Add api token endpoints#107
Merged
IgorDobryn merged 8 commits intomainfrom May 4, 2026
Merged
Conversation
IgorDobryn
commented
Apr 29, 2026
| body: | ||
| encoding: ASCII-8BIT | ||
| string: '{"resources":[{"resource_type":"account","resource_id":1719941,"access_level":100}],"id":2498713,"name":"Ruby | ||
| SDK Test Token","last_4_digits":"dcf7","created_by":"SDK Dev Account Token","expires_at":null,"token":"d5335b07610bd99b7fbc03f80e26dcf7"}' |
Contributor
Author
There was a problem hiding this comment.
the token does not exist in real app already
📝 WalkthroughWalkthroughThis PR adds API token management and permission resource retrieval capabilities to the Mailtrap client library. It introduces ChangesToken and Permission APIs
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Review rate limit: 0/1 reviews remaining, refill in 60 minutes.Comment |
DagonWat
approved these changes
May 4, 2026
| # => #<struct Mailtrap::ApiToken id=12345, name="My API Token", ..., token="a1b2c3d4e5f6g7h8"> | ||
|
|
||
| # Reset a token — expires the old value (short grace period) and returns a new value once. | ||
| api_tokens.reset(12_345) |
Contributor
There was a problem hiding this comment.
I think that it would be nice quality of life improvement to have api_tokens.reset(id: 12_345) so to explicitly define what is the route parameter.
Very optional
Contributor
There was a problem hiding this comment.
that would not be aligned with the rest of the endpoints e.g. get, delete, ...
| ) | ||
| end | ||
|
|
||
| # Returns the recursive tree of resources the current token can access. |
Contributor
There was a problem hiding this comment.
Not sure if that information is crucial for customer, to know that its a recursive tree, everywhere else we just mention that its permissions.
Contributor
Author
There was a problem hiding this comment.
I'd rather keep it
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
♻️ Duplicate comments (1)
spec/fixtures/vcr_cassettes/Mailtrap_ApiTokensAPI/_create/maps_response_data_to_ApiToken_with_full_token_value.yml (1)
70-73:⚠️ Potential issue | 🟠 Major | ⚡ Quick winFull API token value recorded in plaintext — fixture needs sanitization.
The response body at line 72 contains the actual full API token
d5335b07610bd99b7fbc03f80e26dcf7. Even though the author confirmed this token no longer exists in the app, the raw value persists permanently in git history and sets an unsafe precedent. It should be replaced with a redacted placeholder.🔐 Proposed fix
- string: '{"resources":[{"resource_type":"account","resource_id":1719941,"access_level":100}],"id":2498713,"name":"Ruby - SDK Test Token","last_4_digits":"dcf7","created_by":"SDK Dev Account Token","expires_at":null,"token":"d5335b07610bd99b7fbc03f80e26dcf7"}' + string: '{"resources":[{"resource_type":"account","resource_id":1719941,"access_level":100}],"id":2498713,"name":"Ruby + SDK Test Token","last_4_digits":"dcf7","created_by":"SDK Dev Account Token","expires_at":null,"token":"<API_TOKEN_VALUE>"}'🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@spec/fixtures/vcr_cassettes/Mailtrap_ApiTokensAPI/_create/maps_response_data_to_ApiToken_with_full_token_value.yml` around lines 70 - 73, The fixture contains a full API token in the recorded response JSON under the "token" field; replace the cleartext value ("d5335b07610bd99b7fbc03f80e26dcf7") with a redacted placeholder (e.g. "REDACTED_API_TOKEN") in the YAML string so the cassette no longer stores the secret, and scan the same file for any other occurrences of that token and replace them as well; keep the surrounding JSON structure and encoding unchanged to avoid breaking playback.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In
`@spec/fixtures/vcr_cassettes/Mailtrap_ApiTokensAPI/_get/maps_response_data_to_ApiToken_object.yml`:
- Around line 69-73: The cassette contains a potential PII value: the JSON key
"created_by" currently set to "John Doe" in the recorded body of
maps_response_data_to_ApiToken_object.yml; confirm whether that was a real user
name and if so replace it with a sanitized placeholder (e.g. "<CREATED_BY>") by
editing the recorded body string to substitute "created_by":"John Doe" ->
"created_by":"<CREATED_BY>", then re-run the tests or re-record the fixture (or
run your VCR sanitization script) to ensure the placeholder is persisted; also
scan other cassettes for any remaining real-looking display names and sanitize
them similarly.
In
`@spec/fixtures/vcr_cassettes/Mailtrap_ApiTokensAPI/_reset/maps_response_data_to_ApiToken_with_new_token_value.yml`:
- Around line 69-74: The cassette records a real API token in the body.string
JSON under the "token" field; open the VCR fixture
maps_response_data_to_ApiToken_with_new_token_value.yml and sanitize the
body.string value by replacing the actual token value
("token":"ff828c557cb54180a0ce279fd6d5856f") with the same redacted placeholder
used in the _create cassette (e.g. "token":"<REDACTED_TOKEN>" or the project’s
standard placeholder), ensuring the JSON structure and ASCII-8BIT encoding
remain unchanged.
In
`@spec/fixtures/vcr_cassettes/Mailtrap_PermissionsAPI/_resources/returns_a_tree_of_PermissionResource_objects.yml`:
- Around line 1-74: The VCR cassettes currently scrub headers but not sensitive
values in response bodies; update the VCR configuration (the VCR.configure
block) to mask API tokens before recording by adding a filter or before_record
hook that inspects interaction.response.body and replaces token fields (e.g.,
JSON keys like "token", "plain_text_token", "access_token" or 32-char hex
strings such as /"[0-9a-f]{32}"/i) with a placeholder like "<API_TOKEN>";
implement this using VCR.filter_sensitive_data or VCR.configure { |c|
c.before_record { |i| i.response.body.gsub!(regex, '"<API_TOKEN>"') } } so
future cassettes (including the ApiTokensAPI-related cassettes) never store raw
tokens.
---
Duplicate comments:
In
`@spec/fixtures/vcr_cassettes/Mailtrap_ApiTokensAPI/_create/maps_response_data_to_ApiToken_with_full_token_value.yml`:
- Around line 70-73: The fixture contains a full API token in the recorded
response JSON under the "token" field; replace the cleartext value
("d5335b07610bd99b7fbc03f80e26dcf7") with a redacted placeholder (e.g.
"REDACTED_API_TOKEN") in the YAML string so the cassette no longer stores the
secret, and scan the same file for any other occurrences of that token and
replace them as well; keep the surrounding JSON structure and encoding unchanged
to avoid breaking playback.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: ed551991-2039-4a2c-9114-fa7527bfe1d5
📒 Files selected for processing (17)
examples/api_tokens_api.rbexamples/permissions_api.rblib/mailtrap/api_tokens_api.rblib/mailtrap/permission_resource.rblib/mailtrap/permissions_api.rbspec/fixtures/vcr_cassettes/Mailtrap_ApiTokensAPI/_create/maps_response_data_to_ApiToken_with_full_token_value.ymlspec/fixtures/vcr_cassettes/Mailtrap_ApiTokensAPI/_create/when_name_is_missing/raises_a_Mailtrap_Error.ymlspec/fixtures/vcr_cassettes/Mailtrap_ApiTokensAPI/_delete/returns_nil_on_success.ymlspec/fixtures/vcr_cassettes/Mailtrap_ApiTokensAPI/_delete/when_token_does_not_exist/raises_not_found_error.ymlspec/fixtures/vcr_cassettes/Mailtrap_ApiTokensAPI/_get/maps_response_data_to_ApiToken_object.ymlspec/fixtures/vcr_cassettes/Mailtrap_ApiTokensAPI/_get/when_token_does_not_exist/raises_not_found_error.ymlspec/fixtures/vcr_cassettes/Mailtrap_ApiTokensAPI/_reset/maps_response_data_to_ApiToken_with_new_token_value.ymlspec/fixtures/vcr_cassettes/Mailtrap_ApiTokensAPI/_reset/when_token_does_not_exist/raises_not_found_error.ymlspec/fixtures/vcr_cassettes/Mailtrap_PermissionsAPI/_resources/returns_a_tree_of_PermissionResource_objects.ymlspec/mailtrap/api_tokens_api_spec.rbspec/mailtrap/permission_resource_spec.rbspec/mailtrap/permissions_api_spec.rb
Comment on lines
+69
to
+74
| body: | ||
| encoding: ASCII-8BIT | ||
| string: '{"resources":[{"resource_type":"account","resource_id":1719941,"access_level":100}],"id":2498715,"name":"Ruby | ||
| SDK Test Token 2498715","last_4_digits":"856f","created_by":"SDK Dev Account | ||
| Token","expires_at":null,"token":"ff828c557cb54180a0ce279fd6d5856f"}' | ||
| recorded_at: Wed, 29 Apr 2026 14:25:08 GMT |
There was a problem hiding this comment.
Full API token value recorded in plaintext — fixture must be sanitized.
Line 73 embeds the actual API token ff828c557cb54180a0ce279fd6d5856f (newly generated by the reset operation) in the VCR cassette. This is a live credential at the time of recording; even after expiry it remains in git history and creates a credential-in-source pattern that should be avoided across all fixtures. Replace with a redacted placeholder consistent with the approach needed in the _create cassette.
🔐 Proposed fix
- string: '{"resources":[{"resource_type":"account","resource_id":1719941,"access_level":100}],"id":2498715,"name":"Ruby
- SDK Test Token 2498715","last_4_digits":"856f","created_by":"SDK Dev Account
- Token","expires_at":null,"token":"ff828c557cb54180a0ce279fd6d5856f"}'
+ string: '{"resources":[{"resource_type":"account","resource_id":1719941,"access_level":100}],"id":2498715,"name":"Ruby
+ SDK Test Token 2498715","last_4_digits":"856f","created_by":"SDK Dev Account
+ Token","expires_at":null,"token":"<API_TOKEN_VALUE>"}'🧰 Tools
🪛 Betterleaks (1.1.2)
[high] 73-73: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In
`@spec/fixtures/vcr_cassettes/Mailtrap_ApiTokensAPI/_reset/maps_response_data_to_ApiToken_with_new_token_value.yml`
around lines 69 - 74, The cassette records a real API token in the body.string
JSON under the "token" field; open the VCR fixture
maps_response_data_to_ApiToken_with_new_token_value.yml and sanitize the
body.string value by replacing the actual token value
("token":"ff828c557cb54180a0ce279fd6d5856f") with the same redacted placeholder
used in the _create cassette (e.g. "token":"<REDACTED_TOKEN>" or the project’s
standard placeholder), ensuring the JSON structure and ASCII-8BIT encoding
remain unchanged.
i7an
approved these changes
May 4, 2026
| # => [ | ||
| # #<struct Mailtrap::PermissionResource id=4001, name="My First Project", type="project", | ||
| # access_level=1, resources=[ | ||
| # #<struct Mailtrap::PermissionResource id=3816, name="My First Inbox", type="inbox", |
Contributor
There was a problem hiding this comment.
as a suggestion, lets maybe not expose inboxes and choose another resource so its easier to later to remove all the mentions.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Changes
Summary by CodeRabbit
Release Notes
New Features
Tests