Skip to content

Python: validate conversation metadata at the DevUI routes - #9861

Closed
Manohar Paturi (ManoharPaturi) wants to merge 1 commit into
microsoft:mainfrom
ManoharPaturi:fix/devui-conversation-metadata-validation
Closed

Manohar Paturi (ManoharPaturi) wants to merge 1 commit into
microsoft:mainfrom
ManoharPaturi:fix/devui-conversation-metadata-validation

Conversation

@ManoharPaturi

Copy link
Copy Markdown
Contributor

Motivation & Context

The DevUI conversation create and update routes accepted any JSON value as metadata and stored it verbatim. A string or null value survived the write, and the first conversation list call after that crashed with an attribute error while copying stored metadata, taking the whole list endpoint down until restart while single conversation reads kept working, so the failure looked random. The Conversations API contract for metadata is a map of string keys to string values, and the boundary should enforce it.

Description & Review Guide

  • What are the major changes? Both routes now run metadata through one shared validator that accepts only a map of string keys to string values and rejects every other shape with a 400, and an explicit null becomes an empty map so the store never holds a value the readers cannot copy.
  • What is the impact of these changes? Writers sending valid metadata see no difference, invalid writes get a clear rejection instead of a delayed 500 for everyone, and existing stores are unaffected because validation happens before anything is stored.
  • What do you want reviewers to focus on? The validation living at the route boundary rather than inside the store, since the store also serves internal callers that always pass well formed maps.

Related Issue

Fixes #9860

AI Assistance

  • No material AI assistance was used.
  • This is an AI-assisted contribution. I reviewed, understood, and verified all submitted content and accept responsibility for it.

Contribution Checklist

  • The code builds clean without any errors or warnings
  • All unit tests pass, and I have added new tests where possible
  • The PR follows the Contribution Guidelines
  • This PR links to an agreed issue with no competing open PR, or the Related Issue section documents a trivial-change or repository-automation exception.
  • This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

The create and update routes stored any JSON value as metadata, and one non-map entry made the conversation list copy raise for every caller until restart. Metadata is now validated at the boundary as a map of string keys to string values, with null treated as an empty map.

Signed-off-by: Manohar Paturi <186662190+ManoharPaturi@users.noreply.github.com>
@ManoharPaturi

Copy link
Copy Markdown
Contributor Author

Understood, and sorry for jumping ahead. The issue now uses the Python bug report template with the verified reproduction, and I will leave this PR closed until the team agrees with the direction on #9860.

This branch was previously deployed

1 inactive deployment
github-app-auth — e94334b2 Deployed Oct 30, 2026 by ManoharPaturi via team_check #8067
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

python Usage: [Issues, PRs], Target: Python

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Python: [Bug]: DevUI conversation metadata accepts non-map values and then the conversation list fails

2 participants