Files
brent.edwards e4429ee8e4 fix(audit): protect AuditService._ensure_session() with threading.Lock
Added double-checked locking to AuditService._ensure_session() to prevent
the TOCTOU race where concurrent threads could each see _session as None
and create duplicate engines/sessions, leaking all but the last.

The fix uses a threading.Lock (self._session_lock) initialised in __init__().
The outer check avoids lock acquisition overhead on the hot path; the inner
check (under the lock) eliminates the race window.

Includes the TDD bug-capture test from #1095 (which was not yet merged to
master) with the @tdd_expected_fail tag removed since the fix makes the
test pass.  The test launches 10 threads through a threading.Barrier and
asserts create_engine is called exactly once.

ISSUES CLOSED: #991
2026-03-31 09:46:21 +00:00
..