// Public REST API — single user profile by username.
//
// AtomCMS exposed read-only profile JSON for the game site / external
// integrations. Mirrors the same safe field set selected by the public profile
// page (src/app/u/[username]/page.tsx). Never exposes password / auth_ticket /
// 2FA secrets / pincode / mail.

import { eq } from "drizzle-orm";
import { apiJson } from "@/lib/api";
import { db, User } from "@/lib/db";

export const dynamic = "force-dynamic";

export async function GET(
	_req: Request,
	{ params }: { params: Promise<{ username: string }> },
) {
	const { username } = await params;

	try {
		const [user] = await db
			.select({
				username: User.username,
				look: User.look,
				motto: User.motto,
				rank: User.rank,
				credits: User.credits,
				online: User.online,
				accountCreated: User.accountCreated,
			})
			.from(User)
			.where(eq(User.username, username))
			.limit(1);

		if (!user) {
			return apiJson({ error: "User not found" }, { status: 404 });
		}

		return apiJson({
			username: user.username,
			look: user.look,
			motto: user.motto,
			rank: user.rank,
			credits: user.credits,
			online: user.online === "1",
			accountCreated: user.accountCreated,
		});
	} catch {
		// DB unreachable — behave as "not found" rather than 500.
		return apiJson({ error: "User not found" }, { status: 404 });
	}
}