fix(firestore): only reject ids that fully match __.*__

src/google/adk/integrations/firestore/firestore_session_service.py

@@ -20,6 +20,7 @@
 from datetime import datetime
 from datetime import timezone
 import json
+import re
 import logging
 import os
 from typing import Any
@@ -206,7 +207,10 @@ def _validate_identity_component(name: str, value: str) -> None:
       )
     if value in (".", ".."):
       raise ValueError(f"{name} must not be '.' or '..', got {value!r}.")
-    if value.startswith("__") and value.endswith("__"):
+    # Firestore reserved ids match __.*__ (at least four chars). "__" and
+    # "___" are valid document ids; startswith/endswith("__") wrongly rejects
+    # them because the prefix and suffix overlap.
+    if re.fullmatch(r"__.*__", value):
       raise ValueError(
           f"{name} must not match the Firestore-reserved __.*__ pattern, got"
           f" {value!r}."

tests/unittests/integrations/firestore/test_firestore_session_service.py

@@ -1376,6 +1376,34 @@ async def test_create_session_rejects_path_breaking_session_id(
       )
 
 
+@pytest.mark.parametrize(
+    "ok_id",
+    [
+        "__",  # valid Firestore doc id; prefix/suffix overlap
+        "___",
+        "user__",
+        "__user",
+        "_x_",
+    ],
+)
+def test_validate_identity_allows_non_reserved_underscore_ids(ok_id):
+  """Only full __.*__ matches are reserved; "__" and "___" must pass."""
+  FirestoreSessionService._validate_identity_component("user_id", ok_id)
+
+
+@pytest.mark.parametrize(
+    "bad_id",
+    [
+        "____",
+        "__x__",
+        "__reserved__",
+    ],
+)
+def test_validate_identity_rejects_firestore_reserved_pattern(bad_id):
+  with pytest.raises(ValueError, match="Firestore-reserved"):
+    FirestoreSessionService._validate_identity_component("user_id", bad_id)
+
+
 @pytest.mark.asyncio
 async def test_get_session_rejects_path_breaking_identity(
     mock_firestore_client,