// Public REST API — the currently signed-in user.
//
// Reads the NextAuth session, then re-queries prisma.user by the session id to
// return a safe field set (never password / auth_ticket / 2FA secrets / pincode
// / mail). Returns { user: null } only when unauthenticated or missing.

import { apiJson, apiUnavailable } from "@/lib/api";
import { auth } from "@/lib/auth";
import { prisma } from "@/lib/prisma";
import { sessionUserId } from "@/lib/auth/session-user";

export const dynamic = "force-dynamic";

export async function GET(_req: Request) {
  const session = await auth();
  const id = sessionUserId(session?.user?.id);
  if (!id) {
    return apiJson({ user: null });
  }

  try {
    const user = await prisma.user.findUnique({
      where: { id },
      select: {
        id: true,
        username: true,
        look: true,
        motto: true,
        rank: true,
        credits: true,
        pixels: true,
        points: true,
        gender: true,
        online: true,
        accountCreated: true,
      },
    });

    if (!user) {
      return apiJson({ user: null });
    }

    return apiJson({
      user: {
        id: user.id,
        username: user.username,
        look: user.look,
        motto: user.motto,
        rank: user.rank,
        credits: user.credits,
        pixels: user.pixels,
        points: user.points,
        gender: user.gender,
        online: user.online === "1",
        accountCreated: user.accountCreated,
      },
    });
  } catch {
    return apiUnavailable("Account data is temporarily unavailable");
  }
}