Skip to content

fix(workspaces): eliminate TOCTOU race in add_files_to_workspace - #291

Merged
EnjoyBacon7 merged 1 commit into
devfrom
fix/workspace-add-files-toctou
Mar 30, 2026
Merged

fix(workspaces): eliminate TOCTOU race in add_files_to_workspace#291
EnjoyBacon7 merged 1 commit into
devfrom
fix/workspace-add-files-toctou

Conversation

@EnjoyBacon7

Copy link
Copy Markdown
Collaborator

Summary

  • add_files_to_workspace now bulk-resolves all file_ids → File.id in a single query and returns any unresolved IDs, instead of silently skipping them
  • The router checks the return value and raises 404 if any files vanished between the pre-check and the insert, closing the TOCTOU race window

Addresses CodeRabbit review comment on PR #281 (comment 2959737769).

add_files_to_workspace now bulk-resolves all file_ids to File.id in a
single query and returns the list of IDs that could not be resolved.

The router checks the return value and raises 404 if any files vanished
between the pre-check (get_existing_file_ids) and the insert, closing
the race window where a concurrent delete could cause silent data loss.
@coderabbitai

coderabbitai Bot commented Mar 19, 2026

Copy link
Copy Markdown

Warning

Rate limit exceeded

@EnjoyBacon7 has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 9 minutes and 58 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: dec5cc0b-725a-4de3-83b2-02459d2a81f2

📥 Commits

Reviewing files that changed from the base of the PR and between 6a7732b and c4f946b.

📒 Files selected for processing (3)
  • openrag/components/indexer/vectordb/utils.py
  • openrag/components/indexer/vectordb/vectordb.py
  • openrag/routers/workspaces.py
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/workspace-add-files-toctou
📝 Coding Plan
  • Generate coding plan for human review comments

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@Ahmath-Gadji Ahmath-Gadji left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@EnjoyBacon7
EnjoyBacon7 merged commit 8f699cd into dev Mar 30, 2026
4 checks passed
@EnjoyBacon7
EnjoyBacon7 deleted the fix/workspace-add-files-toctou branch March 30, 2026 08:26
@Ahmath-Gadji Ahmath-Gadji added the fix Fix issue label Apr 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

fix Fix issue

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants