Frameworks

// The one header YOUR host sets to the visitor's IP (table below): x-real-ip on Vercel,
// cf-connecting-ip on Cloudflare, x-nf-client-connection-ip on Netlify. Never fall back to
// another: a visitor can send any host's header.
const IP_HEADER = process.env.VISITOR_IP_HEADER;
if (!IP_HEADER) throw new Error("Set VISITOR_IP_HEADER to your host's visitor IP header");

// A server route the page posts its form to, as JSON
export async function POST(request: Request) {
  // The page makes submission_id once, when the form loads (crypto.randomUUID())
  const body: unknown = await request.json().catch(() => null);
  const fields = ["submission_id", "email", "message"] as const;
  if (!body || typeof body !== "object" || fields.some((f) => typeof (body as Record<string, unknown>)[f] !== "string")) {
    return Response.json({ error: "Send submission_id, email and message as JSON strings" }, { status: 400 });
  }
  const { submission_id, email, message } = body as Record<(typeof fields)[number], string>;

  const visitorIp = request.headers.get(IP_HEADER);
  if (!visitorIp) console.warn(`No ${IP_HEADER} header: is VISITOR_IP_HEADER right for this host?`);
  const visitorUserAgent = request.headers.get("user-agent");

  let res: Response;
  try {
    res = await fetch(`${process.env.DB_API_ENDPOINT}/v1/leads`, {
      method: "POST",
      headers: {
        "Content-Type": "application/json",
        "X-API-Key": process.env.DB_API_KEY!,
        "X-1DB-Contract": "2",
        // Sent only when known: without the IP, 1DB records your server's address and that
        // lead shares your server's rate limit
        ...(visitorIp ? { "X-1DB-Client-IP": visitorIp } : {}),
        ...(visitorUserAgent ? { "X-1DB-Client-UA": visitorUserAgent } : {}),
      },
      body: JSON.stringify({ formSlug: process.env.DB_FORM_SLUG, submission_id, email, message }),
      signal: AbortSignal.timeout(10_000),
    });
  } catch {
    // 1DB wasn't reached in 10 seconds. The page keeps its submission_id, so resending can't store the lead twice.
    return Response.json({ error: "Couldn't send the form. Try again." }, { status: 503 });
  }

  // 200: stored. 400 with `fields`: the visitor can fix those fields (`suggestions` may offer
  // fixes), so pass them back. Anything else (a wrong key or form slug, 1DB down) is yours to
  // fix: log it, and the page gets a plain error.
  const answer = await res.json().catch(() => null);
  if (res.ok) return Response.json({ ok: true });
  if (res.status === 400 && answer?.fields) {
    const error = typeof answer.error === "string" ? answer.error : "Check the highlighted fields.";
    return Response.json({ error, fields: answer.fields, suggestions: answer.suggestions }, { status: 400 });
  }
  console.error("1DB answered", res.status, answer);
  return Response.json({ error: "Couldn't send the form. Try again." }, { status: 502 });
}