deckhearth/pages/api/user/profile.js

import { sql } from '@vercel/postgres';
import { getUserFromRequest } from '../../../lib/permission-middleware';

export default async function handler(req, res) {
  try {
    // Get authenticated user
    const user = await getUserFromRequest(req);
    if (!user) {
      return res.status(401).json({ error: 'Authentication required' });
    }

    if (req.method === 'GET') {
      // Get user profile
      const result = await sql`
        SELECT 
          id, email, role, first_name, last_name, username, bio, avatar_url,
          favorite_games, collection_visibility, preferred_currency,
          cards_per_page, default_view, notifications_email, 
          notifications_marketing, two_factor_enabled, theme, language,
          created_at, updated_at
        FROM users 
        WHERE id = ${user.userId}
      `;

      if (result.rows.length === 0) {
        return res.status(404).json({ error: 'User not found' });
      }

      const userProfile = result.rows[0];
      
      // Parse JSON fields
      if (userProfile.favorite_games && typeof userProfile.favorite_games === 'string') {
        try {
          userProfile.favorite_games = JSON.parse(userProfile.favorite_games);
        } catch (e) {
          userProfile.favorite_games = ['MTG'];
        }
      }

      res.status(200).json(userProfile);

    } else if (req.method === 'PUT') {
      // Update user profile
      const {
        first_name,
        last_name,
        username,
        bio,
        favorite_games
      } = req.body;

      // Validate username uniqueness if provided
      if (username) {
        const existingUser = await sql`
          SELECT id FROM users 
          WHERE username = ${username} AND id != ${user.userId}
        `;
        
        if (existingUser.rows.length > 0) {
          return res.status(400).json({ error: 'Username already taken' });
        }
      }

      // Validate favorite_games format
      if (favorite_games && !Array.isArray(favorite_games)) {
        return res.status(400).json({ error: 'favorite_games must be an array' });
      }

      // Update user profile
      const result = await sql`
        UPDATE users 
        SET 
          first_name = ${first_name || null},
          last_name = ${last_name || null},
          username = ${username || null},
          bio = ${bio || null},
          favorite_games = ${favorite_games ? JSON.stringify(favorite_games) : null},
          updated_at = CURRENT_TIMESTAMP
        WHERE id = ${user.userId}
        RETURNING 
          id, email, role, first_name, last_name, username, bio, avatar_url,
          favorite_games, collection_visibility, preferred_currency,
          cards_per_page, default_view, notifications_email, 
          notifications_marketing, two_factor_enabled, theme, language,
          created_at, updated_at
      `;

      if (result.rows.length === 0) {
        return res.status(404).json({ error: 'User not found' });
      }

      const updatedProfile = result.rows[0];
      
      // Parse JSON fields
      if (updatedProfile.favorite_games && typeof updatedProfile.favorite_games === 'string') {
        try {
          updatedProfile.favorite_games = JSON.parse(updatedProfile.favorite_games);
        } catch (e) {
          updatedProfile.favorite_games = ['MTG'];
        }
      }

      res.status(200).json(updatedProfile);

    } else {
      res.status(405).json({ error: 'Method not allowed' });
    }

  } catch (error) {
    console.error('Profile API error:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
}