[Bug]: `AttributeError: 'NoneType' object has no attribute 'merge_from'` on Concurrent Uploads to the Same Session

[Srejoye]

Summary

Description

In rag-service/main.py, when a client uploads a second PDF to an existing session (requested_session_id is set), the code reads vectorstore = session["vectorstore"] under sessions_lock and then calls vectorstore.merge_from(new_vectorstore) outside that lock (lines 3248–3253). A session's vectorstore is initialised to None at creation time (line 3165) and is only replaced with a real FAISS index at the end of the first upload's critical section.

Affected Files

• rag-service/main.py lines 3233–3260 (process_pdf, requested_session_id branch)

Steps to reproduce

1. Create a session by starting (but not completing) a first upload.
2. Immediately issue a second upload to the same session_id before the vectorstore is swapped in.
3. The second request hits vectorstore.merge_from(new_vectorstore) where vectorstore is None.

Expected behavior

If a second upload request arrives after the session placeholder is created but before the first upload's vectorstore has been persisted and swapped in, the second request reads None from session["vectorstore"] and then crashes with:

AttributeError: 'NoneType' object has no attribute 'merge_from'

Actual behavior

The exception is caught by the bare except Exception block which raises HTTP 500 back to the client. Meanwhile the first upload may still succeed, leaving the session with a partially-initialised state and an inconsistent document list.

Additional context

No response

[Srejoye]

Hi — requesting GSSoC'26 assignment for this issue.

Technical understanding: The session's vectorstore field transitions from None → <FAISS> only after persist_vectorstore + the sessions[session_id] = {...} swap at lines 3294–3316. The _peek_session_unlocked quota check on line 3236 reads the in-progress session that still has "vectorstore": None. The sessions_lock is released before session_lock is acquired, so between those two lock acquisitions the vectorstore is still None.

Affected modules/files:

• rag-service/main.py — process_pdf(), specifically the with session_lock: vectorstore.merge_from(...) block (~line 3251)

Proposed fix approach: Add an explicit null-check immediately before calling merge_from. If vectorstore is None at that point, the session is still being initialised by a concurrent first-upload and the second upload should return HTTP 409 (Conflict) with a message like "Session is still being initialised; please retry." The check must happen inside session_lock to be coherent.

Regression/unit test considerations:

• Add a test in test_concurrent_uploads.py that submits two uploads to the same session_id simultaneously using asyncio.gather and asserts that neither causes a 500 (one should succeed, the other should get a 409 or the merged result).
• Verify that after both complete the session's document list is consistent (no phantom entry for the failed merge).