Send email from Laravel

<?php

namespace App\Jobs;

use Illuminate\Bus\Queueable;
use Illuminate\Contracts\Queue\ShouldQueue;
use Illuminate\Foundation\Bus\Dispatchable;
use Illuminate\Queue\InteractsWithQueue;
use Illuminate\Queue\SerializesModels;
use Illuminate\Support\Facades\Http;
use Illuminate\Support\Facades\Log;
use RuntimeException;

class SendTransactionalEmail implements ShouldQueue
{
    use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;

    public int $tries = 3;

    // Wait 10s, then 60s, then 300s. Anything longer than a few minutes on a
    // transactional send is worse than failing, so three attempts is enough.
    public array $backoff = [10, 60, 300];

    public function __construct(
        public string $to,
        public string $subject,
        public string $html,
        public ?string $idempotencyKey = null,
    ) {}

    public function handle(): void
    {
        $response = Http::withToken(config('services.emailssh.key'))
            ->acceptJson()
            ->timeout(15)
            ->post('https://emails.sh/v1/emails', array_filter([
                'from' => config('services.emailssh.from'),
                'to' => [$this->to],
                'subject' => $this->subject,
                'html' => $this->html,
                'text' => strip_tags($this->html),
                'idempotency_key' => $this->idempotencyKey,
            ]));

        if ($response->failed()) {
            Log::error('emails.sh send failed', [
                'status' => $response->status(),
                'body' => $response->body(),
            ]);

            // 4xx will fail the same way on every retry, so stop rather than
            // burn the queue on it. 5xx is worth another attempt.
            if ($response->clientError()) {
                $this->fail(new RuntimeException($response->body()));

                return;
            }

            $response->throw();
        }

        Log::info('emails.sh queued', ['id' => $response->json('id')]);
    }
}

<?php

namespace App\Http\Controllers;

use App\Jobs\SendTransactionalEmail;
use Illuminate\Http\Request;
use Illuminate\Http\RedirectResponse;
use Illuminate\Support\Str;

class SignupController extends Controller
{
    public function store(Request $request): RedirectResponse
    {
        $data = $request->validate([
            'email' => ['required', 'email'],
            'name' => ['nullable', 'string', 'max:100'],
        ]);

        $name = e($data['name'] ?? 'there');

        SendTransactionalEmail::dispatch(
            to: $data['email'],
            subject: 'Welcome to Acme',
            html: "<p>Hi {$name}, your Acme account is ready.</p>",
            // Same signup submitted twice sends once. The API deduplicates on
            // this value for 24 hours.
            idempotencyKey: 'welcome:' . Str::lower($data['email']),
        );

        return back()->with('status', 'Check your inbox.');
    }
}

<?php

use Illuminate\Http\Request;
use Illuminate\Support\Facades\Log;
use Illuminate\Support\Facades\Route;

// Exclude this path from CSRF in bootstrap/app.php:
// ->withMiddleware(fn ($m) => $m->validateCsrfTokens(except: ['webhooks/emailssh']))
Route::post('/webhooks/emailssh', function (Request $request) {
    $signature = $request->header('x-emailssh-signature', '');
    $expected = hash_hmac('sha256', $request->getContent(), config('services.emailssh.webhook_secret'));

    if (! hash_equals($expected, $signature)) {
        return response()->json(['error' => 'bad signature'], 401);
    }

    $event = $request->json('type');
    $email = $request->json('data.to.0');

    match ($event) {
        'email.bounced' => Log::warning('Hard bounce, suppress this address', ['email' => $email]),
        'email.complained' => Log::warning('Spam complaint, stop sending', ['email' => $email]),
        default => Log::info('emails.sh event', ['type' => $event]),
    };

    return response()->noContent();
});