Fix: Fix profile-login

app/api/profile/route.ts

@@ -1,26 +1,52 @@
 import { NextRequest, NextResponse } from "next/server";
 import { createClient } from "@/lib/supabase/server";
 
-export async function GET() {
+export async function GET(request: NextRequest) {
   const supabase = await createClient();
 
   try {
-    // Get the authenticated user
-    const { data: { user }, error: authError } = await supabase.auth.getUser();
-
-    if (authError || !user) {
-      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    // Try to get user ID from multiple sources
+    let userId: string | null = null;
+    let userEmail: string | null = null;
+
+    // First, try Supabase auth (for existing sessions)
+    const { data: { user: supabaseUser }, error: authError } = await supabase.auth.getUser();
+    if (supabaseUser && !authError) {
+      userId = supabaseUser.id;
+      userEmail = supabaseUser.email || null;
+    } else {
+      // For PESU auth users, validate the request more carefully
+      const userIdFromHeader = request.headers.get('X-User-ID');
+
+      if (!userIdFromHeader) {
+        return NextResponse.json({ error: "No user session found. Please log in again." }, { status: 401 });
+      }
+
+      // Additional validation: Check if the user exists in the database
+      // This prevents completely arbitrary user IDs while still allowing PESU auth
+      const { data: userExists } = await supabase
+        .from('user_profiles')
+        .select('id')
+        .eq('id', userIdFromHeader)
+        .single();
+
+      if (!userExists) {
+        return NextResponse.json({ error: "Invalid user session. Please log in again." }, { status: 401 });
+      }
+
+      userId = userIdFromHeader;
     }
 
-    // Get user profile
+    // Get user profile using the userId
     const { data: profile, error: profileError } = await supabase
       .from('user_profiles')
       .select('*')
-      .eq('id', user.id)
+      .eq('id', userId)
       .single();
 
     if (profileError) {
-      return NextResponse.json({ error: profileError.message }, { status: 500 });
+      console.error('Profile error:', profileError);
+      return NextResponse.json({ error: "Profile not found. Please try logging in again." }, { status: 404 });
     }
 
     // Get user's items
@@ -30,7 +56,7 @@ export async function GET() {
         *,
         categories (name)
       `)
-      .eq('seller_id', user.id)
+      .eq('seller_id', userId)
       .order('created_at', { ascending: false });
 
     if (itemsError) {
@@ -67,7 +93,7 @@ export async function GET() {
     const responseData = {
       profile: {
         ...profile,
-        email: user.email
+        email: userEmail || profile.email
       },
       items: itemsWithStats,
       stats: {
@@ -93,15 +119,38 @@ export async function PUT(req: NextRequest) {
   const supabase = await createClient();
 
   try {
-    // Get the authenticated user
-    const { data: { user }, error: authError } = await supabase.auth.getUser();
-
-    if (authError || !user) {
-      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    // Try to get user ID from multiple sources
+    let userId: string | null = null;
+
+    // First, try Supabase auth (for existing sessions)
+    const { data: { user: supabaseUser }, error: authError } = await supabase.auth.getUser();
+    if (supabaseUser && !authError) {
+      userId = supabaseUser.id;
+    } else {
+      // For PESU auth users, validate the request more carefully
+      const userIdFromHeader = req.headers.get('X-User-ID');
+
+      if (!userIdFromHeader) {
+        return NextResponse.json({ error: "No user session found. Please log in again." }, { status: 401 });
+      }
+
+      // Additional validation: Check if the user exists in the database
+      // This prevents completely arbitrary user IDs while still allowing PESU auth
+      const { data: userExists } = await supabase
+        .from('user_profiles')
+        .select('id')
+        .eq('id', userIdFromHeader)
+        .single();
+
+      if (!userExists) {
+        return NextResponse.json({ error: "Invalid user session. Please log in again." }, { status: 401 });
+      }
+
+      userId = userIdFromHeader;
     }
 
     const body = await req.json();
-    const { name, bio, phone, year_of_study, branch, location } = body;
+    const { name, bio, phone, nickname, year_of_study, branch, location } = body;
 
     // Update user profile
     const { data, error } = await supabase
@@ -110,12 +159,13 @@ export async function PUT(req: NextRequest) {
         name,
         bio,
         phone,
+        nickname,
         year_of_study,
         branch,
         location,
         updated_at: new Date().toISOString()
       })
-      .eq('id', user.id)
+      .eq('id', userId)
       .select()
       .single();