Deprecate endpoints - #149
Merged
Merged
Conversation
- Support typing.NamedTuple and object __dict__/model_dump redaction in RedactingFilter - Enforce regular file check before size evaluation to prevent CWE-400 resource exhaustion - Disallow boolean types in timeout evaluation to prevent silent coercion - Harden IDN normalization via rpartition and catch specific UnicodeError bounds - Filter control characters [\x00-\x1f\x7f] and normalize whitespace in log traces - Update test_guardrails suite with edge cases covering CWE-22, CWE-400, and logging extras
…t pagination - Register DEPRECATION_ADVISORY mapping legacy endpoints (newsletter, stats, webhook) - Add static routes for contactslist_csvdata, batchjob_csverror, contact_data, and widget - Emit active DeprecationWarning on deprecated route access in Endpoint._build_url - Preserve CamelCase to kebab-case conversion for sub-actions in Endpoint.__init__ - Implement query parameter casting (_cast_query_param) and snapshot isolation in stream() - Allow custom headers forwarding in create() and update() methods - Add comprehensive unit tests covering routing branches, sub-actions, and deprecations
- Replace deprecated newsletter.create with campaigndraft.create in segments_sample.py - Update smoke_readme_runner health checks to use canonical eventcallbackurl - Align Content API v1 test to use template_contents instead of templates_contents
…utes - Extend fuzz_endpoint with pagination and generator stream mutation paths - Add auth coercion, HTML SpamGuard, and safe kwargs filtering to fuzz_guardrails - Expand fuzz_redacting_filter to exercise Set and Object redaction pathways - Update fuzzer.dict with new static routes, parameters, and encoding payloads
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
…et-apiv3-python into deprecate-endpoints
… deprecations - Document per-request headers parameter support across create/update calls - Add stream() pagination example handling parse_qs multidicts with offset resumption - Document DEPRECATION_ADVISORY mappings for newsletters, statistics, and webhooks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Links:
Jira
Actions:
Architecture & Developer Experience (DX):
routes.py): Registered missing static route definitions inROUTE_MAPforcontactslist_csvdataandbatchjob_csverrorto eliminate runtime dynamic path resolution overhead.Endpoint.__init__(e.g.,statistics_linkClickstatistics/link-click).Endpoint._cast_query_paramand_normalize_stream_filtersto automatically parse and cast multidict query filter values (such asurllib.parse.parse_qsarrays) to native scalar or collection types (int,float,bool,list,tuple,set).headersmapping parameters toEndpoint.__call__,create(), andupdate()for per-request header injection.Endpoint.stream()to monitor the APITotalresponse field, automatically halting generator pagination oncecurrent_offset + len(data) >= total.samples/segments_sample.pyto usecampaigndraftand updatedsamples/smoke_readme_runner.pyhealth checks to use canonical endpointseventcallbackurlandtemplate_contents.API Deprecation Advisory:
DEPRECATION_ADVISORY): Implemented an automated deprecation system inroutes.pythat intercepts retired Mailjet endpoints and emits actionableDeprecationWarningnotices directing developers to official replacements:newsletterand sub-resources (newsletter_*)campaigndraft/campaigndraft_*apikeytotals,campaignstatistics,liststatistics,domainstatistics, etc.)statcounters/statistics_recipientEspwebhookeventcallbackurltemplate_update,templates_contents)template.update(id=...)ortemplate_detailcontent(v3) /template_contents(v1)Security & Guardrails (OWASP):
RedactingFilterto recursively sanitize complex data structures, including structuredtyping.NamedTupleinstances, Pydantic-compatible objects withmodel_dump(), arbitrary__dict__instances, andset/frozensetcollections.[\x00-\x1f\x7f]) inSecurityGuard.sanitize_log_tracebefore whitespace normalization to prevent log forging and trace corruption.True/False) inSecurityGuard.validate_timeoutto prevent accidental type coercion to numeric1.0/0.0seconds.Path.is_file()validation inSecurityGuard.check_file_sizeto block directories or special devices from triggering file-size checks.Client.api_callto acceptMapping[str, str | None]and screen all non-Nonestring representations for CRLF injection sequences.SecurityGuard.normalize_domaintorpartition("@")and strictly scoped exception interception toUnicodeError.Testing & CI/CD Hygiene:
tests/fuzz/fuzzer.dictwith new static routes, streaming tokens, HTML/XSS triggers, IDN tags, and secret patterns. Extendedfuzz_endpoint.py,fuzz_guardrails.py, andfuzz_redacting_filter.pyto cover stream mutation, auth coercion, and complex redaction pathways.DEPRECATION_ADVISORYemit expectedDeprecationWarningmessages with appropriate migration guidance..github/workflows/cflite_build.ymland.github/workflows/cflite_cron.ymlCI tasks.Verification & Testing:
Ensure API credentials (
MJ_APIKEY_PUBLICandMJ_APIKEY_PRIVATE) are set in your local environment, then run the verification steps below:1. Run the Unit & Integration Test Suite:
Validates new routing endpoints, deprecation warnings, and custom header propagation.
2. Verify Deprecation Warnings Specifically:
Runs legacy endpoint tests to ensure all deprecation warnings are properly triggered and formatted.
3. Run the Fuzzing Suite:
Verifies that expanded route mappings, pagination normalization, and redaction logic catch mutated inputs cleanly without unhandled crashes.
4. Execute the Updated Sample Runners:
Validates that sample scripts execute successfully against canonical endpoints without triggering deprecation warnings.