API and web running with same command

server/index.js

@@ -137,6 +137,27 @@ app.get('/api/auth/session', requireAuth, (req, res) => {
   res.json({ user: { id: req.userId } });
 });
 
+app.get('/api/auth/profile', requireAuth, async (req, res) => {
+  try {
+    const { data, error } = await req.supabase
+      .from('profiles')
+      .select('id, display_name, email, avatar_url')
+      .eq('id', req.userId)
+      .single();
+    if (error && error.code !== 'PGRST116') {
+      res.status(500).json({ error: error.message });
+      return;
+    }
+    if (!data) {
+      res.status(404).json({ error: 'Profile not found' });
+      return;
+    }
+    res.json(data);
+  } catch (e) {
+    res.status(500).json({ error: e?.message ?? 'Failed to load profile' });
+  }
+});
+
 app.get('/api/decks/mine', requireAuth, async (req, res) => {
   try {
     const decks = await decksApi.fetchMyDecks(req.supabase, req.userId);
@@ -269,14 +290,15 @@ app.patch('/api/decks/:id', requireAuth, express.json(), async (req, res) => {
   }
 });
 
-app.post('/api/decks/:id/publish', requireAuth, async (req, res) => {
+app.post('/api/decks/:id/publish', requireAuth, express.json(), async (req, res) => {
   try {
     const { data: deck } = await req.supabase.from('decks').select('owner_id').eq('id', req.params.id).single();
     if (!deck || deck.owner_id !== req.userId) {
       res.status(404).json({ error: 'Deck not found' });
       return;
     }
-    await decksApi.togglePublished(req.supabase, req.params.id, true);
+    const published = req.body?.published !== false;
+    await decksApi.togglePublished(req.supabase, req.params.id, published);
     res.json({ ok: true });
   } catch (e) {
     res.status(500).json({ error: e?.message ?? 'Failed to publish' });
@@ -322,6 +344,20 @@ app.post('/api/decks/:id/apply-update', requireAuth, async (req, res) => {
   }
 });
 
+app.delete('/api/decks/:id', requireAuth, async (req, res) => {
+  try {
+    const { data: deck } = await req.supabase.from('decks').select('owner_id').eq('id', req.params.id).single();
+    if (!deck || deck.owner_id !== req.userId) {
+      res.status(404).json({ error: 'Deck not found' });
+      return;
+    }
+    await decksApi.deleteDeck(req.supabase, req.params.id);
+    res.status(204).send();
+  } catch (e) {
+    res.status(500).json({ error: e?.message ?? 'Failed to delete deck' });
+  }
+});
+
 const PORT = process.env.PORT || 3001;
 app.listen(PORT, () => {
   console.log(`API server listening on http://localhost:${PORT}`);