Function security_get_user

apps/api/src/services/users/users.py:721–738

Get user by email for security/authentication purposes. Returns None if user doesn't exist (rather than throwing an exception) to allow the caller to handle the "user not found" case appropriately and prevent email enumeration vulnerabilities.

(request: Request, db_session: AsyncSession, email: str)

async def security_get_user(request: Request, db_session: AsyncSession, email: str) -> User | None:
    """
    Get user by email for security/authentication purposes.

    Returns None if user doesn't exist (rather than throwing an exception)
    to allow the caller to handle the "user not found" case appropriately
    and prevent email enumeration vulnerabilities.
    """
    # Check if user exists
    statement = select(User).where(User.email == email)
    user = (await db_session.execute(statement)).scalars().first()

    if not user:
        return None

    user = User(**user.model_dump())

    return user


## 🔒 RBAC Utils ##