BUG-HUNT: [type-safety] Potential NoneType error in AuditService in security_audit_bench.py #3879

New issue

Open

opened 2026-04-06 07:06:38 +00:00 by freemo · 0 comments

freemo commented

2026-04-06 07:06:38 +00:00

Owner

Metadata

Branch: fix/type-safety-audit-service-none-check
Commit Message: fix(benchmarks): add NoneType guard for AuditService._session in security_audit_bench
Milestone: None (Backlog)
Parent Epic: #400

Background and Context

Pyright has detected that the _session attribute of the AuditService could be None when add and commit are called on it in benchmarks/security_audit_bench.py. While the benchmark code initializes the service correctly, the type checker cannot guarantee that _session will always be non-None. This indicates a potential for a NoneType error at runtime if the service is used in other contexts where initialization is incomplete.

Bug Report: [type-safety] — Potential NoneType error in AuditService in security_audit_bench.py

Severity Assessment

Impact: Medium. If the AuditService is not initialized correctly, this could lead to a NoneType error at runtime.
Likelihood: Low. The code in the benchmark initializes the service correctly, but the type checker is flagging a potential issue that could occur in other contexts.
Priority: Medium

Location

File: benchmarks/security_audit_bench.py
Function/Class: TimePrune.setup
Lines: 135-136

Description

Pyright has detected that the _session attribute of the AuditService could be None when add and commit are called on it. While the benchmark code initializes the service correctly, the type checker cannot guarantee that _session will always be non-None. This indicates a potential for a NoneType error at runtime.

Evidence

# benchmarks/security_audit_bench.py:135-136
            self.service._session.add(row)
        self.service._session.commit()

Pyright Errors:

- error at 135:35 (reportOptionalMemberAccess): "add" is not a known attribute of "None"
- error at 136:31 (reportOptionalMemberAccess): "commit" is not a known attribute of "None"

Current Behavior

The type checker flags a potential NoneType error at lines 135–136 of benchmarks/security_audit_bench.py because AuditService._session is typed as Optional[Session] (or similar), and no guard is present before accessing .add() and .commit() on it.

Expected Behavior

The code should be structured in a way that the type checker can infer that _session is not None when it is used. This can be achieved by adding an assertion or a type guard before accessing the session attribute.

Acceptance Criteria

Pyright reports zero reportOptionalMemberAccess errors for _session in benchmarks/security_audit_bench.py
The fix does not alter benchmark logic or introduce regressions
All nox stages pass after the fix
Test coverage remains >= 97%

Supporting Information

Pyright rule: reportOptionalMemberAccess
Suggested fix: add an assertion before the session is used:

# benchmarks/security_audit_bench.py:134
            assert self.service._session is not None
            self.service._session.add(row)
        self.service._session.commit()

Category: type-safety

Subtasks

Investigate AuditService._session type annotation to confirm it is Optional
Add assert self.service._session is not None guard (or equivalent type narrowing) before session usage in TimePrune.setup
Verify Pyright reports no reportOptionalMemberAccess errors for the affected lines
Run nox (all default sessions), fix any errors
Verify coverage >= 97% via nox -s coverage_report

Definition of Done

This issue is complete when:

All subtasks above are completed and checked off.
A Git commit is created where the first line of the commit message matches the Commit Message in Metadata exactly, followed by a blank line, then additional lines providing relevant details about the implementation.
The commit is pushed to the remote on the branch matching the Branch in Metadata exactly.
The commit is submitted as a pull request to master, reviewed, and merged before this issue is marked done.
All nox stages pass.
Coverage >= 97%.

Backlog note: This issue was discovered during autonomous operation
on milestone v3.2.0. It does not block milestone completion and has been
placed in the backlog for human review and future milestone assignment.

Automated by CleverAgents Bot
Supervisor: Bug Hunting | Agent: ca-new-issue-creator

## Metadata - **Branch**: `fix/type-safety-audit-service-none-check` - **Commit Message**: `fix(benchmarks): add NoneType guard for AuditService._session in security_audit_bench` - **Milestone**: None (Backlog) - **Parent Epic**: #400 ## Background and Context Pyright has detected that the `_session` attribute of the `AuditService` could be `None` when `add` and `commit` are called on it in `benchmarks/security_audit_bench.py`. While the benchmark code initializes the service correctly, the type checker cannot guarantee that `_session` will always be non-None. This indicates a potential for a `NoneType` error at runtime if the service is used in other contexts where initialization is incomplete. ## Bug Report: [type-safety] — Potential NoneType error in AuditService in security_audit_bench.py ### Severity Assessment - **Impact**: Medium. If the `AuditService` is not initialized correctly, this could lead to a `NoneType` error at runtime. - **Likelihood**: Low. The code in the benchmark initializes the service correctly, but the type checker is flagging a potential issue that could occur in other contexts. - **Priority**: Medium ### Location - **File**: `benchmarks/security_audit_bench.py` - **Function/Class**: `TimePrune.setup` - **Lines**: 135-136 ### Description Pyright has detected that the `_session` attribute of the `AuditService` could be `None` when `add` and `commit` are called on it. While the benchmark code initializes the service correctly, the type checker cannot guarantee that `_session` will always be non-None. This indicates a potential for a `NoneType` error at runtime. ### Evidence ```python # benchmarks/security_audit_bench.py:135-136 self.service._session.add(row) self.service._session.commit() ``` **Pyright Errors:** ``` - error at 135:35 (reportOptionalMemberAccess): "add" is not a known attribute of "None" - error at 136:31 (reportOptionalMemberAccess): "commit" is not a known attribute of "None" ``` ## Current Behavior The type checker flags a potential `NoneType` error at lines 135–136 of `benchmarks/security_audit_bench.py` because `AuditService._session` is typed as `Optional[Session]` (or similar), and no guard is present before accessing `.add()` and `.commit()` on it. ## Expected Behavior The code should be structured in a way that the type checker can infer that `_session` is not `None` when it is used. This can be achieved by adding an assertion or a type guard before accessing the session attribute. ## Acceptance Criteria - [ ] Pyright reports zero `reportOptionalMemberAccess` errors for `_session` in `benchmarks/security_audit_bench.py` - [ ] The fix does not alter benchmark logic or introduce regressions - [ ] All nox stages pass after the fix - [ ] Test coverage remains >= 97% ## Supporting Information - Pyright rule: `reportOptionalMemberAccess` - Suggested fix: add an assertion before the session is used: ```python # benchmarks/security_audit_bench.py:134 assert self.service._session is not None self.service._session.add(row) self.service._session.commit() ``` - Category: type-safety ## Subtasks - [ ] Investigate `AuditService._session` type annotation to confirm it is `Optional` - [ ] Add `assert self.service._session is not None` guard (or equivalent type narrowing) before session usage in `TimePrune.setup` - [ ] Verify Pyright reports no `reportOptionalMemberAccess` errors for the affected lines - [ ] Run `nox` (all default sessions), fix any errors - [ ] Verify coverage >= 97% via `nox -s coverage_report` ## Definition of Done This issue is complete when: - All subtasks above are completed and checked off. - A Git commit is created where the **first line** of the commit message matches the Commit Message in Metadata exactly, followed by a blank line, then additional lines providing relevant details about the implementation. - The commit is pushed to the remote on the branch matching the **Branch** in Metadata exactly. - The commit is submitted as a **pull request** to `master`, reviewed, and **merged** before this issue is marked done. - All nox stages pass. - Coverage >= 97%. > **Backlog note:** This issue was discovered during autonomous operation > on milestone v3.2.0. It does not block milestone completion and has been > placed in the backlog for human review and future milestone assignment. --- **Automated by CleverAgents Bot** Supervisor: Bug Hunting | Agent: ca-new-issue-creator

freemo added a new dependency

2026-04-06 07:06:54 +00:00

#400 Epic: Post-MVP Security

freemo added the

Points

label

2026-04-06 07:09:30 +00:00