From 4e765ae2f3821318e581c26a52e11d392aaf72a4 Mon Sep 17 00:00:00 2001 From: Keisuke Oohashi Date: Fri, 27 Jun 2025 11:05:28 -0700 Subject: [PATCH] fix: raise ValueError when sessionId and userId are incorrect combination(#1653) Merge https://github.com/google/adk-python/pull/1655 Fix #1653 When session_id and user_id are incorrect combination on vertex ai session service, it should not return the session. COPYBARA_INTEGRATE_REVIEW=https://github.com/google/adk-python/pull/1655 from soundTricker:fix/1653-invalid-session 7a3dee2fc75602a2685ea922799cc5f5ba666e97 PiperOrigin-RevId: 776648361 --- .../adk/sessions/vertex_ai_session_service.py | 3 +++ .../sessions/test_vertex_ai_session_service.py | 15 +++++++++++++++ 2 files changed, 18 insertions(+) diff --git a/src/google/adk/sessions/vertex_ai_session_service.py b/src/google/adk/sessions/vertex_ai_session_service.py index 06a904c8..6628eb95 100644 --- a/src/google/adk/sessions/vertex_ai_session_service.py +++ b/src/google/adk/sessions/vertex_ai_session_service.py @@ -178,6 +178,9 @@ class VertexAiSessionService(BaseSessionService): ) get_session_api_response = _convert_api_response(get_session_api_response) + if get_session_api_response['userId'] != user_id: + raise ValueError(f'Session not found: {session_id}') + session_id = get_session_api_response['name'].split('/')[-1] update_timestamp = isoparse( get_session_api_response['updateTime'] diff --git a/tests/unittests/sessions/test_vertex_ai_session_service.py b/tests/unittests/sessions/test_vertex_ai_session_service.py index 6a9e0b46..52fa42c9 100644 --- a/tests/unittests/sessions/test_vertex_ai_session_service.py +++ b/tests/unittests/sessions/test_vertex_ai_session_service.py @@ -292,6 +292,21 @@ async def test_get_empty_session(agent_engine_id): assert str(excinfo.value) == 'Session not found: 0' +@pytest.mark.asyncio +@pytest.mark.usefixtures('mock_get_api_client') +@pytest.mark.parametrize('agent_engine_id', [None, '123']) +async def test_get_another_user_session(agent_engine_id): + if agent_engine_id: + session_service = mock_vertex_ai_session_service(agent_engine_id) + else: + session_service = mock_vertex_ai_session_service() + with pytest.raises(ValueError) as excinfo: + await session_service.get_session( + app_name='123', user_id='user2', session_id='1' + ) + assert str(excinfo.value) == 'Session not found: 1' + + @pytest.mark.asyncio @pytest.mark.usefixtures('mock_get_api_client') async def test_get_and_delete_session():