deckhearth/pages/api/collections/[id]/cards.js

import { sql } from '@vercel/postgres';
import { withCollectionPermission, logCollectionActivity } from '../../../../lib/permission-middleware';

async function handler(req, res) {
  // Set CORS headers
  res.setHeader('Access-Control-Allow-Origin', '*');
  res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
  res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');

  // Handle preflight requests
  if (req.method === 'OPTIONS') {
    res.status(200).end();
    return;
  }

  const { id } = req.query; // collection id

  if (req.method === 'POST') {
    // Add card to collection
    try {
      const { cardId, quantity = 1 } = req.body;

      if (!cardId) {
        return res.status(400).json({ error: 'Card ID is required' });
      }

      // Check if card already exists in collection
      const existingResult = await sql`
        SELECT * FROM collection_cards 
        WHERE collection_id = ${id} AND card_id = ${cardId}
      `;

      if (existingResult.rows.length > 0) {
        // Update quantity if card already exists
        const result = await sql`
          UPDATE collection_cards 
          SET quantity = quantity + ${quantity}
          WHERE collection_id = ${id} AND card_id = ${cardId}
          RETURNING *
        `;
        
        await logCollectionActivity(id, req.user.userId, 'card_quantity_updated', {
          cardId,
          oldQuantity: existingCard.quantity,
          newQuantity: quantity
        });

        res.status(200).json({ 
          message: 'Card quantity updated in collection',
          card: result.rows[0]
        });
      } else {
        // Add new card to collection
        const result = await sql`
          INSERT INTO collection_cards (collection_id, card_id, quantity)
          VALUES (${id}, ${cardId}, ${quantity})
          RETURNING *
        `;

        await logCollectionActivity(id, req.user.userId, 'card_added', {
          cardId,
          quantity
        });

        res.status(201).json({ 
          message: 'Card added to collection',
          card: result.rows[0]
        });
      }

    } catch (error) {
      console.error('Error adding card to collection:', error);
      res.status(500).json({ error: 'Internal server error' });
    }
  } else if (req.method === 'PUT') {
    // Update card quantity in collection
    try {
      const { cardId, quantity } = req.body;

      if (!cardId || quantity === undefined) {
        return res.status(400).json({ error: 'Card ID and quantity are required' });
      }

      if (quantity <= 0) {
        // Remove card if quantity is 0 or negative
        await sql`
          DELETE FROM collection_cards 
          WHERE collection_id = ${id} AND card_id = ${cardId}
        `;
        
        await logCollectionActivity(id, req.user.userId, 'card_removed', {
          cardId,
          reason: 'quantity_zero'
        });
        
        res.status(200).json({ message: 'Card removed from collection' });
      } else {
        // Update quantity
        const result = await sql`
          UPDATE collection_cards 
          SET quantity = ${quantity}
          WHERE collection_id = ${id} AND card_id = ${cardId}
          RETURNING *
        `;

        if (result.rows.length === 0) {
          return res.status(404).json({ error: 'Card not found in collection' });
        }

        await logCollectionActivity(id, req.user.userId, 'card_quantity_updated', {
          cardId,
          newQuantity: quantity
        });

        res.status(200).json({ 
          message: 'Card quantity updated',
          card: result.rows[0]
        });
      }

    } catch (error) {
      console.error('Error updating card in collection:', error);
      res.status(500).json({ error: 'Internal server error' });
    }
  } else if (req.method === 'DELETE') {
    // Remove card from collection
    try {
      const { cardId } = req.body;

      if (!cardId) {
        return res.status(400).json({ error: 'Card ID is required' });
      }

      const result = await sql`
        DELETE FROM collection_cards 
        WHERE collection_id = ${id} AND card_id = ${cardId}
        RETURNING *
      `;

      if (result.rows.length === 0) {
        return res.status(404).json({ error: 'Card not found in collection' });
      }

      await logCollectionActivity(id, req.user.userId, 'card_removed', {
        cardId,
        reason: 'explicit_delete'
      });

      res.status(200).json({ message: 'Card removed from collection' });

    } catch (error) {
      console.error('Error removing card from collection:', error);
      res.status(500).json({ error: 'Internal server error' });
    }
  } else {
    res.status(405).json({ error: 'Method not allowed' });
  }
}

// Apply permission middleware - all card operations require editor permissions
export default withCollectionPermission('editor')(handler);