f408e151c8
🚨 Fixed Major Data Leakage Issues: - Replaced hardcoded user_id = 1 with proper JWT authentication - Fixed collections API to filter by authenticated user - Fixed card ownership to use user_cards table (not global cards table) - Fixed decks API to return only user-owned decks - Fixed card collections/decks APIs to respect user permissions - Fixed favorites API to use user_favorites table 🛡️ Authentication & Authorization: - All endpoints now require valid JWT tokens - Proper user isolation across all data operations - Collection permissions properly enforced - User-specific data queries implemented 🔧 Database Schema Fixes: - Card ownership now uses user_cards table - Favorites use user_favorites table - Decks filtered by user_id - Collections respect ownership and permissions ⚠️ Development Note: - Added warning for fallback authentication in dev mode - Should be removed in production deployment ✅ Data Privacy Secured: - Users can only see their own collections, decks, and owned cards - Public collections visible to all (as intended) - Shared collections respect permission levels - No cross-user data leakage
84 lines
No EOL
2.7 KiB
JavaScript
84 lines
No EOL
2.7 KiB
JavaScript
import { sql } from '@vercel/postgres';
|
|
import { getUserFromRequest } from '../../../../lib/permission-middleware';
|
|
|
|
export default async function handler(req, res) {
|
|
const { id } = req.query;
|
|
|
|
if (req.method === 'GET') {
|
|
try {
|
|
// Get authenticated user
|
|
const user = await getUserFromRequest(req);
|
|
if (!user) {
|
|
return res.status(401).json({ error: 'Authentication required' });
|
|
}
|
|
|
|
// Get collections that contain this card and the user has access to
|
|
const result = await sql`
|
|
SELECT DISTINCT
|
|
c.id,
|
|
c.name,
|
|
c.description,
|
|
cc.quantity
|
|
FROM collections c
|
|
JOIN collection_cards cc ON c.id = cc.collection_id
|
|
LEFT JOIN collection_permissions cp ON c.id = cp.collection_id AND cp.user_id = ${user.userId}
|
|
WHERE cc.card_id = ${id}
|
|
AND (
|
|
c.user_id = ${user.userId} OR
|
|
(cp.id IS NOT NULL AND cp.status = 'active') OR
|
|
c.is_public = true
|
|
)
|
|
ORDER BY c.name
|
|
`;
|
|
|
|
res.status(200).json(result.rows);
|
|
} catch (error) {
|
|
console.error('Error fetching card collections:', error);
|
|
res.status(500).json({ error: 'Failed to fetch card collections' });
|
|
}
|
|
} else if (req.method === 'POST') {
|
|
try {
|
|
// Get authenticated user
|
|
const user = await getUserFromRequest(req);
|
|
if (!user) {
|
|
return res.status(401).json({ error: 'Authentication required' });
|
|
}
|
|
|
|
const { collectionId } = req.body;
|
|
|
|
// Check if user has permission to add cards to this collection
|
|
const permissionCheck = await sql`
|
|
SELECT c.id, c.user_id, cp.role
|
|
FROM collections c
|
|
LEFT JOIN collection_permissions cp ON c.id = cp.collection_id AND cp.user_id = ${user.userId}
|
|
WHERE c.id = ${collectionId}
|
|
AND (
|
|
c.user_id = ${user.userId} OR
|
|
(cp.role IN ('editor', 'owner') AND cp.status = 'active')
|
|
)
|
|
`;
|
|
|
|
if (permissionCheck.rows.length === 0) {
|
|
return res.status(403).json({ error: 'Permission denied' });
|
|
}
|
|
|
|
// Add card to collection
|
|
await sql`
|
|
INSERT INTO collection_cards (collection_id, card_id, quantity)
|
|
VALUES (${collectionId}, ${id}, 1)
|
|
ON CONFLICT (collection_id, card_id)
|
|
DO UPDATE SET quantity = collection_cards.quantity + 1
|
|
`;
|
|
|
|
res.status(200).json({
|
|
success: true,
|
|
message: 'Card added to collection'
|
|
});
|
|
} catch (error) {
|
|
console.error('Error adding card to collection:', error);
|
|
res.status(500).json({ error: 'Failed to add card to collection' });
|
|
}
|
|
} else {
|
|
res.status(405).json({ error: 'Method not allowed' });
|
|
}
|
|
}
|