import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { sha256 } from "@/lib/security";

export async function GET(request: Request) {
  const token = new URL(request.url).searchParams.get("token") ?? "";
  const base = (process.env.NEXT_PUBLIC_SITE_URL ?? "https://toolaro.org").replace(/\/$/, "");
  const entry = await prisma.newsletterSubscription.findFirst({
    where: { tokenHash: sha256(token), status: "pending" },
  });
  if (!entry) return NextResponse.redirect(`${base}/account?newsletter=invalid`);
  await prisma.newsletterSubscription.update({
    where: { id: entry.id },
    data: { status: "active", confirmedAt: new Date() },
  });
  if (entry.userId) {
    await prisma.user.update({ where: { id: entry.userId }, data: { newsletterOptIn: true } });
  }
  return NextResponse.redirect(`${base}/account?newsletter=confirmed`);
}