Move blocking work in async routes off the event loop #950

Summary

Most async def routes run synchronous SQLAlchemy work, and some run synchronous HTTP calls, directly on the event loop. Prod runs four uvicorn processes, so one slow request stalls every in-flight request on a quarter of the API. #881 added database limits and moved authentication into the threadpool; this issue converts the routes themselves and adds a test that stops new ones.

Where things stand

Counted on release-2026.4.0 at 7c482dd, which matches main. The routers have 47 async def routes:

The publication fetchers (fetch_pubmed_article, fetch_biorxiv_article, fetch_medrxiv_article, fetch_crossref_work) are declared async, but they call eutils, Rxiv and Crossref, which make synchronous HTTP requests with no timeout. Any route that resolves a publication therefore blocks its loop for as long as NCBI, bioRxiv or Crossref takes to answer.

Scope

1. Convert the 33 database-only routes to def.
2. Convert the 3 publication routes to def, and make the four publication fetchers and find_generic_article sync.
3. Convert the 6 routes that call MONDO, NCBI Taxonomy or ARQ to def. Use a sync httpx client for MONDO and NCBI Taxonomy, and anyio.from_thread.run for the ARQ enqueue.
4. Keep the 2 upload routes (POST /score-sets/{urn}/variants/data and PATCH /score-sets-with-variants/{urn}) async: await request.form() and the enqueue, and move the synchronous work between them into run_in_threadpool. Making them def would mean declaring every form field, which changes the OpenAPI schema and how the riskiest write routes parse their input. Revisit that with Use flexible_model_loader to handle JSON/multipart-form-data in Score Set PATCH Endpoint #629.
5. Make disease search (GET /diseases/search) and search_mondo def as well, so lib/mondo_ols.py uses one client style. It could stay async: it only calls OLS, so awaiting would hold no thread, while as def each search holds a thread for up to OLS's 10-second timeout. That cost is small because only the calibration editor calls it, debounced and cancelled on each keystroke. Revisit if it moves onto a high-traffic page or slow OLS responses start exhausting the thread pool.
6. Make the helpers that are async with no real await sync, and update their callers:
   • lib/identifiers.py: find_or_create_doi_identifier, find_or_create_raw_read_identifier, find_or_create_external_gene_identifier, create_external_gene_identifier_offset, and find_or_create_publication_identifier once step 2 lands.
   • lib/contributors.py: find_or_create_contributor.
   • routers/score_sets.py: fetch_score_set_by_urn, parse_score_set_variants_uploads.
   • models/: ScoreSet.set_legacy_keywords, Experiment.set_keywords, Experiment.set_legacy_keywords, User.set_roles, AccessKey.set_role, and their private _find_* helpers.
   • lib/authorization.py: require_current_user, require_current_user_with_email, get_principal, require_role; and get_access_token in lib/authentication.py.
7. Add a test that walks app.routes and fails when an async def endpoint, or any async def dependency in its tree, takes a session from get_db, unless the route is on an explicit allowlist. A def dependency that uses the session is fine, because it runs in the thread pool.

Out of scope:

• refresh_variant_urns's per-variant UPDATE on publish. Derive variant URNs from the score set so publishing doesn't rewrite every variant #940 removes it by deriving variant URNs.
• Timeouts on the publication, ORCID and NCBI Taxonomy calls. That's Add timeouts to request-path external calls and reuse per-process clients #886. Making the fetchers sync here moves them into the threadpool but doesn't bound them.

Acceptance criteria

• The route-walk test passes, and its allowlist holds only the 2 upload routes.
• No async def in src/mavedb/lib, src/mavedb/models or src/mavedb/routers lacks a real await, directly or through what it awaits.
• The route-walk test fails on the code before this change, and when a converted route or a session-taking dependency is made async again. A timing test isn't practical here: the test fixtures share one database session across requests.
• The OpenAPI schema is unchanged, so the ui needs no types update.