volcano-sdk-python 0.13.2__tar.gz → 0.13.3__tar.gz

volcano_sdk_python-0.13.3/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.13.3"
+}

{volcano_sdk_python-0.13.2 → volcano_sdk_python-0.13.3}/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.13.3](https://github.com/Kong/volcano-sdk-python/compare/v0.13.2...v0.13.3) (2026-09-24)
+
+
+### Bug Fixes
+
+* **python:** harden transport and session boundaries ([#362](https://github.com/Kong/volcano-sdk-python/issues/362)) ([ad077f1](https://github.com/Kong/volcano-sdk-python/commit/ad077f19db4b2148f3be63ec3fc4f112d79e16ea))
+
 ## [0.13.2](https://github.com/Kong/volcano-sdk-python/compare/v0.13.1...v0.13.2) (2026-09-24)
 
 

{volcano_sdk_python-0.13.2 → volcano_sdk_python-0.13.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: volcano-sdk-python
-Version: 0.13.2
+Version: 0.13.3
 Summary: Official Python SDK for Volcano
 Project-URL: Homepage, https://volcano.dev
 Project-URL: Repository, https://github.com/Kong/volcano-sdk-python

{volcano_sdk_python-0.13.2 → volcano_sdk_python-0.13.3}/maintainers/quality-policy.lock.json

@@ -274,7 +274,10 @@
         "src/volcano_sdk/storage.py",
         "src/volcano_sdk/functions.py",
         "src/volcano_sdk/database.py",
-        "src/volcano_sdk/_function_resolution.py"
+        "src/volcano_sdk/_function_resolution.py",
+        "src/volcano_sdk/_transport.py",
+        "src/volcano_sdk/_session.py",
+        "src/volcano_sdk/_session_operations.py"
       ]
     },
     "mypy": {
@@ -383,6 +386,7 @@
     },
     "pytest": {
       "ini_options": {
+        "addopts": "--disable-socket --allow-unix-socket",
         "asyncio_debug": true,
         "asyncio_default_fixture_loop_scope": "function",
         "asyncio_default_test_loop_scope": "function",

{volcano_sdk_python-0.13.2 → volcano_sdk_python-0.13.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "volcano-sdk-python"
-version = "0.13.2"
+version = "0.13.3"
 description = "Official Python SDK for Volcano"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -64,6 +64,7 @@ dev = [
   "pytest-order==1.5.0",
   "coverage==7.16.1",
   "pytest-cov==7.1.0",
+  "pytest-socket==0.8.1",
   "types-behave==1.3.0.20260408",
   "tox==4.62.0",
   "mutmut==3.8.0",
@@ -393,6 +394,7 @@ max-complexity = 5
 
 [tool.pytest.ini_options]
 minversion = "9.1.1"
+addopts = "--disable-socket --allow-unix-socket"
 pythonpath = [".", "features"]
 strict = true
 empty_parameter_set_mark = "fail_at_collect"
@@ -428,6 +430,9 @@ type_check_command = [
   "src/volcano_sdk/functions.py",
   "src/volcano_sdk/database.py",
   "src/volcano_sdk/_function_resolution.py",
+  "src/volcano_sdk/_transport.py",
+  "src/volcano_sdk/_session.py",
+  "src/volcano_sdk/_session_operations.py",
 ]
 cache_invalidation_files = ["tests/**/*.py"]
 pytest_add_cli_args_test_selection = ["tests/unit"]

{volcano_sdk_python-0.13.2 → volcano_sdk_python-0.13.3}/scripts/check_quality_policy.py

@@ -18,7 +18,7 @@ if TYPE_CHECKING:
     from collections.abc import Iterable
 
 GENERATED = "src/volcano_sdk/_generated"
-LOCK_SHA256 = "925d505fd245bd815fffe4a94ec89298294589e5b536aeb51e24d613eb86b6f0"
+LOCK_SHA256 = "87fb82c238174cf5427086d5296306d63d47e297c0be90b1ae6c15d99168e148"
 TYPE_FIXTURES = {
     "tests/typing/contract_steps.py",
     "tests/typing/durable_callbacks.py",

{volcano_sdk_python-0.13.2 → volcano_sdk_python-0.13.3}/src/volcano_sdk/_session.py

@@ -4,8 +4,8 @@ from __future__ import annotations
 
 import base64
 import json
-from collections.abc import Mapping
-from typing import TYPE_CHECKING, cast
+from collections.abc import Callable, Mapping
+from typing import TYPE_CHECKING, TypeGuard
 from uuid import UUID
 
 from .errors import AuthenticationError
@@ -17,6 +17,11 @@ _JWT_PARTS = 3
 _REFRESH_USER_MISMATCH = "Refreshed session belongs to a different user"
 _REFRESH_SESSION_MISMATCH = "Refreshed credentials belong to a different server session"
 _MISSING_SESSION_ID = "Cannot refresh supplied credentials without a session identifier"
+_decode_json: Callable[[str], object] = json.loads
+
+
+def _is_claim_mapping(value: object) -> TypeGuard[Mapping[object, object]]:
+    return isinstance(value, Mapping)
 
 
 def session_id_from_access_token(access_token: str) -> str | None:
@@ -33,15 +38,12 @@ def session_id_from_access_token(access_token: str) -> str | None:
         return None
     padding = "=" * (-len(parts[1]) % 4)
     try:
-        payload = cast(
-            "object", json.loads(base64.urlsafe_b64decode(parts[1] + padding).decode())
-        )
+        payload = _decode_json(base64.urlsafe_b64decode(parts[1] + padding).decode())
     except (ValueError, UnicodeDecodeError, RecursionError):
         return None
-    if not isinstance(payload, Mapping):
+    if not _is_claim_mapping(payload):
         return None
-    values = cast("Mapping[object, object]", payload)
-    return _normalized_session_id(values.get("session_id"))
+    return _normalized_session_id(payload.get("session_id"))
 
 
 def _normalized_session_id(session_id: object) -> str | None:

{volcano_sdk_python-0.13.2 → volcano_sdk_python-0.13.3}/src/volcano_sdk/_session_operations.py

@@ -3,7 +3,7 @@
 from __future__ import annotations
 
 from concurrent.futures import Future
-from threading import Lock
+from threading import Lock, get_ident
 from typing import TYPE_CHECKING, TypeVar
 
 from .errors import SessionChangedError, VolcanoError
@@ -44,6 +44,8 @@ class SessionOperations:
         self._lock: LockType = Lock()
         self.refreshing: Future[Session] | None = None
         self.signing_out: Future[BaseException | None] | None = None
+        self._refresh_owner: int | None = None
+        self._sign_out_owner: int | None = None
         self._locally_cleared: bool = False
         self._verified_pair: tuple[str, str | None] | None = (
             (verified.access_token, verified.refresh_token)
@@ -91,11 +93,15 @@ class SessionOperations:
             future = self.refreshing
             if future is None or future.done():
                 future = self.refreshing = Future()
-                owner = True
+                claimed = future
+                self._refresh_owner = get_ident()
             else:
-                owner = False
-        if owner:
-            self._complete(future, operation)
+                claimed = None
+        if claimed is None and self._refresh_owner == get_ident() and not future.done():
+            message = "Reentrant refresh"
+            raise RuntimeError(message)
+        if claimed is not None:
+            self._complete(claimed, operation)
         return future.result()
 
     def sign_out(
@@ -105,13 +111,21 @@ class SessionOperations:
             future = self.signing_out
             if future is None:
                 future = self.signing_out = Future()
-                owner = True
+                claimed = future
+                self._sign_out_owner = get_ident()
             else:
-                owner = False
+                claimed = None
             preceding = self.refreshing
             pending = preceding is not None and not preceding.done()
-        if owner:
-            self._complete_revocation(future, operation, preceding, pending=pending)
+        if (
+            claimed is None
+            and self._sign_out_owner == get_ident()
+            and not future.done()
+        ):
+            message = "Reentrant sign-out"
+            raise RuntimeError(message)
+        if claimed is not None:
+            self._complete_revocation(claimed, operation, preceding, pending=pending)
         self._sign_out_result(future)
 
     def wait_for_sign_out(self) -> None:

{volcano_sdk_python-0.13.2 → volcano_sdk_python-0.13.3}/src/volcano_sdk/_transport.py

@@ -11,6 +11,7 @@ from typing import (
     TYPE_CHECKING,
     ParamSpec,
     Protocol,
+    TypeGuard,
     TypeVar,
     cast,
     overload,
@@ -288,6 +289,8 @@ HTTP_RATE_LIMITED = 429
 HTTP_OK = 200
 HTTP_SERVER_ERROR_MIN = 500
 HTTP_SERVER_ERROR_MAX = 599
+_RETRY_AFTER_HEADER = "Retry-After"
+_URL_TRAILING_SLASHES = "/"
 _MALFORMED_USER_PROFILE = "Expected a complete user profile"
 _MALFORMED_SESSION_PAGE = "Expected a complete session page"
 _MALFORMED_LINKED_OAUTH_PROVIDERS = "Expected complete linked OAuth providers"
@@ -351,6 +354,17 @@ class _ParsedHTTPResponse(_RawHTTPResponse, Protocol):
     def parsed(self) -> object: ...
 
 
+class _JSONResponse(Protocol):
+    def json(self) -> object: ...
+
+
+class _JSONDecoder(Protocol):
+    def __call__(self, document: bytes, /) -> object: ...
+
+
+_decode_json: _JSONDecoder = json.loads
+
+
 @runtime_checkable
 class _ModelPayload(Protocol):
     def to_dict(self) -> Mapping[str, object]: ...
@@ -704,7 +718,7 @@ class Transport(Protocol):
         bucket_name: str,
         path: str,
         data: bytes,
-        content_type: str = "application/octet-stream",
+        content_type: str,
     ) -> TransportResponse: ...
 
     def download_storage_object(
@@ -802,14 +816,21 @@ def _required_request_string(kwargs: Mapping[str, object], key: str) -> str:
     return value
 
 
+def _is_object_mapping(value: object) -> TypeGuard[Mapping[object, object]]:
+    return isinstance(value, Mapping)
+
+
+def _is_object_dict(value: object) -> TypeGuard[dict[object, object]]:
+    return isinstance(value, dict)
+
+
 def _request_headers(kwargs: Mapping[str, object]) -> dict[str, str]:
     raw_headers = kwargs.get("headers", {})
-    if not isinstance(raw_headers, Mapping):
+    if not _is_object_mapping(raw_headers):
         field = "headers"
         raise _InvalidGeneratedRequestError(field)
-    source = cast("Mapping[object, object]", raw_headers)
     headers: dict[str, str] = {}
-    for key, value in source.items():
+    for key, value in raw_headers.items():
         if not isinstance(key, str) or not isinstance(value, str):
             field = "headers"
             raise _InvalidGeneratedRequestError(field)
@@ -823,12 +844,11 @@ def _request_params(
     raw_params = kwargs.get("params")
     if raw_params is None:
         return None
-    if not isinstance(raw_params, Mapping):
+    if not _is_object_mapping(raw_params):
         field = "params"
         raise _InvalidGeneratedRequestError(field)
-    source = cast("Mapping[object, object]", raw_params)
     params: dict[str, str | int | float | bool | None] = {}
-    for key, value in source.items():
+    for key, value in raw_params.items():
         if not isinstance(key, str) or (
             value is not None and not isinstance(value, (str, int, float, bool))
         ):
@@ -853,14 +873,13 @@ def _generated_request(
     )
 
 
-def _json_object(response: httpx.Response) -> dict[str, object]:
-    raw = cast("object", response.json())
-    if not isinstance(raw, dict):
+def _json_object(response: _JSONResponse) -> dict[str, object]:
+    raw = response.json()
+    if not _is_object_dict(raw):
         field = "response body"
         raise _InvalidGeneratedRequestError(field)
-    source = cast("Mapping[object, object]", raw)
     payload: dict[str, object] = {}
-    for key, value in source.items():
+    for key, value in raw.items():
         if not isinstance(key, str):
             field = "response body key"
             raise _InvalidGeneratedRequestError(field)
@@ -873,10 +892,7 @@ def response_payload(response: TransportResponse, expected_status: int) -> objec
     if status != expected_status:
         payload: Mapping[object, object]
         raw_payload = response.payload
-        if isinstance(raw_payload, dict):
-            payload = cast("Mapping[object, object]", raw_payload)
-        else:
-            payload = {}
+        payload = raw_payload if _is_object_dict(raw_payload) else {}
         message = str(
             payload.get("error") or payload.get("message") or "Volcano request failed"
         )
@@ -884,7 +900,7 @@ def response_payload(response: TransportResponse, expected_status: int) -> objec
         code = str(code_value) if code_value is not None else None
         retry_after = None
         if status == HTTP_RATE_LIMITED:
-            retry_after_value = _header(response.headers, "Retry-After")
+            retry_after_value = _header(response.headers, _RETRY_AFTER_HEADER)
             try:
                 retry_after = (
                     int(retry_after_value) if retry_after_value is not None else None
@@ -908,7 +924,7 @@ class GeneratedTransport:
         timeout: float = 60.0,
         httpx_transport: httpx.BaseTransport | None = None,
     ) -> None:
-        self._api_url: str = api_url.rstrip("/")
+        self._api_url: str = api_url.rstrip(_URL_TRAILING_SLASHES)
         self._timeout: float = timeout
         self._httpx_transport: httpx.BaseTransport | None = httpx_transport
 
@@ -932,7 +948,7 @@ class GeneratedTransport:
             payload = parsed
         else:
             try:
-                raw = cast("object", json.loads(response.content))
+                raw = _decode_json(response.content)
                 payload = raw
             except (json.JSONDecodeError, UnicodeDecodeError):
                 payload = None
@@ -946,7 +962,7 @@ class GeneratedTransport:
     @staticmethod
     def _raw_response(response: _RawHTTPResponse) -> TransportResponse:
         try:
-            payload = cast("object", json.loads(response.content))
+            payload = _decode_json(response.content)
         except (json.JSONDecodeError, UnicodeDecodeError):
             payload = None
         return _GeneratedTransportResponse(
@@ -1833,14 +1849,8 @@ class GeneratedTransport:
         # invoke contract's { payload } envelope.
         plain_payload = _plain_json(payload)
         with self._client(authorization) as client:
-            response = client.get_httpx_client().request(
-                method="POST",
-                url=invoke_url,
-                json={"payload": plain_payload},
-                headers={
-                    "Authorization": f"Bearer {authorization}",
-                    "Content-Type": "application/json",
-                },
+            response = client.get_httpx_client().post(
+                invoke_url, json={"payload": plain_payload}
             )
         return self._raw_response(response)
 

{volcano_sdk_python-0.13.2 → volcano_sdk_python-0.13.3}/tests/unit/test_functions_http.py

@@ -26,6 +26,8 @@ import pytest
 
 from volcano_sdk import NotFoundError, VolcanoClient
 
+pytestmark = pytest.mark.allow_hosts(["127.0.0.1"])
+
 FUNCTION_ID = "00000000-0000-4000-8000-000000000040"
 
 # (status, payload) or (status, payload, extra response headers).
@@ -37,6 +39,8 @@ class RecordedRequest:
     path: str
     body: object
     authorization: str | None
+    method: str
+    content_type: str | None
 
 
 @dataclass
@@ -78,6 +82,8 @@ class Handler(BaseHTTPRequestHandler):
                 path=self.path,
                 body=body,
                 authorization=self.headers.get("Authorization"),
+                method=self.command,
+                content_type=self.headers.get("Content-Type"),
             )
         )
         answer = self.respond(self.path)
@@ -194,6 +200,8 @@ def test_repeated_invocations_resolve_once_and_reach_the_resolved_host(
         invoked = function_requests.requests[0]
         assert invoked.body == {"payload": {"user_id": "u-1"}}
         assert invoked.authorization == "Bearer service-key"
+        assert invoked.method == "POST"
+        assert invoked.content_type == "application/json"
     finally:
         api.close()
 

{volcano_sdk_python-0.13.2 → volcano_sdk_python-0.13.3}/tests/unit/test_generated_transport.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 import asyncio
 import json
 from types import MappingProxyType
+from uuid import UUID
 
 import httpx
 import pytest
@@ -55,8 +56,12 @@ def test_generated_transport_queries_a_database_asynchronously() -> None:
     assert requests[0].headers["authorization"] == "Bearer access-token"
 
 
-def test_generated_transport_builds_an_oauth_authorization_url() -> None:
-    transport = GeneratedTransport(api_url="https://api.test.volcano.dev")
+@pytest.mark.parametrize(
+    "api_url",
+    ["https://api.test.volcano.dev", "https://api.test.volcano.dev///"],
+)
+def test_generated_transport_builds_an_oauth_authorization_url(api_url: str) -> None:
+    transport = GeneratedTransport(api_url=api_url)
 
     result = transport.auth_oauth_authorization_url(
         anon_key="anon key",
@@ -77,6 +82,38 @@ def test_generated_transport_builds_an_oauth_authorization_url() -> None:
     }
 
 
+@pytest.mark.parametrize("timeout", [None, 0.25, 60.0])
+def test_generated_transport_applies_request_timeout(timeout: float | None) -> None:
+    requests: list[httpx.Request] = []
+
+    def handle(request: httpx.Request) -> httpx.Response:
+        requests.append(request)
+        return httpx.Response(200, json={"data": []})
+
+    if timeout is None:
+        transport = GeneratedTransport(
+            api_url="https://api.test.volcano.dev",
+            httpx_transport=httpx.MockTransport(handle),
+        )
+    else:
+        transport = GeneratedTransport(
+            api_url="https://api.test.volcano.dev",
+            timeout=timeout,
+            httpx_transport=httpx.MockTransport(handle),
+        )
+    _ = transport.query_database_select(
+        authorization="access-token", database_name="app", body={"table": "items"}
+    )
+
+    expected_timeout = 60.0 if timeout is None else timeout
+    assert requests[0].extensions["timeout"] == {
+        "connect": expected_timeout,
+        "read": expected_timeout,
+        "write": expected_timeout,
+        "pool": expected_timeout,
+    }
+
+
 def test_generated_transport_resolves_and_invokes_a_function() -> None:
     requests: list[httpx.Request] = []
 
@@ -1423,6 +1460,7 @@ def test_generated_transport_calls_the_seven_openapi_operations() -> None:
         "filters": [{"column": "slug", "operator": "eq", "value": "a"}],
     }
     assert b"hello" in requests[3].content
+    assert b"Content-Type: application/octet-stream" in requests[3].content
     assert requests[4].headers["range"] == "bytes=0-4"
     assert json.loads(requests[6].content) == {"ttl_seconds": 30}
     assert requests[6].headers["x-volcano-lock-token"] == (
@@ -1431,6 +1469,32 @@ def test_generated_transport_calls_the_seven_openapi_operations() -> None:
     assert requests[7].headers["x-volcano-lock-token"] == (
         "00000000-0000-4000-8000-000000000001"
     )
+    assert UUID(requests[6].headers["x-volcano-request-id"]).version == 4
+    assert UUID(requests[7].headers["x-volcano-request-id"]).version == 4
+
+
+def test_generated_transport_names_an_upload_without_a_basename() -> None:
+    requests: list[httpx.Request] = []
+
+    def handle(request: httpx.Request) -> httpx.Response:
+        requests.append(request)
+        return httpx.Response(200, json={"path": "/"})
+
+    transport = GeneratedTransport(
+        api_url="https://api.test.volcano.dev",
+        httpx_transport=httpx.MockTransport(handle),
+    )
+
+    _ = transport.upload_storage_object(
+        authorization="access-token",
+        bucket_name="assets",
+        path="/",
+        data=b"binary\x00data",
+    )
+
+    assert len(requests) == 1
+    assert b'filename="file"' in requests[0].content
+    assert b"binary\x00data" in requests[0].content
 
 
 def test_generated_transport_deletes_a_storage_object() -> None:
@@ -1721,7 +1785,7 @@ def test_generated_transport_gets_project_lock_state() -> None:
     assert requests[0].method == "GET"
     assert requests[0].url.path == "/locks/build:queue"
     assert requests[0].headers["authorization"] == "Bearer service-key"
-    assert requests[0].headers["x-volcano-request-id"]
+    assert UUID(requests[0].headers["x-volcano-request-id"]).version == 4
 
 
 def test_generated_transport_renews_a_project_lock() -> None:
@@ -1758,7 +1822,7 @@ def test_generated_transport_renews_a_project_lock() -> None:
     assert requests[0].headers["x-volcano-lock-token"] == (
         "00000000-0000-4000-8000-000000000001"
     )
-    assert requests[0].headers["x-volcano-request-id"]
+    assert UUID(requests[0].headers["x-volcano-request-id"]).version == 4
 
 
 def test_generated_transport_force_releases_a_project_lock() -> None:
@@ -1783,7 +1847,7 @@ def test_generated_transport_force_releases_a_project_lock() -> None:
     assert requests[0].method == "DELETE"
     assert requests[0].url.path == "/locks/build:queue"
     assert requests[0].headers["authorization"] == "Bearer service-key"
-    assert requests[0].headers["x-volcano-request-id"]
+    assert UUID(requests[0].headers["x-volcano-request-id"]).version == 4
     assert "x-volcano-lock-token" not in requests[0].headers
 
 

{volcano_sdk_python-0.13.2 → volcano_sdk_python-0.13.3}/tests/unit/test_session_claims.py

@@ -15,11 +15,37 @@ from test_session_continuity import (
 )
 
 from volcano_sdk import AuthenticationError, Session
+from volcano_sdk._session import (
+    session_id_from_access_token,
+    validate_refresh_source,
+)
 
 if TYPE_CHECKING:
     import httpx
 
 
+@pytest.mark.parametrize(("suffix", "remainder"), [("a", 2), ("aa", 3)])
+def test_session_claim_decodes_unpadded_base64url(suffix: str, remainder: int) -> None:
+    payload = json.dumps({"session_id": SESSION_A, "x": suffix}).encode()
+    encoded = base64.urlsafe_b64encode(payload).decode().rstrip("=")
+    assert len(encoded) % 4 == remainder
+    assert session_id_from_access_token(f"header.{encoded}.signature") == SESSION_A
+
+
+def test_session_claim_rejects_a_malformed_prefix_even_if_payload_decodes() -> None:
+    payload = json.dumps({"session_id": SESSION_A, "x": "a"}).encode()
+    encoded = base64.urlsafe_b64encode(payload).decode().rstrip("=")
+    assert len(encoded) % 4 == 2
+    assert session_id_from_access_token(f"header.!{encoded}.signature") is None
+
+
+def test_refresh_source_requires_a_claim_without_explicit_verification() -> None:
+    session = Session("opaque-token", "refresh-token", USER_A)
+    with pytest.raises(AuthenticationError, match="without a session identifier"):
+        validate_refresh_source(session)
+    validate_refresh_source(session, verified=True)
+
+
 @pytest.mark.parametrize(
     "payload",
     [

{volcano_sdk_python-0.13.2 → volcano_sdk_python-0.13.3}/tests/unit/test_session_operations.py

@@ -1,7 +1,7 @@
 from __future__ import annotations
 
 from concurrent.futures import Future, ThreadPoolExecutor
-from threading import Event
+from threading import Event, Thread
 
 import pytest
 from typing_extensions import override
@@ -12,6 +12,81 @@ from volcano_sdk._session_operations import SessionOperations
 SESSION = Session("access", "refresh", "user")
 
 
+def test_first_refresh_completes_without_waiting_for_itself() -> None:
+    operations = SessionOperations(SESSION)
+    outcome: list[Session] = []
+
+    def run() -> None:
+        outcome.append(operations.refresh(lambda: SESSION))
+
+    worker = Thread(target=run, daemon=True)
+    worker.start()
+    worker.join(2)
+
+    assert not worker.is_alive()
+    assert outcome == [SESSION]
+
+
+def test_first_sign_out_completes_without_waiting_for_itself() -> None:
+    operations = SessionOperations(SESSION)
+    completed: list[bool] = []
+    revocations: list[tuple[Future[Session] | None, bool]] = []
+
+    def run() -> None:
+        operations.sign_out(
+            lambda preceding, pending: revocations.append((preceding, pending))
+        )
+        completed.append(True)
+
+    worker = Thread(target=run, daemon=True)
+    worker.start()
+    worker.join(2)
+
+    assert not worker.is_alive()
+    assert completed == [True]
+    assert revocations == [(None, False)]
+
+
+def test_reentrant_refresh_fails_instead_of_waiting_for_its_owner() -> None:
+    operations = SessionOperations(SESSION)
+    failures: list[str] = []
+
+    def run() -> None:
+        try:
+            _ = operations.refresh(lambda: operations.refresh(lambda: SESSION))
+        except RuntimeError as error:
+            failures.append(str(error))
+
+    worker = Thread(target=run, daemon=True)
+    worker.start()
+    worker.join(2)
+
+    assert not worker.is_alive()
+    assert failures == ["Reentrant refresh"]
+
+
+def test_reentrant_sign_out_fails_instead_of_waiting_for_its_owner() -> None:
+    operations = SessionOperations(SESSION)
+    failures: list[str] = []
+
+    def run() -> None:
+        try:
+            operations.sign_out(
+                lambda _preceding, _pending: operations.sign_out(
+                    lambda _other_preceding, _other_pending: None
+                )
+            )
+        except RuntimeError as error:
+            failures.append(str(error))
+
+    worker = Thread(target=run, daemon=True)
+    worker.start()
+    worker.join(2)
+
+    assert not worker.is_alive()
+    assert failures == ["Reentrant sign-out"]
+
+
 class JoinedRefresh(Future[Session]):
     def __init__(self, joined: Event) -> None:
         super().__init__()
@@ -124,3 +199,25 @@ def test_sign_out_replays_non_sdk_failures_without_retaining_request_frames(
     assert copied_cause.__traceback__ is None
     assert copied_cause.__context__ is None
     assert not operations.has_verified_pair(SESSION)
+
+
+def test_sign_out_copy_stops_at_one_sdk_cause() -> None:
+    operations = SessionOperations(SESSION)
+    original = RuntimeError("revocation failed")
+    upstream = VolcanoError("upstream failed", status=503)
+    upstream.__cause__ = VolcanoError("nested request", status=500)
+    original.__cause__ = upstream
+
+    def revoke() -> None:
+        raise original
+
+    with pytest.raises(RuntimeError):
+        operations.sign_out(lambda _preceding, _pending: revoke())
+    with pytest.raises(RuntimeError) as replayed:
+        operations.sign_out(lambda _preceding, _pending: revoke())
+
+    copied_cause = replayed.value.__cause__
+    assert isinstance(copied_cause, VolcanoError)
+    assert copied_cause is not upstream
+    assert copied_cause.status == 503
+    assert copied_cause.__cause__ is None