import { sql } from '@vercel/postgres';
import { getUserFromRequest } from '../../../../lib/permission-middleware';

export default async function handler(req, res) {
  const { id } = req.query;

  try {
    // Get authenticated user
    const user = await getUserFromRequest(req);
    if (!user) {
      return res.status(401).json({ error: 'Authentication required' });
    }

    if (req.method === 'GET') {
      // Get user's ownership of this card
      const result = await sql`
        SELECT uc.quantity
        FROM user_cards uc
        WHERE uc.user_id = ${user.userId} AND uc.card_id = ${id}
      `;

      const quantity = result.rows.length > 0 ? result.rows[0].quantity : 0;

      res.status(200).json({
        success: true,
        quantity: quantity
      });
    } else if (req.method === 'POST') {
      const { quantity } = req.body;

      // Check if card exists
      const cardCheck = await sql`
        SELECT id, name FROM cards WHERE id = ${id}
      `;

      if (cardCheck.rows.length === 0) {
        return res.status(404).json({ error: 'Card not found' });
      }

      const card = cardCheck.rows[0];

      if (quantity > 0) {
        // Insert or update user's card ownership
        const result = await sql`
          INSERT INTO user_cards (user_id, card_id, quantity)
          VALUES (${user.userId}, ${id}, ${quantity})
          ON CONFLICT (user_id, card_id)
          DO UPDATE SET 
            quantity = ${quantity},
            updated_at = CURRENT_TIMESTAMP
          RETURNING *
        `;

        res.status(200).json({
          success: true,
          card: {
            id: card.id,
            name: card.name,
            quantity: result.rows[0].quantity
          }
        });
      } else {
        // Remove card from user's collection if quantity is 0
        await sql`
          DELETE FROM user_cards 
          WHERE user_id = ${user.userId} AND card_id = ${id}
        `;

        res.status(200).json({
          success: true,
          card: {
            id: card.id,
            name: card.name,
            quantity: 0
          }
        });
      }
    } else {
      res.status(405).json({ error: 'Method not allowed' });
    }
  } catch (error) {
    console.error('Error handling ownership:', error);
    res.status(500).json({ error: 'Failed to handle ownership' });
  }
}