a bunch of changes

server/api/user/profile.get.ts

@@ -0,0 +1,44 @@
+import { query } from '../../utils/db'
+
+function parseJwt(token: string) {
+  try {
+    const base64Payload = token.split('.')[1]
+    return JSON.parse(Buffer.from(base64Payload, 'base64').toString('utf8'))
+  } catch {
+    return null
+  }
+}
+
+export default defineEventHandler(async (event) => {
+  const authHeader = getRequestHeader(event, 'authorization')
+  const token = authHeader?.replace('Bearer ', '')
+
+  if (!token) {
+    throw createError({ statusCode: 401, statusMessage: 'Missing authorization header' })
+  }
+
+  const decoded = parseJwt(token)
+  if (!decoded?.sub) {
+    throw createError({ statusCode: 401, statusMessage: 'Invalid token' })
+  }
+
+  let dbUser = null
+  try {
+    const result = await query(
+      `SELECT sfid, pid, first_login_completed FROM users WHERE keycloak_id = $1 LIMIT 1`,
+      [decoded.sub]
+    )
+    dbUser = result.rows[0] || null
+  } catch (error) {
+    console.error('[DB PROFILE FETCH ERROR]:', error)
+  }
+
+  return {
+    keycloakId: decoded.sub,
+    username: decoded.preferred_username || decoded.given_name || 'User',
+    email: decoded.email,
+    sfid: dbUser?.sfid || null,
+    pid: dbUser?.pid || null,
+    firstLoginCompleted: dbUser?.first_login_completed || false
+  }
+})