fix: raise ValueError when sessionId and userId are incorrect combination(#1653)

Merge #1655

Fix #1653

When session_id and user_id are incorrect combination on vertex ai session service, it should not return the session.

COPYBARA_INTEGRATE_REVIEW=#1655 from soundTricker:fix/1653-invalid-session 7a3dee2
PiperOrigin-RevId: 776648361

Author: soundTricker

src/google/adk/sessions/vertex_ai_session_service.py

@@ -178,6 +178,9 @@ async def get_session(
     )
     get_session_api_response = _convert_api_response(get_session_api_response)
 
+    if get_session_api_response['userId'] != user_id:
+      raise ValueError(f'Session not found: {session_id}')
+
     session_id = get_session_api_response['name'].split('/')[-1]
     update_timestamp = isoparse(
         get_session_api_response['updateTime']

tests/unittests/sessions/test_vertex_ai_session_service.py

@@ -292,6 +292,21 @@ async def test_get_empty_session(agent_engine_id):
   assert str(excinfo.value) == 'Session not found: 0'
 
 
+@pytest.mark.asyncio
+@pytest.mark.usefixtures('mock_get_api_client')
+@pytest.mark.parametrize('agent_engine_id', [None, '123'])
+async def test_get_another_user_session(agent_engine_id):
+  if agent_engine_id:
+    session_service = mock_vertex_ai_session_service(agent_engine_id)
+  else:
+    session_service = mock_vertex_ai_session_service()
+  with pytest.raises(ValueError) as excinfo:
+    await session_service.get_session(
+        app_name='123', user_id='user2', session_id='1'
+    )
+  assert str(excinfo.value) == 'Session not found: 1'
+
+
 @pytest.mark.asyncio
 @pytest.mark.usefixtures('mock_get_api_client')
 async def test_get_and_delete_session():