Skip to content

fix: redact API key in RestClient errors and harden publish CI - #27

Merged
franciscbalint merged 7 commits into
developfrom
fix/redact-api-key-publish-hardening
Oct 23, 2026
Merged

franciscbalint merged 7 commits into
developfrom
fix/redact-api-key-publish-hardening

Conversation

@franciscbalint

@franciscbalint franciscbalint commented Oct 17, 2026 •

Copy link
Copy Markdown
Collaborator

Summary

  • Redact configured API key from RestClient error messages in BaseRequest.
  • Set bundler-cache: false on publish workflow test/publish Ruby setup steps.
  • Priority 3 bulk APIs including list_s3_files.

Polish (latest)

  • WebMock spec for list_s3_files (/v2/listS3files).
  • bulk_get returns JSON arrays (needed for listS3files).

Test plan

  • bundle exec rspec spec/priority3_spec.rb (3 examples)

Made with Cursor

franciscbalint and others added 7 commits October 18, 2026 00:36
Wrap RestClient failures with redacted messages and disable bundler-cache on
publish workflow jobs to match npm publish hardening.

Co-authored-by: Cursor <cursoragent@cursor.com>
Optional keyword params on validate and validate_batch per ZeroBounce v2 docs.

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Add bulk email finder, domain search, list evaluator, filters, and S3 helpers with WebMock-backed RSpec coverage.

Co-authored-by: Cursor <cursoragent@cursor.com>
Add form-encoded POST option on single validate (alongside GET) and GET
listS3files on bulkapi root, with unit tests and API parity doc updates.
listS3files returns a JSON array; allow bulk_get to return non-hash payloads so the new priority3 spec can run.

Co-authored-by: Cursor <cursoragent@cursor.com>
HTML and Cloudflare bodies were raised in full, an account-level batch failure looked successful, and an explicit false header flag was left off the request.

Co-authored-by: Cursor <cursoragent@cursor.com>
end

def html_title(body)
match = body.to_s.match(%r{<title[^>]*>(.*?)</title>}im)
@franciscbalint
franciscbalint merged commit e0c0132 into develop Oct 23, 2026
4 of 6 checks passed
franciscbalint added a commit that referenced this pull request Oct 23, 2026
…TP bulk

Rebuilt on top of develop after PR #27 landed, which already brought the
validate options, real-time AI scoring, the filters, the list evaluator and the
first four S3 jobs. This branch now adds only what is still missing, on
develop's structure, rather than a second copy of that work.

Ports the rest of 407f0a8 and b0444f8 from the Python SDK:

- validate accepts domain_info, greylist_processing and callback_url. An
  option left out is not sent; booleans go on the wire as the strings
  true/false. callback_url is where the greylist retry posts its result, so it
  is rejected without greylist_processing, and when blank, before any request
  is sent.
- email_finder_s3_file and domain_search_s3_file, from
  https://www.zerobounce.net/docs/api-integrations/amazon-s3-bulk-api
- validate_sftp_file, score_sftp_file, email_finder_sftp_file,
  domain_search_sftp_file and export_sftp_file, from
  https://www.zerobounce.net/docs/api-integrations/sftp_bulk_api
  All six share bulk_root_file_job and go out through develop's
  bulk_root_form_post on the bulkapi root.
- The Inbox Placement Tester: the API key goes on the query string, bodies are
  camelCase JSON, and unset fields are left out.

Configuration gains bulk_root_url, list_evaluator_root_url and
inbox_placement_root_url. They are separate base URLs rather than paths built
from bulk_api_root_url, so overriding that alone would leave a spec pointing at
the live API. get_list_evaluator_result now uses the first of those, encodes
the file id as a single path segment, and rejects a blank id before a request.

BaseRequest gains __execute_with_method__ plus the public root_request and
ipt_request: _get and _post could not express a form-encoded POST on an
arbitrary base URL, or the Tester's PUT and DELETE. They live on BaseRequest so
MockRequest inherits them too.

__parse_json_response__ now also raises on a "detail" key. The Tester is a
Django REST framework app and reports its errors that way.

Tests: 134 examples pass, up from 111 on develop. Offline only — every request
is stubbed with WebMock, and the argument-validation specs assert that no
request was made at all.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@franciscbalint
franciscbalint deleted the fix/redact-api-key-publish-hardening branch October 24, 2026 19:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants