// Source: raku-rentals/backend/api/index.js
app.post('/api/auth/register', requireAuth, async (req, res) => {
  const uid   = req.authUser.id;
  const email = req.authUser.email;
  // Trust only verified JWT claims — client request body is not trusted
  const meta  = req.authUser.user_metadata || {};
  const fullName = (meta.full_name || '').trim() || 'Unknown';
  const phone    = (meta.phone    || '').trim();

  const client = await pool.connect();
  try {
    await client.query('BEGIN');

    // 1. Fast path: bridge already exists (idempotent on repeat logins)
    const existing = await client.query(
      'select customer_id from user_account where supabase_auth_id = $1',
      [uid]
    );
    if (existing.rows.length) {
      await client.query('COMMIT');
      return res.status(200).json({ customer_id: existing.rows[0].customer_id, created: false });
    }

    // 2. Slow path: create customer profile then link to user_account
    const cust = await client.query(
      'insert into customer (full_name, phone, email) values ($1, $2, $3) returning customer_id',
      [fullName, phone, email]
    );
    const customerId = cust.rows[0].customer_id;

    const ua = await client.query(
      `insert into user_account (supabase_auth_id, customer_id, role)
       values ($1, $2, 'Customer')
       on conflict (supabase_auth_id) do nothing
       returning user_account_id`,
      [uid, customerId]
    );

    if (ua.rows.length === 0) {
      // Concurrent race condition won by another request: roll back customer insert
      await client.query('ROLLBACK');
      const winner = await client.query(
        'select customer_id from user_account where supabase_auth_id = $1',
        [uid]
      );
      return res.status(200).json({ customer_id: winner.rows[0].customer_id, created: false });
    }

    await client.query('COMMIT');
    return res.status(201).json({ customer_id: customerId, created: true });
  } catch (err) {
    await client.query('ROLLBACK');
    return res.status(500).json({ error: 'bridge_failed' });
  } finally {
    client.release();
  }
});