fix: add IP rate limiting and guard non-string email in flyer route

Adds an in-memory, IP-based fixed-window rate limit (max 3 req/hour)
to app/api/familyguard-flyer/route.ts to mitigate an email-spam/abuse
vector where any client could trigger outbound emails and DB inserts
with no limit. Also guards against a non-string `email` field in the
request body, which previously threw an uncaught TypeError (HTTP 500)
instead of the intended 400 validation response.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LhY1QhDXGWfyhrxaJvfpNt

app/api/familyguard-flyer/route.ts

@@ -0,0 +1,77 @@
+import { NextResponse } from "next/server";
+import { sendeFlyerBenachrichtigung, sendeFlyerLink } from "@/lib/mailer";
+import { createServiceClient } from "@/lib/supabase";
+
+const FLYER_DOWNLOAD_URL = "/downloads/MBO_FamilyGuard_Flyer_01.pdf";
+
+const RATE_LIMIT_WINDOW_MS = 60 * 60 * 1000;
+const RATE_LIMIT_MAX = 3;
+const requestLog = new Map<string, number[]>();
+
+function isRateLimited(ip: string): boolean {
+  const now = Date.now();
+  const timestamps = (requestLog.get(ip) ?? []).filter(
+    (t) => now - t < RATE_LIMIT_WINDOW_MS
+  );
+  if (timestamps.length >= RATE_LIMIT_MAX) {
+    requestLog.set(ip, timestamps);
+    return true;
+  }
+  timestamps.push(now);
+  requestLog.set(ip, timestamps);
+  return false;
+}
+
+function getClientIp(request: Request): string {
+  const forwarded = request.headers.get("x-forwarded-for");
+  if (forwarded) return forwarded.split(",")[0].trim();
+  return "unknown";
+}
+
+function isValidEmail(email: string): boolean {
+  return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email);
+}
+
+export async function POST(request: Request) {
+  if (isRateLimited(getClientIp(request))) {
+    return NextResponse.json(
+      { ok: false, error: "Zu viele Anfragen. Bitte versuchen Sie es später erneut." },
+      { status: 429 }
+    );
+  }
+
+  let body: { email?: string; dsgvoEinwilligung?: boolean };
+  try {
+    body = await request.json();
+  } catch {
+    return NextResponse.json({ ok: false, error: "Ungültige Anfrage" }, { status: 400 });
+  }
+
+  const email = typeof body.email === "string" ? body.email.trim() : "";
+  if (!isValidEmail(email)) {
+    return NextResponse.json(
+      { ok: false, error: "Bitte geben Sie eine gültige E-Mail-Adresse ein" },
+      { status: 400 }
+    );
+  }
+  if (body.dsgvoEinwilligung !== true) {
+    return NextResponse.json(
+      { ok: false, error: "Bitte stimmen Sie der Datenverarbeitung zu" },
+      { status: 400 }
+    );
+  }
+
+  try {
+    const db = createServiceClient();
+    await db.from("flyer_downloads").insert({ email, dsgvo_einwilligung: true });
+  } catch (err) {
+    console.error("[FamilyGuard-Flyer] Supabase insert error:", err);
+  }
+
+  await sendeFlyerBenachrichtigung({ email });
+  sendeFlyerLink({ email }).catch((err) =>
+    console.error("[FamilyGuard-Flyer] Flyer-Mail an Interessenten fehlgeschlagen:", err)
+  );
+
+  return NextResponse.json({ ok: true, downloadUrl: FLYER_DOWNLOAD_URL });
+}

app/pakete/familyguard/page.tsx

@@ -1,6 +1,7 @@
 import type { Metadata } from "next";
 import Link from "next/link";
 import Logo from "@/components/Logo";
+import FlyerDownloadForm from "@/components/FlyerDownloadForm";
 
 export const metadata: Metadata = {
   title: "MBO FamilyGuard – Familienschutz fürs Heimnetzwerk | MBO-Tech-IT",
@@ -203,6 +204,8 @@ export default function FamilyGuardPage() {
           </div>
         </div>
 
+        <FlyerDownloadForm />
+
         {/* Bottom callout */}
         <div className="p-6 rounded-2xl border border-blue-500/20 bg-blue-500/5 text-center">
           <p className="text-slate-900 dark:text-white font-bold mb-1">

components/FamilyGuardPromo.tsx

@@ -43,6 +43,12 @@ export default function FamilyGuardPromo() {
                   <Link href="/pakete/familyguard" className="btn-primary inline-flex justify-center px-6 py-3 text-sm">
                     FamilyGuard entdecken
                   </Link>
+                  <Link
+                    href="/pakete/familyguard#flyer-download"
+                    className="btn-secondary inline-flex justify-center px-6 py-3 text-sm"
+                  >
+                    Flyer herunterladen
+                  </Link>
                   <a href="#contact" className="btn-secondary inline-flex justify-center px-6 py-3 text-sm">
                     Jetzt beraten lassen
                   </a>

components/FlyerDownloadForm.tsx

@@ -0,0 +1,113 @@
+"use client";
+
+import { useState } from "react";
+
+type Status = "idle" | "loading" | "success" | "error";
+
+export default function FlyerDownloadForm() {
+  const [email, setEmail] = useState("");
+  const [dsgvo, setDsgvo] = useState(false);
+  const [status, setStatus] = useState<Status>("idle");
+  const [errorMsg, setErrorMsg] = useState("");
+  const [downloadUrl, setDownloadUrl] = useState("");
+
+  async function handleSubmit(e: React.FormEvent) {
+    e.preventDefault();
+    setStatus("loading");
+    setErrorMsg("");
+
+    try {
+      const res = await fetch("/api/familyguard-flyer", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ email, dsgvoEinwilligung: dsgvo }),
+      });
+      const data = await res.json();
+
+      if (!res.ok || !data.ok) {
+        setErrorMsg(data.error ?? "Unbekannter Fehler");
+        setStatus("error");
+      } else {
+        setDownloadUrl(data.downloadUrl);
+        setStatus("success");
+      }
+    } catch {
+      setErrorMsg("Netzwerkfehler – bitte versuchen Sie es erneut.");
+      setStatus("error");
+    }
+  }
+
+  return (
+    <div
+      id="flyer-download"
+      className="mb-16 p-6 sm:p-8 rounded-2xl bg-white dark:bg-gray-900 border border-slate-200 dark:border-gray-800 scroll-mt-24"
+    >
+      <div className="text-center mb-6">
+        <span className="text-orange-400 font-mono text-xs font-bold tracking-[0.25em] uppercase">
+          Flyer
+        </span>
+        <h3 className="text-2xl font-black text-slate-900 dark:text-white mt-1 mb-2">
+          FamilyGuard-Flyer herunterladen
+        </h3>
+        <p className="text-slate-600 dark:text-slate-400 text-sm max-w-xl mx-auto">
+          Alle Infos zu MBO FamilyGuard kompakt als PDF – tragen Sie Ihre E-Mail-Adresse
+          ein und laden Sie den Flyer direkt herunter.
+        </p>
+      </div>
+
+      {status === "success" ? (
+        <div className="flex flex-col items-center text-center">
+          <p className="text-slate-700 dark:text-slate-300 text-sm mb-4">
+            Fertig! Der Flyer wurde Ihnen außerdem per E-Mail zugeschickt.
+          </p>
+          <a href={downloadUrl} download className="btn-primary inline-flex px-6 py-3 text-sm">
+            Flyer jetzt herunterladen
+          </a>
+        </div>
+      ) : (
+        <form onSubmit={handleSubmit} className="max-w-md mx-auto space-y-4">
+          <input
+            type="email"
+            required
+            value={email}
+            onChange={(e) => setEmail(e.target.value)}
+            placeholder="max@beispiel.de"
+            className="w-full px-4 py-3 rounded-xl bg-slate-50 dark:bg-[#111925] border border-slate-300 dark:border-gray-700 text-slate-900 dark:text-white placeholder-slate-400 dark:placeholder-slate-600 focus:outline-none focus:border-orange-500/60 focus:ring-1 focus:ring-orange-500/20 transition-colors"
+          />
+
+          <label className="flex items-start gap-2 text-xs text-slate-600 dark:text-slate-400">
+            <input
+              type="checkbox"
+              required
+              checked={dsgvo}
+              onChange={(e) => setDsgvo(e.target.checked)}
+              className="mt-0.5"
+            />
+            <span>
+              Ich bin damit einverstanden, dass meine E-Mail-Adresse zum Zweck des
+              Flyer-Versands gespeichert wird. Details in der{" "}
+              <a href="/datenschutz" className="text-orange-400 hover:underline">
+                Datenschutzerklärung
+              </a>
+              .
+            </span>
+          </label>
+
+          {status === "error" && (
+            <div className="flex items-start gap-3 px-4 py-3 rounded-xl bg-red-500/10 border border-red-500/20 text-red-400 text-sm">
+              <span>{errorMsg || "Anfrage fehlgeschlagen. Bitte versuchen Sie es erneut."}</span>
+            </div>
+          )}
+
+          <button
+            type="submit"
+            disabled={status === "loading"}
+            className="btn-primary w-full py-3 text-sm disabled:opacity-60 disabled:cursor-not-allowed"
+          >
+            {status === "loading" ? "Wird gesendet..." : "Flyer herunterladen"}
+          </button>
+        </form>
+      )}
+    </div>
+  );
+}