fix: omit caller values from VertexAiSessionService error messages

core/src/main/java/com/google/adk/sessions/VertexAiSessionService.java

@@ -310,7 +310,7 @@ public Completable deleteSession(String appName, String userId, String sessionId
               if (!userId.equals(ownerUserId)) {
                 return Completable.error(
                     new SecurityException(
-                        "Session " + sessionId + " does not belong to user " + userId + "."));
+                        "The requested session does not belong to the requesting user."));
               }
               return client.deleteSession(reasoningEngineId, sessionId);
             });
@@ -345,9 +345,7 @@ static String parseReasoningEngineId(String appName) {
 
     if (!matcher.matches()) {
       throw new IllegalArgumentException(
-          "App name "
-              + appName
-              + " is not valid. It should either be the full"
+          "The app name is not valid. It should either be the full"
               + " ReasoningEngine resource name, or the reasoning engine id.");
     }
 
@@ -363,11 +361,7 @@ static String parseReasoningEngineId(String appName) {
   static void validateSessionId(String sessionId) {
     if (sessionId == null || !SESSION_ID_PATTERN.matcher(sessionId).matches()) {
       throw new IllegalArgumentException(
-          "Invalid session id: "
-              + sessionId
-              + ". It must match "
-              + SESSION_ID_PATTERN.pattern()
-              + ".");
+          "Invalid session id. It must match " + SESSION_ID_PATTERN.pattern() + ".");
     }
   }
 

core/src/test/java/com/google/adk/sessions/VertexAiSessionServiceTest.java

@@ -573,21 +573,29 @@ public void getSession_wrongUser_returnsEmpty() {
 
   @Test
   public void deleteSession_wrongUser_deniedAndSessionKept() {
+    sessionMap.put("victim-session", mockSessionJson("victim-session", "2024-12-12T12:12:12Z"));
     // The ownership error surfaces on subscription, so hoist the Completable out.
-    Completable deletion = vertexAiSessionService.deleteSession("123", "attacker", "1");
-    assertThrows(SecurityException.class, deletion::blockingAwait);
+    Completable deletion =
+        vertexAiSessionService.deleteSession("123", "attacker", "victim-session");
+    SecurityException exception = assertThrows(SecurityException.class, deletion::blockingAwait);
+    assertThat(exception).hasMessageThat().doesNotContain("attacker");
+    assertThat(exception).hasMessageThat().doesNotContain("victim-session");
     // The session is still readable by its real owner, i.e. it was not deleted.
     assertThat(
-            vertexAiSessionService.getSession("123", "user", "1", Optional.empty()).blockingGet())
+            vertexAiSessionService
+                .getSession("123", "user", "victim-session", Optional.empty())
+                .blockingGet())
         .isNotNull();
   }
 
   // Session id validation is synchronous, so each call below throws before returning a stream.
   @Test
   public void getSession_invalidSessionId_throws() {
-    assertThrows(
-        IllegalArgumentException.class,
-        () -> vertexAiSessionService.getSession("123", "user", "1/../2", Optional.empty()));
+    IllegalArgumentException exception =
+        assertThrows(
+            IllegalArgumentException.class,
+            () -> vertexAiSessionService.getSession("123", "user", "1/../2", Optional.empty()));
+    assertThat(exception).hasMessageThat().doesNotContain("1/../2");
   }
 
   @Test
@@ -612,6 +620,15 @@ public void appendEvent_invalidSessionId_throws() {
         IllegalArgumentException.class, () -> vertexAiSessionService.appendEvent(session, event));
   }
 
+  @Test
+  public void getSession_invalidAppName_throws() {
+    IllegalArgumentException exception =
+        assertThrows(
+            IllegalArgumentException.class,
+            () -> vertexAiSessionService.getSession("customer-app", "user", "1", Optional.empty()));
+    assertThat(exception).hasMessageThat().doesNotContain("customer-app");
+  }
+
   @Test
   public void listEvents_empty() {
     assertThat(vertexAiSessionService.listEvents("789", "user1", "3").blockingGet().events())