← back to Norma Platform

app/api/consent/route.ts

16 lines

import { NextRequest, NextResponse } from 'next/server';
import { body, CampaignError, failure } from '@/lib/campaigns/validation';
import { confirmConsent, consentRateLimit, unsubscribeConsent } from '@/lib/campaigns/consent';
export const dynamic = 'force-dynamic';
// Public, token-gated. No session — possession of the emailed link is the authorization.
// A landing page POSTs here same-origin so a link prefetch can never flip consent state.
export async function POST(request: NextRequest) {
  try {
    const data = await body(request);
    await consentRateLimit(request);
    if (data.choice === 'confirm') return NextResponse.json(await confirmConsent(data.supporter_id as string, data.token), { headers: { 'Cache-Control': 'no-store' } });
    if (data.choice === 'unsubscribe') return NextResponse.json(await unsubscribeConsent(data.supporter_id as string, data.token), { headers: { 'Cache-Control': 'no-store' } });
    throw new CampaignError(400, 'Choose confirm or unsubscribe.');
  } catch (error) { return failure(error); }
}