fix(backend): resolve issue with concurrent agent-session creation

[rh-rahulshetty]

Summary

Replaces all timestamp-based (time.Now().Unix()) resource name generation with UUID-based naming (github.com/google/uuid) to eliminate conflicts under concurrent requests.

Problem

The POST /api/projects/{PROJECT_NAME}/agentic-sessions endpoint used time.Now().Unix() (1-second precision) to generate session names like session-1711234567. Concurrent requests within the same second produced identical names, causing K8s resource creation conflicts.

Reported Bug: #976

Fix

Use uuid.New().String() to guarantee uniqueness regardless of request timing. The same pattern was applied to all other timestamp-based name generators in the backend:

Test results

After applying the fix, now the concurrent API requests are passing successfully:

[2026-03-23 08:33:38,147] session-create-dc0e746f-master-ssp2h/INFO/locust.main: Shutting down (exit code 0)
Type     Name                                                                          # reqs      # fails |    Avg     Min     Max    Med |   req/s  failures/s
--------|----------------------------------------------------------------------------|-------|-------------|-------|-------|-------|-------|--------|-----------
POST     POST /agentic-sessions                                                           886     0(0.00%) |     23      18      60     23 |    4.92        0.00
--------|----------------------------------------------------------------------------|-------|-------------|-------|-------|-------|-------|--------|-----------
         Aggregated                                                                       886     0(0.00%) |     23      18      60     23 |    4.92        0.00

Response time percentiles (approximated)
Type     Name                                                                                  50%    66%    75%    80%    90%    95%    98%    99%  99.9% 99.99%   100% # reqs
--------|--------------------------------------------------------------------------------|--------|------|------|------|------|------|------|------|------|------|------|------
POST     POST /agentic-sessions                                                                 23     24     25     25     27     29     36     47     61     61     61    886
--------|--------------------------------------------------------------------------------|--------|------|------|------|------|------|------|------|------|------|------|------
         Aggregated                                                                             23     24     25     25     27     29     36     47     61     61     61    886

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 6d0903f0-9ba7-499a-b4f9-afc6fa67274d

📥 Commits

Reviewing files that changed from the base of the PR and between 7af078a and d2ed48f.

📒 Files selected for processing (5)

• components/backend/handlers/oauth.go
• components/backend/handlers/permissions.go
• components/backend/handlers/scheduled_sessions.go
• components/backend/handlers/sessions.go
• components/backend/handlers/sessions_test.go

---

Walkthrough

The changes replace Unix timestamp-based naming and identification schemes with UUID-based generation across multiple OAuth and Kubernetes resource handlers. The github.com/google/uuid import is added to support this transition. A test is updated to remove delays between concurrent requests, relying on UUID-based unique naming instead.

Changes

Cohort / File(s)	Summary
UUID-based Identifier Generation components/backend/handlers/oauth.go, components/backend/handlers/permissions.go, components/backend/handlers/scheduled_sessions.go, components/backend/handlers/sessions.go	Replaces Unix timestamp-based naming schemes with UUID-based generation. OAuth state values, Kubernetes ServiceAccount/RoleBinding names, CronJob/Job names, and session names now use UUID strings (or 8-character UUID prefixes) instead of time.Now().Unix(). The github.com/google/uuid import is added to each file.
Test Logic Update components/backend/handlers/sessions_test.go	Removes time.Sleep(1001 * time.Millisecond) delays between three concurrent POST requests in the session uniqueness test, relying on UUID-based unique naming instead of timestamp separation.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~15 minutes

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: replacing timestamp-based naming with UUID-based naming to fix concurrent session creation conflicts.
Description check	✅ Passed	The description clearly explains the problem, the fix applied, affected files, and includes test results demonstrating the solution works.
Docstring Coverage	✅ Passed	Docstring coverage is 80.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Gkrumbach07]

This is great! been bugging me for a while now