Merge https://github.com/google/adk-python/pull/1959
### What
Fix misleading comment.
```diff
- # Make sure a malicious user can obtain a session and events not belonging to them
+ # Make sure a malicious user **cannot** obtain a session or events not belonging to them
```
### Why
The previous wording contradicted the assertion `assert len(session_mismatch.events) == 0`, which verifies that a malicious user **cannot** access another user’s session or events.
### Testing plan
Docs-only change.
COPYBARA_INTEGRATE_REVIEW=https://github.com/google/adk-python/pull/1959 from mthorme:fix-comment-session-mismatch b1f139af340bd240d40ed58f5dea3274c3a3bd83
PiperOrigin-RevId: 785908548
test: refine test_session_state in test_session_state to catch event leakage
fix: revert app name to my_app for test_session_state test
style: fix pyink style warnings
fix: add app_name to filter as per suggestion from rpedela-recurly
Fixes https://github.com/google/adk-python/issues/1180
We are using `func.now()` to set the `onupdate` time for db, when SQLAlchemy generates the SQL to build the database, it actually translates `func.now()` into `NOW()` or `CURRENT_TIMESTAMP`. The value it returns depends on the database server settings. For example, if the global/default timezone for a db is set to be UTC, the update time will be set to be a UCT time; if the global time zone for a db is set to be a local time zone (e.g. America/Los_Angeles), the update time will be a local time.
Normally, the best practice is to set database server to use UTC. Applications will convert it into different time zones as needed.
For SQLite, there is no way to config the default timezone, it will just treat it as UTC. But because it is a naive datetime (with no timezone info), python will assume it is a local time and then covert it into a UTC, which is why we see the bug (e.g. we create a session at 2025-06-17 12:49:33 local time, but when we read the session, its last update time is 2025-06-17 19:49:33 local time).
The solution is converting the native datatime to be timezone aware before `.timestamp()`.
The change in this CL only affects SQLite database.
PiperOrigin-RevId: 776654443
Copybara import of the project:
--
d01a8fd5f079bc4fca9e4b71796dbe65312ce9ff by Leo Yongsul Kim <ystory84@gmail.com>:
fix(DatabaseSessionService): Align event filtering and ordering logic
This commit addresses inconsistencies in how DatabaseSessionService
handles config.after_timestamp and config.num_recent_events
parameters, aligning its behavior with InMemorySessionService and
VertexAiSessionService.
Key changes:
- Made after_timestamp filtering inclusive
- Corrected num_recent_events behavior to fetch the N most recent events
- Refined timezone handling for after_timestamp
- Updated the unit test test_get_session_with_config to includeSessionServiceType.DATABASE, allowing verification of these fixes.
Fixes#911
COPYBARA_INTEGRATE_REVIEW=https://github.com/google/adk-python/pull/915 from ystory:fix/database-session-timestamp-recency 5cc8cf5f5a5c0cb3e87f6ab178a5725d3f696c88
PiperOrigin-RevId: 763874840
Copybara import of the project:
--
c1d0d649b5aae1322a02dbaa586822d69b8546f6 by allengour <allengour@google.com>:
fix: fix and test `config.after_timestamp` behavior in `InMemorySessionService.get_session()`
COPYBARA_INTEGRATE_REVIEW=https://github.com/google/adk-python/pull/438 from allengour:fix/issue-437-after_timestamp-behavior 4b49a5e6509b5ad9dd9103a6dc357fd44c101f31
PiperOrigin-RevId: 755492201
* Move unit tests to root package.
* Adds deps to "test" extra, and mark two broken tests in tests/unittests/auth/test_auth_handler.py
* Adds github workflow
* minor fix in lite_llm.py for python 3.9.
* format pyproject.toml
