Sessions 5-7a: 955 tests, deployment ready

web/src/app/api/waitlist/route.ts

@@ -0,0 +1,36 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { jsonError } from '@/lib/auth-helpers';
+import { getServiceRoleSupabase } from '@/lib/supabase';
+
+export const dynamic = 'force-dynamic';
+
+const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+const ALLOWED_LISTS = new Set(['merch', 'ledger-book', 'The Line', 'The Edge', 'The Correlation', 'The System', 'general']);
+
+export async function POST(req: NextRequest) {
+  let body: { email?: string; list?: string; honeypot?: string };
+  try {
+    body = await req.json();
+  } catch {
+    return jsonError(400, 'Invalid JSON.');
+  }
+
+  // Honeypot — silently accept then drop
+  if (body.honeypot) return NextResponse.json({ ok: true });
+
+  if (!body.email || !EMAIL_RE.test(body.email)) {
+    return jsonError(400, 'Enter a valid email.');
+  }
+  const list = body.list && ALLOWED_LISTS.has(body.list) ? body.list : 'general';
+
+  const sb = getServiceRoleSupabase();
+  if (sb) {
+    await sb
+      .from('waitlist_signups')
+      .insert({ email: body.email.toLowerCase(), list, source: 'web' })
+      .select()
+      .maybeSingle();
+  }
+
+  return NextResponse.json({ ok: true, list });
+}