Bug: TOCTOU race condition in ResourceTypeRepository.create #8118

New issue

Open

opened 2026-04-13 03:35:53 +00:00 by HAL9000 · 0 comments

HAL9000 commented

2026-04-13 03:35:53 +00:00

Owner

Metadata

Module: src/cleveragents/infrastructure/database/repositories.py
Lines: 1805-1863
Pass: Concurrency

Background and Context

The ResourceTypeRepository.create method attempts to prevent the creation of duplicate resource types by first checking if a type with the same name already exists.

The check for an existing resource type and the subsequent creation of a new one are not performed in an atomic operation. This creates a Time-of-check-to-time-of-use (TOCTOU) race condition. If two concurrent requests attempt to create a resource type with the same name, both could pass the existence check before either transaction is committed. While the database's UNIQUE constraint will ultimately prevent data corruption by raising an IntegrityError, the application-level check is flawed and can result in the less specific DatabaseError being raised instead of the intended DuplicateResourceTypeError.

Expected Behavior

The application should not rely on a non-atomic check-then-act pattern for enforcing uniqueness. The logic should be simplified to attempt the insertion and handle the IntegrityError that arises from a UNIQUE constraint violation, converting it into the more specific DuplicateResourceTypeError.

Acceptance Criteria

The non-atomic pre-check for existing resource types in ResourceTypeRepository.create is removed.
The IntegrityError exception handler is the sole mechanism for detecting and reporting duplicate resource types.
The method correctly raises DuplicateResourceTypeError upon a UNIQUE constraint violation.

Subtasks

Remove the existence check from ResourceTypeRepository.create.
Ensure the IntegrityError handler correctly identifies uniqueness violations and raises DuplicateResourceTypeError.
Add a test case that simulates a concurrent creation attempt to verify the fix.

Definition of Done

The code is refactored as described.
The change is covered by unit tests.
The pull request is reviewed and merged.

Automated by CleverAgents Bot
Supervisor: Bug Hunt Pool | Agent: bug-hunt-pool-supervisor

## Metadata - **Module:** `src/cleveragents/infrastructure/database/repositories.py` - **Lines:** 1805-1863 - **Pass:** Concurrency ## Background and Context The `ResourceTypeRepository.create` method attempts to prevent the creation of duplicate resource types by first checking if a type with the same name already exists. The check for an existing resource type and the subsequent creation of a new one are not performed in an atomic operation. This creates a Time-of-check-to-time-of-use (TOCTOU) race condition. If two concurrent requests attempt to create a resource type with the same name, both could pass the existence check before either transaction is committed. While the database's `UNIQUE` constraint will ultimately prevent data corruption by raising an `IntegrityError`, the application-level check is flawed and can result in the less specific `DatabaseError` being raised instead of the intended `DuplicateResourceTypeError`. ## Expected Behavior The application should not rely on a non-atomic check-then-act pattern for enforcing uniqueness. The logic should be simplified to attempt the insertion and handle the `IntegrityError` that arises from a `UNIQUE` constraint violation, converting it into the more specific `DuplicateResourceTypeError`. ## Acceptance Criteria - The non-atomic pre-check for existing resource types in `ResourceTypeRepository.create` is removed. - The `IntegrityError` exception handler is the sole mechanism for detecting and reporting duplicate resource types. - The method correctly raises `DuplicateResourceTypeError` upon a `UNIQUE` constraint violation. ## Subtasks - [ ] Remove the existence check from `ResourceTypeRepository.create`. - [ ] Ensure the `IntegrityError` handler correctly identifies uniqueness violations and raises `DuplicateResourceTypeError`. - [ ] Add a test case that simulates a concurrent creation attempt to verify the fix. ## Definition of Done - The code is refactored as described. - The change is covered by unit tests. - The pull request is reviewed and merged. --- **Automated by CleverAgents Bot** Supervisor: Bug Hunt Pool | Agent: bug-hunt-pool-supervisor

HAL9000 added this to the v3.3.0 milestone

2026-04-13 03:35:57 +00:00