Harden diff-scan processing sentinel

Author: lelia

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketdev"
-version = "3.4.0"
+version = "3.4.1"
 requires-python = ">= 3.9"
 dependencies = [
     'requests',

socketdev/diffscans/__init__.py

@@ -48,13 +48,17 @@ def get(self, org_slug: str, diff_scan_id: str, params: Optional[Dict[str, Any]]
         if response.status_code == 200:
             return response.json()
         if response.status_code == 202:
-            result = {"status": "processing", "id": diff_scan_id}
+            result = {}
             try:
                 body = response.json()
                 if isinstance(body, dict):
                     result.update(body)
             except ValueError:
                 pass
+            # HTTP 202 always means the requested diff is still processing.
+            # Keep any additional response fields, but make the polling
+            # sentinel and requested resource ID authoritative for callers.
+            result.update({"status": "processing", "id": diff_scan_id})
             return result
         log.error(f"Error fetching diff scan: {response.status_code}, message: {response.text}")
         return {}

socketdev/version.py

@@ -1 +1 @@
-__version__ = "3.4.0"
+__version__ = "3.4.1"

tests/unit/test_all_endpoints_unit.py

@@ -152,6 +152,20 @@ def test_diffscans_get_processing_empty_body_unit(self):
 
         self.assertEqual(result, {"status": "processing", "id": "diff-123"})
 
+    def test_diffscans_get_processing_sentinel_wins_unit(self):
+        """Test a 202 body cannot override the SDK's polling sentinel or requested ID."""
+        self._mock_response(
+            {"status": "pending", "id": "wrong-id", "retry_after": 5},
+            202,
+        )
+
+        result = self.sdk.diffscans.get("test-org", "diff-123", params={"cached": "true"})
+
+        self.assertEqual(
+            result,
+            {"status": "processing", "id": "diff-123", "retry_after": 5},
+        )
+
     def test_diffscans_create_from_ids_unit(self):
         """Test diffscans creation from scan IDs."""
         expected_data = {"id": "new-diff-scan", "status": "queued"}