Fix get user from request blocks loop

main.py

@@ -393,9 +393,7 @@ async def general_exception_handler(request: Request, exc: Exception):
 
 
 @app.get("/")
-async def read_home(
-    request: Request, _: None = Depends(require_unauthenticated_client)
-):
+def read_home(request: Request, _: None = Depends(require_unauthenticated_client)):
     return templates.TemplateResponse(request, "index.html", {"user": None})
 
 

routers/core/account.py

@@ -188,7 +188,7 @@ def logout(
 
 
 @router.get("/login")
-async def read_login(
+def read_login(
     request: Request,
     _: None = Depends(require_unauthenticated_unless_invitation_warning),
     invitation_token: Optional[str] = Query(None),
@@ -215,7 +215,7 @@ async def read_login(
 
 
 @router.get("/register")
-async def read_register(
+def read_register(
     request: Request,
     _: None = Depends(require_unauthenticated_unless_invitation_warning),
     email: Optional[EmailStr] = Query(None),
@@ -246,7 +246,7 @@ async def read_register(
 
 
 @router.get("/forgot_password")
-async def read_forgot_password(
+def read_forgot_password(
     request: Request,
     _: None = Depends(require_unauthenticated_client),
     show_form: Optional[str] = "true",
@@ -262,7 +262,7 @@ async def read_forgot_password(
 
 
 @router.get("/reset_password")
-async def read_reset_password(
+def read_reset_password(
     request: Request,
     email: str,
     token: str,
@@ -291,7 +291,7 @@ async def read_reset_password(
 
 
 @router.post("/delete", response_class=RedirectResponse)
-async def delete_account(
+def delete_account(
     account: Account = Depends(get_verified_account),
     session: Session = Depends(get_session),
 ):
@@ -314,7 +314,7 @@ async def delete_account(
 
 
 @router.post("/register", response_class=RedirectResponse)
-async def register(
+def register(
     request: Request,
     _ip_check: None = Depends(check_register_ip_rate_limit),
     name: str = Form(
@@ -473,7 +473,7 @@ async def register(
 
 
 @router.post("/login", response_class=RedirectResponse)
-async def login(
+def login(
     request: Request,
     _ip_check: None = Depends(check_login_ip_rate_limit),
     _email_check: EmailStr = Depends(check_login_email_rate_limit),
@@ -588,7 +588,7 @@ async def login(
 
 # Updated refresh_token endpoint
 @router.post("/refresh", response_class=RedirectResponse)
-async def refresh_token(
+def refresh_token(
     tokens: tuple[Optional[str], Optional[str]] = Depends(oauth2_scheme_cookie),
     session: Session = Depends(get_session),
 ) -> RedirectResponse:
@@ -666,7 +666,7 @@ async def refresh_token(
 
 
 @router.post("/forgot_password")
-async def forgot_password(
+def forgot_password(
     background_tasks: BackgroundTasks,
     request: Request,
     _ip_check: None = Depends(check_forgot_password_ip_rate_limit),
@@ -703,7 +703,7 @@ async def forgot_password(
 
 
 @router.post("/reset_password")
-async def reset_password(
+def reset_password(
     request: Request,
     email: EmailStr = Form(..., title="Email", description="Account email address"),
     token: str = Form(
@@ -765,7 +765,7 @@ async def reset_password(
 
 
 @router.get("/recover")
-async def recover_account_confirm(
+def recover_account_confirm(
     request: Request,
     token: str = Query(...),
     session: Session = Depends(get_session),
@@ -784,7 +784,7 @@ async def recover_account_confirm(
 
 
 @router.post("/recover")
-async def recover_account(
+def recover_account(
     token: str = Form(...),
     session: Session = Depends(get_session),
 ):
@@ -852,7 +852,7 @@ async def recover_account(
 
 
 @router.post("/emails/add")
-async def add_email(
+def add_email(
     request: Request,
     new_email: EmailStr = Form(
         ..., title="New email", description="New email address to add"
@@ -905,7 +905,7 @@ async def add_email(
 
 
 @router.get("/emails/verify")
-async def verify_email(
+def verify_email(
     token: str,
     session: Session = Depends(get_session),
 ):
@@ -958,7 +958,7 @@ async def verify_email(
 
 
 @router.post("/emails/promote")
-async def promote_email(
+def promote_email(
     request: Request,
     email_id: int = Form(
         ..., title="Email ID", description="ID of the email to promote"
@@ -1047,7 +1047,7 @@ async def promote_email(
 
 
 @router.post("/emails/remove")
-async def remove_email(
+def remove_email(
     request: Request,
     email_id: int = Form(
         ..., title="Email ID", description="ID of the email to remove"

routers/core/dashboard.py

@@ -15,7 +15,7 @@
 
 
 @router.get("/")
-async def read_dashboard(
+def read_dashboard(
     request: Request,
     user: User = Depends(get_user_with_relations),
     session: Session = Depends(get_session),
@@ -77,7 +77,7 @@ async def read_dashboard(
 
 
 @router.post("/select-organization/{org_id}")
-async def select_organization(
+def select_organization(
     request: Request,
     org_id: int,
     user: User = Depends(get_user_with_relations),

routers/core/invitation.py

@@ -108,7 +108,7 @@ def _members_table_response(
 
 
 @router.post("/", name="create_invitation")
-async def create_invitation(
+def create_invitation(
     request: Request,
     current_user: User = Depends(get_authenticated_user),
     session: Session = Depends(get_session),
@@ -205,7 +205,7 @@ async def create_invitation(
 
 
 @router.post("/resend", name="resend_invitation", response_class=RedirectResponse)
-async def resend_invitation(
+def resend_invitation(
     request: Request,
     current_user: User = Depends(get_authenticated_user),
     session: Session = Depends(get_session),
@@ -277,7 +277,7 @@ async def resend_invitation(
 
 
 @router.post("/delete", name="delete_invitation", response_class=RedirectResponse)
-async def delete_invitation(
+def delete_invitation(
     request: Request,
     current_user: User = Depends(get_authenticated_user),
     session: Session = Depends(get_session),
@@ -318,7 +318,7 @@ async def delete_invitation(
 
 
 @router.get("/accept", name="accept_invitation")
-async def accept_invitation(
+def accept_invitation(
     token: str = Query(...),
     current_user: Optional[User] = Depends(get_optional_user),
     session: Session = Depends(get_session),

routers/core/organization.py

@@ -36,7 +36,7 @@
 
 
 @router.get("/{org_id}")
-async def read_organization(
+def read_organization(
     org_id: int,
     request: Request,
     user: User = Depends(get_user_with_relations),

routers/core/static_pages.py

@@ -16,7 +16,7 @@
 
 
 @router.get("/{page_name}", name="read_static_page")
-async def read_static_page(
+def read_static_page(
     page_name: str, request: Request, user: Optional[User] = Depends(get_optional_user)
 ):
     """

routers/core/user.py

@@ -1,5 +1,6 @@
 from fastapi import APIRouter, Depends, Form, UploadFile, File, Request, HTTPException
 from fastapi.responses import RedirectResponse, Response
+from starlette.concurrency import run_in_threadpool
 from sqlmodel import Session, select, col
 from typing import Optional, List
 from fastapi.templating import Jinja2Templates
@@ -51,7 +52,7 @@
 
 
 @router.get("/profile")
-async def read_profile(
+def read_profile(
     request: Request,
     user: User = Depends(get_user_with_relations),
     session: Session = Depends(get_session),
@@ -82,7 +83,7 @@ async def read_profile(
 
 
 @router.get("/edit-form")
-async def edit_profile_form(
+def edit_profile_form(
     request: Request,
     user: User = Depends(get_authenticated_user),
 ):
@@ -104,7 +105,7 @@ async def edit_profile_form(
 
 
 @router.get("/profile-display")
-async def profile_display(
+def profile_display(
     request: Request,
     user: User = Depends(get_authenticated_user),
 ):
@@ -131,17 +132,17 @@ async def update_profile(
 ):
     avatar_changed = bool(avatar_file and avatar_file.filename)
 
-    # Handle avatar update
+    # Async upload read stays on the event loop. CPU-bound image work is
+    # offloaded; Session/ORM mutations stay here so the Session is not passed
+    # into the thread pool.
     if avatar_changed:
         assert avatar_file is not None
         reject_oversized_content_length(
             request.headers.get("content-length"), MAX_AVATAR_UPLOAD_BYTES
         )
         avatar_data = await read_upload_with_size_limit(avatar_file, MAX_FILE_SIZE)
-        avatar_content_type = avatar_file.content_type
-
-        processed_image, content_type = validate_and_process_image(
-            avatar_data, avatar_content_type
+        processed_image, content_type = await run_in_threadpool(
+            validate_and_process_image, avatar_data, avatar_file.content_type
         )
         if user.avatar:
             user.avatar.avatar_data = processed_image
@@ -154,9 +155,7 @@ async def update_profile(
                 avatar_content_type=content_type,
             )
 
-    # Update user details
     user.name = name
-
     session.commit()
     session.refresh(user)
 
@@ -185,7 +184,7 @@ async def update_profile(
 
 
 @router.post("/communication-preferences", response_class=RedirectResponse)
-async def update_communication_preferences(
+def update_communication_preferences(
     request: Request,
     comm_opt_in: Optional[str] = Form(None),
     comm_updates: Optional[str] = Form(None),
@@ -210,7 +209,7 @@ async def update_communication_preferences(
 
 
 @router.get("/avatar")
-async def get_avatar(user: User = Depends(get_authenticated_user)):
+def get_avatar(user: User = Depends(get_authenticated_user)):
     """Serve avatar image from database"""
     if not user.avatar:
         raise DataIntegrityError(resource="User avatar")