volcano-sdk-python 0.6.7__tar.gz → 0.7.0__tar.gz

volcano_sdk_python-0.7.0/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.7.0"
+}

{volcano_sdk_python-0.6.7 → volcano_sdk_python-0.7.0}/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.7.0](https://github.com/Kong/volcano-sdk-python/compare/v0.6.7...v0.7.0) (2026-09-17)
+
+
+### Features
+
+* **auth:** synchronize the local user after profile operations ([#130](https://github.com/Kong/volcano-sdk-python/issues/130)) ([e73ee4b](https://github.com/Kong/volcano-sdk-python/commit/e73ee4b4fba33ff04df08fb13c6faca838cc24cb))
+
 ## [0.6.7](https://github.com/Kong/volcano-sdk-python/compare/v0.6.6...v0.6.7) (2026-09-17)
 
 

{volcano_sdk_python-0.6.7 → volcano_sdk_python-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: volcano-sdk-python
-Version: 0.6.7
+Version: 0.7.0
 Summary: Official Python SDK for Volcano
 Project-URL: Homepage, https://volcano.dev
 Project-URL: Repository, https://github.com/Kong/volcano-sdk-python
@@ -315,18 +315,24 @@ including metadata. The snapshot is deeply immutable and available without a
 request. It is cached data, not proof of authentication; use `auth.get_user()`
 to fetch the server-validated profile. Existing three-field `Session` construction
 still works, with `user=None`. An adopted snapshot must have the same user ID.
+Successful `get_user()`, `update_user()`, `convert_anonymous()`, and
+`confirm_email_change()` calls update that local snapshot without changing tokens
+or emitting an auth-state event. Previously returned sessions remain immutable.
+Profile identity checks compare UUID values; the session retains its original
+user ID spelling, including in the cached snapshot.
 
 `get_user()` sends the active access token to Volcano and returns an immutable, server-validated
 profile with the complete public AuthUser fields. Profile timestamps are timezone-aware `datetime`
-values, and nested user and application metadata are immutable. The request does not replace the
-session or cache the profile. If another authentication operation replaces the session while the
-request is in flight, `get_user()` raises `SessionChangedError` instead of returning a profile for
-stale credentials.
+values, and nested user and application metadata are immutable. The request updates the cached
+profile without changing credentials. If another authentication operation replaces the session
+while the request is in flight, `get_user()` raises `SessionChangedError` instead of returning a
+profile for stale credentials.
 
 `update_user()` updates the current user's password, metadata, or both. Metadata is a shallow patch:
 omitted keys remain unchanged, and setting a key to `None` removes it. The method returns the same
-immutable profile type as `get_user()` and does not replace the active session. It also rejects a
-response if another authentication operation replaces the session while the update is in flight.
+immutable profile type as `get_user()` and updates the cached profile without changing credentials.
+It also rejects a response if another authentication operation replaces the session while the
+update is in flight.
 
 Request a password reset email without creating or changing a session:
 

{volcano_sdk_python-0.6.7 → volcano_sdk_python-0.7.0}/README.md

@@ -293,18 +293,24 @@ including metadata. The snapshot is deeply immutable and available without a
 request. It is cached data, not proof of authentication; use `auth.get_user()`
 to fetch the server-validated profile. Existing three-field `Session` construction
 still works, with `user=None`. An adopted snapshot must have the same user ID.
+Successful `get_user()`, `update_user()`, `convert_anonymous()`, and
+`confirm_email_change()` calls update that local snapshot without changing tokens
+or emitting an auth-state event. Previously returned sessions remain immutable.
+Profile identity checks compare UUID values; the session retains its original
+user ID spelling, including in the cached snapshot.
 
 `get_user()` sends the active access token to Volcano and returns an immutable, server-validated
 profile with the complete public AuthUser fields. Profile timestamps are timezone-aware `datetime`
-values, and nested user and application metadata are immutable. The request does not replace the
-session or cache the profile. If another authentication operation replaces the session while the
-request is in flight, `get_user()` raises `SessionChangedError` instead of returning a profile for
-stale credentials.
+values, and nested user and application metadata are immutable. The request updates the cached
+profile without changing credentials. If another authentication operation replaces the session
+while the request is in flight, `get_user()` raises `SessionChangedError` instead of returning a
+profile for stale credentials.
 
 `update_user()` updates the current user's password, metadata, or both. Metadata is a shallow patch:
 omitted keys remain unchanged, and setting a key to `None` removes it. The method returns the same
-immutable profile type as `get_user()` and does not replace the active session. It also rejects a
-response if another authentication operation replaces the session while the update is in flight.
+immutable profile type as `get_user()` and updates the cached profile without changing credentials.
+It also rejects a response if another authentication operation replaces the session while the
+update is in flight.
 
 Request a password reset email without creating or changing a session:
 

{volcano_sdk_python-0.6.7 → volcano_sdk_python-0.7.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "volcano-sdk-python"
-version = "0.6.7"
+version = "0.7.0"
 description = "Official Python SDK for Volcano"
 readme = "README.md"
 requires-python = ">=3.11"

{volcano_sdk_python-0.6.7 → volcano_sdk_python-0.7.0}/src/volcano_sdk/auth.py

@@ -262,7 +262,7 @@ def _email_change_result_from_payload(payload: object) -> EmailChangeResult:
     )
 
 
-def _user_from_payload(payload: object) -> User:
+def _user_from_payload(payload: object) -> tuple[User, Mapping[str, JSONValue]]:
     if not isinstance(
         payload,
         (
@@ -277,7 +277,7 @@ def _user_from_payload(payload: object) -> User:
     project_id = _none_if_unset(user.project_id)
     user_metadata = _none_if_unset(user.user_metadata)
     app_metadata = _none_if_unset(user.app_metadata)
-    return User(
+    profile = User(
         id=str(user.id),
         email=user.email,
         status=user.status,
@@ -299,6 +299,7 @@ def _user_from_payload(payload: object) -> User:
         created_at=_none_if_unset(user.created_at),
         updated_at=_none_if_unset(user.updated_at),
     )
+    return profile, cast("Mapping[str, JSONValue]", user.to_dict())
 
 
 def _none_if_unset(value: _T | Unset) -> _T | None:
@@ -468,6 +469,10 @@ class AuthContext(Protocol):
 
     def _capture_session_binding(self) -> tuple[int, int, Session | None]: ...
 
+    def _update_session_user_if_current(
+        self, user: Mapping[str, JSONValue], generation: int
+    ) -> bool: ...
+
     def _set_session_if_current(
         self,
         session: Session,
@@ -580,10 +585,7 @@ class Auth:
             password=password,
             metadata=dict(metadata or {}),
         )
-        user = _user_from_payload(response_payload(response, 200))
-        if self._client._capture_session()[0] != generation:
-            raise SessionChangedError
-        return user
+        return self._update_current_user(response_payload(response, 200), generation)
 
     def reset_password_for_email(self, *, email: str) -> None:
         """Request a reset email without revealing whether the account exists."""
@@ -636,10 +638,7 @@ class Auth:
             authorization=current.access_token,
             token=token,
         )
-        user = _user_from_payload(response_payload(response, 200))
-        if self._client._capture_session()[0] != generation:
-            raise SessionChangedError
-        return user
+        return self._update_current_user(response_payload(response, 200), generation)
 
     def delete_all_other_sessions(self) -> None:
         """Delete every other session while preserving the current session."""
@@ -945,6 +944,12 @@ class Auth:
         )
         response_payload(response, 200)
 
+    def _update_current_user(self, payload: object, generation: int) -> User:
+        user, snapshot = _user_from_payload(payload)
+        if not self._client._update_session_user_if_current(snapshot, generation):
+            raise SessionChangedError
+        return user
+
     def get_user(self) -> User:
         """Load a server-validated profile for the current session."""
         generation, current = self._client._capture_session()
@@ -952,10 +957,7 @@ class Auth:
             raise AuthenticationError(_NO_ACTIVE_SESSION)
         transport = cast("AuthGetUserTransport", self._client._transport)
         response = invoke(transport.auth_get_user, authorization=current.access_token)
-        user = _user_from_payload(response_payload(response, 200))
-        if self._client._capture_session()[0] != generation:
-            raise SessionChangedError
-        return user
+        return self._update_current_user(response_payload(response, 200), generation)
 
     def update_user(
         self,
@@ -974,10 +976,7 @@ class Auth:
             password=password,
             metadata=None if metadata is None else dict(metadata),
         )
-        user = _user_from_payload(response_payload(response, 200))
-        if self._client._capture_session()[0] != generation:
-            raise SessionChangedError
-        return user
+        return self._update_current_user(response_payload(response, 200), generation)
 
     def sign_in(self, *, email: str, password: str) -> Session:
         """Sign in a user and store the returned session."""

{volcano_sdk_python-0.6.7 → volcano_sdk_python-0.7.0}/src/volcano_sdk/client.py

@@ -4,11 +4,14 @@ from __future__ import annotations
 
 import threading
 from collections import deque
+from dataclasses import replace
 from typing import TYPE_CHECKING
+from uuid import UUID
 
 from ._transport import GeneratedTransport, Transport
 from .auth import Auth
 from .database import Database
+from .errors import AuthenticationError
 from .functions import Functions
 from .locks import Locks
 from .logs import Logs
@@ -16,17 +19,19 @@ from .models import (
     AuthChangeEvent,
     AuthStateCallback,
     AuthSubscription,
+    JSONValue,
     Session,
 )
 from .realtime import CentrifugeFactory, Realtime
 from .storage import Storage
 
 if TYPE_CHECKING:
-    from collections.abc import Callable
+    from collections.abc import Callable, Mapping
     from types import TracebackType
 
 _NO_ACTIVE_SESSION = "No active session"
 _NO_SERVICE_KEY = "No service key configured"
+_PROFILE_USER_MISMATCH = "Profile user does not match the active session"
 
 
 class _CallbackOutcome:
@@ -161,6 +166,25 @@ class VolcanoClient:
                 self._current_session,
             )
 
+    def _update_session_user_if_current(
+        self, user: Mapping[str, JSONValue], generation: int
+    ) -> bool:
+        with self._session_lock:
+            current = self._current_session
+            if generation != self._session_generation or current is None:
+                return False
+            try:
+                same_user = UUID(str(user["id"])) == UUID(current.user_id)
+            except ValueError:
+                same_user = False
+            if not same_user:
+                raise AuthenticationError(_PROFILE_USER_MISMATCH)
+            # Profile updates do not replace credentials or invalidate other requests.
+            self._current_session = replace(
+                current, user={**user, "id": current.user_id}
+            )
+        return True
+
     def _set_session_if_current(
         self,
         session: Session,

{volcano_sdk_python-0.6.7 → volcano_sdk_python-0.7.0}/tests/unit/test_state.py

@@ -7,6 +7,7 @@ from datetime import datetime
 from threading import Event, Thread
 from types import MappingProxyType
 from typing import TYPE_CHECKING, Any, cast
+from uuid import UUID
 
 import httpx
 import pytest
@@ -538,6 +539,141 @@ class StateTransport:
         return Response(204)
 
 
+@pytest.mark.parametrize(
+    ("method", "arguments"),
+    [
+        ("get_user", {}),
+        ("update_user", {"metadata": {"name": "updated"}}),
+        ("convert_anonymous", {"email": "user@example.com", "password": "secret"}),
+        ("confirm_email_change", {"token": "confirmation"}),
+    ],
+)
+def test_profile_operations_update_the_local_snapshot(
+    method: str, arguments: dict[str, Any]
+) -> None:
+    client = VolcanoClient(anon_key="anon", _transport=StateTransport())
+    original = client.auth.sign_in(email="user@example.com", password="secret")
+    binding = client._capture_session_binding()
+    events: list[str] = []
+    client.auth.on_auth_state_change(lambda event, _session: events.append(event))
+    events.clear()
+
+    user = getattr(client.auth, method)(**arguments)
+    current = client.auth.get_session()
+
+    assert current is not None
+    assert current.user is not None
+    assert current.user["id"] == current.user_id == user.id
+    assert current.user["email"] == user.email
+    assert current.access_token == original.access_token
+    assert current.refresh_token == original.refresh_token
+    assert client._capture_session_binding()[:2] == binding[:2]
+    assert events == []
+    assert original.user == {"id": original.user_id}
+    mutable_user: Any = current.user
+    with pytest.raises(TypeError):
+        mutable_user["email"] = "changed"
+
+
+@pytest.mark.parametrize(
+    ("method", "arguments"),
+    [
+        ("get_user", {}),
+        ("update_user", {"metadata": {}}),
+        (
+            "convert_anonymous",
+            {"email": "user@example.com", "password": "secret"},
+        ),
+        (
+            "confirm_email_change",
+            {"token": "confirmation"},
+        ),
+    ],
+)
+@pytest.mark.parametrize(
+    "user_id", ["00000000-0000-4000-8000-000000000099", "invalid-id"]
+)
+def test_profile_operations_reject_a_different_user_without_changing_session(
+    method: str, arguments: dict[str, Any], user_id: str
+) -> None:
+    client = VolcanoClient(anon_key="anon", _transport=StateTransport())
+    original = client.auth.set_session(Session("access", "refresh", user_id))
+    binding = client._capture_session_binding()
+
+    with pytest.raises(AuthenticationError, match="Profile user does not match"):
+        getattr(client.auth, method)(**arguments)
+
+    assert client.auth.get_session() is original
+    assert client._capture_session_binding() == binding
+
+
+@pytest.mark.parametrize(
+    ("method", "arguments"),
+    [
+        ("get_user", {}),
+        ("update_user", {"metadata": {}}),
+        ("convert_anonymous", {"email": "user@example.com", "password": "secret"}),
+        ("confirm_email_change", {"token": "confirmation"}),
+    ],
+)
+@pytest.mark.parametrize("spelling", ["uppercase", "braced", "hex"])
+def test_profile_operations_preserve_equivalent_session_user_ids(
+    method: str, arguments: dict[str, Any], spelling: str
+) -> None:
+    transport = StateTransport()
+    identity = UUID("ab123456-7890-4abc-8def-0123456789ab")
+    for response in (
+        transport.user_response,
+        transport.update_user_response,
+        transport.anonymous_conversion_response,
+        transport.confirm_email_change_response,
+    ):
+        response.payload.user.id = identity
+    identifiers = {
+        "uppercase": str(identity).upper(),
+        "braced": "{" + str(identity) + "}",
+        "hex": identity.hex,
+    }
+    user_id = identifiers[spelling]
+    client = VolcanoClient(anon_key="anon", _transport=transport)
+    original = client.auth.set_session(
+        Session("access", "refresh", user_id, user={"id": user_id})
+    )
+    binding = client._capture_session_binding()
+
+    user = getattr(client.auth, method)(**arguments)
+    current = client.auth.get_session()
+
+    assert user.id == str(identity)
+    assert current is not None
+    assert current.user is not None
+    assert current.user_id == current.user["id"] == user_id
+    assert current.user["email"] == user.email
+    assert current.access_token == original.access_token
+    assert current.refresh_token == original.refresh_token
+    assert client._capture_session_binding()[:2] == binding[:2]
+    assert original.user == {"id": user_id}
+    assert client.auth.set_session(current) == current
+
+
+def test_profile_updates_do_not_invalidate_an_overlapping_profile_read() -> None:
+    transport = StateTransport()
+    client = VolcanoClient(anon_key="anon", _transport=transport)
+    client.auth.sign_in(email="user@example.com", password="secret")
+
+    def update_profile() -> None:
+        client.auth.update_user(metadata={"name": "new"})
+
+    transport.on_get_user = update_profile
+
+    user = client.auth.get_user()
+    current = client.auth.get_session()
+
+    assert current is not None
+    assert current.user is not None
+    assert current.user["email"] == user.email
+
+
 def test_query_builder_chains_are_immutable() -> None:
     transport = StateTransport()
     client = VolcanoClient(anon_key="anon", _transport=transport)
@@ -1318,8 +1454,11 @@ def test_sign_in_anonymously_preserves_session_when_disabled() -> None:
     assert client.auth.get_session() is established
 
 
-def test_convert_anonymous_returns_the_user_without_replacing_the_session() -> None:
+def test_convert_anonymous_updates_the_user_without_replacing_credentials() -> None:
     transport = StateTransport()
+    transport.anonymous_signin_response.payload["user"]["id"] = (
+        "00000000-0000-4000-8000-000000000010"
+    )
     client = VolcanoClient(anon_key="anon", _transport=transport)
     established = client.auth.sign_in_anonymously()
 
@@ -1331,7 +1470,11 @@ def test_convert_anonymous_returns_the_user_without_replacing_the_session() -> N
 
     assert user.email == "converted@example.com"
     assert user.email_confirmed is False
-    assert client.auth.get_session() is established
+    current = client.auth.get_session()
+    assert current is not None
+    assert current.user is not None
+    assert current.access_token == established.access_token
+    assert current.user["email"] == user.email
     assert transport.anonymous_conversion_calls == [
         {
             "authorization": "anonymous-access",
@@ -1483,7 +1626,7 @@ def test_cancel_email_change_rejects_a_stale_response() -> None:
     assert client.auth.get_session() == replacement
 
 
-def test_confirm_email_change_returns_user_without_replacing_session() -> None:
+def test_confirm_email_change_updates_user_without_replacing_credentials() -> None:
     transport = StateTransport()
     client = VolcanoClient(anon_key="anon", _transport=transport)
     established = client.auth.sign_in(email="user@example.com", password="secret")
@@ -1491,7 +1634,11 @@ def test_confirm_email_change_returns_user_without_replacing_session() -> None:
     user = client.auth.confirm_email_change(token="change-token")
 
     assert user.email == "new@example.com"
-    assert client.auth.get_session() is established
+    current = client.auth.get_session()
+    assert current is not None
+    assert current.user is not None
+    assert current.access_token == established.access_token
+    assert current.user["email"] == user.email
     assert transport.confirm_email_change_calls == [
         {"authorization": "access-1", "token": "change-token"}
     ]
@@ -2549,7 +2696,11 @@ def test_get_user_returns_an_immutable_server_validated_profile() -> None:
     assert user.created_at == datetime.fromisoformat("2026-08-30T12:00:00+00:00")
     assert user.updated_at == datetime.fromisoformat("2026-08-31T17:30:00+05:30")
     assert transport.authorizations[-1] == ("get_user", "access-1")
-    assert client.auth.get_session() is established
+    current = client.auth.get_session()
+    assert current is not None
+    assert current.user is not None
+    assert current.access_token == established.access_token
+    assert current.user["user_metadata"] == user.user_metadata
     mutable_user: Any = user
     mutable_metadata: Any = user.user_metadata
     mutable_app_metadata: Any = user.app_metadata
@@ -2745,7 +2896,7 @@ def test_get_user_rejects_a_profile_loaded_for_a_replaced_session() -> None:
     assert client.auth.get_session() == replacement
 
 
-def test_update_user_returns_the_updated_profile_without_replacing_session() -> None:
+def test_update_user_updates_the_profile_without_replacing_credentials() -> None:
     transport = StateTransport()
     client = VolcanoClient(anon_key="anon", _transport=transport)
     established = client.auth.sign_in(email="user@example.com", password="secret")
@@ -2764,7 +2915,11 @@ def test_update_user_returns_the_updated_profile_without_replacing_session() ->
             "metadata": {"display_name": "Grace", "avatar": None},
         }
     ]
-    assert client.auth.get_session() is established
+    current = client.auth.get_session()
+    assert current is not None
+    assert current.user is not None
+    assert current.access_token == established.access_token
+    assert current.user["email"] == user.email
 
 
 def test_update_user_without_a_session_fails_before_transport() -> None:

{volcano_sdk_python-0.6.7 → volcano_sdk_python-0.7.0}/uv.lock

@@ -918,7 +918,7 @@ wheels = [
 
 [[package]]
 name = "volcano-sdk-python"
-version = "0.6.7"
+version = "0.7.0"
 source = { editable = "." }
 dependencies = [
     { name = "attrs" },

volcano_sdk_python-0.6.7/.release-please-manifest.json

@@ -1,3 +0,0 @@
-{
-  ".": "0.6.7"
-}