How to Send Email with Next.js

AHASEND_API_KEY=aha-sk-...
AHASEND_ACCOUNT_ID=your-account-uuid
AHASEND_WEBHOOK_SECRET=aha-whsec-...
WELCOME_API_TOKEN=generate-a-long-random-service-token

import "server-only";
import { AhaSendClient } from "@ahasend/sdk";
import { createHash } from "node:crypto";

let client: AhaSendClient | undefined;

function ahasend(): AhaSendClient {
  client ??= AhaSendClient.fromEnv();
  return client;
}

export interface WelcomeInput {
  signupId: string;
  email: string;
  name?: string | undefined;
}

export async function sendWelcomeEmail(input: WelcomeInput) {
  const idempotencyKey = `welcome-${createHash("sha256")
    .update(input.signupId)
    .digest("hex")}`;

  const result = await ahasend().messages.send({
    from: { email: "hello@yourdomain.com", name: "Your App" },
    recipients: [{ email: input.email, name: input.name }],
    subject: "Welcome to Your App!",
    html_content: "<h1>Welcome aboard 🎉</h1><p>We're glad you're here.</p>",
    text_content: "Welcome aboard! We're glad you're here.",
  }, { idempotencyKey });

  const rejected = result.data.filter((entry) => entry.status === "error");
  return { queued: result.data.length - rejected.length, rejected: rejected.length };
}

import "server-only";
import { createHash, timingSafeEqual } from "node:crypto";

let expected: Buffer | undefined;

function expectedDigest(): Buffer {
  if (expected) return expected;
  const token = process.env.WELCOME_API_TOKEN;
  if (!token || token.length < 32) {
    throw new Error("WELCOME_API_TOKEN must contain at least 32 characters");
  }
  expected = createHash("sha256").update(token).digest();
  return expected;
}

export function isInternalRequest(request: Request): boolean {
  const parts = request.headers.get("authorization")?.split(" ") ?? [];
  if (parts.length !== 2 || parts[0] !== "Bearer") return false;
  const actual = createHash("sha256").update(parts[1]).digest();
  return timingSafeEqual(actual, expectedDigest());
}

import { NextResponse } from "next/server";
import { AhaSendAPIError, isAhaSendError } from "@ahasend/sdk";
import { z } from "zod";
import { sendWelcomeEmail } from "@/lib/ahasend";
import { isInternalRequest } from "@/lib/internal-auth";

const MAX_BODY_BYTES = 16_384;
const WelcomeInput = z.strictObject({
  signupId: z.string().min(1).max(128),
  email: z.string().email().max(320),
  name: z.string().max(200).optional(),
});

class RequestBodyError extends Error {
  constructor(readonly status: 400 | 413 | 415) {
    super();
  }
}

async function readJsonBody(request: Request): Promise<unknown> {
  const mediaType = request.headers.get("content-type")?.split(";", 1)[0]
    .trim()
    .toLowerCase();
  if (mediaType !== "application/json") throw new RequestBodyError(415);

  const declared = request.headers.get("content-length");
  if (declared !== null) {
    const length = Number(declared);
    if (!Number.isSafeInteger(length) || length < 0) throw new RequestBodyError(400);
    if (length > MAX_BODY_BYTES) throw new RequestBodyError(413);
  }

  const reader = request.body?.getReader();
  if (!reader) throw new RequestBodyError(400);
  const chunks: Uint8Array[] = [];
  let total = 0;

  try {
    while (true) {
      const { done, value } = await reader.read();
      if (done) break;
      total += value.byteLength;
      if (total > MAX_BODY_BYTES) {
        await reader.cancel();
        throw new RequestBodyError(413);
      }
      chunks.push(value);
    }
  } finally {
    reader.releaseLock();
  }

  const bytes = new Uint8Array(total);
  let offset = 0;
  for (const chunk of chunks) {
    bytes.set(chunk, offset);
    offset += chunk.byteLength;
  }

  try {
    return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
  } catch {
    throw new RequestBodyError(400);
  }
}

export async function POST(request: Request) {
  if (!isInternalRequest(request)) {
    return new Response(null, { status: 401 });
  }

  let input: z.infer<typeof WelcomeInput>;
  try {
    input = WelcomeInput.parse(await readJsonBody(request));
  } catch (err) {
    const status = err instanceof RequestBodyError ? err.status : 400;
    return new Response(null, { status });
  }

  try {
    const result = await sendWelcomeEmail(input);
    return NextResponse.json(result, { status: result.rejected > 0 ? 422 : 200 });
  } catch (err) {
    if (AhaSendAPIError.is(err)) {
      console.error(`AhaSend API error ${err.status}; request ${err.requestId ?? "unknown"}`);
    } else if (isAhaSendError(err)) {
      console.error(`AhaSend SDK error: ${err.code}`);
    } else {
      console.error("Unexpected email send failure");
    }
    return new Response(null, { status: 502 });
  }
}

"use server";

import { AhaSendAPIError, isAhaSendError } from "@ahasend/sdk";
import { sendWelcomeEmail } from "@/lib/ahasend";
import { requireCurrentUser } from "@/lib/auth";

export async function sendWelcome() {
  const user = await requireCurrentUser();

  try {
    return await sendWelcomeEmail({
      signupId: user.signupId,
      email: user.email,
      name: user.name,
    });
  } catch (err) {
    if (AhaSendAPIError.is(err)) {
      console.error(`AhaSend API error ${err.status}; request ${err.requestId ?? "unknown"}`);
    } else if (isAhaSendError(err)) {
      console.error(`AhaSend SDK error: ${err.code}`);
    } else {
      console.error("Unexpected email send failure");
    }
    throw new Error("Unable to queue welcome email");
  }
}

import {
  WebhookVerifier,
  nextRouteHandler,
} from "@ahasend/sdk/webhooks";

let receiver: ((request: Request) => Promise<Response>) | undefined;

function webhookReceiver() {
  if (receiver) return receiver;
  const secret = process.env.AHASEND_WEBHOOK_SECRET;
  if (!secret) throw new Error("AHASEND_WEBHOOK_SECRET is required");
  receiver = nextRouteHandler(
    new WebhookVerifier(secret),
    async () => new Response(null, { status: 204 }),
    {
      maxBodyBytes: 1_000_000,
      onError(_error, context) {
        console.error(`AhaSend webhook ${context.stage} failure`);
      },
    },
  );
  return receiver;
}

export async function POST(request: Request) {
  return webhookReceiver()(request);
}