internal/service/chunk.go (1)

1360-1361: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Same panic risk with tokenizer.Tokenize result cast.

This has the same issue as in AddChunk - direct type assertion without safety check.

🛡️ Proposed fix

 	// Tokenize.
 	contentLtks, _ := tokenizer.Tokenize(content)
-	contentSmLtks, _ := tokenizer.FineGrainedTokenize(contentLtks.(string))
+	contentLtksStr, ok := contentLtks.(string)
+	if !ok {
+		contentLtksStr = ""
+	}
+	contentSmLtks, _ := tokenizer.FineGrainedTokenize(contentLtksStr)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/service/chunk.go` around lines 1360 - 1361, The code unsafely
type-asserts tokenizer.Tokenize(...) result to string (contentLtks.(string))
which can panic; change the call sites (where contentLtks and contentSmLtks are
set) to use the two-value type assertion or a type switch to verify the returned
value is a string before using it, and propagate or handle errors from
tokenizer.Tokenize and tokenizer.FineGrainedTokenize instead of ignoring them;
update the logic around variables contentLtks and contentSmLtks and the calls to
tokenizer.Tokenize and tokenizer.FineGrainedTokenize so you return/log an error
or bail out if the result type is unexpected.

internal/handler/chunk.go (1)

367-381: 💤 Low value

Consider using strconv.Atoi instead of json.Number for query parameter parsing.

Using json.Number(v).Int64() for string-to-int conversion is unconventional. strconv.Atoi or strconv.ParseInt is more idiomatic for parsing query parameters and avoids the intermediate json.Number type.

♻️ Suggested refactor

 	page := 1
 	if v := c.Query("page"); v != "" {
-		if p, err := json.Number(v).Int64(); err == nil && p > 0 {
+		if p, err := strconv.Atoi(v); err == nil && p > 0 {
 			page = int(p)
 		}
 	}
 	pageSize := 30
 	if v := c.Query("page_size"); v != "" {
-		if ps, err := json.Number(v).Int64(); err == nil && ps > 0 {
+		if ps, err := strconv.Atoi(v); err == nil && ps > 0 {
 			if ps > 100 {
 				ps = 100
 			}
-			pageSize = int(ps)
+			pageSize = ps
 		}
 	}

This would also require adding "strconv" to the imports.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/handler/chunk.go` around lines 367 - 381, The current parsing of
query params for pagination (page and pageSize variables in
internal/handler/chunk.go) uses json.Number(v).Int64(), which is unconventional;
replace those conversions with strconv.Atoi (or strconv.ParseInt) to parse
c.Query("page") and c.Query("page_size"), keep the same validation (positive
values and cap pageSize to 100), and add "strconv" to imports; ensure you still
default page=1 and pageSize=30 when parsing fails or values are empty.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

internal/service/chunk.go (1)

1458-1474: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Scope the bulk update to the requested document.

documentID is never used after access resolution, and each update filters only by id. This endpoint is still not document-scoped, so supplied chunk IDs from other documents in the same dataset can be toggled here.

🩹 Proposed fix

 	for _, chunkID := range chunkIDs {
-		condition := map[string]interface{}{"id": chunkID}
+		condition := map[string]interface{}{"id": chunkID, "doc_id": documentID}
 		update := map[string]interface{}{"available_int": availInt}
 		if err := s.docEngine.UpdateChunks(ctx, condition, update, indexName, datasetID); err != nil {
 			common.Warn("SwitchChunks: failed to update chunk", zap.String("chunkID", chunkID), zap.Error(err))
 		}
 	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/service/chunk.go` around lines 1458 - 1474, The update loop
currently uses condition := {"id": chunkID} so it ignores the resolved document
scope (documentID) and can flip chunks from other documents; change the
condition used in s.docEngine.UpdateChunks to include the document identifier
(e.g., add "document_id": documentID or the appropriate field name) so the bulk
update in the loop (function using resolveDatasetAccess, variables chunkIDs,
available, indexName) is scoped to the requested document, leaving indexName and
datasetID usage unchanged.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

internal/service/chunk.go (1)

1480-1488: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

SwitchChunks does not validate that chunks belong to the specified document.

The documentID parameter is accepted but never used. The update condition at line 1482 contains only "id": chunkID, allowing a user with dataset access to toggle availability of chunks from any document in that dataset—not just the document specified in the URL path.

Add "doc_id": documentID to the condition map so the update is scoped to the correct document:

🔒 Proposed fix

 	for _, chunkID := range chunkIDs {
-		condition := map[string]interface{}{"id": chunkID}
+		condition := map[string]interface{}{"id": chunkID, "doc_id": documentID}
 		update := map[string]interface{}{"available_int": availInt}
 		if err := s.docEngine.UpdateChunks(ctx, condition, update, indexName, datasetID); err != nil {
 			common.Warn("SwitchChunks: failed to update chunk", zap.String("chunkID", chunkID), zap.Error(err))
 		}
 	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/service/chunk.go` around lines 1480 - 1488, SwitchChunks accepts
documentID but never scopes the chunk update to that document, so UpdateChunks
is called with condition {"id": chunkID} and can modify chunks from other
documents; update the condition map in the loop inside SwitchChunks to include
the document ID (e.g., add "doc_id": documentID) so the call to
s.docEngine.UpdateChunks(ctx, condition, update, indexName, datasetID) only
affects chunks belonging to the specified documentID (ensure the key name
matches the DB field used elsewhere).