volcano-sdk-python 0.13.2__tar.gz → 0.13.4__tar.gz

volcano_sdk_python-0.13.4/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.13.4"
+}

{volcano_sdk_python-0.13.2 → volcano_sdk_python-0.13.4}/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.13.4](https://github.com/Kong/volcano-sdk-python/compare/v0.13.3...v0.13.4) (2026-09-24)
+
+
+### Bug Fixes
+
+* **durable:** validate execution snapshots and exact mutation scope ([5652b49](https://github.com/Kong/volcano-sdk-python/commit/5652b49c5d6533cfd1c35dec7e2751234aedeae5))
+
+## [0.13.3](https://github.com/Kong/volcano-sdk-python/compare/v0.13.2...v0.13.3) (2026-09-24)
+
+
+### Bug Fixes
+
+* **python:** harden transport and session boundaries ([#362](https://github.com/Kong/volcano-sdk-python/issues/362)) ([ad077f1](https://github.com/Kong/volcano-sdk-python/commit/ad077f19db4b2148f3be63ec3fc4f112d79e16ea))
+
 ## [0.13.2](https://github.com/Kong/volcano-sdk-python/compare/v0.13.1...v0.13.2) (2026-09-24)
 
 

{volcano_sdk_python-0.13.2 → volcano_sdk_python-0.13.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: volcano-sdk-python
-Version: 0.13.2
+Version: 0.13.4
 Summary: Official Python SDK for Volcano
 Project-URL: Homepage, https://volcano.dev
 Project-URL: Repository, https://github.com/Kong/volcano-sdk-python

{volcano_sdk_python-0.13.2 → volcano_sdk_python-0.13.4}/maintainers/quality-policy.lock.json

@@ -16,10 +16,21 @@
         },
         {
           "reportAny": "error",
+          "reportExplicitAny": "error",
           "reportUnannotatedClassAttribute": "error",
           "reportUnusedCallResult": "error",
           "root": "src/volcano_sdk/realtime.py"
         },
+        {
+          "reportAny": "error",
+          "reportExplicitAny": "error",
+          "root": "src/volcano_sdk/auth.py"
+        },
+        {
+          "reportAny": "error",
+          "reportExplicitAny": "error",
+          "root": "src/volcano_sdk/functions.py"
+        },
         {
           "reportAny": "error",
           "reportUnannotatedClassAttribute": "error",
@@ -43,6 +54,16 @@
           "reportUnusedCallResult": "error",
           "root": "tests/unit/test_realtime.py"
         },
+        {
+          "reportAny": "error",
+          "reportExplicitAny": "error",
+          "root": "tests/unit/test_functions.py"
+        },
+        {
+          "reportAny": "error",
+          "reportExplicitAny": "error",
+          "root": "tests/unit/test_logs.py"
+        },
         {
           "reportAny": "error",
           "reportExplicitAny": "error",
@@ -274,7 +295,10 @@
         "src/volcano_sdk/storage.py",
         "src/volcano_sdk/functions.py",
         "src/volcano_sdk/database.py",
-        "src/volcano_sdk/_function_resolution.py"
+        "src/volcano_sdk/_function_resolution.py",
+        "src/volcano_sdk/_transport.py",
+        "src/volcano_sdk/_session.py",
+        "src/volcano_sdk/_session_operations.py"
       ]
     },
     "mypy": {
@@ -383,6 +407,7 @@
     },
     "pytest": {
       "ini_options": {
+        "addopts": "--disable-socket --allow-unix-socket",
         "asyncio_debug": true,
         "asyncio_default_fixture_loop_scope": "function",
         "asyncio_default_test_loop_scope": "function",

{volcano_sdk_python-0.13.2 → volcano_sdk_python-0.13.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "volcano-sdk-python"
-version = "0.13.2"
+version = "0.13.4"
 description = "Official Python SDK for Volcano"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -64,6 +64,7 @@ dev = [
   "pytest-order==1.5.0",
   "coverage==7.16.1",
   "pytest-cov==7.1.0",
+  "pytest-socket==0.8.1",
   "types-behave==1.3.0.20260408",
   "tox==4.62.0",
   "mutmut==3.8.0",
@@ -179,6 +180,17 @@ root = "src/volcano_sdk/realtime.py"
 reportUnannotatedClassAttribute = "error"
 reportUnusedCallResult = "error"
 reportAny = "error"
+reportExplicitAny = "error"
+
+[[tool.basedpyright.executionEnvironments]]
+root = "src/volcano_sdk/auth.py"
+reportAny = "error"
+reportExplicitAny = "error"
+
+[[tool.basedpyright.executionEnvironments]]
+root = "src/volcano_sdk/functions.py"
+reportAny = "error"
+reportExplicitAny = "error"
 
 [[tool.basedpyright.executionEnvironments]]
 root = "src/volcano_sdk/_transport.py"
@@ -203,6 +215,16 @@ reportImplicitStringConcatenation = "error"
 reportUnannotatedClassAttribute = "error"
 reportUnusedCallResult = "error"
 
+[[tool.basedpyright.executionEnvironments]]
+root = "tests/unit/test_functions.py"
+reportAny = "error"
+reportExplicitAny = "error"
+
+[[tool.basedpyright.executionEnvironments]]
+root = "tests/unit/test_logs.py"
+reportAny = "error"
+reportExplicitAny = "error"
+
 [[tool.basedpyright.executionEnvironments]]
 root = "tests/unit/test_auth_facade_recovery.py"
 reportAny = "error"
@@ -393,6 +415,7 @@ max-complexity = 5
 
 [tool.pytest.ini_options]
 minversion = "9.1.1"
+addopts = "--disable-socket --allow-unix-socket"
 pythonpath = [".", "features"]
 strict = true
 empty_parameter_set_mark = "fail_at_collect"
@@ -428,6 +451,9 @@ type_check_command = [
   "src/volcano_sdk/functions.py",
   "src/volcano_sdk/database.py",
   "src/volcano_sdk/_function_resolution.py",
+  "src/volcano_sdk/_transport.py",
+  "src/volcano_sdk/_session.py",
+  "src/volcano_sdk/_session_operations.py",
 ]
 cache_invalidation_files = ["tests/**/*.py"]
 pytest_add_cli_args_test_selection = ["tests/unit"]

{volcano_sdk_python-0.13.2 → volcano_sdk_python-0.13.4}/scripts/check_quality_policy.py

@@ -18,7 +18,7 @@ if TYPE_CHECKING:
     from collections.abc import Iterable
 
 GENERATED = "src/volcano_sdk/_generated"
-LOCK_SHA256 = "925d505fd245bd815fffe4a94ec89298294589e5b536aeb51e24d613eb86b6f0"
+LOCK_SHA256 = "5da168f90e02c72a3ee45f4f7b8899149a80c408574c2b693c3d83db7b5d7c1b"
 TYPE_FIXTURES = {
     "tests/typing/contract_steps.py",
     "tests/typing/durable_callbacks.py",

{volcano_sdk_python-0.13.2 → volcano_sdk_python-0.13.4}/scripts/mutation.sh

@@ -64,7 +64,7 @@ else
   for path in "${modules[@]}"; do
     module=${path#src/}
     module=${module%.py}
-    patterns+=("${module//\//.}*")
+    patterns+=("${module//\//.}.x*")
   done
   if ! mutmut run --max-children 1 "${patterns[@]}"; then
     printf '%s\0' "scoped mutation run" >> "$failed"

{volcano_sdk_python-0.13.2 → volcano_sdk_python-0.13.4}/src/volcano_sdk/_session.py

@@ -4,8 +4,8 @@ from __future__ import annotations
 
 import base64
 import json
-from collections.abc import Mapping
-from typing import TYPE_CHECKING, cast
+from collections.abc import Callable, Mapping
+from typing import TYPE_CHECKING, TypeGuard
 from uuid import UUID
 
 from .errors import AuthenticationError
@@ -17,6 +17,11 @@ _JWT_PARTS = 3
 _REFRESH_USER_MISMATCH = "Refreshed session belongs to a different user"
 _REFRESH_SESSION_MISMATCH = "Refreshed credentials belong to a different server session"
 _MISSING_SESSION_ID = "Cannot refresh supplied credentials without a session identifier"
+_decode_json: Callable[[str], object] = json.loads
+
+
+def _is_claim_mapping(value: object) -> TypeGuard[Mapping[object, object]]:
+    return isinstance(value, Mapping)
 
 
 def session_id_from_access_token(access_token: str) -> str | None:
@@ -33,15 +38,12 @@ def session_id_from_access_token(access_token: str) -> str | None:
         return None
     padding = "=" * (-len(parts[1]) % 4)
     try:
-        payload = cast(
-            "object", json.loads(base64.urlsafe_b64decode(parts[1] + padding).decode())
-        )
+        payload = _decode_json(base64.urlsafe_b64decode(parts[1] + padding).decode())
     except (ValueError, UnicodeDecodeError, RecursionError):
         return None
-    if not isinstance(payload, Mapping):
+    if not _is_claim_mapping(payload):
         return None
-    values = cast("Mapping[object, object]", payload)
-    return _normalized_session_id(values.get("session_id"))
+    return _normalized_session_id(payload.get("session_id"))
 
 
 def _normalized_session_id(session_id: object) -> str | None:

{volcano_sdk_python-0.13.2 → volcano_sdk_python-0.13.4}/src/volcano_sdk/_session_operations.py

@@ -3,7 +3,7 @@
 from __future__ import annotations
 
 from concurrent.futures import Future
-from threading import Lock
+from threading import Lock, get_ident
 from typing import TYPE_CHECKING, TypeVar
 
 from .errors import SessionChangedError, VolcanoError
@@ -44,6 +44,8 @@ class SessionOperations:
         self._lock: LockType = Lock()
         self.refreshing: Future[Session] | None = None
         self.signing_out: Future[BaseException | None] | None = None
+        self._refresh_owner: int | None = None
+        self._sign_out_owner: int | None = None
         self._locally_cleared: bool = False
         self._verified_pair: tuple[str, str | None] | None = (
             (verified.access_token, verified.refresh_token)
@@ -91,11 +93,15 @@ class SessionOperations:
             future = self.refreshing
             if future is None or future.done():
                 future = self.refreshing = Future()
-                owner = True
+                claimed = future
+                self._refresh_owner = get_ident()
             else:
-                owner = False
-        if owner:
-            self._complete(future, operation)
+                claimed = None
+        if claimed is None and self._refresh_owner == get_ident() and not future.done():
+            message = "Reentrant refresh"
+            raise RuntimeError(message)
+        if claimed is not None:
+            self._complete(claimed, operation)
         return future.result()
 
     def sign_out(
@@ -105,13 +111,21 @@ class SessionOperations:
             future = self.signing_out
             if future is None:
                 future = self.signing_out = Future()
-                owner = True
+                claimed = future
+                self._sign_out_owner = get_ident()
             else:
-                owner = False
+                claimed = None
             preceding = self.refreshing
             pending = preceding is not None and not preceding.done()
-        if owner:
-            self._complete_revocation(future, operation, preceding, pending=pending)
+        if (
+            claimed is None
+            and self._sign_out_owner == get_ident()
+            and not future.done()
+        ):
+            message = "Reentrant sign-out"
+            raise RuntimeError(message)
+        if claimed is not None:
+            self._complete_revocation(claimed, operation, preceding, pending=pending)
         self._sign_out_result(future)
 
     def wait_for_sign_out(self) -> None:

{volcano_sdk_python-0.13.2 → volcano_sdk_python-0.13.4}/src/volcano_sdk/_transport.py

@@ -11,6 +11,7 @@ from typing import (
     TYPE_CHECKING,
     ParamSpec,
     Protocol,
+    TypeGuard,
     TypeVar,
     cast,
     overload,
@@ -288,6 +289,8 @@ HTTP_RATE_LIMITED = 429
 HTTP_OK = 200
 HTTP_SERVER_ERROR_MIN = 500
 HTTP_SERVER_ERROR_MAX = 599
+_RETRY_AFTER_HEADER = "Retry-After"
+_URL_TRAILING_SLASHES = "/"
 _MALFORMED_USER_PROFILE = "Expected a complete user profile"
 _MALFORMED_SESSION_PAGE = "Expected a complete session page"
 _MALFORMED_LINKED_OAUTH_PROVIDERS = "Expected complete linked OAuth providers"
@@ -351,6 +354,17 @@ class _ParsedHTTPResponse(_RawHTTPResponse, Protocol):
     def parsed(self) -> object: ...
 
 
+class _JSONResponse(Protocol):
+    def json(self) -> object: ...
+
+
+class _JSONDecoder(Protocol):
+    def __call__(self, document: bytes, /) -> object: ...
+
+
+_decode_json: _JSONDecoder = json.loads
+
+
 @runtime_checkable
 class _ModelPayload(Protocol):
     def to_dict(self) -> Mapping[str, object]: ...
@@ -704,7 +718,7 @@ class Transport(Protocol):
         bucket_name: str,
         path: str,
         data: bytes,
-        content_type: str = "application/octet-stream",
+        content_type: str,
     ) -> TransportResponse: ...
 
     def download_storage_object(
@@ -802,14 +816,21 @@ def _required_request_string(kwargs: Mapping[str, object], key: str) -> str:
     return value
 
 
+def _is_object_mapping(value: object) -> TypeGuard[Mapping[object, object]]:
+    return isinstance(value, Mapping)
+
+
+def _is_object_dict(value: object) -> TypeGuard[dict[object, object]]:
+    return isinstance(value, dict)
+
+
 def _request_headers(kwargs: Mapping[str, object]) -> dict[str, str]:
     raw_headers = kwargs.get("headers", {})
-    if not isinstance(raw_headers, Mapping):
+    if not _is_object_mapping(raw_headers):
         field = "headers"
         raise _InvalidGeneratedRequestError(field)
-    source = cast("Mapping[object, object]", raw_headers)
     headers: dict[str, str] = {}
-    for key, value in source.items():
+    for key, value in raw_headers.items():
         if not isinstance(key, str) or not isinstance(value, str):
             field = "headers"
             raise _InvalidGeneratedRequestError(field)
@@ -823,12 +844,11 @@ def _request_params(
     raw_params = kwargs.get("params")
     if raw_params is None:
         return None
-    if not isinstance(raw_params, Mapping):
+    if not _is_object_mapping(raw_params):
         field = "params"
         raise _InvalidGeneratedRequestError(field)
-    source = cast("Mapping[object, object]", raw_params)
     params: dict[str, str | int | float | bool | None] = {}
-    for key, value in source.items():
+    for key, value in raw_params.items():
         if not isinstance(key, str) or (
             value is not None and not isinstance(value, (str, int, float, bool))
         ):
@@ -853,14 +873,13 @@ def _generated_request(
     )
 
 
-def _json_object(response: httpx.Response) -> dict[str, object]:
-    raw = cast("object", response.json())
-    if not isinstance(raw, dict):
+def _json_object(response: _JSONResponse) -> dict[str, object]:
+    raw = response.json()
+    if not _is_object_dict(raw):
         field = "response body"
         raise _InvalidGeneratedRequestError(field)
-    source = cast("Mapping[object, object]", raw)
     payload: dict[str, object] = {}
-    for key, value in source.items():
+    for key, value in raw.items():
         if not isinstance(key, str):
             field = "response body key"
             raise _InvalidGeneratedRequestError(field)
@@ -873,10 +892,7 @@ def response_payload(response: TransportResponse, expected_status: int) -> objec
     if status != expected_status:
         payload: Mapping[object, object]
         raw_payload = response.payload
-        if isinstance(raw_payload, dict):
-            payload = cast("Mapping[object, object]", raw_payload)
-        else:
-            payload = {}
+        payload = raw_payload if _is_object_dict(raw_payload) else {}
         message = str(
             payload.get("error") or payload.get("message") or "Volcano request failed"
         )
@@ -884,7 +900,7 @@ def response_payload(response: TransportResponse, expected_status: int) -> objec
         code = str(code_value) if code_value is not None else None
         retry_after = None
         if status == HTTP_RATE_LIMITED:
-            retry_after_value = _header(response.headers, "Retry-After")
+            retry_after_value = _header(response.headers, _RETRY_AFTER_HEADER)
             try:
                 retry_after = (
                     int(retry_after_value) if retry_after_value is not None else None
@@ -908,7 +924,7 @@ class GeneratedTransport:
         timeout: float = 60.0,
         httpx_transport: httpx.BaseTransport | None = None,
     ) -> None:
-        self._api_url: str = api_url.rstrip("/")
+        self._api_url: str = api_url.rstrip(_URL_TRAILING_SLASHES)
         self._timeout: float = timeout
         self._httpx_transport: httpx.BaseTransport | None = httpx_transport
 
@@ -932,7 +948,7 @@ class GeneratedTransport:
             payload = parsed
         else:
             try:
-                raw = cast("object", json.loads(response.content))
+                raw = _decode_json(response.content)
                 payload = raw
             except (json.JSONDecodeError, UnicodeDecodeError):
                 payload = None
@@ -946,7 +962,7 @@ class GeneratedTransport:
     @staticmethod
     def _raw_response(response: _RawHTTPResponse) -> TransportResponse:
         try:
-            payload = cast("object", json.loads(response.content))
+            payload = _decode_json(response.content)
         except (json.JSONDecodeError, UnicodeDecodeError):
             payload = None
         return _GeneratedTransportResponse(
@@ -1833,14 +1849,8 @@ class GeneratedTransport:
         # invoke contract's { payload } envelope.
         plain_payload = _plain_json(payload)
         with self._client(authorization) as client:
-            response = client.get_httpx_client().request(
-                method="POST",
-                url=invoke_url,
-                json={"payload": plain_payload},
-                headers={
-                    "Authorization": f"Bearer {authorization}",
-                    "Content-Type": "application/json",
-                },
+            response = client.get_httpx_client().post(
+                invoke_url, json={"payload": plain_payload}
             )
         return self._raw_response(response)
 

{volcano_sdk_python-0.13.2 → volcano_sdk_python-0.13.4}/src/volcano_sdk/auth.py

@@ -459,12 +459,22 @@ def _oauth_provider_token_status_from_payload(
     )
 
 
+class _OAuthAPIData(Protocol):
+    @property
+    def data(self) -> object: ...
+
+
+def _oauth_api_data(payload: _OAuthAPIData) -> object:
+    return payload.data
+
+
 def _oauth_api_data_from_payload(payload: object) -> JSONValue:
     if not isinstance(payload, CallOAuthProviderAPIResponse200):
         raise VolcanoError(_INVALID_OAUTH_API_RESPONSE)
-    if not _is_json_value(payload.data):
+    data = _oauth_api_data(payload)
+    if not _is_json_value(data):
         raise VolcanoError(_INVALID_OAUTH_API_RESPONSE)
-    return _freeze_json(payload.data)
+    return _freeze_json(data)
 
 
 class _SetSession(Protocol):