fix: enforce unique WakaTime API key and handle errors

app/api/wakatime/sync/route.ts

@@ -85,10 +85,24 @@ export async function GET(request: Request) {
   }
 
   if (apiKey) {
-    await supabase
+    const { error } = await supabase
       .from("profiles")
       .update({ wakatime_api_key: apiKey })
       .eq("id", user.id);
+
+    if (error) {
+      if (error.code === "23505") {
+        return NextResponse.json(
+          { error: "This WakaTime API key is already in use." },
+          { status: 400 },
+        );
+      }
+
+      return NextResponse.json(
+        { error: "Failed to update API key" },
+        { status: 500 },
+      );
+    }
   }
 
   const { data: statsResult, error: statsError } = await supabase

sql/public.profiles.sql

@@ -2,7 +2,7 @@
 create table public.profiles (
   id uuid primary key references auth.users(id) on delete cascade,
   email text not null,
-  wakatime_api_key text,
+  wakatime_api_key text default null unique,
   created_at timestamp with time zone default now()
 );