Send email from Hono

import { Hono } from 'hono';
import { zValidator } from '@hono/zod-validator';
import { z } from 'zod';
import { Emailssh } from '@emails.sh/sdk';

type Bindings = {
	EMAILSSH_API_KEY: string;
	EMAILSSH_FROM: string;
};

const app = new Hono<{ Bindings: Bindings }>();

const signup = z.object({
	email: z.string().email(),
	name: z.string().max(100).optional()
});

app.post('/send', zValidator('json', signup), async (c) => {
	const { email, name = 'there' } = c.req.valid('json');

	// c.env is per request on Workers, so the client is built here rather than
	// at module scope. It is a thin fetch wrapper, so this costs nothing.
	const mail = new Emailssh({ apiKey: c.env.EMAILSSH_API_KEY });

	const sent = await mail.send({
		from: c.env.EMAILSSH_FROM,
		to: [email],
		subject: 'Welcome to Acme',
		html: `<p>Hi ${escapeHtml(name)}, your Acme account is ready.</p>`,
		text: `Hi ${name}, your Acme account is ready.`,
		idempotencyKey: `welcome:${email.toLowerCase()}`
	});

	return c.json({ id: sent.id, status: sent.status });
});

function escapeHtml(value: string) {
	return value.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;');
}

export default app;

import { Hono } from 'hono';

type Bindings = { EMAILSSH_WEBHOOK_SECRET: string };

export const webhooks = new Hono<{ Bindings: Bindings }>();

webhooks.post('/webhooks/emailssh', async (c) => {
	const signature = c.req.header('x-emailssh-signature') ?? '';
	const raw = await c.req.text();

	// WebCrypto rather than node:crypto, so this runs on every runtime Hono
	// supports without a polyfill.
	const key = await crypto.subtle.importKey(
		'raw',
		new TextEncoder().encode(c.env.EMAILSSH_WEBHOOK_SECRET),
		{ name: 'HMAC', hash: 'SHA-256' },
		false,
		['sign']
	);
	const digest = await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(raw));
	const expected = [...new Uint8Array(digest)]
		.map((byte) => byte.toString(16).padStart(2, '0'))
		.join('');

	if (expected !== signature) return c.json({ error: 'bad signature' }, 401);

	const event = JSON.parse(raw) as { type: string; data: { id: string; to: string[] } };

	if (event.type === 'email.bounced' || event.type === 'email.complained') {
		console.warn('Suppress', event.data.to[0], 'after', event.type);
	}

	return c.body(null, 204);
});