1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
export const schema = yup
  .object({
    to: recipientsSchema, // single or multiple recipients
    from: senderSchema,
    subject: yup.string().required(),
    html: yup.string(),
    text: yup.string(),
  })
  .test(
    "html-or-text-required",
    "Either html or text must be provided",
    function (value) {
      return !!(value?.html || value?.text);
    },
  );
// single recipient
const recipientSchema = yup.object({
  name: yup.string().nullable().optional(),
  email: yup.string().email().required(),
});
// multiple recipients
const recipientsSchema = yup.lazy((value) => {
  if (Array.isArray(value)) {
    return yup.array().of(recipientSchema).required();
  }
  return recipientSchema.required();
});
const senderSchema = yup
  .object({
    name: yup.string().nullable().optional(),
    email: yup.string().email().required(),
  })
  // 
  .transform((value, originalValue) => {
    if (
      originalValue === undefined ||
      originalValue === null ||
      (typeof originalValue === "object" &&
        originalValue !== null &&
        Object.keys(originalValue).length === 0)
    ) {
      return undefined;
    }
    return value;
  })
  .optional();

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
import { Schema } from "../schema";
import { CreateEmailOptions, Resend } from "resend";
import { getRecipientsField, getSenderField } from "../helpers/email";
// Resend has a limit of 2 emails per second
const retryAfter = 500;
export async function sendEmail(body: Schema, resend?: Resend) {
  if (!resend) {
    throw new Error("Resend instance is required");
  }
  const payload: CreateEmailOptions = {
    from: getSenderField(body.from),
    to: getRecipientsField(body.to),
    subject: body.subject,
    html: body.html,
    text: body.text,
    react: undefined,
  };
  const { data, error } = await resend.emails.send(payload);
  if (error) {
    if (isResendRateLimitError(error)) {
      await sleep(retryAfter);
      return sendEmail(body, resend);
    }
    // Throw to trigger Lambda retry and DLQ if needed
    throw new Error(JSON.stringify({ ...error, payload }));
  }
}
function isResendRateLimitError(error: unknown): boolean {
  if (typeof error !== "object" || error === null) return false;
  // Resend SDK returns the error as a plain Error with a message string
  const message = (error as Error).message;
  return message?.includes("rate_limit_exceeded");
}
async function sleep(ms: number): Promise<void> {
  return new Promise((resolve) => setTimeout(resolve, ms));
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
import { RecipientSchema, RecipientsSchema, SenderSchema } from "../schema";
export const getSenderField = (sender?: SenderSchema) => {
  if (!sender) {
    return `${process.env.FROM_NAME} <${process.env.FROM_EMAIL}>`;
  }
  if (sender.name?.trim()) {
    return `${sender.name} <${sender.email}>`;
  }
  return sender.email;
};
export const getRecipientsField = (
  recipient: RecipientsSchema,
): string | string[] => {
  if (Array.isArray(recipient)) {
    return recipient.map((r) => getRecipientField(r));
  }
  return getRecipientField(recipient);
};
const getRecipientField = (recipient: RecipientSchema) => {
  if (recipient.name?.trim()) {
    return `${recipient.name} <${recipient.email}>`;
  }
  return recipient.email;
};

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
import {
  SecretsManagerClient,
  GetSecretValueCommand,
} from "@aws-sdk/client-secrets-manager";
async function getResendApiKey(): Promise<string> {
  const client = new SecretsManagerClient({});
  const command = new GetSecretValueCommand({
    SecretId: process.env.RESEND_SECRET_NAME,
  });
  const response = await client.send(command);
  if (!response.SecretString) {
    throw new Error("Resend API key not found");
  }
  return response.SecretString;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
const allowedSenderEmails = (process.env.ALLOWED_SENDERS
  || "contact@example.com").split(",");
export const handler: SQSHandler = async (event: SQSEvent) => {
  const resend = new Resend(await getResendApiKey());
  const failedRecords: SQSBatchResponse["batchItemFailures"] = [];
  for (const record of event.Records) {
    try {
      if (!record.body) {
        throw new Error("Invalid input");
      }
      const body = JSON.parse(record.body);
      await validateBodyAsync(body);
      // Validate sender email if provided
      if (body.from_email && !allowedSenderEmails.includes(body.from_email)) {
        throw new Error(
          `Sender email ${body.from_email} is not allowed. Allowed emails: ${allowedSenderEmails.join(", ")}`,
        );
      }
      await sendResendEmail(body, resend);
    } catch (err) {
      console.error(err);
      failedRecords.push({
        itemIdentifier: record.messageId,
      });
    }
  }
  if (failedRecords.length > 0) {
    return {
      batchItemFailures: failedRecords,
    };
  }
};

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
# More information about the configuration file can be found here:
# https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/serverless-sam-cli-config.html
version = 0.1
[default.global.parameters]
stack_name = "prod-notification-service-sh"
[default.build.parameters]
cached = true
parallel = true
[default.validate.parameters]
lint = true
[default.deploy.parameters]
capabilities = "CAPABILITY_IAM"
confirm_changeset = true
resolve_s3 = true
s3_prefix = "prod-notification-service-sh"
region = "eu-west-3"
[default.package.parameters]
resolve_s3 = true
s3_prefix = "prod-notification-service-sh"
output_template_file = "packaged.yaml"
[default.sync.parameters]
watch = true
stack_name = "prod-notification-service-sh"
[default.local_start_api.parameters]
warm_containers = "EAGER"
[default.local_start_lambda.parameters]
warm_containers = "EAGER"

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
import type {
  SQSEvent,
  SQSMessageAttributes,
  SQSRecordAttributes,
} from "aws-lambda";
import { handler } from "../src";
import type { Schema } from "../src/schema";
import { v4 as uuidv4 } from "uuid";
describe("Unit test for app handler", function () {
  it("sends text email", async () => {
    const emails: Schema[] = [
      {
        to: { email: "YOUR_EMAIL@gmail.com" },
        subject: "Test Email",
        text: "This is a test email.",
      },
    ];
    const events = getSQSEvents(emails);
    const result = await handler(events, {} as any, () => {});
    // Add assertions here to verify the email was sent correctly
  });
});
const getSQSEvents = (emails: Schema[]): SQSEvent => {
  const attributes: SQSRecordAttributes = {
    ApproximateReceiveCount: "0",
    SentTimestamp: "1630456800000",
    SenderId: "",
    ApproximateFirstReceiveTimestamp: "1630456800000",
  };
  const messageAttributes: SQSMessageAttributes = {
    dummy: {
      dataType: "String",
      stringValue: "dummy",
    },
  };
  const event: SQSEvent = {
    Records: emails.map((email) => ({
      messageId: uuidv4(),
      receiptHandle: "",
      attributes,
      messageAttributes,
      md5OfBody: "",
      md5OfMessageAttributes: "",
      eventSource: "",
      eventSourceARN: "",
      awsRegion: "eu-west-3",
      body: JSON.stringify(email),
    })),
  };
  return event;
};

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: >
  A serverless application that processes email notifications from an SQS queue.
Globals:
  Function:
    Timeout: 30
    MemorySize: 256
    Tracing: Active
    LoggingConfig:
      LogFormat: JSON
    Environment:
      Variables:
        EMAIL_SERVICE: "resend"
        FROM_NAME: "Your Firm"
        FROM_EMAIL: "contact@example.com"
        ALLOWED_SENDERS_EMAILS: "contact@example.com"
        RESEND_SECRET_NAME: "prod-notification-service-resend-api-key"
Resources:
  NotificationServiceLambda:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: prod-notification-service-sh-lambda
      CodeUri: ./
      Handler: dist/src/index.handler
      Runtime: nodejs20.x
      Architectures:
        - x86_64
      Events:
        SQSEvent:
          Type: SQS
          Properties:
            Queue: !GetAtt SQSQueue.Arn
            BatchSize: 2
            Enabled: true
      Policies:
        - SQSPollerPolicy:
            QueueName: !GetAtt SQSQueue.QueueName
        - Statement:
            - Effect: Allow
              Action:
                - ses:SendEmail
                - ses:SendRawEmail
              Resource: "*"
        - Statement:
            - Effect: Allow
              Action:
                - logs:CreateLogGroup
                - logs:CreateLogStream
                - logs:PutLogEvents
              Resource: "*"
        - Statement:
            - Effect: Allow
              Action: secretsmanager:GetSecretValue
              Resource: arn:aws:secretsmanager:YOUR_REGION:YOUR_ACCOUNT_ID:secret:prod-notification-service-*
  SQSQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: prod-notification-service-sh-queue
      VisibilityTimeout: 120
      RedrivePolicy:
        deadLetterTargetArn: !GetAtt DeadLetterQueue.Arn
        maxReceiveCount: 3
  DeadLetterQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: prod-notification-service-sh-deadletter-queue
      MessageRetentionPeriod: 1209600 # 14 days in seconds
Outputs:
  NotificationServiceLambda:
    Description: Notification Service Lambda Function ARN
    Value: !GetAtt NotificationServiceLambda.Arn
  SQSQueueURL:
    Description: URL of the SQS Queue
    Value: !Ref SQSQueue
  SQSQueueARN:
    Description: ARN of the SQS Queue
    Value: !GetAtt SQSQueue.Arn
  DeadLetterQueueURL:
    Description: URL of the Dead Letter Queue
    Value: !Ref DeadLetterQueue
  DeadLetterQueueARN:
    Description: ARN of the Dead Letter Queue
    Value: !GetAtt DeadLetterQueue.Arn

1
2
3
4
5
6
7
"scripts": {
  "build": "rm -rf dist && tsc && sam build",
  "deploy": "pnpm run build && sam deploy --disable-rollback",
  "delete": "aws cloudformation delete-stack --stack-name prod-notification-service-sh --region eu-west-3",
  "log": "sam logs -n NotificationServiceLambda --stack-name prod-notification-service-sh --tail",
  "test": "jest"
},

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
import { Logger } from "workers-loki-logger";
import {
  SQSClient,
  SendMessageCommand,
} from "@aws-sdk/client-sqs";
type Bindings = {
  AWS_SQS_ACCESS_KEY_ID: string;
  AWS_SQS_SECRET_ACCESS_KEY: string;
  AWS_SQS_REGION: string;
  AWS_SQS_QUEUE_URL: string;
  LOKI_SECRET: string;
  LOKI_URL: string;
  ENVIRONMENT: string;
};
function getLogger(context: ExecutionContext, env: Bindings) {
  return new Logger({
    cloudflareContext: context,
    lokiSecret: env.LOKI_SECRET,
    lokiUrl: env.LOKI_URL || "https://logs-prod-eu-west-0.grafana.net",
    stream: {
      worker: "newsletter-worker",
      environment: env.ENVIRONMENT,
    },
  });
}
async function handleSendEmail(
  req: Request,
  env: Bindings,
  ctx: ExecutionContext,
  logger: Logger,
): Promise<Response> {
  const sqsClient = new SQSClient({
    region: env.AWS_SQS_REGION,
    credentials: {
      accessKeyId: env.AWS_SQS_ACCESS_KEY_ID,
      secretAccessKey: env.AWS_SQS_SECRET_ACCESS_KEY,
    },
  });
  const parsedBody = await req.json();
  const command = new SendMessageCommand({
    QueueUrl: env.AWS_SQS_QUEUE_URL,
    MessageBody: JSON.stringify(parsedBody),
  });
  console.log(`Sending email to SQS: ${JSON.stringify(command)}`);
  const result = await sqsClient.send(command);
  return result.$metadata.httpStatusCode === 200
    ? new Response("Email queued in SQS")
    : Response.json({
        status: 500,
        message: "Failed to queue email in SQS",
        requestId: result.$metadata.requestId,
      });
}
export default {
  async fetch(
    req: Request,
    env: Bindings,
    ctx: ExecutionContext,
  ): Promise<Response> {
    const logger = getLogger(ctx, env);
    logger.mdcSet("requestUrl", req.url);
    try {
      const url = new URL(req.url);
      // Send email directly on POST request
      if (req.method === "POST" && url.pathname === "/send-email") {
        return handleSendEmail(req, env, ctx, logger);
      }
      logger.error(
        "Route not found",
        new Error(`Route ${req.method} ${url.pathname} not found`),
      );
      return new Response("Not found", { status: 404 });
    } catch (error) {
      logger.error("Caught error", error);
      return new Response(JSON.stringify({ error: "Internal server error" }), {
        status: 500,
        headers: { "Content-Type": "application/json" },
      });
    } finally {
      await logger.flush();
    }
  }
}

1
2
3
4
5
AWS_SQS_ACCESS_KEY_ID=
AWS_SQS_SECRET_ACCESS_KEY=
AWS_SQS_REGION=eu-west-3
AWS_SQS_QUEUE_URL=
LOKI_SECRET=

1
2
3
4
5
6
7
8
9
pnpm install
# Define all secrets on remote worker.
# On the first time, it will also create the worker.
npx wrangler secret put -e production AWS_SQS_ACCESS_KEY_ID
npx wrangler secret put -e production AWS_SQS_SECRET_ACCESS_KEY
npx wrangler secret put -e production AWS_SQS_REGION
npx wrangler secret put -e production AWS_SQS_QUEUE_URL
npx wrangler secret put -e production LOKI_SECRET
pnpm run deploy

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
{
  "services": [
    {
      "binding": "NOTIFICATION",
      "service": "notification",
      "environment": "production"
    }
  ],
  "env": {
    "production": {
      "services": [
        {
          "binding": "NOTIFICATION",
          "service": "notification",
          "environment": "production"
        }
      ]
    }
  }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
const res = await context.cloudflare.env.NOTIFICATION.fetch(
    new Request(`https://dummy/send-email`, {
      method: "POST",
      body: JSON.stringify({
        to: {
          name: `${firstName} ${lastName}`,
          email: email,
        },
        subject: `${subject}`,
        txt,
        html,
      }),
      headers: { "Content-Type": "application/json" },
    })
  );
  if (!res.ok) {
    const errorData = await res.json();
    return Response.json(
      {
        success: false,
        error: errorData.message || "Failed to send email",
      },
      {
        status: res.status,
      }
    );
  }