-identical.
Closes P0 #5 from PARTIAL to RESOLVED. Sweeps the remaining 24 pages/api/** handlers that carried the identical scaffolded wildcard-CORS + OPTIONS preflight pattern (Brief 4 cleaned login + register; this finishes the job). Adds a blocking forbidden-cors-headers CI job modeled on forbidden-endpoints to lock the cleanup against future regression. 25 files changed (+29/-261). Local: lint 128 baseline, vitest 21/21, zero CORS matches, YAML valid. CI: Playwright smoke 3/3 in 3.3s against post-removal preview (login/verify flow still works), new forbidden-cors-headers job passes in 4s, all gates green. PR #19 architect-commit ec22b70, implementer-commit a843736.
🐛 Database Schema Fixes:
- Removed non-existent 'updated_at' column from collection_cards operations
- Fixed SQL queries in card ownership API and seeding scripts
- Resolved column does not exist errors
🚫 Hide System Collections from Selection:
- Added 'excludeSystem' parameter to /api/collections endpoint
- Updated CollectionSelectionModal to exclude system collections
- 'All My Cards' no longer appears in card addition modals
✨ Enhanced System Collection Styling:
- Upgraded system collection badge with gradient styling
- Added 🔒 SYSTEM badge with blue-purple gradient
- Added informative tooltip: 'Automatically syncs with your owned cards'
- Made system collections visually distinct and educational
🎯 User Experience Improvements:
- System collections are now clearly identified as special
- Users understand they can't manually add cards to system collections
- Better visual hierarchy and information architecture
- Automatic sync behavior is now clearly communicated
Card ownership should now work without errors! 🚀
🐛 Database Fixes:
- Added unique constraint on user_cards (user_id, card_id)
- Added unique constraint on collection_cards (collection_id, card_id)
- Fixed ON CONFLICT clauses in card ownership API
✨ Auto-Sync Feature:
- Card ownership now automatically syncs with 'All My Cards' collection
- When user marks card as owned → added to system collection
- When user removes ownership → removed from system collection
- Real-time bidirectional sync between user_cards and collection_cards
🔄 Migration Script:
- Cleaned up any duplicate entries
- Added necessary database constraints
- Synced existing owned cards (0 users had existing data)
🎯 API Improvements:
- Simplified card ownership API (removed GET method)
- Better error handling and validation
- Clear success messages for user feedback
- Automatic collection management
Card ownership should now work perfectly! 🚀
🐛 Root Cause:
- API was selecting non-existent columns (flavor_text, hp, type, form, weakness, retreat_cost)
- Database schema only includes columns defined in setup scripts
- Caused 'column does not exist' errors preventing cards from loading
🔧 Schema Alignment:
- Updated all SELECT statements to only use existing columns
- Removed references to flavor_text, hp, type, form, weakness, retreat_cost
- Kept all valid columns: id, name, set_name, set_code, card_number, rarity, game, mana_cost, cmc, card_type, colors, oracle_text, power, toughness, image_url, stock_image_url, current_price, market_price, scryfall_id, verified, quantity
📊 Database Status:
- 29,834 cards currently in database (MTG, Pokemon, Lorcana)
- Added sample cards for testing (Lightning Bolt, Black Lotus, Pikachu, Charizard, Mickey Mouse, Elsa)
- All filter combinations working correctly
✅ API Testing Results:
- ✅ No filters: Returns all cards with pagination
- ✅ Game filter: MTG cards returned correctly
- ✅ Search filter: Pikachu search returns 50+ variants
- ✅ Pagination: 29,834 total cards across 5,967 pages
- ✅ Filter metadata: Games, rarities, and sets populated correctly
🎯 Expected Frontend Behavior:
- Cards page should now load and display cards
- Search, filters, and infinite scroll should work properly
- No more API errors or empty card grids
The cards database is populated and the API is fully functional! 🃏✨
🔍 Search & Filter Fixes:
- Completely rewrote /api/cards/search.js to support all frontend filters
- Added support for query, game, rarity, set, and price range filters
- Implemented proper pagination with page/limit/offset handling
- Added individual filter combinations for optimal performance
📡 API Enhancements:
- Support for complex filter combinations with JavaScript fallback
- Proper total count calculation for pagination
- Enhanced card data selection including all necessary fields
- Better error handling and response structure
🔄 Infinite Scroll Support:
- Fixed pagination metadata (page, total, pages, hasMore)
- Proper LIMIT/OFFSET implementation for database queries
- Support for incremental loading with page-based navigation
🎯 Filter Combinations Supported:
- No filters (all cards)
- Search by name only
- Filter by game only
- Filter by rarity only
- Game + rarity combination
- Search + game combination
- Complex multi-filter combinations
✅ Expected Behavior:
- Search bar should now filter cards by name
- TCG filter buttons should work (MTG, Pokemon, Lorcana)
- Rarity, Set, and Price range dropdowns should filter results
- Infinite scroll should load more cards as you scroll down
- Proper card count and pagination information displayed
The cards page should now be fully functional with working search, filters, and infinite scroll! 🃏✨
✅ Authentication Headers Added:
- Added JWT tokens to all API calls in card detail page
- Fixed collections, decks, ownership, and favorites API calls
- Added proper error handling for authentication failures
🔧 Enhanced Ownership API:
- Added GET method to fetch user's card ownership
- Maintains existing POST method for updating ownership
- Returns user-specific quantity data
🎯 User Data Integration:
- Fetches user's owned quantity on page load
- Checks favorite status from user_favorites table
- Refreshes data after collection/deck additions
- All data now properly scoped to authenticated user
🛡️ Security Improvements:
- All API calls now include Authorization headers
- User-specific data fetching implemented
- No more reliance on global card data
- Proper JWT token validation throughout
The card detail page now properly integrates with the secured API endpoints and displays user-specific data correctly! 🃏🔒
🚨 Fixed Major Data Leakage Issues:
- Replaced hardcoded user_id = 1 with proper JWT authentication
- Fixed collections API to filter by authenticated user
- Fixed card ownership to use user_cards table (not global cards table)
- Fixed decks API to return only user-owned decks
- Fixed card collections/decks APIs to respect user permissions
- Fixed favorites API to use user_favorites table
🛡️ Authentication & Authorization:
- All endpoints now require valid JWT tokens
- Proper user isolation across all data operations
- Collection permissions properly enforced
- User-specific data queries implemented
🔧 Database Schema Fixes:
- Card ownership now uses user_cards table
- Favorites use user_favorites table
- Decks filtered by user_id
- Collections respect ownership and permissions
⚠️ Development Note:
- Added warning for fallback authentication in dev mode
- Should be removed in production deployment
✅ Data Privacy Secured:
- Users can only see their own collections, decks, and owned cards
- Public collections visible to all (as intended)
- Shared collections respect permission levels
- No cross-user data leakage
- Updated /api/cards/search to return expected format with success, cards, pagination, and filters
- This fixes the empty cards page when clicking 'Add Cards'
- Removed debug console logs since TCG tags and CollaboratorFacepile are working
- Cards page should now display the sample cards properly
✅ Database & API Fixes:
- Fixed collection detail API to use correct column names (card_type, market_price, image_url)
- Removed all mock data and fallbacks
- Updated field mappings throughout collection detail page
- Fixed hero section to use real collection data with proper image support
�� Test Users Created:
- admin@tcgvault.com / admin123 (Admin)
- alice@tcgvault.com / alice123 (User)
- bob@tcgvault.com / bob123 (User)
🃏 Sample Cards Added:
- Lightning Bolt (MTG) - $2.50
- Black Lotus (MTG) - $25,000
- Pikachu (Pokemon) - $8.50
- Charizard (Pokemon) - $350
- Mickey Mouse (Lorcana) - $45
- Elsa (Lorcana) - $15.75
🔧 Collaboration Features:
- Added CollaborationManager to collection detail page
- Integrated real user permissions (isOwner check)
- Updated hero section with real stats and creator info
🔍 Card Management:
- Created cards search API (/api/cards/search)
- Implemented quick add functionality in empty state
- Real-time card search with dropdown results
- Add cards directly to collection with quantity
�� Ready for Testing:
1. Login as any user to see only their collections
2. Create collections with real data
3. Add cards using search functionality
4. Invite collaborators via email system
5. Switch users to test collaboration workflow
Complete end-to-end testing environment ready! 🚀
- Built complete admin interface for editing all card properties
- Added card search functionality with live results
- Created comprehensive form with sections for:
* Basic information (name, game, set, rarity, etc.)
* Game mechanics (type, mana cost, power/toughness, colors)
* Card text and oracle text
* Image URLs (primary and stock images)
* Pricing information (current and market prices)
- Added real-time card preview that updates as you edit
- Implemented PUT API endpoint for updating cards
- Added proper validation and error handling
- Added database schema updates (updated_at column)
- Integrated admin navigation between card editor and import tools
- Full responsive design with modern UI components
- Live search with card thumbnails and metadata
- Proper form state management and data persistence
- Updated card detail page to fetch real data from API
- Added ownership tracking with quantity management
- Added favorite system for cards
- Added collection and deck management functionality
- Created API endpoints for ownership, favorites, collections, and decks
- Added database columns for quantity and favorited status
- Shows current collections and decks the card belongs to
- Added proper error handling and loading states
- Integrated with real card data from database
- Added purchase links to TCGPlayer and eBay
- Replaced mock Lorcana import with real API integration
- Uses Lorcast API (https://api.lorcast.com/v0/cards/search) for comprehensive card data
- Added proper set code mapping (tfc->1, rotf->2, ink->3)
- Includes card images, prices, stats, and detailed metadata
- Created dedicated Lorcana import scripts for standalone use
- Maintains duplicate checking and proper error handling
- Supports all 3 Lorcana sets: The First Chapter, Rise of the Floodborn, Into the Inklands
- Added retry logic with exponential backoff for Pokemon API calls
- Created Lorcana import endpoint with placeholder data
- Improved error handling for 504 timeouts and 404 not found errors
- Added longer delays for Pokemon imports to avoid rate limiting
- Enhanced logging for better debugging of import issues
- Fixed response parsing to handle different API response formats
- Redesigned card display with 2.5:3.5 aspect ratio and image-only view
- Added infinite scroll to replace pagination
- Implemented authentic card back placeholders for MTG, Pokemon, and Lorcana
- Added rarity-based particle effects with tiered intensity (mythic/enchanted/rare/uncommon)
- Enhanced hover details panel with structured card information
- Fixed search functionality with debouncing and Enter key support
- Improved filter system with working TCG, rarity, set, and price filters
- Added favorite system for cards in both hover and detail views
- Updated card detail page with comprehensive metadata and actions
- Fixed API filtering with proper Vercel Postgres implementation
- Added particle animations and rarity glow effects
- Improved overall UX with better visual hierarchy and interactions
