// Public REST API — single user profile by username.
//
// AtomCMS exposed read-only profile JSON for the game site / external
// integrations. Mirrors the same safe field set selected by the public profile
// page (src/app/u/[username]/page.tsx). Never exposes password / auth_ticket /
// 2FA secrets / pincode / mail.

import { apiJson } from "@/lib/api";
import { prisma } from "@/lib/prisma";

export const dynamic = "force-dynamic";

export async function GET(
  _req: Request,
  { params }: { params: Promise<{ username: string }> },
) {
  const { username } = await params;

  try {
    const user = await prisma.user.findUnique({
      where: { username },
      select: {
        username: true,
        look: true,
        motto: true,
        rank: true,
        credits: true,
        online: true,
        accountCreated: true,
      },
    });

    if (!user) {
      return apiJson({ error: "User not found" }, { status: 404 });
    }

    return apiJson({
      username: user.username,
      look: user.look,
      motto: user.motto,
      rank: user.rank,
      credits: user.credits,
      online: user.online === "1",
      accountCreated: user.accountCreated,
    });
  } catch {
    // DB unreachable — behave as "not found" rather than 500.
    return apiJson({ error: "User not found" }, { status: 404 });
  }
}