application/database/db.py (2)

1038-1089: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Hoist the repeated datetime/timezone import to module scope.

from datetime import datetime, timezone is imported locally in both upsert_user (Line 1046) and set_user_resource_selection (Line 1105). Move it to the top-level imports once.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@application/database/db.py` around lines 1038 - 1089, Move the repeated “from
datetime import datetime, timezone” import from the methods upsert_user and
set_user_resource_selection to the module-level imports, leaving both methods to
use the shared top-level import without local import statements.

---

1101-1125: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick win

set_user_resource_selection has no guard against concurrent duplicate inserts.

Unlike upsert_user above (which recovers from IntegrityError on google_sub races), this delete-then-insert sequence has no equivalent safeguard. Two concurrent calls for the same user_id (e.g. a double-submitted "save selection" request) could both pass the delete step and then collide on uq_user_resource_selection for a shared standard_name, raising an unhandled IntegrityError. No endpoint calls this yet, but it's worth hardening before wiring it up.

♻️ Suggested guard mirroring upsert_user's recovery pattern

         self.session.query(UserResourceSelection).filter(
             UserResourceSelection.user_id == user_id
         ).delete()
         for name in deduped:
             self.session.add(
                 UserResourceSelection(
                     id=generate_uuid(),
                     user_id=user_id,
                     standard_name=name,
                     created_at=now,
                 )
             )
-        self.session.commit()
+        try:
+            self.session.commit()
+        except IntegrityError:
+            # A concurrent call raced on the same (user_id, standard_name) pair;
+            # the other writer's result wins, just return the current state.
+            self.session.rollback()
         return self.get_user_resource_selection(user_id)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@application/database/db.py` around lines 1101 - 1125, Harden
set_user_resource_selection against concurrent IntegrityError races during its
delete-and-insert sequence. Mirror the existing recovery pattern used by
upsert_user: catch the uniqueness violation, roll back the failed transaction,
and return the persisted selection for user_id without leaving the exception
unhandled; preserve the current deduplication and replacement behavior for
non-conflicting calls.

application/web/web_main.py (1)

1164-1185: 🩺 Stability & Availability | 🔵 Trivial | 💤 Low value

Broad exception catch is intentional but worth narrowing eventually.

Ruff flags the blind except Exception here (BLE001). The rationale in the comment (avoid leaking SQL parameters) is sound for upsert_user failures specifically, but the broad catch also silently swallows unrelated bugs (e.g., a malformed id_info dict) that would otherwise be visible. Consider catching SQLAlchemyError specifically if you want DB failures to degrade gracefully while other exceptions still surface.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@application/web/web_main.py` around lines 1164 - 1185, In the user
persistence block around upsert_user, replace the broad Exception handler with
SQLAlchemyError and import that exception from the project’s SQLAlchemy
dependency. Preserve the existing sanitized class-name logging and graceful
redirect for database failures, while allowing unrelated errors such as
malformed id_info data to propagate.

Source: Linters/SAST tools