MineGeo/app/api/moderator-apply/route.ts

import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { createModeratorApplication } from "@/lib/moderator-applications";
import { verifyTelegramInitData } from "@/lib/telegram-webapp";
import { jsonBody } from "@/lib/json-body";
import { ServiceError } from "@/lib/service-error";

export const runtime = "nodejs";

const payload = z.object({
  initData: z.string().min(1).max(4096),
  username: z
    .string()
    .min(3)
    .max(32)
    .regex(/^[A-Za-z0-9_]+$/),
});

export async function POST(request: NextRequest) {
  const botToken = process.env.TELEGRAM_BOT_TOKEN;
  if (!botToken)
    return NextResponse.json(
      { error: "The Telegram bot is not configured" },
      { status: 503 },
    );
  let decoded: unknown;
  try {
    decoded = await jsonBody(request);
  } catch (error) {
    if (error instanceof ServiceError)
      return NextResponse.json({ error: error.message }, { status: error.status });
    return NextResponse.json({ error: "Invalid request" }, { status: 400 });
  }
  const input = payload.safeParse(decoded);
  if (!input.success)
    return NextResponse.json(
      {
        error:
          "Use your MineGeo username (3–32 letters, numbers or underscores).",
      },
      { status: 400 },
    );
  const telegramUser = verifyTelegramInitData(input.data.initData, botToken);
  if (!telegramUser)
    return NextResponse.json(
      {
        error:
          "Telegram signature could not be verified. Open the form again from the MineGeo bot.",
      },
      { status: 401 },
    );
  const result = await createModeratorApplication({
    platform: "telegram",
    platformUserId: telegramUser.id,
    platformUsername: telegramUser.username,
    requestedUsername: input.data.username,
    origin: process.env.MINEGEO_URL ?? request.nextUrl.origin,
  });
  if (!result.ok)
    return NextResponse.json({ error: result.message }, { status: 409 });
  return NextResponse.json({ url: result.url });
}