volcano-sdk-python 0.10.3__tar.gz → 0.10.4__tar.gz

volcano_sdk_python-0.10.4/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.10.4"
+}

{volcano_sdk_python-0.10.3 → volcano_sdk_python-0.10.4}/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.10.4](https://github.com/Kong/volcano-sdk-python/compare/v0.10.3...v0.10.4) (2026-09-23)
+
+
+### Bug Fixes
+
+* **types:** validate transport payloads before facade access ([#287](https://github.com/Kong/volcano-sdk-python/issues/287)) ([60e280c](https://github.com/Kong/volcano-sdk-python/commit/60e280ca0665ea5a143dc8df69a3d3cc2bdbb481))
+
 ## [0.10.3](https://github.com/Kong/volcano-sdk-python/compare/v0.10.2...v0.10.3) (2026-09-23)
 
 

{volcano_sdk_python-0.10.3 → volcano_sdk_python-0.10.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: volcano-sdk-python
-Version: 0.10.3
+Version: 0.10.4
 Summary: Official Python SDK for Volcano
 Project-URL: Homepage, https://volcano.dev
 Project-URL: Repository, https://github.com/Kong/volcano-sdk-python

{volcano_sdk_python-0.10.3 → volcano_sdk_python-0.10.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "volcano-sdk-python"
-version = "0.10.3"
+version = "0.10.4"
 description = "Official Python SDK for Volcano"
 readme = "README.md"
 requires-python = ">=3.11"

{volcano_sdk_python-0.10.3 → volcano_sdk_python-0.10.4}/src/volcano_sdk/_transport.py

@@ -738,7 +738,7 @@ def _error_type(status: int) -> type[VolcanoError]:
     return VolcanoError
 
 
-def response_payload(response: TransportResponse, expected_status: int) -> Any:
+def response_payload(response: TransportResponse, expected_status: int) -> object:
     status = int(response.status_code)
     if status != expected_status:
         payload: Mapping[str, object]

{volcano_sdk_python-0.10.3 → volcano_sdk_python-0.10.4}/src/volcano_sdk/locks.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+from collections.abc import Mapping
 from contextlib import contextmanager, suppress
 from datetime import datetime
 from typing import TYPE_CHECKING, Protocol, cast
@@ -22,6 +23,7 @@ _MIN_LOCK_TTL_SECONDS = 5
 _MAX_LOCK_TTL_SECONDS = 7_776_000
 _INVALID_LOCK_TTL = "ttl must be an integer between 5 seconds and 90 days"
 _MISSING_RENEWAL_FAILURE = "lock guard rejected renewal without a failure"
+_INVALID_LOCK_RESPONSE = "Expected a complete lock response"
 
 
 class LocksContext(Protocol):
@@ -82,6 +84,26 @@ def _parse_datetime(value: object) -> datetime | None:
     return datetime.fromisoformat(str(value))
 
 
+def _lock_values(payload: object) -> Mapping[object, object]:
+    if not isinstance(payload, Mapping):
+        raise TypeError(_INVALID_LOCK_RESPONSE)
+    return cast("Mapping[object, object]", payload)
+
+
+def _fencing_token(value: object) -> int | None:
+    if value is None or type(value) is int:
+        return value
+    raise TypeError(_INVALID_LOCK_RESPONSE)
+
+
+def _lease_fields(payload: Mapping[object, object]) -> tuple[datetime, int]:
+    expires_at = payload.get("expires_at")
+    fencing_token = payload.get("fencing_token")
+    if not isinstance(expires_at, str) or type(fencing_token) is not int:
+        raise TypeError(_INVALID_LOCK_RESPONSE)
+    return datetime.fromisoformat(expires_at), fencing_token
+
+
 def _validate_ttl(ttl: object) -> None:
     if (
         isinstance(ttl, bool)
@@ -125,11 +147,14 @@ class Locks:
             key=key,
             request_id=_request_uuid(request_id, "request_id"),
         )
-        payload = response_payload(response, 200)
+        payload = _lock_values(response_payload(response, 200))
+        held = payload.get("held")
+        if not isinstance(held, bool):
+            raise TypeError(_INVALID_LOCK_RESPONSE)
         return LockState(
-            held=payload["held"],
+            held=held,
             expires_at=_parse_datetime(payload.get("expires_at")),
-            fencing_token=payload.get("fencing_token"),
+            fencing_token=_fencing_token(payload.get("fencing_token")),
         )
 
     def acquire(
@@ -173,17 +198,18 @@ class Locks:
                 raise
             started_at = _lease_now()
             payload = self._acquire_payload(key, ttl, token, request_id, authorization)
+        expires_at, fencing_token = _lease_fields(payload)
         lease = LockLease(
             key=key,
             token=token,
-            expires_at=_parse_datetime(payload.get("expires_at")),
-            fencing_token=cast("int | None", payload.get("fencing_token")),
+            expires_at=expires_at,
+            fencing_token=fencing_token,
         )
         return lease, started_at
 
     def _acquire_payload(
         self, key: str, ttl: int, token: str, request_id: str, authorization: str
-    ) -> dict[str, object]:
+    ) -> Mapping[object, object]:
         response = invoke(
             self._client._transport.acquire_project_lock,
             authorization=authorization,
@@ -192,7 +218,7 @@ class Locks:
             token=token,
             request_id=request_id,
         )
-        return cast("dict[str, object]", response_payload(response, 201))
+        return _lock_values(response_payload(response, 201))
 
     def renew(
         self, key: str, lease: LockLease, *, ttl: int, request_id: str | None = None
@@ -216,12 +242,13 @@ class Locks:
             ttl=ttl,
             token=lease.token,
         )
-        payload = response_payload(response, 200)
+        payload = _lock_values(response_payload(response, 200))
+        expires_at, fencing_token = _lease_fields(payload)
         return LockLease(
             key=key,
             token=lease.token,
-            expires_at=_parse_datetime(payload.get("expires_at")),
-            fencing_token=payload.get("fencing_token"),
+            expires_at=expires_at,
+            fencing_token=fencing_token,
         )
 
     def release(

{volcano_sdk_python-0.10.3 → volcano_sdk_python-0.10.4}/src/volcano_sdk/realtime.py

@@ -35,6 +35,7 @@ from ._transport import (
     invoke_async,
     response_payload,
 )
+from .database import _database_rows
 from .models import JSONValue, _freeze_json
 
 if TYPE_CHECKING:
@@ -1391,8 +1392,7 @@ class Realtime:
                 "limit": len(row_ids),
             },
         )
-        payload = response_payload(response, 200)
-        rows = list(payload["data"])
+        rows = _database_rows(response_payload(response, 200))
         return tuple(
             next(
                 (row for row in rows if row.get("id") == request.row_id),

{volcano_sdk_python-0.10.3 → volcano_sdk_python-0.10.4}/src/volcano_sdk/storage.py

@@ -50,6 +50,7 @@ _HTTP_PARTIAL_CONTENT = 206
 _UPLOAD_SPOOL_READ_SIZE = 1_048_576
 _UPLOAD_SOURCE_UNAVAILABLE = "Upload source is temporarily unavailable"
 _INVALID_SIMPLE_UPLOAD = "Upload data must be bytes or a readable binary stream"
+_INVALID_UPLOAD_RESPONSE = "Expected a storage upload response object"
 
 
 def _optional_datetime(value: object) -> datetime | None:
@@ -498,7 +499,12 @@ class StorageBucket:
             binding=binding,
         )
         payload = response_payload(response, 201)
-        return dict(payload)
+        if not isinstance(payload, Mapping):
+            raise TypeError(_INVALID_UPLOAD_RESPONSE)
+        values = cast("Mapping[object, object]", payload)
+        if not all(isinstance(key, str) for key in values):
+            raise TypeError(_INVALID_UPLOAD_RESPONSE)
+        return dict(cast("Mapping[str, Any]", values))
 
     def download(self, path: str, *, byte_range: str | None = None) -> bytes:
         """Download bytes from a path in this bucket.

{volcano_sdk_python-0.10.3 → volcano_sdk_python-0.10.4}/tests/unit/test_lock_acquisition.py

@@ -13,6 +13,7 @@ from volcano_sdk import _lock_guard as guard_module
 from volcano_sdk import locks as locks_module
 from volcano_sdk._lock_guard import LockGuard
 from volcano_sdk._transport import GeneratedTransport
+from volcano_sdk.locks import _lock_values
 
 if TYPE_CHECKING:
     from collections.abc import Callable
@@ -186,6 +187,47 @@ def test_each_lock_operation_forwards_the_supplied_request_id() -> None:
     assert json.loads(requests[1].content) == {"ttl_seconds": 30}
 
 
+def test_lock_response_rejects_a_non_object_payload() -> None:
+    with pytest.raises(TypeError, match="Expected a complete lock response"):
+        _lock_values([])
+
+
+@pytest.mark.parametrize(
+    "payload",
+    [{"held": "yes"}, {"held": True, "fencing_token": "seven"}],
+)
+def test_get_rejects_invalid_lock_response_fields(payload: object) -> None:
+    def handle(_request: httpx.Request) -> httpx.Response:
+        return httpx.Response(200, json=payload)
+
+    with pytest.raises(TypeError, match="Expected a complete lock response"):
+        make_client(handle).locks.get("build")
+
+
+@pytest.mark.parametrize("value", [None, "seven", True])
+def test_acquisition_rejects_invalid_fencing_tokens(value: object) -> None:
+    def handle(_request: httpx.Request) -> httpx.Response:
+        return httpx.Response(
+            201,
+            json={"expires_at": "2026-09-18T18:00:00Z", "fencing_token": value},
+        )
+
+    with pytest.raises(TypeError, match="Expected a complete lock response"):
+        make_client(handle).locks.acquire("build", ttl=30)
+
+
+def test_renew_rejects_a_non_integer_fencing_token() -> None:
+    def handle(_request: httpx.Request) -> httpx.Response:
+        return httpx.Response(
+            200,
+            json={"expires_at": "2026-09-18T18:00:00Z", "fencing_token": "seven"},
+        )
+
+    lease = LockLease(key="build", token=OWNER_TOKEN, expires_at=None, fencing_token=7)
+    with pytest.raises(TypeError, match="Expected a complete lock response"):
+        make_client(handle).locks.renew("build", lease, ttl=30)
+
+
 def test_acquire_keeps_the_original_service_credential_on_retry() -> None:
     requests: list[httpx.Request] = []
 

{volcano_sdk_python-0.10.3 → volcano_sdk_python-0.10.4}/tests/unit/test_state.py

@@ -540,7 +540,7 @@ class StateTransport(OAuthTransport):
 
     def acquire_project_lock(self, **kwargs: Any) -> Response:
         self.authorizations.append(("acquire", kwargs["authorization"]))
-        return Response(201, {"expires_at": None, "fencing_token": 1})
+        return Response(201, {"expires_at": "2030-01-01T00:00:00Z", "fencing_token": 1})
 
     def release_project_lock(self, **kwargs: Any) -> Response:
         self.authorizations.append(("release", kwargs["authorization"]))

{volcano_sdk_python-0.10.3 → volcano_sdk_python-0.10.4}/tests/unit/test_storage_upload.py

@@ -1,14 +1,43 @@
 from __future__ import annotations
 
+from dataclasses import dataclass
 from io import BytesIO
 
 import httpx
 import pytest
 from fixtures.invalid_arguments import non_string_content_type
 from storage_fixtures import upload_response
+from typing_extensions import override
 
 from volcano_sdk import Session, VolcanoClient
-from volcano_sdk._transport import GeneratedTransport
+from volcano_sdk._transport import GeneratedTransport, TransportResponse
+
+
+@dataclass(frozen=True)
+class UploadResponse:
+    payload: object
+    status_code: int = 201
+    content: bytes = b""
+    headers: dict[str, str] | None = None
+
+
+class UploadPayloadTransport(GeneratedTransport):
+    def __init__(self, payload: object) -> None:
+        super().__init__(api_url="https://api.test.volcano.dev")
+        self.payload = payload
+
+    @override
+    def upload_storage_object(
+        self,
+        *,
+        authorization: str,
+        bucket_name: str,
+        path: str,
+        data: bytes,
+        content_type: str = "application/octet-stream",
+    ) -> TransportResponse:
+        del authorization, bucket_name, path, data, content_type
+        return UploadResponse(self.payload)
 
 
 @pytest.mark.parametrize(
@@ -68,3 +97,12 @@ def test_upload_rejects_non_string_content_type_before_reading() -> None:
         non_string_content_type(client.storage.from_("assets"), source)
 
     assert source.tell() == 0
+
+
+@pytest.mark.parametrize("payload", [[], {1: "unexpected"}])
+def test_upload_rejects_malformed_success_payload(payload: object) -> None:
+    client = VolcanoClient(anon_key="anon", _transport=UploadPayloadTransport(payload))
+    client.auth.set_session(Session("access", "refresh", "user"))
+
+    with pytest.raises(TypeError, match="Expected a storage upload response object"):
+        client.storage.from_("assets").upload("payload.bin", b"payload")

{volcano_sdk_python-0.10.3 → volcano_sdk_python-0.10.4}/uv.lock

@@ -1821,7 +1821,7 @@ wheels = [
 
 [[package]]
 name = "volcano-sdk-python"
-version = "0.10.3"
+version = "0.10.4"
 source = { editable = "." }
 dependencies = [
     { name = "attrs" },

volcano_sdk_python-0.10.3/.release-please-manifest.json

@@ -1,3 +0,0 @@
-{
-  ".": "0.10.3"
-}