Bug
/api/process (app.py ~line 7964) has no check for whether processing is already active. Unlike /api/process_background which checks _bg_processing_active, rapid clicks on the process button could spawn concurrent processing threads.
The global rate limiter lock serializes actual API calls, but multiple threads queue up competing for the same books.
Fix
Add the same _bg_processing_active guard that /api/process_background uses, or share a common lock/flag between both endpoints.
Severity
Medium — rate limiter prevents actual API spam but concurrent processing is wasteful and could cause confusing status updates.
Found via code audit.
Bug
/api/process(app.py ~line 7964) has no check for whether processing is already active. Unlike/api/process_backgroundwhich checks_bg_processing_active, rapid clicks on the process button could spawn concurrent processing threads.The global rate limiter lock serializes actual API calls, but multiple threads queue up competing for the same books.
Fix
Add the same
_bg_processing_activeguard that/api/process_backgrounduses, or share a common lock/flag between both endpoints.Severity
Medium — rate limiter prevents actual API spam but concurrent processing is wasteful and could cause confusing status updates.
Found via code audit.