Skip to content

Python: fix(azure-cosmos): reject empty session_id instead of generating an orphan GUID - #9908

Open
lisry-1 wants to merge 2 commits into
microsoft:mainfrom
lisry-1:fix/cosmos-session-id-orphan-data
Open

lisry-1 wants to merge 2 commits into
microsoft:mainfrom
lisry-1:fix/cosmos-session-id-orphan-data

Conversation

@lisry-1

@lisry-1 lisry-1 commented Oct 31, 2026 •

Copy link
Copy Markdown
Contributor

Summary

CosmosHistoryProvider._session_partition_key generated a fresh random GUID on every call when session_id was None/empty. Because save_messages, get_messages, and clear each call it independently, saving to an empty session id wrote the data to partition A while later reads/clears targeted partitions B and C. The stored messages became silently unreachable (orphaned) and could never be listed or cleared via that session id.

This also diverged from the other providers:

| Provider | session_id=None behavior |

|---|---|

| File / Redis (legacy) | maps to stable "default" |

| InMemory | stores in session state |

| Redis (scoped) / VectorStore | raises ValueError |

| Cosmos | random GUID every call (orphans data) |

Change

Align Cosmos with the Redis scoped and VectorStore providers by raising ValueError for a missing session id, and update the regression test accordingly.

…enerating orphan GUID

_session_partition_key previously generated a fresh random GUID for every
call when session_id was None/empty. This made save_messages(None, ...)
write to partition A while get_messages(None) / clear(None) read partition
B/C, silently orphaning the stored data. This also diverged from the Redis
scoped and VectorStore providers, which reject an empty session_id.

Align Cosmos with those providers by raising ValueError for a missing
session_id, and update the regression test accordingly.
Copilot AI balanced review requested due to automatic review settings October 31, 2026 07:19
@lisry-1
lisry-1 temporarily deployed to github-app-auth October 31, 2026 07:19 — with GitHub Actions Inactive
@lisry-1
lisry-1 temporarily deployed to github-app-auth October 31, 2026 07:20 — with GitHub Actions Inactive
@agent-framework-automation agent-framework-automation Bot added the python Usage: [Issues, PRs], Target: Python label Oct 31, 2026
@github-actions github-actions Bot changed the title fix(azure-cosmos): reject empty session_id instead of generating an orphan GUID Python: fix(azure-cosmos): reject empty session_id instead of generating an orphan GUID Oct 31, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

The regression test omits the empty-string session ID case, so it could pass while leaving part of the missing-session-ID contract unprotected.

1 open issue
What changed in this PR

This PR prevents unreachable conversation history in the Python Cosmos provider by rejecting missing session IDs instead of generating a new random partition key on each call.

Changes:

  • Raise ValueError for None or empty session IDs.
  • Update the regression test to verify that None raises without querying Cosmos.
File Description
python/​packages/​azure-cosmos/​tests/​test_cosmos_history_provider.py Replace the GUID-generation test with a validation-error test.
python/​packages/​azure-cosmos/​agent_framework_azure_cosmos/​_history_provider.py Reject empty session IDs and preserve valid partition keys.

Review effort: Balanced

) -> None:
mock_container.query_items.return_value = _to_async_iter([])

async def test_none_session_id_raises_value_error(self, mock_container: MagicMock) -> None:
Parameterize the missing-session-id test to cover both None and the
empty string, matching the non-empty guard in _session_partition_key.
@lisry-1
lisry-1 temporarily deployed to github-app-auth November 1, 2026 12:29 — with GitHub Actions Inactive
@eavanvalkenburg

Copy link
Copy Markdown
Member

Thanks for the contribution, lisry-1. The code review is clean, but this changes the session-ID behavior contract, so the PR needs the required Related Issue answer before approval. Please link an agreed issue with a closing keyword, or document a maintainer-approved exception. Missing AI Assistance alone is not a blocker.

@lisry-1

lisry-1 commented Nov 2, 2026

Copy link
Copy Markdown
Contributor Author

Thanks Eduard van Valkenburg (@eavanvalkenburg). I've opened #9975 to track this bug and linked it in the PR's Related Issue section (Fixes #9975). The change aligns Cosmos with the Redis (scoped) and VectorStore providers by rejecting an empty session_id, and I've documented that in the issue. Please let me know if you'd like the issue labeled ready-for-implementation or any additional confirmation before approval.

This branch was previously deployed

1 inactive deployment
github-app-auth — d28c798a Deployed Nov 2, 2026 by lisry-1 via add_label #26841
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

python Usage: [Issues, PRs], Target: Python

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants