Function authenticate_user

apps/api/src/security/auth.py:119–136

(
    request: Request,
    email: str,
    password: str,
    db_session: AsyncSession,
)

#### Classes ####################################################
async def authenticate_user(
    request: Request,
    email: str,
    password: str,
    db_session: AsyncSession,
) -> User | bool:
    user = await security_get_user(request, db_session, email)
    if not user:
        # SECURITY: run a real password-verify against a dummy hash so
        # unknown-user responses take roughly the same time as known-user
        # wrong-password responses. Without this, an attacker can enumerate
        # accounts via response timing alone (Argon2 verify is slow, skipping
        # it is fast).
        security_verify_password(password, _DUMMY_PASSWORD_HASH)
        return False
    if not security_verify_password(password, user.password):
        return False
    return user


def create_access_token(data: dict, expires_delta: timedelta | None = None):