fix: keep Session off the thread pool in update_profile

Offload only CPU-bound image processing, convert remaining falsely-async
routes, and type the async test helper. Follow-up: #237.

Author: chriscarrollsmith

main.py

@@ -393,9 +393,7 @@ async def general_exception_handler(request: Request, exc: Exception):
 
 
 @app.get("/")
-async def read_home(
-    request: Request, _: None = Depends(require_unauthenticated_client)
-):
+def read_home(request: Request, _: None = Depends(require_unauthenticated_client)):
     return templates.TemplateResponse(request, "index.html", {"user": None})
 
 

routers/core/static_pages.py

@@ -16,7 +16,7 @@
 
 
 @router.get("/{page_name}", name="read_static_page")
-async def read_static_page(
+def read_static_page(
     page_name: str, request: Request, user: Optional[User] = Depends(get_optional_user)
 ):
     """

routers/core/user.py

@@ -131,26 +131,33 @@ async def update_profile(
     session: Session = Depends(get_session),
 ):
     avatar_changed = bool(avatar_file and avatar_file.filename)
-    avatar_data: Optional[bytes] = None
-    avatar_content_type: Optional[str] = None
 
-    # Async chunked read must stay on the event loop; sync image/DB work is offloaded.
+    # Async upload read stays on the event loop. CPU-bound image work is
+    # offloaded; Session/ORM mutations stay here (do not pass Session into the
+    # thread pool — see issue #237).
     if avatar_changed:
         assert avatar_file is not None
         reject_oversized_content_length(
             request.headers.get("content-length"), MAX_AVATAR_UPLOAD_BYTES
         )
         avatar_data = await read_upload_with_size_limit(avatar_file, MAX_FILE_SIZE)
-        avatar_content_type = avatar_file.content_type
+        processed_image, content_type = await run_in_threadpool(
+            validate_and_process_image, avatar_data, avatar_file.content_type
+        )
+        if user.avatar:
+            user.avatar.avatar_data = processed_image
+            user.avatar.avatar_content_type = content_type
+        else:
+            assert user.id is not None
+            user.avatar = UserAvatar(
+                user_id=user.id,
+                avatar_data=processed_image,
+                avatar_content_type=content_type,
+            )
 
-    await run_in_threadpool(
-        _apply_profile_update,
-        session,
-        user,
-        name,
-        avatar_data,
-        avatar_content_type,
-    )
+    user.name = name
+    session.commit()
+    session.refresh(user)
 
     if is_htmx_request(request):
         response = templates.TemplateResponse(
@@ -176,34 +183,6 @@ async def update_profile(
     return RedirectResponse(url=router.url_path_for("read_profile"), status_code=303)
 
 
-def _apply_profile_update(
-    session: Session,
-    user: User,
-    name: Optional[str],
-    avatar_data: Optional[bytes],
-    avatar_content_type: Optional[str],
-) -> None:
-    """Sync image processing and DB persistence for update_profile."""
-    if avatar_data is not None:
-        processed_image, content_type = validate_and_process_image(
-            avatar_data, avatar_content_type
-        )
-        if user.avatar:
-            user.avatar.avatar_data = processed_image
-            user.avatar.avatar_content_type = content_type
-        else:
-            assert user.id is not None
-            user.avatar = UserAvatar(
-                user_id=user.id,
-                avatar_data=processed_image,
-                avatar_content_type=content_type,
-            )
-
-    user.name = name
-    session.commit()
-    session.refresh(user)
-
-
 @router.post("/communication-preferences", response_class=RedirectResponse)
 def update_communication_preferences(
     request: Request,

tests/utils/test_dependencies.py

@@ -2,6 +2,7 @@
 from concurrent.futures import ThreadPoolExecutor
 from unittest.mock import MagicMock, patch
 from datetime import datetime, timedelta, UTC
+from typing import Any, Coroutine, TypeVar
 from starlette.concurrency import run_in_threadpool
 from starlette.requests import Request
 from utils.core.models import (
@@ -715,14 +716,21 @@ def _request_with_auth_cookies(
     )
 
 
-def _run_async(coro):  # type: ignore[no-untyped-def]
+T = TypeVar("T")
+
+
+def _run_async(coro: Coroutine[Any, Any, T]) -> T:
     """Drive an async helper from sync tests.
 
     The full suite may already have an event loop (e.g. after Playwright), so
     asyncio.run() on the main thread can fail. Always run in a fresh thread.
     """
+
+    def _runner() -> T:
+        return asyncio.run(coro)
+
     with ThreadPoolExecutor(max_workers=1) as pool:
-        return pool.submit(asyncio.run, coro).result()
+        return pool.submit(_runner).result()
 
 
 def test_get_user_from_request_resolves_user_via_threadpool() -> None: