/**
 * POST /api/sms/verify — verify SMS opt-in code.
 */
import { NextResponse } from "next/server";
import { getCurrentUser } from "@/lib/auth";
import { verifySmsOptIn } from "@/lib/services/sms-sender";

export const dynamic = "force-dynamic";

export async function POST(req: Request) {
  const user = await getCurrentUser();
  if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
  const body = await req.json().catch(() => null) as { code?: string } | null;
  if (!body?.code) return NextResponse.json({ error: "code required" }, { status: 400 });

  const verified = await verifySmsOptIn(user.id, body.code);
  return NextResponse.json({ verified });
}
