const express = require('express');
const { getSupabaseServiceClient } = require('../utils/supabase');

const router = express.Router();

router.post('/', async (req, res) => {
  const { email, list, website } = req.body;

  // Honeypot check — bots fill hidden "website" field, humans don't
  if (website) {
    // Silently discard — return 200 so bots think it worked
    return res.json({ success: true });
  }

  if (!email || !email.includes('@') || !list) {
    return res.status(400).json({ error: 'Email and list name required' });
  }

  try {
    const supabase = getSupabaseServiceClient();
    await supabase.from('waitlist').upsert(
      { email: email.toLowerCase().trim(), list_name: list },
      { onConflict: 'email,list_name' }
    );
    return res.json({ success: true });
  } catch (err) {
    console.error('[VYNDR] Waitlist error:', err.message);
    return res.json({ success: true }); // Never reveal errors to potential bots
  }
});

module.exports = router;