How to Send Email with gorilla/mux (Go)

package main

import (
	"context"
	"errors"
	"log"
	"net/http"
	"os"
	"os/signal"
	"syscall"
	"time"

	"github.com/AhaSend/ahasend-go/api"
	"github.com/google/uuid"
	"github.com/gorilla/mux"
)

var (
	ahasendClient *api.APIClient
	accountID     uuid.UUID
	sandboxMode   bool
	welcomeToken  string
)

func main() {
	apiKey := os.Getenv("AHASEND_API_KEY")
	if apiKey == "" {
		log.Fatal("AHASEND_API_KEY is required")
	}
	welcomeToken = os.Getenv("WELCOME_ENDPOINT_TOKEN")
	if welcomeToken == "" {
		log.Fatal("WELCOME_ENDPOINT_TOKEN is required")
	}

	var err error
	accountID, err = uuid.Parse(os.Getenv("AHASEND_ACCOUNT_ID"))
	if err != nil {
		log.Fatal("AHASEND_ACCOUNT_ID must be a UUID")
	}

	switch os.Getenv("AHASEND_DELIVERY_MODE") {
	case "sandbox":
		sandboxMode = true
	case "live":
		sandboxMode = false
	default:
		log.Fatal("AHASEND_DELIVERY_MODE must be sandbox or live")
	}

	ahasendClient = api.NewAPIClient(api.WithAPIKey(apiKey))

	r := mux.NewRouter()
	r.Handle("/api/welcome", requireWelcomeToken(http.HandlerFunc(sendWelcome))).Methods(http.MethodPost)

	server := &http.Server{
		Addr:              ":8080",
		Handler:           r,
		ReadHeaderTimeout: 5 * time.Second,
		ReadTimeout:       30 * time.Second,
		WriteTimeout:      30 * time.Second,
		IdleTimeout:       60 * time.Second,
		MaxHeaderBytes:    1 << 20,
	}

	shutdownSignal, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
	defer stop()
	go func() {
		<-shutdownSignal.Done()
		shutdownCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
		defer cancel()
		if err := server.Shutdown(shutdownCtx); err != nil {
			log.Print("HTTP server graceful shutdown failed")
		}
	}()

	if err := server.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
		log.Fatal("HTTP server stopped unexpectedly")
	}
}

package main

import (
	"crypto/sha256"
	"crypto/subtle"
	"encoding/json"
	"errors"
	"io"
	"log"
	"net/http"
	"net/mail"
	"strings"

	"github.com/AhaSend/ahasend-go"
	"github.com/AhaSend/ahasend-go/api"
	"github.com/AhaSend/ahasend-go/models/common"
	"github.com/AhaSend/ahasend-go/models/requests"
	"github.com/google/uuid"
)

type welcomeInput struct {
	EventID string `json:"event_id"`
	Email   string `json:"email"`
	Name    string `json:"name"`
}

func requireWelcomeToken(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		provided := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
		providedHash := sha256.Sum256([]byte(provided))
		expectedHash := sha256.Sum256([]byte(welcomeToken))
		if provided == "" || subtle.ConstantTimeCompare(providedHash[:], expectedHash[:]) != 1 {
			w.WriteHeader(http.StatusUnauthorized)
			return
		}
		next.ServeHTTP(w, r)
	})
}

func sendWelcome(w http.ResponseWriter, r *http.Request) {
	r.Body = http.MaxBytesReader(w, r.Body, 64<<10)
	decoder := json.NewDecoder(r.Body)
	decoder.DisallowUnknownFields()

	var in welcomeInput
	if err := decoder.Decode(&in); err != nil {
		var maxBytesErr *http.MaxBytesError
		if errors.As(err, &maxBytesErr) {
			w.WriteHeader(http.StatusRequestEntityTooLarge)
		} else {
			http.Error(w, "invalid JSON body", http.StatusBadRequest)
		}
		return
	}
	if err := decoder.Decode(&struct{}{}); !errors.Is(err, io.EOF) {
		http.Error(w, "body must contain one JSON object", http.StatusBadRequest)
		return
	}

	address, err := mail.ParseAddress(in.Email)
	if err != nil || address.Address != in.Email {
		http.Error(w, "a plain email address is required", http.StatusBadRequest)
		return
	}
	eventID, err := uuid.Parse(in.EventID)
	if err != nil {
		http.Error(w, "event_id must be a UUID", http.StatusBadRequest)
		return
	}
	name := strings.TrimSpace(in.Name)
	if len(name) > 128 || strings.ContainsAny(name, "\r\n") {
		http.Error(w, "name must be a single line of at most 128 bytes", http.StatusBadRequest)
		return
	}

	message := requests.CreateMessageRequest{
		From:        common.SenderAddress{Email: "hello@yourdomain.com", Name: ahasend.String("Your App")},
		Recipients:  []common.Recipient{{Email: in.Email, Name: ahasend.String(name)}},
		Subject:     "Welcome to Your App!",
		HtmlContent: ahasend.String("<h1>Welcome aboard 🎉</h1><p>We're glad you're here.</p>"),
		TextContent: ahasend.String("Welcome aboard! We're glad you're here."),
		Sandbox:     ahasend.Bool(sandboxMode),
	}

	// The delivery mode is part of the request body, and a key replayed with a
	// different body is rejected, so keep sandbox and live keys apart.
	mode := "live"
	if sandboxMode {
		mode = "sandbox"
	}

	response, _, err := ahasendClient.MessagesAPI.CreateMessage(
		r.Context(),
		accountID,
		message,
		api.WithIdempotencyKey("welcome-"+mode+"-"+eventID.String()),
	)
	if err != nil {
		var apiErr *api.APIError
		if errors.As(err, &apiErr) {
			log.Printf("AhaSend request failed: status=%d code=%s request_id=%s", apiErr.StatusCode, apiErr.Code, apiErr.RequestID)
			switch {
			case apiErr.IsRetryable():
				http.Error(w, "failed to send email", http.StatusBadGateway)
			case apiErr.StatusCode == http.StatusUnauthorized || apiErr.StatusCode == http.StatusForbidden:
				// The API key, not the caller's payload.
				http.Error(w, "email service misconfigured", http.StatusInternalServerError)
			default:
				http.Error(w, "email was rejected", http.StatusUnprocessableEntity)
			}
			return
		}
		http.Error(w, "unexpected error", http.StatusInternalServerError)
		return
	}

	queued, rejected := 0, 0
	for _, result := range response.Data {
		switch result.Status {
		case "queued", "scheduled":
			queued++
		default:
			rejected++
		}
	}
	if rejected > 0 || queued == 0 {
		log.Printf("AhaSend rejected recipients: count=%d", rejected)
		http.Error(w, "email was not accepted", http.StatusUnprocessableEntity)
		return
	}

	w.Header().Set("Content-Type", "application/json")
	w.WriteHeader(http.StatusAccepted)
	_ = json.NewEncoder(w).Encode(map[string]int{"queued": queued})
}

package main

import (
	"context"
	"errors"
	"net/http"
	"os"

	"github.com/AhaSend/ahasend-go/webhooks"
	"github.com/gorilla/mux"
)

const maxWebhookBodyBytes int64 = 30_000_000

type webhookStore interface {
	// EnqueueOnce atomically commits webhookID and durable work for event.
	// It returns false if that ID was already committed.
	EnqueueOnce(ctx context.Context, webhookID string, event webhooks.WebhookEvent) (bool, error)
}

func newAhaSendWebhookHandler(secret string, store webhookStore) (http.Handler, error) {
	if secret == "" {
		return nil, errors.New("AHASEND_WEBHOOK_SECRET is required")
	}
	verifier, err := webhooks.NewWebhookVerifier(secret)
	if err != nil {
		return nil, errors.New("invalid AHASEND_WEBHOOK_SECRET")
	}

	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		r.Body = http.MaxBytesReader(w, r.Body, maxWebhookBodyBytes)
		event, err := verifier.ParseRequest(r)
		if err != nil {
			var maxBytesErr *http.MaxBytesError
			switch {
			case errors.As(err, &maxBytesErr):
				w.WriteHeader(http.StatusRequestEntityTooLarge)
			case errors.Is(err, webhooks.ErrMissingHeaders),
				errors.Is(err, webhooks.ErrInvalidSignature),
				errors.Is(err, webhooks.ErrExpiredTimestamp):
				w.WriteHeader(http.StatusUnauthorized)
			case errors.Is(err, webhooks.ErrUnknownEventType):
				// The signature is valid; acknowledge an event this app does not use.
				w.WriteHeader(http.StatusNoContent)
			default:
				w.WriteHeader(http.StatusBadRequest)
			}
			return
		}

		webhookID := r.Header.Get(webhooks.HeaderWebhookID)
		accepted, err := store.EnqueueOnce(r.Context(), webhookID, event)
		if err != nil {
			w.WriteHeader(http.StatusInternalServerError)
			return
		}
		if !accepted {
			w.WriteHeader(http.StatusOK)
			return
		}

		w.WriteHeader(http.StatusAccepted)
	}), nil
}

func registerAhaSendWebhook(r *mux.Router, store webhookStore) error {
	handler, err := newAhaSendWebhookHandler(os.Getenv("AHASEND_WEBHOOK_SECRET"), store)
	if err != nil {
		return err
	}
	r.Handle("/webhooks/ahasend", handler).Methods(http.MethodPost)
	return nil
}