Send email from Go with an email API

// net/http and encoding/json are all you need.package main
import (	"bytes"	"encoding/json"	"fmt"	"net/http"	"os")
const url = "https://api.rasket.com/emails"
func main() {	payload, err := json.Marshal(map[string]any{		"from":    "Acme <orders@send.acme.example>",		"to":      []string{"ronald.williams@example.com"},		"subject": "Your order has shipped",		"html":    "<p>Order 1042 shipped today.</p>",	})	if err != nil {		panic(err)	}
	body := bytes.NewReader(payload)	req, err := http.NewRequest("POST", url, body)	if err != nil {		panic(err)	}
	key := os.Getenv("RASKET_API_KEY")	req.Header.Set("Authorization", "Bearer "+key)	// Required on every request.	req.Header.Set("User-Agent", "acme-billing/1.0")	req.Header.Set("Content-Type", "application/json")	req.Header.Set("Idempotency-Key", "order-1042")
	res, err := http.DefaultClient.Do(req)	if err != nil {		panic(err)	}	defer res.Body.Close()
	var email struct {		ID string `json:"id"`	}	err = json.NewDecoder(res.Body).Decode(&email)	if err != nil {		panic(err)	}
	fmt.Println(email.ID)}

package rasket
import (	"bytes"	"context"	"encoding/json"	"errors"	"net/http"	"os"	"time")
const baseURL = "https://api.rasket.com"
// Client sends email through the Rasket API.type Client struct {	key  string	http *http.Client}
// New reads the key from the environment and fails at start-up if it is missing.func New() (*Client, error) {	key := os.Getenv("RASKET_API_KEY")	if key == "" {		return nil, errors.New("RASKET_API_KEY is not set")	}	return &Client{		key:  key,		http: &http.Client{Timeout: 10 * time.Second},	}, nil}
// Message is the body of POST /emails.type Message struct {	From    string   `json:"from"`	To      []string `json:"to"`	Subject string   `json:"subject"`	HTML    string   `json:"html,omitempty"`	Text    string   `json:"text,omitempty"`}
// Send posts one message. The idempotency key names the thing that caused the send.func (c *Client) Send(ctx context.Context, msg Message, idempotencyKey string) (string, error) {	payload, err := json.Marshal(msg)	if err != nil {		return "", err	}
	req, err := http.NewRequestWithContext(		ctx, http.MethodPost, baseURL+"/emails", bytes.NewReader(payload),	)	if err != nil {		return "", err	}	req.Header.Set("Authorization", "Bearer "+c.key)	req.Header.Set("User-Agent", "acme-billing/1.0")	req.Header.Set("Content-Type", "application/json")	req.Header.Set("Idempotency-Key", idempotencyKey)
	res, err := c.http.Do(req)	if err != nil {		return "", err	}	defer res.Body.Close()
	if res.StatusCode != http.StatusOK {		return "", decodeError(res)	}
	var email struct {		ID string `json:"id"`	}	if err := json.NewDecoder(res.Body).Decode(&email); err != nil {		return "", err	}	return email.ID, nil}

// Same package as the client. Add "fmt" and "strconv" to its imports.
// APIError is the body every refused request carries.type APIError struct {	StatusCode int    `json:"statusCode"`	Name       string `json:"name"`	Message    string `json:"message"`	Errors     []struct {		Path    string `json:"path"`		Message string `json:"message"`	} `json:"errors,omitempty"`	// Seconds to wait, from the Retry-After header. Only set on a 429.	RetryAfter int `json:"-"`}
func (e *APIError) Error() string {	return fmt.Sprintf("rasket: %d %s: %s", e.StatusCode, e.Name, e.Message)}
func decodeError(res *http.Response) error {	apiErr := &APIError{StatusCode: res.StatusCode}	if err := json.NewDecoder(res.Body).Decode(apiErr); err != nil {		apiErr.Name = "unknown"		apiErr.Message = res.Status	}	if apiErr.Name == "rate_limit_exceeded" {		if seconds, err := strconv.Atoi(res.Header.Get("Retry-After")); err == nil {			apiErr.RetryAfter = seconds		}	}	return apiErr}

id, err := client.Send(ctx, msg, "order-1042")if err != nil {	var apiErr *rasket.APIError	if errors.As(err, &apiErr) {		// The API answered and said no.		switch apiErr.Name {		case "validation_error":			log.Printf("payload rejected: %v", apiErr.Errors) // a retry fails the same way		case "rate_limit_exceeded":			log.Printf("rate limited, retry in %ds", apiErr.RetryAfter)		default:			log.Printf("refused: %v", apiErr)		}		return err	}	// Nothing answered: a timeout or a connection error. Retry with the SAME key.	log.Printf("no answer: %v", err)	return err}log.Printf("accepted as %s", id)

// Same package again, with "fmt" and "math/rand/v2" imported.
// SendWithRetry repeats Send on a 429, a 5xx and on no answer at all,// with the same idempotency key on every attempt.func (c *Client) SendWithRetry(ctx context.Context, msg Message, idempotencyKey string) (string, error) {	backoff := 500 * time.Millisecond	for attempt := 1; ; attempt++ {		id, err := c.Send(ctx, msg, idempotencyKey)		if err == nil {			return id, nil		}
		wait := backoff		var apiErr *APIError		if errors.As(err, &apiErr) {			if apiErr.StatusCode != http.StatusTooManyRequests && apiErr.StatusCode < 500 {				return "", err // any other 4xx will not change on retry			}			if apiErr.RetryAfter > 0 {				wait = time.Duration(apiErr.RetryAfter) * time.Second			}		}		if attempt == 5 {			return "", fmt.Errorf("giving up after %d attempts: %w", attempt, err)		}
		// Jitter, so a fleet of workers does not retry in step. math/rand/v2.		wait += rand.N(wait / 4)		select {		case <-time.After(wait):		case <-ctx.Done():			return "", ctx.Err()		}		backoff *= 2	}}

package main
import (	"crypto/hmac"	"crypto/sha256"	"encoding/base64"	"encoding/json"	"io"	"math"	"net/http"	"os"	"strconv"	"strings"	"time")
// verify checks one Standard-Webhooks signature: HMAC-SHA256 over "id.timestamp.body".func verify(secret, id, timestamp string, body []byte, signatures string) bool {	key, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(secret, "whsec_"))	if err != nil {		return false	}
	sent, err := strconv.ParseInt(timestamp, 10, 64)	if err != nil || math.Abs(float64(time.Now().Unix()-sent)) > 300 {		return false // older than five minutes, or from the future: a replay	}
	mac := hmac.New(sha256.New, key)	mac.Write([]byte(id + "." + timestamp + "." + string(body)))	expected := base64.StdEncoding.EncodeToString(mac.Sum(nil))
	// "v1,<sig> v1,<sig>": two entries for 24 hours after a secret rotation.	for _, entry := range strings.Fields(signatures) {		version, sig, ok := strings.Cut(entry, ",")		if !ok || version != "v1" {			continue		}		if hmac.Equal([]byte(sig), []byte(expected)) {			return true		}	}	return false}
func webhook(w http.ResponseWriter, r *http.Request) {	// Read the raw bytes BEFORE anything decodes them. The signature is over what arrived.	body, err := io.ReadAll(r.Body)	if err != nil {		http.Error(w, "unreadable body", http.StatusBadRequest)		return	}
	ok := verify(		os.Getenv("RASKET_WEBHOOK_SECRET"),		r.Header.Get("svix-id"),		r.Header.Get("svix-timestamp"),		body,		r.Header.Get("svix-signature"),	)	if !ok {		http.Error(w, "invalid signature", http.StatusBadRequest)		return	}
	var event struct {		Type string `json:"type"`	}	if err := json.Unmarshal(body, &event); err != nil {		http.Error(w, "invalid json", http.StatusBadRequest)		return	}
	w.WriteHeader(http.StatusOK) // answer first, work after	go record(r.Header.Get("svix-id"), event.Type, body)}