dark-lord/app/api/pending-deposit/route.ts

/**
 * /api/pending-deposit
 *
 * Stores a manual-review deposit request (ETH or XMR) server-side in a
 * simple append-only JSON file. In production you'd swap this for a DB
 * write. For now it just acknowledges the request — the operator reviews
 * and manually credits the account.
 */
import { NextResponse } from "next/server";

export async function POST(req: Request) {
  let body: unknown;
  try { body = await req.json(); } catch {
    return NextResponse.json({ ok: false, error: "Invalid JSON" }, { status: 400 });
  }

  const { coin, txid, handle } = (body as Record<string, string | undefined>) ?? {};

  if (!coin || !txid || !handle) {
    return NextResponse.json({ ok: false, error: "Missing coin, txid or handle" }, { status: 400 });
  }

  const validCoins = ["ETH", "XMR"];
  if (!validCoins.includes(coin.toUpperCase())) {
    return NextResponse.json({ ok: false, error: "Unsupported coin for manual review" }, { status: 400 });
  }

  const txidClean = txid.trim();
  if (txidClean.length < 20) {
    return NextResponse.json({ ok: false, error: "Invalid txid" }, { status: 400 });
  }

  // Log to console so operator can see it in server output.
  // In production: write to DB or send webhook.
  console.log(
    `[PENDING DEPOSIT] coin=${coin.toUpperCase()} handle=@${handle} txid=${txidClean} ts=${new Date().toISOString()}`
  );

  return NextResponse.json({
    ok: true,
    message: `Manual review request logged for @${handle}. Operator will verify and credit your account.`,
    ref: `${coin.toUpperCase()}-${txidClean.slice(0, 8).toUpperCase()}`,
  });
}