perf(backend): full backend audit — offload blocking SDK calls, harden rate limiter + AI cache

- Offload all remaining synchronous Supabase/PostgREST SDK calls to worker
  threads via run_blocking: auth endpoints (login, refresh, register, logout,
  forgot/reset-password), lighter chat handlers, ~13 email-controller sites
  (ownership helpers now async), and the OAuth callback upsert — slow
  upstream calls no longer stall concurrent requests
- Rate limiter: compaction sweep for the in-memory sliding window — keys
  embed caller-controlled input (login:{ip}:{email}) and previously grew
  without bound (memory-exhaustion DoS vector)
- AI suggestion cache: SHA-256 keys (built-in 64-bit hash() collision could
  serve one user another user's cached suggestions) + expired-entry sweep
  on write instead of leaking until a same-key read

Verification: ruff check/format clean, pytest 102/102, bandit 0 issues,
frontend build OK.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: Raoof128

AGENT.md

@@ -5,6 +5,16 @@ description: Foundational agent rules for the Gemini + LiteStar + React project.
 
 # Agent Rules
 
+### 2026-06-13 (Australia/Sydney) — Full Backend Audit + Hardening/Performance Pass
+
+**Raouf:**
+
+- **Scope:** Audit all 21 backend modules (auth middleware, controllers, services, rate limiting, data protection, email service/poller, OAuth, config, security headers, observability) + schemas/tests, then fix findings directly.
+- **Summary:** The backend was already strongly hardened (alg-confusion-guarded JWT with issuer/audience checks, RLS-scoped per-user PostgREST clients, PKCE+state OAuth with Host validation, Fernet-encrypted tokens/takeaways, prompt scrubbing + circuit breaker, Sentry scrubbing, production config guards). Four real issues fixed: **(1) Event-loop blocking on auth hot paths** — every synchronous Supabase auth SDK call (`/auth/login`, `/auth/refresh` which fires on every silent refresh, `register`, `logout` revocation, `forgot/reset-password`) ran directly on the event loop, stalling all concurrent requests during slow upstream calls; all now offloaded via `run_blocking`. Same completion for the remaining sync `.execute()` sites in `chat_controller` (list/create/delete sessions, get_messages), `email_controller` (~13 sites incl. the `_get_account`/`_get_email` ownership helpers, now async), and the OAuth callback upsert — this clears the deferred follow-up from the 2026-05-31 performance pass. **(2) In-memory rate limiter unbounded key growth (DoS)** — keys embed caller-controlled input (`login:{ip}:{email}`) and were never evicted; an attacker spraying unique emails could grow the dict without bound. Added a compaction sweep (threshold 10k keys) that drops keys whose entries have aged out. **(3) AI suggestion cache cross-user collision risk** — cache keys used Python's built-in 64-bit `hash()`; a collision would hand one user another user's cached suggestions. Switched to SHA-256. **(4) Suggestion cache slow leak** — expired entries were only removed on same-key reads; now swept on every write.
+- **Files Changed:** `backend/auth_controller.py`, `backend/chat_controller.py`, `backend/email_controller.py`, `backend/oauth_controller.py`, `backend/rate_limit.py`, `backend/services.py`.
+- **Verification:** `ruff check backend tests` ✓ (all checks passed), `ruff format --check` ✓ (38 files), `pytest` **102/102 pass**, `bandit -r backend` 0 issues, frontend `npm run build` ✓.
+- **Follow-ups (manual/optional):** Gmail N+1 message fetch + sequential account polling in `email_poller.py` could be parallelised (background path, affects mail freshness only); shared httpx transport for per-request PostgREST clients; streaming Gemini chat responses. **Not deployed** — droplet redeploy pending user go-ahead.
+
 ### 2026-06-13 (Australia/Sydney) — Full UI/UX Audit + Accessibility/Polish Pass
 
 **Raouf:**

CHANGELOG.md

@@ -1,5 +1,15 @@
 # Change Log
 
+### 2026-06-13 (Australia/Sydney) — Full Backend Audit + Hardening/Performance Pass
+
+**Raouf:**
+
+- **Scope:** Full audit of all 21 backend modules with direct fixes (security + performance + production-readiness).
+- **Summary:** Fixed four real issues in an otherwise heavily-hardened backend: (1) offloaded every remaining synchronous Supabase/PostgREST SDK call to worker threads via `run_blocking` — auth endpoints (login, refresh, register, logout, forgot/reset-password), the four lighter chat handlers, ~13 email-controller sites (ownership helpers `_get_account`/`_get_email` are now async), and the OAuth callback upsert — so slow upstream calls no longer stall every concurrent request (completes the deferred follow-up from the 2026-05-31 performance pass); (2) added a compaction sweep to the in-memory sliding-window rate limiter, whose keys embed caller-controlled input and previously grew without bound (memory-exhaustion DoS vector); (3) switched the AI suggestion cache key from Python's 64-bit `hash()` to SHA-256 — a collision could have served one user another user's cached suggestions; (4) the suggestion cache now sweeps expired entries on write instead of leaking them until a same-key read.
+- **Files Changed:** `backend/{auth_controller,chat_controller,email_controller,oauth_controller,rate_limit,services}.py`.
+- **Verification:** ruff check ✓, ruff format ✓ (38 files), pytest 102/102 ✓, bandit 0 issues, frontend build ✓.
+- **Follow-ups:** Optional: parallelise Gmail N+1 fetch + account polling in the poller; shared httpx transport for PostgREST clients; streaming chat responses. Not deployed to the droplet yet.
+
 ### 2026-06-13 (Australia/Sydney) — Full UI/UX Audit + Accessibility/Polish Pass
 
 **Raouf:**

backend/auth_controller.py

@@ -21,7 +21,7 @@
         ResetPasswordRequest,
         SessionUser,
     )
-    from .services import create_supabase_auth_client
+    from .services import create_supabase_auth_client, run_blocking
 except ImportError:  # pragma: no cover - supports backend cwd execution
     from auth import decode_supabase_token
     from config import get_settings
@@ -34,7 +34,7 @@
         ResetPasswordRequest,
         SessionUser,
     )
-    from services import create_supabase_auth_client
+    from services import create_supabase_auth_client, run_blocking
 
 logger = logging.getLogger(__name__)
 
@@ -173,8 +173,12 @@ async def login(self, data: LoginRequest, request: Request) -> Response:
 
         enforce_auth_rate_limit(f"login:{_client_ip(request)}:{data.email.lower()}")
         try:
-            auth_response = create_supabase_auth_client().auth.sign_in_with_password(
-                {"email": data.email, "password": data.password}
+            # The Supabase auth SDK is synchronous — offload its network calls
+            # so one slow upstream call doesn't stall every concurrent request.
+            client = create_supabase_auth_client()
+            auth_response = await run_blocking(
+                client.auth.sign_in_with_password,
+                {"email": data.email, "password": data.password},
             )
         except Exception as exc:  # pragma: no cover - upstream auth failure
             logger.exception("Supabase sign-in failed")
@@ -210,8 +214,9 @@ async def refresh(self, request: Request) -> Response:
             return Response(content={"authenticated": False})
 
         try:
-            auth_response = create_supabase_auth_client().auth.refresh_session(
-                refresh_token
+            client = create_supabase_auth_client()
+            auth_response = await run_blocking(
+                client.auth.refresh_session, refresh_token
             )
         except Exception as exc:  # pragma: no cover - upstream auth failure
             logger.exception("Supabase token refresh failed")
@@ -241,9 +246,13 @@ async def logout(self, request: Request) -> Response:
         refresh_token = request.cookies.get(get_settings().refresh_cookie_name)
         if access_token and refresh_token:
             try:
-                client = create_supabase_auth_client()
-                client.auth.set_session(access_token, refresh_token)
-                client.auth.sign_out()
+
+                def _revoke_session() -> None:
+                    client = create_supabase_auth_client()
+                    client.auth.set_session(access_token, refresh_token)
+                    client.auth.sign_out()
+
+                await run_blocking(_revoke_session)
             except Exception:  # pragma: no cover - upstream auth failure
                 logger.warning(
                     "Supabase session revocation failed during logout",
@@ -259,8 +268,10 @@ async def register(self, data: RegisterRequest, request: Request) -> Response:
 
         enforce_auth_rate_limit(f"register:{_client_ip(request)}")
         try:
-            auth_response = create_supabase_auth_client().auth.sign_up(
-                {"email": data.email, "password": data.password}
+            client = create_supabase_auth_client()
+            auth_response = await run_blocking(
+                client.auth.sign_up,
+                {"email": data.email, "password": data.password},
             )
         except Exception as exc:  # pragma: no cover - upstream auth failure
             logger.exception("Supabase sign-up failed")
@@ -293,7 +304,9 @@ async def forgot_password(
         settings = get_settings()
         redirect_url = settings.password_reset_redirect_url
         try:
-            create_supabase_auth_client().auth.reset_password_email(
+            client = create_supabase_auth_client()
+            await run_blocking(
+                client.auth.reset_password_email,
                 data.email,
                 options={"redirect_to": redirect_url} if redirect_url else {},
             )
@@ -328,8 +341,10 @@ async def reset_password(
             raise HTTPException(status_code=400, detail="Recovery token is required.")
         try:
             client = create_supabase_auth_client()
-            client.auth.set_session(access_token, refresh_token)
-            user_response = client.auth.update_user({"password": data.new_password})
+            await run_blocking(client.auth.set_session, access_token, refresh_token)
+            user_response = await run_blocking(
+                client.auth.update_user, {"password": data.new_password}
+            )
         except Exception as exc:  # pragma: no cover - upstream auth failure
             logger.exception("Password reset failed")
             raise HTTPException(
@@ -344,11 +359,12 @@ async def reset_password(
             )
 
         try:
-            login_response = client.auth.sign_in_with_password(
+            login_response = await run_blocking(
+                client.auth.sign_in_with_password,
                 {
                     "email": user_response.user.email,
                     "password": data.new_password,
-                }
+                },
             )
         except Exception as exc:  # pragma: no cover - upstream auth failure
             logger.exception("Post-reset sign-in failed")

backend/chat_controller.py

@@ -122,7 +122,8 @@ async def list_sessions(
             query = _get_client(request).from_("chat_sessions").select("*")
             if category:
                 query = query.eq("category", category)
-            response = query.order("created_at", desc=True).execute()
+            builder = query.order("created_at", desc=True)
+            response = await run_blocking(builder.execute)
         except Exception as exc:
             logger.exception("Failed to list chat sessions")
             raise HTTPException(
@@ -136,7 +137,7 @@ async def create_session(self, data: ChatSessionCreate, request: Request) -> dic
 
         user_id = request.state.user_id
         try:
-            response = (
+            builder = (
                 _get_client(request)
                 .from_("chat_sessions")
                 .insert(
@@ -146,8 +147,8 @@ async def create_session(self, data: ChatSessionCreate, request: Request) -> dic
                         "category": data.category,
                     }
                 )
-                .execute()
             )
+            response = await run_blocking(builder.execute)
         except Exception as exc:
             logger.exception("Failed to create chat session")
             raise HTTPException(
@@ -160,9 +161,13 @@ async def delete_session(self, session_id: str, request: Request) -> None:
         """Delete a chat session and all its messages (cascade)."""
 
         try:
-            _get_client(request).from_("chat_sessions").delete().eq(
-                "id", session_id
-            ).execute()
+            builder = (
+                _get_client(request)
+                .from_("chat_sessions")
+                .delete()
+                .eq("id", session_id)
+            )
+            await run_blocking(builder.execute)
         except Exception as exc:
             logger.exception("Failed to delete chat session")
             raise HTTPException(
@@ -174,14 +179,14 @@ async def get_messages(self, session_id: str, request: Request) -> list[dict]:
         """Get all messages for a chat session."""
 
         try:
-            response = (
+            builder = (
                 _get_client(request)
                 .from_("chat_messages")
                 .select("*")
                 .eq("session_id", session_id)
                 .order("created_at")
-                .execute()
             )
+            response = await run_blocking(builder.execute)
         except Exception as exc:
             logger.exception("Failed to load chat messages")
             raise HTTPException(