f36fea8e58
✅ Authentication Headers Added: - Added JWT tokens to all API calls in card detail page - Fixed collections, decks, ownership, and favorites API calls - Added proper error handling for authentication failures 🔧 Enhanced Ownership API: - Added GET method to fetch user's card ownership - Maintains existing POST method for updating ownership - Returns user-specific quantity data 🎯 User Data Integration: - Fetches user's owned quantity on page load - Checks favorite status from user_favorites table - Refreshes data after collection/deck additions - All data now properly scoped to authenticated user 🛡️ Security Improvements: - All API calls now include Authorization headers - User-specific data fetching implemented - No more reliance on global card data - Proper JWT token validation throughout The card detail page now properly integrates with the secured API endpoints and displays user-specific data correctly! 🃏🔒
85 lines
No EOL
2.3 KiB
JavaScript
85 lines
No EOL
2.3 KiB
JavaScript
import { sql } from '@vercel/postgres';
|
|
import { getUserFromRequest } from '../../../../lib/permission-middleware';
|
|
|
|
export default async function handler(req, res) {
|
|
const { id } = req.query;
|
|
|
|
try {
|
|
// Get authenticated user
|
|
const user = await getUserFromRequest(req);
|
|
if (!user) {
|
|
return res.status(401).json({ error: 'Authentication required' });
|
|
}
|
|
|
|
if (req.method === 'GET') {
|
|
// Get user's ownership of this card
|
|
const result = await sql`
|
|
SELECT uc.quantity
|
|
FROM user_cards uc
|
|
WHERE uc.user_id = ${user.userId} AND uc.card_id = ${id}
|
|
`;
|
|
|
|
const quantity = result.rows.length > 0 ? result.rows[0].quantity : 0;
|
|
|
|
res.status(200).json({
|
|
success: true,
|
|
quantity: quantity
|
|
});
|
|
} else if (req.method === 'POST') {
|
|
const { quantity } = req.body;
|
|
|
|
// Check if card exists
|
|
const cardCheck = await sql`
|
|
SELECT id, name FROM cards WHERE id = ${id}
|
|
`;
|
|
|
|
if (cardCheck.rows.length === 0) {
|
|
return res.status(404).json({ error: 'Card not found' });
|
|
}
|
|
|
|
const card = cardCheck.rows[0];
|
|
|
|
if (quantity > 0) {
|
|
// Insert or update user's card ownership
|
|
const result = await sql`
|
|
INSERT INTO user_cards (user_id, card_id, quantity)
|
|
VALUES (${user.userId}, ${id}, ${quantity})
|
|
ON CONFLICT (user_id, card_id)
|
|
DO UPDATE SET
|
|
quantity = ${quantity},
|
|
updated_at = CURRENT_TIMESTAMP
|
|
RETURNING *
|
|
`;
|
|
|
|
res.status(200).json({
|
|
success: true,
|
|
card: {
|
|
id: card.id,
|
|
name: card.name,
|
|
quantity: result.rows[0].quantity
|
|
}
|
|
});
|
|
} else {
|
|
// Remove card from user's collection if quantity is 0
|
|
await sql`
|
|
DELETE FROM user_cards
|
|
WHERE user_id = ${user.userId} AND card_id = ${id}
|
|
`;
|
|
|
|
res.status(200).json({
|
|
success: true,
|
|
card: {
|
|
id: card.id,
|
|
name: card.name,
|
|
quantity: 0
|
|
}
|
|
});
|
|
}
|
|
} else {
|
|
res.status(405).json({ error: 'Method not allowed' });
|
|
}
|
|
} catch (error) {
|
|
console.error('Error handling ownership:', error);
|
|
res.status(500).json({ error: 'Failed to handle ownership' });
|
|
}
|
|
}
|