Send email from Express

import express from 'express';
import { Emailssh } from '@emails.sh/sdk';

const app = express();
const mail = new Emailssh({ apiKey: process.env.EMAILSSH_API_KEY });
const FROM = process.env.EMAILSSH_FROM ?? 'Acme <onboarding@emails.sh>';

// The webhook route is mounted before express.json() so it still receives the
// raw bytes the signature was computed over.
app.use('/webhooks/emailssh', express.raw({ type: 'application/json' }));
app.use(express.json());

app.post('/send', async (req, res) => {
	const { email, name = 'there' } = req.body ?? {};

	if (typeof email !== 'string' || !email.includes('@')) {
		return res.status(400).json({ error: 'A valid email is required' });
	}

	try {
		const sent = await mail.send({
			from: FROM,
			to: [email],
			subject: 'Welcome to Acme',
			html: `<p>Hi ${escapeHtml(name)}, your Acme account is ready.</p>`,
			text: `Hi ${name}, your Acme account is ready.`,
			idempotencyKey: `welcome:${email.toLowerCase()}`
		});

		res.json({ id: sent.id, status: sent.status });
	} catch (error) {
		// The API describes what to do next in the body, so surface it in logs
		// and keep the generic message for the caller.
		console.error('emails.sh send failed', error);
		res.status(502).json({ error: 'Could not send right now' });
	}
});

function escapeHtml(value) {
	return String(value)
		.replaceAll('&', '&amp;')
		.replaceAll('<', '&lt;')
		.replaceAll('>', '&gt;');
}

app.listen(3000, () => console.log('listening on http://localhost:3000'));

import crypto from 'node:crypto';
import express from 'express';

export const webhooks = express.Router();

webhooks.post('/webhooks/emailssh', (req, res) => {
	const signature = req.get('x-emailssh-signature') ?? '';
	const expected = crypto
		.createHmac('sha256', process.env.EMAILSSH_WEBHOOK_SECRET)
		.update(req.body) // req.body is a Buffer here, thanks to express.raw
		.digest('hex');

	const a = Buffer.from(expected);
	const b = Buffer.from(signature);

	// timingSafeEqual throws on a length mismatch, so check that first.
	if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
		return res.status(401).json({ error: 'bad signature' });
	}

	const event = JSON.parse(req.body.toString('utf8'));

	switch (event.type) {
		case 'email.bounced':
		case 'email.complained':
			console.warn('Suppress', event.data.to[0], 'after', event.type);
			break;
		case 'email.delivered':
			console.log('Delivered', event.data.id);
			break;
	}

	// Reply 2xx quickly. Anything slow here gets retried as a failure.
	res.status(204).end();
});