Keep duplicate diff scans on cached polling

Author: lelia

CHANGELOG.md

@@ -13,6 +13,9 @@
   step when scans take several minutes to compare and network middleboxes
   (e.g. Azure NAT gateways, which default to a 4-minute TCP idle timeout)
   reap the idle connection (CE-354).
+- Duplicate scan pairs are resolved after an HTTP 409 and then polled through
+  the same cached endpoint. This avoids automatically following the API's 302
+  duplicate redirect with an uncached, potentially long-lived GET request.
 - The change is transparent: no flags or workflow changes are needed. If the
   org API token is missing the `diff-scans:create`, `diff-scans:list` or
   `full-scans:list` scopes — or the new flow fails for any other reason — the

socketsecurity/core/__init__.py

@@ -1356,17 +1356,38 @@ def get_diff_scan_artifacts(
             "before": head_full_scan_id,
             "after": new_full_scan_id,
             "description": f"Socket Security CLI v{__version__} scan comparison",
-            # A rerun against the same pair of scans returns the existing diff
-            # scan instead of failing with a 409.
-            "on_duplicate": "redirect",
         }
-        result = self.sdk.diffscans.create_from_ids(self.config.org_slug, create_params)
-        diff_scan = result.get("diff_scan") or {}
+        try:
+            result = self.sdk.diffscans.create_from_ids(self.config.org_slug, create_params)
+            diff_scan = result.get("diff_scan") or {}
+            response_summary = result
+        except APIFailure as error:
+            if error.status_code != 409:
+                raise
+
+            # Do not use on_duplicate=redirect here. The SDK follows that 302
+            # automatically with a GET that lacks cached=true, which can leave
+            # the connection idle while an existing diff scan is still computing.
+            # Resolve the duplicate resource explicitly so every result fetch
+            # continues through the bounded cached polling path below.
+            existing = self.sdk.diffscans.list(
+                self.config.org_slug,
+                params={
+                    "before_full_scan_id": head_full_scan_id,
+                    "after_full_scan_id": new_full_scan_id,
+                    "per_page": 1,
+                },
+            )
+            matches = existing.get("results") or []
+            diff_scan = matches[0] if matches else {}
+            response_summary = existing
+
         diff_scan_id = diff_scan.get("id")
         if not diff_scan_id:
-            raise Exception(f"Error creating diff scan: unexpected response: {str(result)[:500]}")
-        # An on_duplicate redirect can land on an already-computed diff scan, in
-        # which case the create response already carries the artifacts.
+            raise Exception(
+                "Error creating or resolving diff scan: "
+                f"unexpected response: {str(response_summary)[:500]}"
+            )
         artifacts_dict = diff_scan.get("artifacts")
 
         # cached=true is the polling contract (202 while computing, 200 when

tests/core/test_diff_scan_polling.py

@@ -75,13 +75,32 @@ def test_poll_timeout_raises(core, no_sleep, monkeypatch):
         core.get_diff_scan_artifacts("head", "new")
 
 
-def test_duplicate_redirect_uses_embedded_artifacts(core, diff_scan_get_response):
-    """An on_duplicate redirect can return the computed diff scan straight away."""
-    core.sdk.diffscans.create_from_ids.return_value = diff_scan_get_response
+def test_duplicate_conflict_uses_cached_polling(core, diff_scan_get_response):
+    """A duplicate is resolved explicitly so the SDK cannot follow an uncached redirect."""
+    core.sdk.diffscans.create_from_ids.side_effect = APIFailure(
+        "duplicate", status_code=409
+    )
+    core.sdk.diffscans.list.return_value = {
+        "results": [{"id": "existing-diff-scan"}],
+    }
 
     artifacts = core.get_diff_scan_artifacts("head", "new")
 
-    core.sdk.diffscans.get.assert_not_called()
+    create_params = core.sdk.diffscans.create_from_ids.call_args.args[1]
+    assert "on_duplicate" not in create_params
+    core.sdk.diffscans.list.assert_called_once_with(
+        core.config.org_slug,
+        params={
+            "before_full_scan_id": "head",
+            "after_full_scan_id": "new",
+            "per_page": 1,
+        },
+    )
+    core.sdk.diffscans.get.assert_called_once_with(
+        core.config.org_slug,
+        "existing-diff-scan",
+        params={"cached": "true"},
+    )
     assert len(artifacts.added) > 0
 
 

tests/core/test_sdk_methods.py

@@ -234,7 +234,7 @@ def test_get_added_and_removed_packages(core):
     create_params = create_args[0][1]
     assert create_params["before"] == "head"
     assert create_params["after"] == "new"
-    assert create_params["on_duplicate"] == "redirect"
+    assert "on_duplicate" not in create_params
 
     # cached=true is the polling contract (202 while computing, 200 when ready).
     # No omit_license_details param: the API ignores it for cached reads (cached