Save a PDF receipt to S3 for each payment and email the link

import base64, boto3
from datetime import datetime, timezone
from email.message import EmailMessage
from google.oauth2.credentials import Credentials
from googleapiclient.discovery import build
from clickruntime import on_event, credentials, http
REGION, BUCKET = "us-east-1", "northwind-files"

def aws(service):
    return boto3.client(service, region_name=REGION, aws_access_key_id=credentials.secret("AWS_ACCESS_KEY_ID"),
                        aws_secret_access_key=credentials.secret("AWS_SECRET_ACCESS_KEY"))

def pdf(lines):
    text = " ".join(f"BT /F1 12 Tf 72 {720 - 20 * i} Td ({l.replace('(', '[').replace(')', ']')}) Tj ET" for i, l in enumerate(lines))
    objs = ["<</Type/Catalog/Pages 2 0 R>>", "<</Type/Pages/Kids[3 0 R]/Count 1>>", "<</Type/Page/Parent 2 0 R/MediaBox[0 0 612 792]/Contents 4 0 R/Resources<</Font<</F1 5 0 R>>>>>>",
            f"<</Length {len(text)}>>stream\n{text}\nendstream", "<</Type/Font/Subtype/Type1/BaseFont/Helvetica>>"]
    return ("%PDF-1.4\n" + "".join(f"{i} 0 obj{o}endobj\n" for i, o in enumerate(objs, 1)) + "trailer<</Root 1 0 R>>\n%%EOF").encode()

@on_event
def handle(event):
    pi = event.json["data"]["object"]
    email = pi.get("receipt_email") or pi["metadata"].get("email")
    when = datetime.fromtimestamp(pi["created"], timezone.utc).date()
    key = f"receipts/{when}/{pi['id']}.pdf"
    s3 = aws("s3")
    s3.put_object(Bucket=BUCKET, Key=key, ContentType="application/pdf", Body=pdf(["Northwind Ltd - Receipt", f"Date: {when}", f"Reference: {pi['id']}",
                  f"Amount: {pi['amount_received'] / 100:,.2f} {pi['currency'].upper()}", f"Customer: {email}"]))
    link = s3.generate_presigned_url("get_object", Params={"Bucket": BUCKET, "Key": key}, ExpiresIn=7 * 24 * 3600)
    msg = EmailMessage()
    msg["To"], msg["Subject"] = email, "Your receipt from Northwind"
    msg.set_content(f"Thanks for your payment of {pi['amount_received'] / 100:,.2f} {pi['currency'].upper()}.\n\nDownload your receipt (link valid 7 days):\n{link}")
    build("gmail", "v1", credentials=Credentials(credentials.connection("google", "work")), cache_discovery=False).users().messages().send(userId="me", body={"raw": base64.urlsafe_b64encode(msg.as_bytes()).decode()}).execute()
    return {"key": key}