[CorgiBoyG]

Link to Issue or Description of Change

• Closes: FirestoreSessionService rejects valid ids "__" and "___" as reserved #7855

Problem:

The reserved-id check added in #7801 uses:

if value.startswith("__") and value.endswith("__"):

Firestore reserves only ids that fully match __.*__, which needs at least four characters. Because the prefix and suffix overlap, the check above also matches "__" and "___". Those are valid Firestore document ids and do not change the document path, but FirestoreSessionService now rejects them, and any sessions already stored under them can no longer be read or deleted through the service.

Solution:

Require a minimum length of four characters:

if len(value) >= 4 and value.startswith("__") and value.endswith("__"):

This makes the check equivalent to re.fullmatch(r"__.*__", value). Nothing else in the validation changes: /, ., .., empty ids and genuinely reserved ids such as "____" and "__x__" are still rejected, so the path-injection protection from #7800 is unaffected.

Testing Plan

Unit Tests:

• I have added or updated unit tests for my change.
• All relevant unit tests pass locally.

New tests:

• test_validate_identity_component_matches_firestore_reserved_pattern checks "__", "___", "____", "__x__", "__alice" and "alice__" against the reserved rule.
• test_create_session_accepts_short_underscore_identity checks that create_session accepts "__" and "___" as user_id.

The 4 cases for "__" / "___" fail on current main with ValueError: user_id must not match the Firestore-reserved __.*__ pattern and pass with the fix.

pytest -q tests/unittests/integrations/firestore/
85 passed

pytest -q tests/unittests/sessions/
720 passed, 1 xfailed

I also compared the check against re.fullmatch(r"__.*__", value) for every string over {"_", "a"} up to length 8 (510 values): 0 mismatches.

Static checks:

pyink --check: passed
ruff check: passed
mypy (firestore_session_service.py): no issues
git diff --check: passed

The full repository test suite was not run.

Manual End-to-End (E2E) Tests:

Not run. The change is limited to the id validation predicate, which is covered by the unit tests above.

Checklist

• I have read the CONTRIBUTING.md document.
• I have performed a self-review of my own code.
• I have added tests that prove my fix is effective.
• Relevant unit tests pass locally.
• I have manually tested my changes end-to-end.
• No downstream dependency changes are required.

Additional context

This boundary was introduced by my own change in #7801.

[adk-bot]

Thank you @CorgiBoyG for your contribution! 🎉

Your changes have been successfully imported and merged via Copybara in commit e533f55.

Closing this PR as the changes are now in the main branch.