deckhearth/pages/api/collections/[identifier]/cards.js

import { sql } from '../../../../lib/sql.js';
import { getUserFromRequest, logCollectionActivity } from '../../../../lib/permission-middleware';
import { isValidSlug } from '../../../../lib/slug-utils';
import { listUnitPriceExpr } from '../../../../lib/pricing/collection-valuation.js';

const VALID_SORTS = new Set(['name', 'price', 'rarity', 'date']);
const VALID_ORDERS = new Set(['asc', 'desc']);

function buildSortClause(sort, order) {
  const dir = order === 'desc' ? 'DESC' : 'ASC';
  const nulls = 'NULLS LAST';
  const priceExpr = listUnitPriceExpr({ cardAlias: 'cards' });

  switch (sort) {
    case 'price':
      return `ORDER BY ${priceExpr} ${dir} ${nulls}, cards.name ASC`;
    case 'rarity':
      return `ORDER BY cards.rarity ${dir} ${nulls}, cards.name ASC`;
    case 'date':
      return `ORDER BY cc.created_at ${dir} ${nulls}, cards.name ASC`;
    case 'name':
    default:
      return `ORDER BY cards.name ${dir} ${nulls}`;
  }
}

export default async function handler(req, res) {
  try {
    // Try to get authenticated user (optional for public collections)
    const user = await getUserFromRequest(req);

    const { identifier } = req.query;

    if (!identifier) {
      return res.status(400).json({ error: 'Collection identifier is required' });
    }

    // Determine if identifier is a slug or numeric ID
    const isSlug = isValidSlug(identifier) || isNaN(parseInt(identifier));
    
    // Get collection ID from identifier
    let collectionResult;
    if (isSlug) {
      collectionResult = await sql`
        SELECT c.*, ${user ? sql`cp.role as user_role` : sql`NULL as user_role`}
        FROM collections c
        ${user ? sql`LEFT JOIN collection_permissions cp ON c.id = cp.collection_id AND cp.user_id = ${user.userId} AND cp.status = 'active'` : sql``}
        WHERE c.slug = ${identifier}
          AND (
            ${user ? sql`c.user_id = ${user.userId} OR cp.id IS NOT NULL OR` : sql``}
            c.is_public = true
          )
      `;
    } else {
      const numericId = parseInt(identifier);
      collectionResult = await sql`
        SELECT c.*, ${user ? sql`cp.role as user_role` : sql`NULL as user_role`}
        FROM collections c
        ${user ? sql`LEFT JOIN collection_permissions cp ON c.id = cp.collection_id AND cp.user_id = ${user.userId} AND cp.status = 'active'` : sql``}
        WHERE c.id = ${numericId}
          AND (
            ${user ? sql`c.user_id = ${user.userId} OR cp.id IS NOT NULL OR` : sql``}
            c.is_public = true
          )
      `;
    }

    if (collectionResult.rows.length === 0) {
      return res.status(404).json({ error: 'Collection not found or access denied' });
    }

    const collection = collectionResult.rows[0];

    if (req.method === 'GET') {
      const sortParam = req.query.sort ?? 'name';
      const orderParam = req.query.order ?? 'asc';
      const sort = VALID_SORTS.has(sortParam) ? sortParam : 'name';
      const order = VALID_ORDERS.has(orderParam) ? orderParam : 'asc';
      const orderClause = buildSortClause(sort, order);

      const cardsResult = await sql.query(
        `
        SELECT 
          cards.*,
          cc.quantity,
          cc.created_at as added_at
        FROM collection_cards cc
        JOIN cards ON cc.card_id = cards.id
        WHERE cc.collection_id = $1
        ${orderClause}
        `,
        [collection.id]
      );

      const cards = cardsResult.rows.map(card => ({
        id: card.id,
        name: card.name,
        set_name: card.set_name,
        set_code: card.set_code,
        card_number: card.card_number,
        rarity: card.rarity,
        game: card.game,
        mana_cost: card.mana_cost,
        cmc: card.cmc,
        card_type: card.card_type,
        colors: card.colors,
        oracle_text: card.oracle_text,
        power: card.power,
        toughness: card.toughness,
        image_url: card.image_url,
        stock_image_url: card.stock_image_url,
        current_price: parseFloat(card.current_price) || 0,
        market_price: parseFloat(card.market_price) || 0,
        quantity: parseInt(card.quantity) || 1,
        added_at: card.added_at
      }));

      res.status(200).json({ cards });

    } else if (req.method === 'POST') {
      if (!user) {
        return res.status(401).json({ error: 'Authentication required to modify this collection' });
      }

      // Add card to collection - only allow if user has write access
      const canWrite = collection.user_id === user.userId || 
                      ['owner', 'editor'].includes(collection.user_role);
      
      if (!canWrite) {
        return res.status(403).json({ error: 'You do not have permission to add cards to this collection' });
      }

      const { cardId, quantity = 1, condition = 'NM', is_foil = false } = req.body;

      if (!cardId) {
        return res.status(400).json({ error: 'Card ID is required' });
      }

      // Check if card exists
      const cardCheck = await sql`SELECT id, name FROM cards WHERE id = ${cardId}`;
      if (cardCheck.rows.length === 0) {
        return res.status(404).json({ error: 'Card not found' });
      }

      const cardRecord = cardCheck.rows[0];

      // Check if card already exists in collection
      const existingResult = await sql`
        SELECT * FROM collection_cards 
        WHERE collection_id = ${collection.id} AND card_id = ${cardId}
      `;

      if (existingResult.rows.length > 0) {
        // Update quantity if card already exists
        const result = await sql`
          UPDATE collection_cards 
          SET quantity = quantity + ${quantity}, updated_at = CURRENT_TIMESTAMP
          WHERE collection_id = ${collection.id} AND card_id = ${cardId}
          RETURNING *
        `;

        await logCollectionActivity(collection.id, user.userId, 'card_added', {
          cardId,
          cardName: cardRecord.name,
          quantityAdded: quantity,
          newQuantity: result.rows[0]?.quantity,
          condition,
          is_foil: Boolean(is_foil),
        });

        res.status(200).json({ 
          message: 'Card quantity updated in collection',
          card: result.rows[0]
        });
      } else {
        // Add new card to collection
        const result = await sql`
          INSERT INTO collection_cards (collection_id, card_id, quantity)
          VALUES (${collection.id}, ${cardId}, ${quantity})
          RETURNING *
        `;

        await logCollectionActivity(collection.id, user.userId, 'card_added', {
          cardId,
          cardName: cardRecord.name,
          quantityAdded: quantity,
          condition,
          is_foil: Boolean(is_foil),
        });

        res.status(201).json({ 
          message: 'Card added to collection',
          card: result.rows[0]
        });
      }

      // Update collection's updated_at timestamp
      await sql`
        UPDATE collections 
        SET updated_at = CURRENT_TIMESTAMP 
        WHERE id = ${collection.id}
      `;

    } else if (req.method === 'PUT') {
      if (!user) {
        return res.status(401).json({ error: 'Authentication required to modify this collection' });
      }

      // Update card quantity in collection
      const canWrite = collection.user_id === user.userId || 
                      ['owner', 'editor'].includes(collection.user_role);
      
      if (!canWrite) {
        return res.status(403).json({ error: 'You do not have permission to modify this collection' });
      }

      const { cardId, quantity } = req.body;

      if (!cardId || quantity === undefined) {
        return res.status(400).json({ error: 'Card ID and quantity are required' });
      }

      if (quantity <= 0) {
        // Remove card from collection if quantity is 0 or negative
        await sql`
          DELETE FROM collection_cards 
          WHERE collection_id = ${collection.id} AND card_id = ${cardId}
        `;

        res.status(200).json({ message: 'Card removed from collection' });
      } else {
        // Update quantity
        const result = await sql`
          UPDATE collection_cards 
          SET quantity = ${quantity}, updated_at = CURRENT_TIMESTAMP
          WHERE collection_id = ${collection.id} AND card_id = ${cardId}
          RETURNING *
        `;

        if (result.rows.length === 0) {
          return res.status(404).json({ error: 'Card not found in collection' });
        }

        res.status(200).json({ 
          message: 'Card quantity updated',
          card: result.rows[0]
        });
      }

      // Update collection's updated_at timestamp
      await sql`
        UPDATE collections 
        SET updated_at = CURRENT_TIMESTAMP 
        WHERE id = ${collection.id}
      `;

    } else if (req.method === 'DELETE') {
      if (!user) {
        return res.status(401).json({ error: 'Authentication required to modify this collection' });
      }

      // Remove card from collection
      const canWrite = collection.user_id === user.userId || 
                      ['owner', 'editor'].includes(collection.user_role);
      
      if (!canWrite) {
        return res.status(403).json({ error: 'You do not have permission to modify this collection' });
      }

      const { cardId } = req.body;

      if (!cardId) {
        return res.status(400).json({ error: 'Card ID is required' });
      }

      const result = await sql`
        DELETE FROM collection_cards 
        WHERE collection_id = ${collection.id} AND card_id = ${cardId}
        RETURNING *
      `;

      if (result.rows.length === 0) {
        return res.status(404).json({ error: 'Card not found in collection' });
      }

      // Update collection's updated_at timestamp
      await sql`
        UPDATE collections 
        SET updated_at = CURRENT_TIMESTAMP 
        WHERE id = ${collection.id}
      `;

      res.status(200).json({ message: 'Card removed from collection' });

    } else {
      res.status(405).json({ error: 'Method not allowed' });
    }

  } catch (error) {
    console.error('Collection cards API error:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
}