How to Send Email with Echo (Go)

package main

import (
	"crypto/subtle"
	"log"
	"net/http"
	"os"

	"github.com/AhaSend/ahasend-go/api"
	"github.com/AhaSend/ahasend-go/webhooks"
	"github.com/google/uuid"
	"github.com/labstack/echo/v5"
	"github.com/labstack/echo/v5/middleware"
)

var (
	ahasendClient *api.APIClient
	accountID     uuid.UUID
	verifier      *webhooks.WebhookVerifier
	sendToken     string
)

// sendRateLimiter caps how fast this process can turn requests into email. The
// identifier is constant so the cap is process-wide rather than per client IP:
// the AhaSend rate limit is per account, and these callers may all arrive
// through one proxy address. Keep the sum across processes below your account
// limit.
func sendRateLimiter() echo.MiddlewareFunc {
	return middleware.RateLimiterWithConfig(middleware.RateLimiterConfig{
		Store: middleware.NewRateLimiterMemoryStoreWithConfig(
			middleware.RateLimiterMemoryStoreConfig{Rate: 20, Burst: 40},
		),
		IdentifierExtractor: func(c *echo.Context) (string, error) { return "send", nil },
	})
}

// requireSendToken rejects unauthenticated callers before they reach the rate
// limiter, so a flood of anonymous requests cannot exhaust the send budget and
// 429 legitimate traffic. KeyAuth's default lookup reads the Authorization
// header and trims the "Bearer " prefix.
func requireSendToken() echo.MiddlewareFunc {
	return middleware.KeyAuthWithConfig(middleware.KeyAuthConfig{
		Validator: func(c *echo.Context, key string, _ middleware.ExtractorSource) (bool, error) {
			return sendToken != "" && subtle.ConstantTimeCompare([]byte(key), []byte(sendToken)) == 1, nil
		},
		// Both failures already answer 401, but with different bodies: a
		// missing token reports "missing key" and a wrong one "Unauthorized".
		// Collapse them so a caller cannot tell missing from wrong.
		ErrorHandler: func(c *echo.Context, err error) error {
			return echo.NewHTTPError(http.StatusUnauthorized, "unauthorized")
		},
	})
}

func main() {
	apiKey := os.Getenv("AHASEND_API_KEY")
	if apiKey == "" {
		log.Fatal("AHASEND_API_KEY is required")
	}
	sendToken = os.Getenv("AHASEND_SEND_TOKEN")
	if sendToken == "" {
		log.Fatal("AHASEND_SEND_TOKEN is required")
	}
	webhookSecret := os.Getenv("AHASEND_WEBHOOK_SECRET")
	if webhookSecret == "" {
		log.Fatal("AHASEND_WEBHOOK_SECRET is required")
	}

	var err error
	accountID, err = uuid.Parse(os.Getenv("AHASEND_ACCOUNT_ID"))
	if err != nil {
		log.Fatalf("invalid AHASEND_ACCOUNT_ID: %v", err)
	}

	ahasendClient = api.NewAPIClient(api.WithAPIKey(apiKey))
	verifier, err = webhooks.NewWebhookVerifier(webhookSecret)
	if err != nil {
		log.Fatalf("failed to create webhook verifier: %v", err)
	}

	e := echo.New()
	e.Use(middleware.RequestLogger())
	e.Use(middleware.Recover())
	e.POST("/api/welcome", sendWelcome,
		requireSendToken(),
		middleware.BodyLimit(16*1024),
		sendRateLimiter(),
	)
	e.POST("/webhooks/ahasend", handleAhaSendWebhook, middleware.BodyLimit(1_000_000))
	if err := e.Start(":8080"); err != nil {
		log.Fatalf("Echo stopped: %v", err)
	}
}

package main

import (
	"errors"
	"log"
	"net/http"
	"net/mail"
	"regexp"
	"strings"

	"github.com/AhaSend/ahasend-go"
	"github.com/AhaSend/ahasend-go/api"
	"github.com/AhaSend/ahasend-go/models/common"
	"github.com/AhaSend/ahasend-go/models/requests"
	"github.com/labstack/echo/v5"
)

type welcomeInput struct {
	Email   string `json:"email"`
	Name    string `json:"name"`
	EventID string `json:"event_id"`
}

var eventIDPattern = regexp.MustCompile(`^[A-Za-z0-9._:-]{1,200}$`)

// sendWelcome runs only for callers that cleared requireSendToken.
func sendWelcome(c *echo.Context) error {
	var in welcomeInput
	if err := c.Bind(&in); err != nil {
		return echo.NewHTTPError(http.StatusBadRequest, "invalid JSON body")
	}
	if !eventIDPattern.MatchString(in.EventID) {
		return echo.NewHTTPError(http.StatusBadRequest, "a valid event_id is required")
	}
	// Require a bare address: ParseAddress also accepts `Name <a@b.com>`, so
	// compare against the parsed address to reject anything that smuggles extra
	// addressing into this field.
	addr, err := mail.ParseAddress(in.Email)
	if err != nil || addr.Address != in.Email || len(in.Email) > 254 {
		return echo.NewHTTPError(http.StatusBadRequest, "a valid email address is required")
	}
	if len(in.Name) > 100 || strings.ContainsAny(in.Name, "\r\n") {
		return echo.NewHTTPError(http.StatusBadRequest, "invalid name")
	}

	sandbox := true
	message := requests.CreateMessageRequest{
		From:        common.SenderAddress{Email: "hello@yourdomain.com", Name: ahasend.String("Your App")},
		Recipients:  []common.Recipient{{Email: in.Email, Name: ahasend.String(in.Name)}},
		Subject:     "Welcome to Your App!",
		HtmlContent: ahasend.String("<h1>Welcome aboard 🎉</h1><p>We're glad you're here.</p>"),
		TextContent: ahasend.String("Welcome aboard! We're glad you're here."),
		Sandbox:     ahasend.Bool(sandbox),
	}

	idempotencyKey := "sandbox-welcome-" + in.EventID
	if !sandbox {
		idempotencyKey = "live-welcome-" + in.EventID
	}
	response, _, err := ahasendClient.MessagesAPI.CreateMessage(
		c.Request().Context(),
		accountID,
		message,
		api.WithIdempotencyKey(idempotencyKey),
	)
	if err != nil {
		var apiErr *api.APIError
		if errors.As(err, &apiErr) {
			log.Printf("AhaSend API error status=%d code=%s request_id=%s", apiErr.StatusCode, apiErr.Code, apiErr.RequestID)
			switch apiErr.Type {
			case api.ErrorTypeValidation, api.ErrorTypeIdempotency:
				// The caller's payload is the problem; retrying it unchanged
				// will fail the same way.
				return echo.NewHTTPError(http.StatusBadRequest, "email request rejected")
			default:
				return echo.NewHTTPError(http.StatusBadGateway, "failed to send email")
			}
		}
		return echo.NewHTTPError(http.StatusInternalServerError, "unexpected error")
	}

	// A 2xx only means the request was accepted: each recipient carries its own
	// status, so check it rather than trusting the HTTP code.
	if len(response.Data) != 1 {
		log.Printf("AhaSend returned an unexpected result count=%d", len(response.Data))
		return echo.NewHTTPError(http.StatusBadGateway, "unexpected send result")
	}
	if response.Data[0].Status == "error" {
		reason := ""
		if response.Data[0].Error != nil {
			reason = *response.Data[0].Error
		}
		// Suppressed or undeliverable address: permanent, so do not invite a retry.
		log.Printf("AhaSend rejected the recipient reason=%q", reason)
		return echo.NewHTTPError(http.StatusBadRequest, "recipient rejected")
	}

	messageID := ""
	if response.Data[0].ID != nil {
		messageID = *response.Data[0].ID
	}
	return c.JSON(http.StatusAccepted, map[string]interface{}{
		"accepted":   true,
		"message_id": messageID,
	})
}

package main

import (
	"errors"
	"log"
	"net/http"

	"github.com/AhaSend/ahasend-go/webhooks"
	"github.com/labstack/echo/v5"
)

func handleAhaSendWebhook(c *echo.Context) error {
	event, err := verifier.ParseRequest(c.Request())
	if err != nil {
		if errors.Is(err, echo.ErrStatusRequestEntityTooLarge) {
			return c.NoContent(http.StatusRequestEntityTooLarge)
		}
		switch {
		case errors.Is(err, webhooks.ErrMissingHeaders),
			errors.Is(err, webhooks.ErrInvalidSignature),
			errors.Is(err, webhooks.ErrExpiredTimestamp),
			errors.Is(err, webhooks.ErrInvalidPayload),
			errors.Is(err, webhooks.ErrUnknownEventType):
			return c.NoContent(http.StatusBadRequest)
		default:
			return c.NoContent(http.StatusInternalServerError)
		}
	}

	webhookID := c.Request().Header.Get(webhooks.HeaderWebhookID)
	log.Printf("verified AhaSend webhook type=%s webhook_id=%s", event.GetType(), webhookID)

	return c.NoContent(http.StatusOK)
}