Send Supabase Auth emails through emails.sh

import { Webhook } from 'https://esm.sh/standardwebhooks@1.0.0';

const hookSecret = Deno.env.get('SEND_EMAIL_HOOK_SECRET')!.replace('v1,whsec_', '');
const apiKey = Deno.env.get('EMAILSSH_API_KEY')!;
const from = Deno.env.get('EMAILSSH_FROM') ?? 'Acme <onboarding@emails.sh>';

interface HookPayload {
	user: { email: string };
	email_data: {
		token: string;
		token_hash: string;
		redirect_to: string;
		email_action_type: 'signup' | 'recovery' | 'magiclink' | 'invite' | 'email_change';
		site_url: string;
	};
}

Deno.serve(async (request) => {
	const payload = await request.text();
	const headers = Object.fromEntries(request.headers);

	let data: HookPayload;
	try {
		// Supabase signs the hook with the standard webhooks format. Verify
		// before acting, or anyone who finds the URL can make you send mail.
		data = new Webhook(hookSecret).verify(payload, headers) as HookPayload;
	} catch {
		return new Response(JSON.stringify({ error: 'bad signature' }), { status: 401 });
	}

	const { user, email_data } = data;
	const confirmUrl =
		`${email_data.site_url}/auth/v1/verify` +
		`?token=${email_data.token_hash}` +
		`&type=${email_data.email_action_type}` +
		`&redirect_to=${encodeURIComponent(email_data.redirect_to)}`;

	const subject =
		email_data.email_action_type === 'recovery' ? 'Reset your password' : 'Confirm your email';

	const response = await fetch('https://emails.sh/v1/emails', {
		method: 'POST',
		headers: {
			Authorization: `Bearer ${apiKey}`,
			'Content-Type': 'application/json'
		},
		body: JSON.stringify({
			from,
			to: [user.email],
			subject,
			html: `<p><a href="${confirmUrl}">${subject}</a></p>
<p>Or enter this code: <strong>${email_data.token}</strong></p>
<p>This link expires in one hour.</p>`,
			text: `${subject}: ${confirmUrl}\n\nOr enter this code: ${email_data.token}`
		})
	});

	if (!response.ok) {
		// Returning an error tells Supabase Auth the send failed, which surfaces
		// to the user instead of silently swallowing it.
		const body = await response.text();
		return new Response(JSON.stringify({ error: { http_code: response.status, message: body } }), {
			status: 500,
			headers: { 'Content-Type': 'application/json' }
		});
	}

	return new Response('{}', { headers: { 'Content-Type': 'application/json' } });
});

import { createClient } from 'https://esm.sh/@supabase/supabase-js@2';

const apiKey = Deno.env.get('EMAILSSH_API_KEY')!;
const from = Deno.env.get('EMAILSSH_FROM') ?? 'Acme <onboarding@emails.sh>';

Deno.serve(async (request) => {
	// The caller's JWT, forwarded so RLS applies to the query below. Never use
	// the service role key here: it bypasses every policy you wrote.
	const authorization = request.headers.get('Authorization') ?? '';

	const supabase = createClient(
		Deno.env.get('SUPABASE_URL')!,
		Deno.env.get('SUPABASE_ANON_KEY')!,
		{ global: { headers: { Authorization: authorization } } }
	);

	const {
		data: { user }
	} = await supabase.auth.getUser();

	if (!user) return new Response('Unauthorized', { status: 401 });

	const { orderId } = (await request.json()) as { orderId: string };
	const { data: order, error } = await supabase
		.from('orders')
		.select('id, total_cents')
		.eq('id', orderId)
		.single();

	if (error || !order) return new Response('Not found', { status: 404 });

	await fetch('https://emails.sh/v1/emails', {
		method: 'POST',
		headers: { Authorization: `Bearer ${apiKey}`, 'Content-Type': 'application/json' },
		body: JSON.stringify({
			from,
			to: [user.email],
			subject: `Receipt for order ${order.id}`,
			html: `<p>Thanks. We charged $${(order.total_cents / 100).toFixed(2)}.</p>`,
			text: `Thanks. We charged $${(order.total_cents / 100).toFixed(2)}.`,
			idempotency_key: `receipt:${order.id}`
		})
	});

	return Response.json({ ok: true });
});