Closes P0 #5 (CORS) from PARTIAL → RESOLVED. fix-auth-bypass
Brief 4 (commit 297afca) cleaned login + register; this brief
sweeps the remaining 24 pages/api/** handlers that carried the
identical scaffolded wildcard-CORS + redundant-OPTIONS pattern,
plus adds a blocking forbidden-cors-headers CI job to lock in
the cleanup against future regression.
Per architect Decision 1 — Option B (sweep all 24 in one PR)
chosen over Option A (narrow verify.js-only + queue separate
sweep). Pattern-drift audit (14 of 24 files spot-checked across
parent + architect) found zero drift; mechanical safety
confirmed.
Per Decision 2 — OPTIONS handler deleted entirely (matches
Brief 4 precedent). Same-origin Vercel deployment doesn't
preflight; method check at top of handler returns 405 if any
client ever sends OPTIONS again.
Per Decision 3 — verify.js's overly-permissive Allow-Methods:
'GET, POST, PUT, DELETE, OPTIONS' is moot (deleted under D2);
the handler's existing `if (req.method !== 'GET') return 405`
guard at line 17 (now line ~5) is the remaining gate.
Per Decision 4 — no new per-route tests this convoy. None of
the 24 routes have vitest coverage today; adding handler-level
tests is the queued fill-vitest-handler-coverage convoy.
Per Decision 5 — new `forbidden-cors-headers` CI job added,
modeled verbatim on `forbidden-endpoints`. Blocking (no
`|| true`, no `continue-on-error`). Greps pages/api/ for any
`Access-Control-Allow-(Origin|Methods|Headers)` reappearance
and exits 1 on hit.
Verification:
- npm run lint: 128 problems (baseline match)
- npm run test:run: 21/21 vitest pass (no regression)
- git grep -nE "Access-Control-Allow-..." -- 'pages/api/**':
zero matches
- git grep -nE "OPTIONS" -- 'pages/api/**': zero matches
(post-sweep)
- new forbidden-cors-headers grep exits 0 against swept tree
No code paths in lib/**, components/**, scripts/**, or test/**
touched. No package.json / lockfile churn. No workflow YAML
beyond the single ci.yml job addition. No AGENTS.md edits
(doc-writer pass at convoy close).
Co-authored-by: Cursor <cursoragent@cursor.com>
125 lines
No EOL
4 KiB
JavaScript
125 lines
No EOL
4 KiB
JavaScript
import { sql } from '@vercel/postgres';
|
|
import { getUserFromRequest } from '../../../lib/permission-middleware';
|
|
|
|
export default async function handler(req, res) {
|
|
if (req.method !== 'GET') {
|
|
return res.status(405).json({ error: 'Method not allowed' });
|
|
}
|
|
|
|
try {
|
|
// Get authenticated user
|
|
const user = await getUserFromRequest(req);
|
|
if (!user) {
|
|
return res.status(401).json({ error: 'Authentication required' });
|
|
}
|
|
|
|
// Get total cards owned by user
|
|
const cardsResult = await sql`
|
|
SELECT COALESCE(SUM(quantity), 0) as total_cards
|
|
FROM user_cards
|
|
WHERE user_id = ${user.userId}
|
|
`;
|
|
|
|
// Get total collections owned by user
|
|
const collectionsResult = await sql`
|
|
SELECT COUNT(*) as total_collections
|
|
FROM collections
|
|
WHERE user_id = ${user.userId}
|
|
`;
|
|
|
|
// Get total decks owned by user
|
|
const decksResult = await sql`
|
|
SELECT COUNT(*) as total_decks
|
|
FROM decks
|
|
WHERE user_id = ${user.userId}
|
|
`;
|
|
|
|
// Get total value of user's cards
|
|
const valueResult = await sql`
|
|
SELECT COALESCE(SUM(cards.market_price * user_cards.quantity), 0) as total_value
|
|
FROM user_cards
|
|
JOIN cards ON user_cards.card_id = cards.id
|
|
WHERE user_cards.user_id = ${user.userId}
|
|
AND cards.market_price IS NOT NULL
|
|
`;
|
|
|
|
// Get game breakdown
|
|
const gameBreakdownResult = await sql`
|
|
SELECT
|
|
cards.game,
|
|
COUNT(DISTINCT cards.id) as unique_cards,
|
|
COALESCE(SUM(user_cards.quantity), 0) as total_quantity,
|
|
COALESCE(SUM(cards.market_price * user_cards.quantity), 0) as total_value
|
|
FROM user_cards
|
|
JOIN cards ON user_cards.card_id = cards.id
|
|
WHERE user_cards.user_id = ${user.userId}
|
|
GROUP BY cards.game
|
|
ORDER BY total_value DESC
|
|
`;
|
|
|
|
// Get rarity breakdown
|
|
const rarityBreakdownResult = await sql`
|
|
SELECT
|
|
cards.rarity,
|
|
COUNT(DISTINCT cards.id) as unique_cards,
|
|
COALESCE(SUM(user_cards.quantity), 0) as total_quantity,
|
|
COALESCE(SUM(cards.market_price * user_cards.quantity), 0) as total_value
|
|
FROM user_cards
|
|
JOIN cards ON user_cards.card_id = cards.id
|
|
WHERE user_cards.user_id = ${user.userId}
|
|
GROUP BY cards.rarity
|
|
ORDER BY total_value DESC
|
|
`;
|
|
|
|
// Get recent activity (last 10 cards added)
|
|
const recentActivityResult = await sql`
|
|
SELECT
|
|
cards.name,
|
|
cards.game,
|
|
cards.rarity,
|
|
cards.image_url,
|
|
cards.market_price,
|
|
user_cards.quantity,
|
|
user_cards.created_at
|
|
FROM user_cards
|
|
JOIN cards ON user_cards.card_id = cards.id
|
|
WHERE user_cards.user_id = ${user.userId}
|
|
ORDER BY user_cards.created_at DESC
|
|
LIMIT 10
|
|
`;
|
|
|
|
const stats = {
|
|
totalCards: parseInt(cardsResult.rows[0].total_cards) || 0,
|
|
totalCollections: parseInt(collectionsResult.rows[0].total_collections) || 0,
|
|
totalDecks: parseInt(decksResult.rows[0].total_decks) || 0,
|
|
totalValue: parseFloat(valueResult.rows[0].total_value) || 0,
|
|
gameBreakdown: gameBreakdownResult.rows.map(row => ({
|
|
game: row.game,
|
|
uniqueCards: parseInt(row.unique_cards),
|
|
totalQuantity: parseInt(row.total_quantity),
|
|
totalValue: parseFloat(row.total_value)
|
|
})),
|
|
rarityBreakdown: rarityBreakdownResult.rows.map(row => ({
|
|
rarity: row.rarity,
|
|
uniqueCards: parseInt(row.unique_cards),
|
|
totalQuantity: parseInt(row.total_quantity),
|
|
totalValue: parseFloat(row.total_value)
|
|
})),
|
|
recentActivity: recentActivityResult.rows.map(row => ({
|
|
name: row.name,
|
|
game: row.game,
|
|
rarity: row.rarity,
|
|
imageUrl: row.image_url,
|
|
marketPrice: parseFloat(row.market_price) || 0,
|
|
quantity: parseInt(row.quantity),
|
|
addedAt: row.created_at
|
|
}))
|
|
};
|
|
|
|
res.status(200).json(stats);
|
|
|
|
} catch (error) {
|
|
console.error('Stats API error:', error);
|
|
res.status(500).json({ error: 'Internal server error' });
|
|
}
|
|
}
|