encounter/adk-python
0
0
Fork 0
mirror of https://github.com/encounter/adk-python.git synced 2026-07-09 18:19:28 -07:00
Code Issues Packages Projects Releases Wiki Activity

fix: Make credential key generation stable and prevent cross-user credential leaks

Browse Source 
This change updates the credential key generation to use a stable hash (SHA256) instead of Python's built-in hash, which can vary based on PYTHONHASHSEED. It also makes sure that temporary or exchanged OAuth2 fields are excluded from the key calculation. I also added when saving credentials, a copy of the AuthConfig is used to avoid modifying the original shared AuthConfig instance with user-specific exchanged credentials.

Co-authored-by: George Weale <gweale@google.com>
PiperOrigin-RevId: 864599326
This commit is contained in:
George Weale
2026-02-02 17:51:19 -08:00
committed by Copybara-Service
parent 666cebe369
commit 33012e6dda
11 changed files with 448 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/unittests/tools/openapi_tool/openapi_spec_parser/test_tool_auth_handler.py
+17
View File
@@ -138,6 +138,23 @@ async def test_openid_connect_no_auth_response(
assert result.auth_credential == openid_connect_credential
@pytest.mark.asyncio
async def test_openid_connect_uses_explicit_credential_key(
openid_connect_scheme, openid_connect_credential
):
tool_context = create_mock_tool_context()
handler = ToolAuthHandler(
tool_context,
openid_connect_scheme,
openid_connect_credential,
credential_key='my_tool_tokens',
)
result = await handler.prepare_auth_credentials()
assert result.state == 'pending'
requested = tool_context.actions.requested_auth_configs['test-fc-id']
assert requested.credential_key == 'my_tool_tokens'
@pytest.mark.asyncio
async def test_openid_connect_with_auth_response(
openid_connect_scheme, openid_connect_credential, monkeypatch