27 lines
1.1 KiB
TypeScript
27 lines
1.1 KiB
TypeScript
// API route: POST /api/invite. Validates the body with the SAME schema the
|
|
// modal's invite form uses in the browser, so a request that bypasses the
|
|
// client (curl, a replayed fetch, a stale page) is held to identical rules.
|
|
//
|
|
// There is no mail provider connected up in the example, so a successful parse
|
|
// just echoes the invite back. The point being demonstrated is the shared
|
|
// schema and the client/server round trip, not delivery.
|
|
import { verifyCsrf, type Context } from "@wrnexus/core";
|
|
import { parseBody } from "@wrnexus/validation";
|
|
import invite from "../schemas/invite.ts";
|
|
|
|
export async function POST(ctx: Context): Promise<Response> {
|
|
if (!verifyCsrf(ctx)) return new Response("Invalid CSRF token", { status: 403 });
|
|
|
|
const result = await parseBody(invite, ctx.req);
|
|
if (!result.ok) return result.response; // 400 { ok:false, errors } — rendered per field
|
|
|
|
const { email, message } = result.value as { email: string; message?: string };
|
|
|
|
return Response.json({
|
|
ok: true,
|
|
email,
|
|
message: message ?? "",
|
|
sentAt: new Date().toISOString(),
|
|
});
|
|
}
|