From 7c04450b57a8b152be35e15127ebb13a37219e7c Mon Sep 17 00:00:00 2001
From: MBO-Tech-IT <jonny@mbo-tech-it.de>
Date: Tue, 21 Jul 2026 11:36:37 +0200
Subject: [PATCH] feat: add API route for FamilyGuard flyer email-gate download

Creates POST /api/familyguard-flyer endpoint that validates email format
and DSGVO consent, records download intent in Supabase flyer_downloads table,
and sends notification and download link emails (fire-and-forget) before
returning the flyer download URL.

Implements Task 4 of 7-task email-gated flyer download feature.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LhY1QhDXGWfyhrxaJvfpNt
---
 app/api/familyguard-flyer/route.ts | 46 ++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100644 app/api/familyguard-flyer/route.ts

diff --git a/app/api/familyguard-flyer/route.ts b/app/api/familyguard-flyer/route.ts
new file mode 100644
index 0000000..9cc48fd
--- /dev/null
+++ b/app/api/familyguard-flyer/route.ts
@@ -0,0 +1,46 @@
+import { NextResponse } from "next/server";
+import { sendeFlyerBenachrichtigung, sendeFlyerLink } from "@/lib/mailer";
+import { createServiceClient } from "@/lib/supabase";
+
+const FLYER_DOWNLOAD_URL = "/downloads/MBO_FamilyGuard_Flyer_01.pdf";
+
+function isValidEmail(email: string): boolean {
+  return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email);
+}
+
+export async function POST(request: Request) {
+  let body: { email?: string; dsgvoEinwilligung?: boolean };
+  try {
+    body = await request.json();
+  } catch {
+    return NextResponse.json({ ok: false, error: "Ungültige Anfrage" }, { status: 400 });
+  }
+
+  const email = body.email?.trim() ?? "";
+  if (!isValidEmail(email)) {
+    return NextResponse.json(
+      { ok: false, error: "Bitte geben Sie eine gültige E-Mail-Adresse ein" },
+      { status: 400 }
+    );
+  }
+  if (body.dsgvoEinwilligung !== true) {
+    return NextResponse.json(
+      { ok: false, error: "Bitte stimmen Sie der Datenverarbeitung zu" },
+      { status: 400 }
+    );
+  }
+
+  try {
+    const db = createServiceClient();
+    await db.from("flyer_downloads").insert({ email, dsgvo_einwilligung: true });
+  } catch (err) {
+    console.error("[FamilyGuard-Flyer] Supabase insert error:", err);
+  }
+
+  await sendeFlyerBenachrichtigung({ email });
+  sendeFlyerLink({ email }).catch((err) =>
+    console.error("[FamilyGuard-Flyer] Flyer-Mail an Interessenten fehlgeschlagen:", err)
+  );
+
+  return NextResponse.json({ ok: true, downloadUrl: FLYER_DOWNLOAD_URL });
+}