How to Send Email with SvelteKit

AHASEND_API_KEY=aha-sk-...
AHASEND_ACCOUNT_ID=your-account-uuid
AHASEND_WEBHOOK_SECRET=aha-whsec-...
WELCOME_ROUTE_TOKEN=at-least-32-random-characters

import { env } from "$env/dynamic/private";
import { AhaSendClient } from "@ahasend/sdk";

export function requirePrivateEnv(name: string, minLength = 1): string {
  const value = env[name];
  if (!value || value.length < minLength) {
    throw new Error(`${name} is missing or shorter than ${minLength} characters`);
  }
  return value;
}

let client: AhaSendClient | undefined;

export function ahasend(): AhaSendClient {
  client ??= new AhaSendClient({
    apiKey: requirePrivateEnv("AHASEND_API_KEY"),
    accountId: requirePrivateEnv("AHASEND_ACCOUNT_ID"),
  });
  return client;
}

import { json } from "@sveltejs/kit";
import type { RequestHandler } from "./$types";
import { isAhaSendError } from "@ahasend/sdk";
import { ahasend, requirePrivateEnv } from "$lib/server/ahasend";

const MAX_JSON_BYTES = 16 * 1024;

class BodyTooLargeError extends Error {}

type WelcomeInput = {
  email: string;
  name?: string;
  eventId: string;
};

function isWelcomeInput(value: unknown): value is WelcomeInput {
  if (!value || typeof value !== "object") return false;
  const input = value as Record<string, unknown>;
  return (
    typeof input.email === "string" &&
    input.email.length > 0 &&
    input.email.length <= 254 &&
    (input.name === undefined ||
      (typeof input.name === "string" && input.name.length <= 200)) &&
    typeof input.eventId === "string" &&
    /^[A-Za-z0-9._:-]{1,200}$/.test(input.eventId)
  );
}

async function readJson(request: Request): Promise<unknown> {
  if (!request.body) throw new SyntaxError("Missing request body");

  const reader = request.body.getReader();
  const chunks: Uint8Array[] = [];
  let length = 0;

  try {
    while (true) {
      const { done, value } = await reader.read();
      if (done) break;
      length += value.byteLength;
      if (length > MAX_JSON_BYTES) {
        await reader.cancel();
        throw new BodyTooLargeError();
      }
      chunks.push(value);
    }
  } finally {
    reader.releaseLock();
  }

  const bytes = new Uint8Array(length);
  let offset = 0;
  for (const chunk of chunks) {
    bytes.set(chunk, offset);
    offset += chunk.byteLength;
  }
  return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
}

async function secretsEqual(left: string, right: string): Promise<boolean> {
  const encoder = new TextEncoder();
  const [leftHash, rightHash] = await Promise.all([
    crypto.subtle.digest("SHA-256", encoder.encode(left)),
    crypto.subtle.digest("SHA-256", encoder.encode(right)),
  ]);
  const leftBytes = new Uint8Array(leftHash);
  const rightBytes = new Uint8Array(rightHash);
  let difference = 0;
  for (let i = 0; i < leftBytes.length; i += 1) {
    difference |= leftBytes[i]! ^ rightBytes[i]!;
  }
  return difference === 0;
}

async function isAuthorized(request: Request): Promise<boolean> {
  const authorization = request.headers.get("authorization");
  if (!authorization?.startsWith("Bearer ")) return false;
  return secretsEqual(
    authorization.slice("Bearer ".length),
    requirePrivateEnv("WELCOME_ROUTE_TOKEN", 32),
  );
}

export const POST: RequestHandler = async ({ request }) => {
  if (!(await isAuthorized(request))) {
    return json({ error: "Unauthorized" }, { status: 401 });
  }

  const contentType = request.headers.get("content-type") ?? "";
  if (!/^application\/json(?:\s*;|$)/i.test(contentType)) {
    return json({ error: "Content-Type must be application/json" }, { status: 415 });
  }

  let input: unknown;
  try {
    input = await readJson(request);
  } catch (error) {
    if (error instanceof BodyTooLargeError) {
      return json({ error: "Request body is too large" }, { status: 413 });
    }
    return json({ error: "Invalid JSON" }, { status: 400 });
  }

  if (!isWelcomeInput(input)) {
    return json({ error: "Invalid request" }, { status: 400 });
  }

  try {
    const result = await ahasend().messages.send(
      {
        from: { email: "hello@yourdomain.com", name: "Your App" },
        recipients: [{ email: input.email, name: input.name }],
        subject: "Welcome to Your App!",
        html_content: "<h1>Welcome aboard 🎉</h1><p>We're glad you're here.</p>",
        text_content: "Welcome aboard! We're glad you're here.",
      },
      { idempotencyKey: `welcome:${input.eventId}` },
    );

    const rejectedCount = result.data.filter((entry) => entry.status === "error").length;
    if (rejectedCount > 0) {
      console.error("AhaSend rejected recipients", { rejectedCount });
      // Deterministic: retrying replays the same rejection, so do not
      // answer with a status that invites one.
      return json({ error: "Email was not accepted for delivery" }, { status: 422 });
    }

    return json({ queued: true }, { status: 202 });
  } catch (error) {
    if (isAhaSendError(error)) {
      const { code, status, requestId, retryAfterSeconds } = error.toJSON();
      console.error("AhaSend request failed", { code, status, requestId });
      if (code === "rate_limit_error") {
        return json(
          { error: "Rate limited" },
          {
            status: 429,
            headers: retryAfterSeconds ? { "retry-after": String(retryAfterSeconds) } : {},
          },
        );
      }
    }
    return json({ error: "Email could not be queued" }, { status: 502 });
  }
};

import type { RequestHandler } from "./$types";
import {
  WebhookVerifier,
  isKnownWebhookEvent,
  nextRouteHandler,
} from "@ahasend/sdk/webhooks";
import { requirePrivateEnv } from "$lib/server/ahasend";

let route: ReturnType<typeof nextRouteHandler> | undefined;

export const POST: RequestHandler = ({ request }) => {
  route ??= nextRouteHandler(
    new WebhookVerifier(requirePrivateEnv("AHASEND_WEBHOOK_SECRET")),
    async (event) => {
      if (isKnownWebhookEvent(event)) {
        console.log("AhaSend event", event.type);
      } else {
        // Acknowledge valid event types not yet recognized by this SDK.
        console.log("Unknown AhaSend event", event.type);
      }
      return new Response(null, { status: 200 });
    },
    { maxBodyBytes: 1_000_000 },
  );

  return route(request);
};