deckhearth/pages/api/collections/[identifier]/activity.js

import { sql } from '@vercel/postgres';
import { getUserFromRequest } from '../../../../lib/permission-middleware';
import { isValidSlug } from '../../../../lib/slug-utils';

export default async function handler(req, res) {
  if (req.method !== 'GET') {
    return res.status(405).json({ error: 'Method not allowed' });
  }

  try {
    // Get authenticated user
    const user = await getUserFromRequest(req);
    if (!user) {
      return res.status(401).json({ error: 'Authentication required' });
    }

    const { identifier } = req.query;

    if (!identifier) {
      return res.status(400).json({ error: 'Collection identifier is required' });
    }

    // Determine if identifier is a slug or numeric ID
    const isSlug = isValidSlug(identifier) || isNaN(parseInt(identifier));
    
    // Verify user has access to this collection
    let collectionResult;
    if (isSlug) {
      collectionResult = await sql`
        SELECT c.*, cp.role as user_role
        FROM collections c
        LEFT JOIN collection_permissions cp ON c.id = cp.collection_id AND cp.user_id = ${user.userId} AND cp.status = 'active'
        WHERE c.slug = ${identifier}
          AND (
            c.user_id = ${user.userId} OR
            cp.id IS NOT NULL OR
            c.is_public = true
          )
      `;
    } else {
      const numericId = parseInt(identifier);
      collectionResult = await sql`
        SELECT c.*, cp.role as user_role
        FROM collections c
        LEFT JOIN collection_permissions cp ON c.id = cp.collection_id AND cp.user_id = ${user.userId} AND cp.status = 'active'
        WHERE c.id = ${numericId}
          AND (
            c.user_id = ${user.userId} OR
            cp.id IS NOT NULL OR
            c.is_public = true
          )
      `;
    }

    if (collectionResult.length === 0) {
      return res.status(404).json({ error: 'Collection not found or access denied' });
    }

    const collection = collectionResult[0];

    // Get collection activity (this would typically come from an activity log table)
    // For now, we'll return a simple mock response
    const activities = [
      {
        id: 1,
        type: 'card_added',
        description: 'Added Lightning Bolt to collection',
        timestamp: new Date().toISOString(),
        user: user.email
      }
    ];

    res.status(200).json({ activities });

  } catch (error) {
    console.error('Collection activity API error:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
}