feat: Zoho Mail #3214

Saedbhati · 2025-09-26T11:28:31Z

Description

Describe your changes in detail (optional if the linked issue already contains a detailed description of the changes).
fixes #3203

Checklist

Go over all the following points, and put an x in all the boxes that apply.

I have read the CONTRIBUTION guide (required)
I have linked this PR to an issue using the Development section on the right sidebar or by adding Fixes #issue-number in the PR description (required)
I have checked if any dependencies need to be added or updated in pyproject.toml and uv lock
I have updated the tests accordingly (required for a bug fix or a new feature)
I have updated the documentation if needed:
I have added examples if this is a new feature

If you are unsure about any of these, don't hesitate to ask. We are here to help!

coderabbitai · 2025-09-26T11:28:38Z

Important

Review skipped

Auto reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch feat_zoho_mail

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

examples/toolkits/zoho_toolkit.py

+        scope=scopes,
+    )
+    print("\nToken response:")
+    print(json.dumps(token_resp, indent=2))


To fix this issue, we must avoid logging cleartext sensitive data such as OAuth tokens, the client secret, and refresh tokens or secrets that could be included in either a successful response or within error information.

The correct way is to:

Never print the entire token_resp out to the logs.

Instead, explicitly print only non-sensitive subfields as needed (e.g., print e.g. "Access token received" or the keys but not values, or simply suppress printing altogether unless debugging).

If details from the response must be shown, redact any sensitive fields like access_token, refresh_token, and any client_secret or request_params/request_json objects.

Specifically for the snippet, remove or replace the line print(json.dumps(token_resp, indent=2)) with a safe message, or print only a fixed set of non-sensitive keys (e.g. the keys present in the response).

Only make these changes in examples/toolkits/zoho_toolkit.py, as shown.

Wendong-Fan · 2025-09-26T12:21:00Z

camel/societies/workforce/workforce.py

+        on_subtask_completed (Optional[Callable[[Task], None]], optional):
+            Callback function to be called when a subtask is completed.
+            (default: :obj:`None`)
+        on_subtask_failed (Optional[Callable[[Task], None]], optional):
+            Callback function to be called when a subtask fails.
+            (default: :obj:`None`)


why we need to add these 2 argument in this PR, could you describe more for this change?

I was working on this issue
, but when I saw that coolbeevip was already working on it, I decided to drop it. I’m not sure how I ended up committing, but I will remove it.

a7m-1st · 2025-09-29T13:45:03Z

@Saedbhati while testing, I provided:

$env:ZOHO_CLIENT_ID
$env:ZOHO_CLIENT_SECRET
$env:ZOHO_REDIRECT_URI
$env:ZOHO_TO_ADDRESS

Which I got from the api console (Workspace account):

But I am facing this issue, the outh generation seems fine though. Is this the correct way to get started with the api?

a7m-1st · 2025-09-29T13:49:17Z

Program flow for me:

Saedbhati · 2025-09-29T14:06:34Z

@a7m-1st

you have to set redirect url to http://localhost:8000/callback

a7m-1st · 2025-09-29T14:23:27Z

Oh all right, didn't realize that. I will try again later. Thanks @Saedbhati

waleedalzarooni

Hey Saed good work!

I left some comments, most are quick fixes, let me know if you need any clarification!

waleedalzarooni · 2025-10-02T12:12:04Z

camel/toolkits/zoho_toolkit.py

+            "Content-Type": "application/json",
+        }
+        try:
+            response = requests.request(


Other toolkits include a timeout parameter here just in case, may be useful if you have time

waleedalzarooni · 2025-10-02T12:13:44Z

camel/toolkits/zoho_toolkit.py

+        url = f"{self.base_url}/api/accounts/{self.account_id}/messages/search"
+        query = f"label:{tag_id}"
+        params: Dict[str, Any] = {
+            "query": query,


In line 758 you use searchKey, just wan't to double check this difference is intentional

waleedalzarooni · 2025-10-06T16:27:16Z

camel/toolkits/zoho_toolkit.py

+    @staticmethod
+    def build_authorize_url(
+        *,
+        client_type: str,


Consider adding some input validation for client_type client_id and scope

waleedalzarooni · 2025-10-06T16:50:31Z

camel/toolkits/zoho_toolkit.py

+        }
+        if scope:
+            params["scope"] = scope
+        return self._request_json("POST", url, params=params)


OAUTH 2.0 specification (RFC 6749) violation here may cause exposed client secrets susceptible to attack.
params is sent in URL query string as opposed to request body

waleedalzarooni · 2025-10-06T16:53:13Z

camel/toolkits/zoho_toolkit.py

+        }
+        if scope:
+            params["scope"] = scope
+        return self._request_json("POST", url, params=params)


I believe this is the same violation as above

waleedalzarooni · 2025-10-06T17:23:09Z

camel/toolkits/zoho_toolkit.py

+        description: Optional[str] = None,
+        due_in_epoch_ms: Optional[int] = None,
+    ) -> Dict[str, Any]:
+        r"""Action: Create Task (OAuth Scope: ZohoMail.tasks )


waleedalzarooni · 2025-10-06T17:24:22Z

camel/toolkits/zoho_toolkit.py

+        description: Optional[str] = None,
+        due_in_epoch_ms: Optional[int] = None,
+    ) -> Dict[str, Any]:
+        r"""Action: Create Task (OAuth Scope: ZohoMail.tasks )


Suggested change

r"""Action: Create Task (OAuth Scope: ZohoMail.tasks )

r"""Action: Create Task (OAuth Scope: ZohoMail.tasks)

waleedalzarooni · 2025-10-06T17:29:39Z

camel/toolkits/zoho_toolkit.py

+            folder_id (str): Folder ID.
+            since_epoch_seconds (Optional[int]): Since epoch seconds.
+            limit (int): Limit.
+            sort_order (str): Sort order.


Possibly a more detailed description to help the agent understand what the Args mean, also missing default tags, see CONTRIBUTING.md

waleedalzarooni · 2025-10-06T17:35:14Z

camel/toolkits/zoho_toolkit.py

+    def trigger_new_email_matching_search_poll(
+        self,
+        query: str,
+        folder_id: Optional[str] = None,


waleedalzarooni · 2025-10-06T17:41:09Z

camel/toolkits/zoho_toolkit.py

+            params["includeto"] = True
+        if received_time_ms is not None:
+            params["receivedTime"] = int(received_time_ms)
+        # Note: folderId is not supported in search API; omit to avoid


the next method uses folderId in the search API request so not sure whether this note is correct or not

a7m-1st

Thanks for the PR @Saedbhati , all in all my comments is that it requires an existing server side zoho api which is configured correctly. Also requires a local oauth2 server for redirection for some reason and have to manage the auth & api requests manually i.e. no sdk's or anything. Have to use Zoho's mail and set the region server manually too.

Too much hussle for a niche use case, but as a reviewer, it works for me (perhaps just the fixes in mentioned)

a7m-1st · 2025-09-29T09:10:59Z

camel/toolkits/zoho_toolkit.py

+        subject: str,
+        content: str,


Perhaps can rename this to body for consistency with imap_toolkit

a7m-1st · 2025-09-29T09:19:15Z

camel/toolkits/zoho_toolkit.py

+            "encoding": encoding,
+        }
+
+        self._add_recipients(payload, to=to, cc=cc, bcc=bcc)


Cool, I like this idea of modular add recipients.

a7m-1st · 2025-09-29T09:28:13Z

camel/toolkits/zoho_toolkit.py

+    ) -> Dict[str, Any]:
+        r"""Trigger: New Tagged Email (Polling)
+
+        Retrieves emails that have the specified tag/label.
+


Since this we can retrieve emails based on tags, is there a way to send emails with a tag as in this example from Resend toolkit:

def send_email( self, to: List[str], subject: str, from_email: str, html: Optional[str] = None, text: Optional[str] = None, cc: Optional[List[str]] = None, bcc: Optional[List[str]] = None, reply_to: Optional[str] = None, tags: Optional[List[Dict[str, str]]] = None, headers: Optional[Dict[str, str]] = None, ) -> str:

a7m-1st · 2025-09-29T09:31:22Z

camel/toolkits/zoho_toolkit.py

+        from_email: Optional[str] = None,
+        cc: Optional[Union[List[str], List[Dict[str, Any]]]] = None,
+        bcc: Optional[Union[List[str], List[Dict[str, Any]]]] = None,
+        is_html: bool = True,
+        encoding: str = "UTF-8",


I think would be nice to have reply_to param with the documentation:
https://www.zoho.com/mail/help/api/post-reply-to-an-email.html

I guess in your case it will be a boolean value & just add those to your api request

"askReceipt" : "yes", "action":"reply"

a7m-1st · 2025-10-10T12:46:27Z

examples/toolkits/zoho_toolkit.py

+
+    temp = ZohoMailToolkit(access_token="", account_id="", datacenter="in")
+    token_resp = temp.exchange_code_for_token(


datacenter is hardcoded here ++

a7m-1st · 2025-10-10T12:55:54Z

examples/toolkits/zoho_toolkit.py

+    identifier = os.getenv("ZOHO_ACCOUNT_ID", "").strip()
+    if not identifier:
+        identifier = input(
+            "Enter ZOHO_ACCOUNT_ID (numeric or email, leave blank to auto): "
+        ).strip()
+    if identifier.isdigit():
+        account_id, default_from_email = identifier, ""
+    else:


Currently there is no way to authenticate if account id is real, so it still proceeds to send emails.

a7m-1st · 2025-10-10T13:06:50Z

examples/toolkits/zoho_toolkit.py

+    # Action: Create Task
+    task_resp = toolkit.create_task(
+        title="Follow up", description="Call customer", due_in_epoch_ms=None
+    )
+    print("\nCreate Task response:")


I think need to update the scope , as api returns 404: URL_RULE_NOT_CONFIGURED.
Need to add ZohoMail.tasks to the scope above

a7m-1st · 2025-10-10T13:10:37Z

camel/toolkits/zoho_toolkit.py

+        Creates a task in Zoho Mail Tasks.
+        """
+        url = f"{self.base_url}/api/accounts/{self.account_id}/tasks"
+        payload: Dict[str, Any] = {"title": title}


This endpoint doesn't seem to match the doc, unless you are using a different one such as Zoho Mail360?
https://www.zoho.com/mail/help/api/task-api.html

a7m-1st · 2025-10-10T13:17:17Z

camel/toolkits/zoho_toolkit.py

+                    continue
+                fid = f.get("folderId") or f.get("id") or f.get("folder_id")
+                names = []
+                for key in (
+                    "folderName",
+                    "displayName",
+                    "name",
+                    "systemFolder",
+                    "folderType",
+                    "type",
+                ):


I don't think we need to check for id, type, or display name. Here is what each item in the loop looks like:

{'path': '/Outbox', 'VW': True, 'previousFolderId': '1026610003021', 'HIDE': False, 'isArchived': 0, 'folderName': 'Outbox', 'imapAccess': True, 'folderType': 'Outbox', 'URI': 'https:mail.zoho.in/api/accounts/1026610002002/folders/1026610002028', 'folderId': '102660002028'}

a7m-1st · 2025-10-10T13:22:01Z

examples/toolkits/zoho_toolkit.py

+    print("\nTrigger: New Email Matching Search (Polling)")
+    search_resp = toolkit.trigger_new_email_matching_search_poll(
+        query=f'from:"{to_email}"', folder_id="inbox", limit=10
+    )
+    print(json.dumps(search_resp, indent=2))


Can I ask what the polling is supposed to do? Just fetch latest results?

feat: Zoho Mail

8bbddfe

github-advanced-security bot found potential problems Sep 26, 2025

View reviewed changes

Wendong-Fan reviewed Sep 26, 2025

View reviewed changes

Wendong-Fan requested review from a7m-1st and waleedalzarooni September 26, 2025 12:55

update

761b240

Saedbhati and others added 2 commits September 29, 2025 07:27

Merge branch 'master' into feat_zoho_mail

24ff193

Merge branch 'master' into feat_zoho_mail

7f16472

waleedalzarooni reviewed Oct 6, 2025

View reviewed changes

Saedbhati self-assigned this Oct 9, 2025

a7m-1st requested changes Oct 10, 2025

View reviewed changes

Merge branch 'master' into feat_zoho_mail

ef59bb9

Wendong-Fan added the Waiting for Update PR has been reviewed, need to be updated based on review comment label Oct 20, 2025

@@ -118,7 +118,14 @@
                     scope=scopes,
                 )
                 print("\nToken response:")
-                print(json.dumps(token_resp, indent=2))
+                # Do not print entire response as it may contain sensitive information.
+                # Only indicate success or reason for failure (if available).
+                if "access_token" in token_resp:
+                    print("Access token received.")
+                elif "error" in token_resp:
+                    print(f"Token request failed: {token_resp.get('error')}")
+                else:
+                    print("Token response received, but access_token not found.")
                 access_token = token_resp.get("access_token") or ""
                 if not access_token:
                     print("Failed to obtain access token.")

	r"""Action: Create Task (OAuth Scope: ZohoMail.tasks )
	r"""Action: Create Task (OAuth Scope: ZohoMail.tasks)


		temp = ZohoMailToolkit(access_token="", account_id="", datacenter="in")
		token_resp = temp.exchange_code_for_token(

Uh oh!

feat: Zoho Mail #3214

Are you sure you want to change the base?

feat: Zoho Mail #3214

Conversation

Saedbhati commented Sep 26, 2025

Description

Checklist

Uh oh!

coderabbitai bot commented Sep 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

Check failure

Uh oh!

Uh oh!

Copilot Autofix

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

a7m-1st commented Sep 29, 2025

Uh oh!

a7m-1st commented Sep 29, 2025

Uh oh!

Saedbhati commented Sep 29, 2025

Uh oh!

a7m-1st commented Sep 29, 2025

Uh oh!

waleedalzarooni left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

a7m-1st left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

coderabbitai bot commented Sep 26, 2025 •

edited

Loading