deckhearth/pages/api/cards/import-mtg.js

import { getUserFromRequest } from '../../../lib/permission-middleware';
import { checkImportRateLimit } from '../../../lib/rate-limit.js';
import { importMtgSet } from '../../../lib/card-import/mtg.js';

export default async function handler(req, res) {
  if (req.method !== 'POST') {
    return res.status(405).json({ error: 'Method not allowed' });
  }

  const user = await getUserFromRequest(req);
  if (!user) {
    return res.status(401).json({ error: 'Authentication required' });
  }
  if (user.role !== 'admin') {
    return res.status(403).json({ error: 'Admin access required' });
  }

  const { allowed, reset } = await checkImportRateLimit(req, user.userId);
  if (!allowed) {
    res.setHeader('Retry-After', Math.ceil((reset - Date.now()) / 1000));
    return res.status(429).json({ error: 'Too many attempts. Try again later.' });
  }

  try {
    const { setCode } = req.body;

    if (!setCode) {
      return res.status(400).json({ error: 'Set code is required' });
    }

    const result = await importMtgSet(setCode);

    return res.status(200).json({
      success: true,
      message: `Import completed for set ${setCode}`,
      ...result,
    });
  } catch (error) {
    console.error('Card import error:', error);
    return res.status(500).json({
      error: 'Import failed',
      details: error.message,
    });
  }
}