import { NextRequest, NextResponse } from 'next/server'
import { z } from 'zod'
import { unsubscribeByToken } from '@/lib/data/pilot-network'

/** Public (no login): one-click unsubscribe (§23). Idempotent. */
const schema = z.object({ token: z.string().regex(/^[a-f0-9]{48}$/) })

export async function POST(req: NextRequest) {
  const parsed = schema.safeParse(await req.json().catch(() => ({})))
  if (!parsed.success) return NextResponse.json({ error: 'Invalid link.' }, { status: 400 })
  const out = await unsubscribeByToken(parsed.data.token)
  if (!out.ok) return NextResponse.json({ error: 'This unsubscribe link is not valid.' }, { status: 404 })
  return NextResponse.json({ ok: true, already: out.already })
}