Add Telegram moderator application mini app

app/api/moderator-apply/route.ts

@@ -0,0 +1,62 @@
+import { NextRequest, NextResponse } from "next/server";
+import { z } from "zod";
+import { createModeratorApplication } from "@/lib/moderator-applications";
+import { verifyTelegramInitData } from "@/lib/telegram-webapp";
+import { jsonBody } from "@/lib/json-body";
+import { ServiceError } from "@/lib/service-error";
+
+export const runtime = "nodejs";
+
+const payload = z.object({
+  initData: z.string().min(1).max(4096),
+  username: z
+    .string()
+    .min(3)
+    .max(32)
+    .regex(/^[A-Za-z0-9_]+$/),
+});
+
+export async function POST(request: NextRequest) {
+  const botToken = process.env.TELEGRAM_BOT_TOKEN;
+  if (!botToken)
+    return NextResponse.json(
+      { error: "The Telegram bot is not configured" },
+      { status: 503 },
+    );
+  let decoded: unknown;
+  try {
+    decoded = await jsonBody(request);
+  } catch (error) {
+    if (error instanceof ServiceError)
+      return NextResponse.json({ error: error.message }, { status: error.status });
+    return NextResponse.json({ error: "Invalid request" }, { status: 400 });
+  }
+  const input = payload.safeParse(decoded);
+  if (!input.success)
+    return NextResponse.json(
+      {
+        error:
+          "Use your MineGeo username (3–32 letters, numbers or underscores).",
+      },
+      { status: 400 },
+    );
+  const telegramUser = verifyTelegramInitData(input.data.initData, botToken);
+  if (!telegramUser)
+    return NextResponse.json(
+      {
+        error:
+          "Telegram signature could not be verified. Open the form again from the MineGeo bot.",
+      },
+      { status: 401 },
+    );
+  const result = await createModeratorApplication({
+    platform: "telegram",
+    platformUserId: telegramUser.id,
+    platformUsername: telegramUser.username,
+    requestedUsername: input.data.username,
+    origin: process.env.MINEGEO_URL ?? request.nextUrl.origin,
+  });
+  if (!result.ok)
+    return NextResponse.json({ error: result.message }, { status: 409 });
+  return NextResponse.json({ url: result.url });
+}