bug: InMemoryProjectManager.createProject() has TOCTOU race - containsKey/put not atomic

[sfloess]

Description

In InMemoryProjectManager.java, the createProject() method checks containsKey() and then calls put() in separate operations. Between these two calls, another thread could insert the same project, and the second put() would silently overwrite it.

Location

platform-mlops/platform-mlops-core/src/main/java/org/flossware/platform/mlops/core/InMemoryProjectManager.java, lines 50-53

if (projects.containsKey(project.getProjectId())) {    // check
    throw new IllegalArgumentException("Project already exists: " + project.getProjectId());
}
projects.put(project.getProjectId(), project);          // put - another thread may have inserted between check and put

Impact

• Silently overwrites a concurrently created project
• Violates the uniqueness guarantee

Suggested Fix

Use putIfAbsent() which is atomic on ConcurrentHashMap:

MlProject existing = projects.putIfAbsent(project.getProjectId(), project);
if (existing != null) {
    throw new IllegalArgumentException("Project already exists: " + project.getProjectId());
}

Labels

bug