Sessions 5-7a: 955 tests, deployment ready

src/routes/waitlist.js

@@ -0,0 +1,32 @@
+const express = require('express');
+const { getSupabaseServiceClient } = require('../utils/supabase');
+
+const router = express.Router();
+
+router.post('/', async (req, res) => {
+  const { email, list, website } = req.body;
+
+  // Honeypot check — bots fill hidden "website" field, humans don't
+  if (website) {
+    // Silently discard — return 200 so bots think it worked
+    return res.json({ success: true });
+  }
+
+  if (!email || !email.includes('@') || !list) {
+    return res.status(400).json({ error: 'Email and list name required' });
+  }
+
+  try {
+    const supabase = getSupabaseServiceClient();
+    await supabase.from('waitlist').upsert(
+      { email: email.toLowerCase().trim(), list_name: list },
+      { onConflict: 'email,list_name' }
+    );
+    return res.json({ success: true });
+  } catch (err) {
+    console.error('[VYNDR] Waitlist error:', err.message);
+    return res.json({ success: true }); // Never reveal errors to potential bots
+  }
+});
+
+module.exports = router;