Check email breaches in a Next.js route handler

// app/api/breaches/email/route.ts
import { NextResponse } from "next/server";
import { auth } from "@/lib/auth"; // your session helper
import { finowl, FinowlError } from "@/lib/finowl";

type Breach = { Title: string; BreachDate: string; DataClasses: string[]; IsVerified: boolean };
type EmailBreachResult = { email: string; breached: boolean; breaches: Breach[] };

export async function POST() {
  // Check the signed-in user's own address, so this route is not an open lookup service.
  const session = await auth();
  if (!session?.user?.email) {
    return NextResponse.json({ error: "Sign in first." }, { status: 401 });
  }

  try {
    const result = await finowl<EmailBreachResult>("/v1/breaches/email", { email: session.user.email });
    return NextResponse.json({
      breached: result.breached,
      breaches: result.breaches.map((b) => ({
        title: b.Title,
        date: b.BreachDate,
        exposed: b.DataClasses,
        verified: b.IsVerified,
      })),
    });
  } catch (err) {
    if (!(err instanceof FinowlError)) throw err;

    switch (err.status) {
      case 400:
        return NextResponse.json({ error: "That address cannot be checked." }, { status: 422 });
      case 401:
        console.error("Finowl rejected FINOWL_API_KEY");
        return NextResponse.json({ error: "Breach check unavailable." }, { status: 503 });
      case 429:
        return NextResponse.json(
          { error: "Too many checks. Try again shortly." },
          { status: 429, headers: err.retryAfter ? { "Retry-After": String(err.retryAfter) } : undefined },
        );
      default:
        return NextResponse.json({ error: "Breach check failed." }, { status: 502 });
    }
  }
}