fix: raise ValueError when sessionId and userId are incorrect combination(#1653)

Merge #1655 Fix #1653 When session_id and user_id are incorrect combination on vertex ai session service, it should not return the session. COPYBARA_INTEGRATE_REVIEW=#1655 from soundTricker:fix/1653-invalid-session 7a3dee2 PiperOrigin-RevId: 776648361

Author: soundTricker

src/google/adk/sessions/vertex_ai_session_service.py

@@ -178,6 +178,9 @@ async def get_session(
  )
  get_session_api_response = _convert_api_response(get_session_api_response)
 
+ if get_session_api_response['userId'] != user_id:
+ raise ValueError(f'Session not found: {session_id}')
+
  session_id = get_session_api_response['name'].split('/')[-1]
  update_timestamp = isoparse(
  get_session_api_response['updateTime']

tests/unittests/sessions/test_vertex_ai_session_service.py

@@ -292,6 +292,21 @@ async def test_get_empty_session(agent_engine_id):
  assert str(excinfo.value) == 'Session not found: 0'
 
 
+@pytest.mark.asyncio
+@pytest.mark.usefixtures('mock_get_api_client')
+@pytest.mark.parametrize('agent_engine_id', [None, '123'])
+async def test_get_another_user_session(agent_engine_id):
+ if agent_engine_id:
+ session_service = mock_vertex_ai_session_service(agent_engine_id)
+ else:
+ session_service = mock_vertex_ai_session_service()
+ with pytest.raises(ValueError) as excinfo:
+ await session_service.get_session(
+ app_name='123', user_id='user2', session_id='1'
+ )
+ assert str(excinfo.value) == 'Session not found: 1'
+
+
 @pytest.mark.asyncio
 @pytest.mark.usefixtures('mock_get_api_client')
 async def test_get_and_delete_session():