f408e151c8
🚨 Fixed Major Data Leakage Issues: - Replaced hardcoded user_id = 1 with proper JWT authentication - Fixed collections API to filter by authenticated user - Fixed card ownership to use user_cards table (not global cards table) - Fixed decks API to return only user-owned decks - Fixed card collections/decks APIs to respect user permissions - Fixed favorites API to use user_favorites table 🛡️ Authentication & Authorization: - All endpoints now require valid JWT tokens - Proper user isolation across all data operations - Collection permissions properly enforced - User-specific data queries implemented 🔧 Database Schema Fixes: - Card ownership now uses user_cards table - Favorites use user_favorites table - Decks filtered by user_id - Collections respect ownership and permissions ⚠️ Development Note: - Added warning for fallback authentication in dev mode - Should be removed in production deployment ✅ Data Privacy Secured: - Users can only see their own collections, decks, and owned cards - Public collections visible to all (as intended) - Shared collections respect permission levels - No cross-user data leakage
46 lines
No EOL
1.3 KiB
JavaScript
46 lines
No EOL
1.3 KiB
JavaScript
import { sql } from '@vercel/postgres';
|
|
import { getUserFromRequest } from '../../lib/permission-middleware';
|
|
|
|
export default async function handler(req, res) {
|
|
if (req.method !== 'GET') {
|
|
return res.status(405).json({ error: 'Method not allowed' });
|
|
}
|
|
|
|
try {
|
|
// Get authenticated user
|
|
const user = await getUserFromRequest(req);
|
|
if (!user) {
|
|
return res.status(401).json({ error: 'Authentication required' });
|
|
}
|
|
|
|
// Get user's decks from database
|
|
const result = await sql`
|
|
SELECT
|
|
d.*,
|
|
COUNT(dc.card_id) as card_count,
|
|
COALESCE(SUM(cards.market_price * dc.quantity), 0) as total_value
|
|
FROM decks d
|
|
LEFT JOIN deck_cards dc ON d.id = dc.deck_id
|
|
LEFT JOIN cards ON dc.card_id = cards.id
|
|
WHERE d.user_id = ${user.userId}
|
|
GROUP BY d.id
|
|
ORDER BY d.updated_at DESC
|
|
`;
|
|
|
|
const decks = result.rows.map(deck => ({
|
|
id: deck.id,
|
|
name: deck.name,
|
|
description: deck.description,
|
|
game: deck.game,
|
|
cardCount: parseInt(deck.card_count) || 0,
|
|
value: parseFloat(deck.total_value) || 0,
|
|
createdAt: deck.created_at,
|
|
updatedAt: deck.updated_at
|
|
}));
|
|
|
|
res.status(200).json(decks);
|
|
} catch (error) {
|
|
console.error('Error fetching decks:', error);
|
|
res.status(500).json({ error: 'Failed to fetch decks' });
|
|
}
|
|
}
|