How to Send Email with Nuxt

export default defineNuxtConfig({
  runtimeConfig: {
    // server-only: never put these under runtimeConfig.public
    ahasendApiKey: "",
    ahasendAccountId: "",
    ahasendWebhookSecret: "",
    welcomeRouteToken: "",
  },
});

NUXT_AHASEND_API_KEY=aha-sk-...
NUXT_AHASEND_ACCOUNT_ID=your-account-uuid
NUXT_AHASEND_WEBHOOK_SECRET=aha-whsec-...
NUXT_WELCOME_ROUTE_TOKEN=replace-with-a-long-random-value

import { AhaSendClient } from "@ahasend/sdk";
import type { H3Event } from "h3";

let client: AhaSendClient | undefined;

function requireSecret(value: unknown, name: string): string {
  if (typeof value !== "string" || value.length === 0) {
    throw new Error(`${name} is not configured`);
  }
  return value;
}

export function useAhaSend(event: H3Event): AhaSendClient {
  if (!client) {
    const config = useRuntimeConfig(event);
    client = new AhaSendClient({
      apiKey: requireSecret(config.ahasendApiKey, "NUXT_AHASEND_API_KEY"),
      accountId: requireSecret(config.ahasendAccountId, "NUXT_AHASEND_ACCOUNT_ID"),
    });
  }
  return client;
}

import { isAhaSendError } from "@ahasend/sdk";
import type { H3Event } from "h3";

type WelcomeRequest = {
  email: string;
  name: string;
  eventId: string;
};

function isWelcomeRequest(value: unknown): value is WelcomeRequest {
  if (typeof value !== "object" || value === null) return false;
  const body = value as Record<string, unknown>;
  return (
    typeof body.email === "string" &&
    body.email.length <= 320 &&
    /^[^\s@]+@[^\s@]+$/.test(body.email) &&
    typeof body.name === "string" &&
    body.name.length > 0 &&
    body.name.length <= 100 &&
    typeof body.eventId === "string" &&
    /^[A-Za-z0-9._:-]{1,200}$/.test(body.eventId)
  );
}

async function secretsEqual(left: string, right: string): Promise<boolean> {
  const encoder = new TextEncoder();
  const [leftHash, rightHash] = await Promise.all([
    crypto.subtle.digest("SHA-256", encoder.encode(left)),
    crypto.subtle.digest("SHA-256", encoder.encode(right)),
  ]);
  const leftBytes = new Uint8Array(leftHash);
  const rightBytes = new Uint8Array(rightHash);
  let difference = 0;
  for (let i = 0; i < leftBytes.length; i++) {
    difference |= leftBytes[i]! ^ rightBytes[i]!;
  }
  return difference === 0;
}

async function requireAuthorizedCaller(event: H3Event): Promise<void> {
  const expected = useRuntimeConfig(event).welcomeRouteToken;
  if (typeof expected !== "string" || expected.length === 0) {
    throw new Error("NUXT_WELCOME_ROUTE_TOKEN is not configured");
  }
  const authorization = getRequestHeader(event, "authorization") ?? "";
  const supplied = authorization.startsWith("Bearer ") ? authorization.slice(7) : "";
  if (!(await secretsEqual(supplied, expected))) {
    throw createError({ statusCode: 401, statusMessage: "Unauthorized" });
  }
}

export default defineEventHandler(async (event) => {
  await requireAuthorizedCaller(event);

  const contentType = getRequestHeader(event, "content-type") ?? "";
  if (!contentType.toLowerCase().startsWith("application/json")) {
    throw createError({ statusCode: 415, statusMessage: "Expected application/json" });
  }

  const contentLength = Number(getRequestHeader(event, "content-length"));
  if (Number.isFinite(contentLength) && contentLength > 16_384) {
    throw createError({ statusCode: 413, statusMessage: "Request body too large" });
  }

  const { email, name, eventId } = await readValidatedBody<WelcomeRequest>(
    event,
    isWelcomeRequest,
  );

  let result;
  try {
    result = await useAhaSend(event).messages.send(
      {
        from: { email: "hello@yourdomain.com", name: "Your App" },
        recipients: [{ email, name }],
        subject: "Welcome to Your App!",
        html_content: "<h1>Welcome aboard 🎉</h1><p>We're glad you're here.</p>",
        text_content: "Welcome aboard! We're glad you're here.",
      },
      { idempotencyKey: `welcome:${eventId}` },
    );
  } catch (err) {
    if (isAhaSendError(err)) {
      const { code, status, requestId } = err.toJSON();
      console.error("AhaSend request failed", { code, status, requestId });
      throw createError({ statusCode: 502, statusMessage: "Failed to send email" });
    }
    throw err;
  }

  if (result.data.some((entry) => entry.status === "error")) {
    throw createError({ statusCode: 502, statusMessage: "Failed to queue email" });
  }

  setResponseStatus(event, 202);
  return { queued: true };
});

import {
  AhaSendWebhookVerificationError,
  WebhookVerifier,
  isKnownWebhookEvent,
} from "@ahasend/sdk/webhooks";
import type { H3Event } from "h3";

const MAX_WEBHOOK_BYTES = 1_000_000;

let verifier: WebhookVerifier | undefined;

function useWebhookVerifier(event: H3Event): WebhookVerifier {
  if (!verifier) {
    const secret = useRuntimeConfig(event).ahasendWebhookSecret;
    if (typeof secret !== "string" || secret.length === 0) {
      throw new Error("NUXT_AHASEND_WEBHOOK_SECRET is not configured");
    }
    verifier = new WebhookVerifier(secret);
  }
  return verifier;
}

export default defineEventHandler(async (event) => {
  // Built before the verification try/catch so a missing secret surfaces as a
  // server error instead of being answered as a signature failure.
  const webhookVerifier = useWebhookVerifier(event);

  const declaredLength = Number(getRequestHeader(event, "content-length"));
  if (Number.isSafeInteger(declaredLength) && declaredLength > MAX_WEBHOOK_BYTES) {
    setResponseStatus(event, 413);
    return null;
  }

  const rawBody = await readRawBody(event, false);
  if (!rawBody || rawBody.byteLength > MAX_WEBHOOK_BYTES) {
    setResponseStatus(event, rawBody ? 413 : 400);
    return null;
  }

  let webhookEvent;
  try {
    webhookEvent = await webhookVerifier.parse(getRequestHeaders(event), rawBody);
  } catch (err) {
    const tooLarge =
      err instanceof AhaSendWebhookVerificationError && err.reason === "body_too_large";
    setResponseStatus(event, tooLarge ? 413 : 400);
    return null;
  }

  if (isKnownWebhookEvent(webhookEvent)) {
    // Enqueue trusted work here; do not log the event or recipient data.
    console.log("Verified AhaSend webhook", { type: webhookEvent.type });
  }

  setResponseStatus(event, 204);
  return null;
});