48 lines
3.5 KiB
TypeScript
48 lines
3.5 KiB
TypeScript
import { NextResponse } from "next/server";
|
|
import { getPayload } from "payload";
|
|
import config from "@payload-config";
|
|
import { checkRateLimit, getClientIp } from "@/lib/auth/rateLimit";
|
|
import { groupRegistrationEmail } from "@/lib/email/conversationTemplates";
|
|
import { sendEmail } from "@/lib/email/sendBookingEmails";
|
|
import { verifyTurnstileToken } from "@/lib/turnstile/server";
|
|
|
|
export const dynamic = "force-dynamic";
|
|
|
|
const value = (v: unknown, max: number) => typeof v === "string" ? v.trim().slice(0, max) : "";
|
|
|
|
export async function POST(request: Request) {
|
|
if (!checkRateLimit(`group-registration:${getClientIp(request)}`, { max: 5, windowMs: 60 * 60 * 1000 })) return NextResponse.json({ error: "Zu viele Anmeldungen. Bitte versuche es später erneut." }, { status: 429 });
|
|
let body: Record<string, unknown>;
|
|
try { body = await request.json(); } catch { return NextResponse.json({ error: "Ungültige Anfrage." }, { status: 400 }); }
|
|
const offerSlug = value(body.offerSlug, 160);
|
|
const name = value(body.name, 160);
|
|
const email = value(body.email, 254).toLowerCase();
|
|
const phone = value(body.phone, 80);
|
|
const message = value(body.message, 3000);
|
|
if (!offerSlug || !name || !email || !/^\S+@\S+\.\S+$/.test(email)) return NextResponse.json({ error: "Bitte fülle Name und E-Mail korrekt aus." }, { status: 400 });
|
|
if (!(await verifyTurnstileToken(body.token, "group-registration", request))) return NextResponse.json({ error: "Sicherheitsprüfung fehlgeschlagen. Bitte versuche es erneut." }, { status: 403 });
|
|
|
|
try {
|
|
const payload = await getPayload({ config });
|
|
const offerResult = await payload.find({ collection: "offers", where: { slug: { equals: offerSlug } }, limit: 1, overrideAccess: false });
|
|
const offer = offerResult.docs[0];
|
|
if (!offer || offer.bookingMode !== "group") return NextResponse.json({ error: "Dieses Gruppenangebot ist nicht verfügbar." }, { status: 404 });
|
|
if (offer.registrationDeadline && new Date(offer.registrationDeadline) < new Date()) return NextResponse.json({ error: "Die Anmeldefrist ist bereits abgelaufen." }, { status: 409 });
|
|
if (offer.groupCapacity) {
|
|
const count = await payload.count({ collection: "group-registrations", where: { and: [{ offer: { equals: offer.id } }, { status: { in: ["pending", "accepted"] } }] }, overrideAccess: true });
|
|
if (count.totalDocs >= offer.groupCapacity && offer.groupRegistrationMode === "capacity") return NextResponse.json({ error: "Für dieses Angebot sind aktuell keine Plätze mehr frei." }, { status: 409 });
|
|
}
|
|
const registration = await payload.create({ collection: "group-registrations", overrideAccess: true, data: { offer: offer.id, name, email, phone, message, status: "pending" } });
|
|
const contact = await payload.findGlobal({ slug: "contact", overrideAccess: true });
|
|
const serverUrl = process.env.NEXT_PUBLIC_SERVER_URL || new URL(request.url).origin;
|
|
await Promise.all([
|
|
contact.email ? sendEmail(contact.email, groupRegistrationEmail({ name, offerTitle: offer.title, status: "admin", adminUrl: `${serverUrl}/admin/collections/group-registrations/${registration.id}` }), { replyTo: email }) : Promise.resolve(),
|
|
sendEmail(email, groupRegistrationEmail({ name, offerTitle: offer.title, status: "received" })),
|
|
]);
|
|
return NextResponse.json({ ok: true });
|
|
} catch (error) {
|
|
console.error("group registration failed", error);
|
|
return NextResponse.json({ error: "Die Anmeldung konnte nicht gesendet werden." }, { status: 500 });
|
|
}
|
|
}
|