fix event loop blocking for sync routes and offload get_user_from_request

Author: rafizamankhan

routers/core/account.py

@@ -188,7 +188,7 @@ def logout(
 
 
 @router.get("/login")
-async def read_login(
+def read_login(
     request: Request,
     _: None = Depends(require_unauthenticated_unless_invitation_warning),
     invitation_token: Optional[str] = Query(None),
@@ -215,7 +215,7 @@ async def read_login(
 
 
 @router.get("/register")
-async def read_register(
+def read_register(
     request: Request,
     _: None = Depends(require_unauthenticated_unless_invitation_warning),
     email: Optional[EmailStr] = Query(None),
@@ -246,7 +246,7 @@ async def read_register(
 
 
 @router.get("/forgot_password")
-async def read_forgot_password(
+def read_forgot_password(
     request: Request,
     _: None = Depends(require_unauthenticated_client),
     show_form: Optional[str] = "true",
@@ -262,7 +262,7 @@ async def read_forgot_password(
 
 
 @router.get("/reset_password")
-async def read_reset_password(
+def read_reset_password(
     request: Request,
     email: str,
     token: str,
@@ -291,7 +291,7 @@ async def read_reset_password(
 
 
 @router.post("/delete", response_class=RedirectResponse)
-async def delete_account(
+def delete_account(
     account: Account = Depends(get_verified_account),
     session: Session = Depends(get_session),
 ):
@@ -314,7 +314,7 @@ async def delete_account(
 
 
 @router.post("/register", response_class=RedirectResponse)
-async def register(
+def register(
     request: Request,
     _ip_check: None = Depends(check_register_ip_rate_limit),
     name: str = Form(
@@ -473,7 +473,7 @@ async def register(
 
 
 @router.post("/login", response_class=RedirectResponse)
-async def login(
+def login(
     request: Request,
     _ip_check: None = Depends(check_login_ip_rate_limit),
     _email_check: EmailStr = Depends(check_login_email_rate_limit),
@@ -588,7 +588,7 @@ async def login(
 
 # Updated refresh_token endpoint
 @router.post("/refresh", response_class=RedirectResponse)
-async def refresh_token(
+def refresh_token(
     tokens: tuple[Optional[str], Optional[str]] = Depends(oauth2_scheme_cookie),
     session: Session = Depends(get_session),
 ) -> RedirectResponse:
@@ -666,7 +666,7 @@ async def refresh_token(
 
 
 @router.post("/forgot_password")
-async def forgot_password(
+def forgot_password(
     background_tasks: BackgroundTasks,
     request: Request,
     _ip_check: None = Depends(check_forgot_password_ip_rate_limit),
@@ -703,7 +703,7 @@ async def forgot_password(
 
 
 @router.post("/reset_password")
-async def reset_password(
+def reset_password(
     request: Request,
     email: EmailStr = Form(..., title="Email", description="Account email address"),
     token: str = Form(
@@ -765,7 +765,7 @@ async def reset_password(
 
 
 @router.get("/recover")
-async def recover_account_confirm(
+def recover_account_confirm(
     request: Request,
     token: str = Query(...),
     session: Session = Depends(get_session),
@@ -784,7 +784,7 @@ async def recover_account_confirm(
 
 
 @router.post("/recover")
-async def recover_account(
+def recover_account(
     token: str = Form(...),
     session: Session = Depends(get_session),
 ):
@@ -852,7 +852,7 @@ async def recover_account(
 
 
 @router.post("/emails/add")
-async def add_email(
+def add_email(
     request: Request,
     new_email: EmailStr = Form(
         ..., title="New email", description="New email address to add"
@@ -905,7 +905,7 @@ async def add_email(
 
 
 @router.get("/emails/verify")
-async def verify_email(
+def verify_email(
     token: str,
     session: Session = Depends(get_session),
 ):
@@ -958,7 +958,7 @@ async def verify_email(
 
 
 @router.post("/emails/promote")
-async def promote_email(
+def promote_email(
     request: Request,
     email_id: int = Form(
         ..., title="Email ID", description="ID of the email to promote"
@@ -1047,7 +1047,7 @@ async def promote_email(
 
 
 @router.post("/emails/remove")
-async def remove_email(
+def remove_email(
     request: Request,
     email_id: int = Form(
         ..., title="Email ID", description="ID of the email to remove"

routers/core/dashboard.py

@@ -15,7 +15,7 @@
 
 
 @router.get("/")
-async def read_dashboard(
+def read_dashboard(
     request: Request,
     user: User = Depends(get_user_with_relations),
     session: Session = Depends(get_session),
@@ -77,7 +77,7 @@ async def read_dashboard(
 
 
 @router.post("/select-organization/{org_id}")
-async def select_organization(
+def select_organization(
     request: Request,
     org_id: int,
     user: User = Depends(get_user_with_relations),

routers/core/invitation.py

@@ -108,7 +108,7 @@ def _members_table_response(
 
 
 @router.post("/", name="create_invitation")
-async def create_invitation(
+def create_invitation(
     request: Request,
     current_user: User = Depends(get_authenticated_user),
     session: Session = Depends(get_session),
@@ -205,7 +205,7 @@ async def create_invitation(
 
 
 @router.post("/resend", name="resend_invitation", response_class=RedirectResponse)
-async def resend_invitation(
+def resend_invitation(
     request: Request,
     current_user: User = Depends(get_authenticated_user),
     session: Session = Depends(get_session),
@@ -277,7 +277,7 @@ async def resend_invitation(
 
 
 @router.post("/delete", name="delete_invitation", response_class=RedirectResponse)
-async def delete_invitation(
+def delete_invitation(
     request: Request,
     current_user: User = Depends(get_authenticated_user),
     session: Session = Depends(get_session),
@@ -318,7 +318,7 @@ async def delete_invitation(
 
 
 @router.get("/accept", name="accept_invitation")
-async def accept_invitation(
+def accept_invitation(
     token: str = Query(...),
     current_user: Optional[User] = Depends(get_optional_user),
     session: Session = Depends(get_session),

routers/core/organization.py

@@ -36,7 +36,7 @@
 
 
 @router.get("/{org_id}")
-async def read_organization(
+def read_organization(
     org_id: int,
     request: Request,
     user: User = Depends(get_user_with_relations),

routers/core/user.py

@@ -1,5 +1,6 @@
 from fastapi import APIRouter, Depends, Form, UploadFile, File, Request, HTTPException
 from fastapi.responses import RedirectResponse, Response
+from starlette.concurrency import run_in_threadpool
 from sqlmodel import Session, select, col
 from typing import Optional, List
 from fastapi.templating import Jinja2Templates
@@ -51,7 +52,7 @@
 
 
 @router.get("/profile")
-async def read_profile(
+def read_profile(
     request: Request,
     user: User = Depends(get_user_with_relations),
     session: Session = Depends(get_session),
@@ -82,7 +83,7 @@ async def read_profile(
 
 
 @router.get("/edit-form")
-async def edit_profile_form(
+def edit_profile_form(
     request: Request,
     user: User = Depends(get_authenticated_user),
 ):
@@ -104,7 +105,7 @@ async def edit_profile_form(
 
 
 @router.get("/profile-display")
-async def profile_display(
+def profile_display(
     request: Request,
     user: User = Depends(get_authenticated_user),
 ):
@@ -130,8 +131,10 @@ async def update_profile(
     session: Session = Depends(get_session),
 ):
     avatar_changed = bool(avatar_file and avatar_file.filename)
+    avatar_data: Optional[bytes] = None
+    avatar_content_type: Optional[str] = None
 
-    # Handle avatar update
+    # Async chunked read must stay on the event loop; sync image/DB work is offloaded.
     if avatar_changed:
         assert avatar_file is not None
         reject_oversized_content_length(
@@ -140,25 +143,14 @@ async def update_profile(
         avatar_data = await read_upload_with_size_limit(avatar_file, MAX_FILE_SIZE)
         avatar_content_type = avatar_file.content_type
 
-        processed_image, content_type = validate_and_process_image(
-            avatar_data, avatar_content_type
-        )
-        if user.avatar:
-            user.avatar.avatar_data = processed_image
-            user.avatar.avatar_content_type = content_type
-        else:
-            assert user.id is not None
-            user.avatar = UserAvatar(
-                user_id=user.id,
-                avatar_data=processed_image,
-                avatar_content_type=content_type,
-            )
-
-    # Update user details
-    user.name = name
-
-    session.commit()
-    session.refresh(user)
+    await run_in_threadpool(
+        _apply_profile_update,
+        session,
+        user,
+        name,
+        avatar_data,
+        avatar_content_type,
+    )
 
     if is_htmx_request(request):
         response = templates.TemplateResponse(
@@ -184,8 +176,36 @@ async def update_profile(
     return RedirectResponse(url=router.url_path_for("read_profile"), status_code=303)
 
 
+def _apply_profile_update(
+    session: Session,
+    user: User,
+    name: Optional[str],
+    avatar_data: Optional[bytes],
+    avatar_content_type: Optional[str],
+) -> None:
+    """Sync image processing and DB persistence for update_profile."""
+    if avatar_data is not None:
+        processed_image, content_type = validate_and_process_image(
+            avatar_data, avatar_content_type
+        )
+        if user.avatar:
+            user.avatar.avatar_data = processed_image
+            user.avatar.avatar_content_type = content_type
+        else:
+            assert user.id is not None
+            user.avatar = UserAvatar(
+                user_id=user.id,
+                avatar_data=processed_image,
+                avatar_content_type=content_type,
+            )
+
+    user.name = name
+    session.commit()
+    session.refresh(user)
+
+
 @router.post("/communication-preferences", response_class=RedirectResponse)
-async def update_communication_preferences(
+def update_communication_preferences(
     request: Request,
     comm_opt_in: Optional[str] = Form(None),
     comm_updates: Optional[str] = Form(None),
@@ -210,7 +230,7 @@ async def update_communication_preferences(
 
 
 @router.get("/avatar")
-async def get_avatar(user: User = Depends(get_authenticated_user)):
+def get_avatar(user: User = Depends(get_authenticated_user)):
     """Serve avatar image from database"""
     if not user.avatar:
         raise DataIntegrityError(resource="User avatar")