How to Implement RFC 8058 One-Click Unsubscribe Headers in React Email

{
  "to": "developer@customer.com",
  "subject": "Weekly AI Agent Architecture Digest #52",
  "headers": {
    "List-Unsubscribe": "<https://api.sadasend.com/v1/unsubscribe?token=jwt_signed_token>, <mailto:unsubscribe@sadasend.com?subject=unsub_jwt_token>",
    "List-Unsubscribe-Post": "List-Unsubscribe=One-Click"
  }
}

import { NextRequest, NextResponse } from 'next/server';
import crypto from 'node:crypto';

// Verify signed HMAC token to prevent unauthorized unsubscribe attacks
function verifyUnsubscribeToken(token: string): { email: string; valid: boolean } {
  try {
    const [payloadBase64, signature] = token.split('.');
    const expectedSig = crypto
      .createHmac('sha256', process.env.UNSUBSCRIBE_SECRET!)
      .update(payloadBase64)
      .digest('hex');

    if (signature !== expectedSig) return { email: '', valid: false };
    const { email } = JSON.parse(Buffer.from(payloadBase64, 'base64').toString('utf8'));
    return { email, valid: true };
  } catch {
    return { email: '', valid: false };
  }
}

export async function POST(req: NextRequest) {
  const token = req.nextUrl.searchParams.get('token');
  if (!token) return NextResponse.json({ error: 'Missing token' }, { status: 400 });

  const bodyText = await req.text();
  // RFC 8058 standard payload check
  if (!bodyText.includes('List-Unsubscribe=One-Click')) {
    return NextResponse.json({ error: 'Invalid RFC 8058 payload' }, { status: 400 });
  }

  const { email, valid } = verifyUnsubscribeToken(token);
  if (!valid) return NextResponse.json({ error: 'Invalid token' }, { status: 403 });

  // Update suppression list or database record
  console.log(`[RFC 8058] Successfully unsubscribed: ${email}`);

  return new NextResponse('Unsubscribed successfully', {
    status: 200,
    headers: { 'Content-Type': 'text/plain' },
  });
}