How to Send Email with Astro

import { defineConfig } from "astro/config";
import node from "@astrojs/node";

export default defineConfig({
  adapter: node({ mode: "standalone" }),
});

AHASEND_API_KEY=aha-sk-...
AHASEND_ACCOUNT_ID=your-account-uuid
AHASEND_WEBHOOK_SECRET=aha-whsec-...
WELCOME_ENDPOINT_TOKEN=replace-with-a-long-random-value

import { defineConfig, envField } from "astro/config";
import node from "@astrojs/node";

export default defineConfig({
  adapter: node({ mode: "standalone" }),
  env: {
    schema: {
      AHASEND_API_KEY: envField.string({ context: "server", access: "secret" }),
      AHASEND_ACCOUNT_ID: envField.string({ context: "server", access: "secret" }),
      AHASEND_WEBHOOK_SECRET: envField.string({ context: "server", access: "secret" }),
      WELCOME_ENDPOINT_TOKEN: envField.string({ context: "server", access: "secret" }),
    },
    validateSecrets: true,
  },
});

import { AhaSendClient } from "@ahasend/sdk";
import { AHASEND_API_KEY, AHASEND_ACCOUNT_ID } from "astro:env/server";

export const ahasend = new AhaSendClient({
  apiKey: AHASEND_API_KEY,
  accountId: AHASEND_ACCOUNT_ID,
});

/** Reads the whole body, or returns `null` once it exceeds `maxBytes`. */
export async function readBoundedBody(
  request: Request,
  maxBytes: number,
): Promise<Uint8Array | null> {
  const reader = request.body?.getReader();
  if (!reader) return new Uint8Array();

  const chunks: Uint8Array[] = [];
  let length = 0;
  try {
    while (true) {
      const { done, value } = await reader.read();
      if (done) break;
      length += value.byteLength;
      if (length > maxBytes) {
        await reader.cancel();
        return null;
      }
      chunks.push(value);
    }
  } finally {
    reader.releaseLock();
  }

  const body = new Uint8Array(length);
  let offset = 0;
  for (const chunk of chunks) {
    body.set(chunk, offset);
    offset += chunk.byteLength;
  }
  return body;
}

import type { APIRoute } from "astro";
import { AhaSendAPIError } from "@ahasend/sdk";
import { WELCOME_ENDPOINT_TOKEN } from "astro:env/server";
import { ahasend } from "../../lib/ahasend";
import { readBoundedBody } from "../../lib/request";

export const prerender = false;

const MAX_JSON_BYTES = 16_384;

type WelcomeInput = { signupId: string; email: string; name?: string };

function isWelcomeInput(value: unknown): value is WelcomeInput {
  if (!value || typeof value !== "object") return false;
  const input = value as Record<string, unknown>;
  return (
    typeof input.signupId === "string" &&
    /^[A-Za-z0-9._:-]{1,200}$/.test(input.signupId) &&
    typeof input.email === "string" &&
    input.email.length > 0 &&
    input.email.length <= 254 &&
    (input.name === undefined || (typeof input.name === "string" && input.name.length <= 200))
  );
}

/** Constant-time comparison, so a wrong token leaks nothing through timing. */
async function secretsEqual(left: string, right: string): Promise<boolean> {
  const encoder = new TextEncoder();
  const [leftHash, rightHash] = await Promise.all([
    crypto.subtle.digest("SHA-256", encoder.encode(left)),
    crypto.subtle.digest("SHA-256", encoder.encode(right)),
  ]);
  const leftBytes = new Uint8Array(leftHash);
  const rightBytes = new Uint8Array(rightHash);
  let difference = 0;
  for (let i = 0; i < leftBytes.length; i += 1) difference |= leftBytes[i]! ^ rightBytes[i]!;
  return difference === 0;
}

async function isAuthorized(request: Request): Promise<boolean> {
  const authorization = request.headers.get("authorization");
  if (!authorization?.startsWith("Bearer ")) return false;
  return secretsEqual(authorization.slice("Bearer ".length), WELCOME_ENDPOINT_TOKEN);
}

export const POST: APIRoute = async ({ request }) => {
  if (!(await isAuthorized(request))) {
    return Response.json({ error: "Unauthorized" }, { status: 401 });
  }

  if (!/^application\/json(?:\s*;|$)/i.test(request.headers.get("content-type") ?? "")) {
    return Response.json({ error: "Content-Type must be application/json" }, { status: 415 });
  }

  const rawBody = await readBoundedBody(request, MAX_JSON_BYTES);
  if (rawBody === null) {
    return Response.json({ error: "Request body is too large" }, { status: 413 });
  }

  let input: unknown;
  try {
    input = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(rawBody));
  } catch {
    return Response.json({ error: "Invalid JSON" }, { status: 400 });
  }
  if (!isWelcomeInput(input)) {
    return Response.json({ error: "Invalid request" }, { status: 400 });
  }

  try {
    const result = await ahasend.messages.send(
      {
        from: { email: "hello@yourdomain.com", name: "Your App" },
        recipients: [{ email: input.email, name: input.name }],
        subject: "Welcome to Your App!",
        html_content: "<h1>Welcome aboard 🎉</h1><p>We're glad you're here.</p>",
        text_content: "Welcome aboard! We're glad you're here.",
      },
      { idempotencyKey: `welcome-${input.signupId}` },
    );

    const rejected = result.data.filter((r) => r.status === "error");
    if (rejected.length > 0) {
      console.warn(`${rejected.length} of ${result.data.length} recipient(s) rejected`);
      return Response.json({ error: "Recipient was not accepted" }, { status: 422 });
    }

    return Response.json({ statuses: result.data.map((r) => r.status) }); // ["queued"]
  } catch (err) {
    if (err instanceof AhaSendAPIError) {
      console.error(`AhaSend error ${err.status} (request ${err.requestId})`);
      return Response.json({ error: "Failed to send email" }, { status: 502 });
    }
    throw err;
  }
};

import type { APIRoute } from "astro";
import {
  AhaSendWebhookVerificationError,
  MAX_WEBHOOK_BODY_BYTES,
  WebhookVerifier,
  isKnownWebhookEvent,
} from "@ahasend/sdk/webhooks";
import { AHASEND_WEBHOOK_SECRET } from "astro:env/server";
import { readBoundedBody } from "../../../lib/request";

export const prerender = false;

const verifier = new WebhookVerifier(AHASEND_WEBHOOK_SECRET);

export const POST: APIRoute = async ({ request }) => {
  const rawBody = await readBoundedBody(request, MAX_WEBHOOK_BODY_BYTES);
  if (rawBody === null) return new Response(null, { status: 413 });

  let event;
  try {
    event = await verifier.parse(request.headers, rawBody);
  } catch (err) {
    // `reason` is a fixed enum, so it is safe to log; the body and signature are not.
    if (err instanceof AhaSendWebhookVerificationError) {
      console.warn(`Webhook rejected: ${err.reason}`);
    }
    return new Response(null, { status: 400 });
  }

  if (isKnownWebhookEvent(event)) {
    switch (event.type) {
      case "message.delivered":
        console.log("Message delivered");
        break;
      case "message.bounced":
        console.log("Message bounced");
        break;
      case "message.opened":
        console.log("Message opened");
        break;
    }
  }

  return new Response(null, { status: 200 });
};