Apr 1 2026: clean up code

app/api/auth.py

@@ -170,7 +170,7 @@ def refresh():
                        request.remote_addr)
         return api_error('Refresh token is invalid or expired', 401)
 
-    user = User.query.get(rt_row.user_id)
+    user = db.session.get(User, rt_row.user_id)
     if user is None or not user.active:
         rt_row.revoke()
         db.session.commit()

app/api/decorators.py

@@ -34,6 +34,7 @@ from flask import request, g, abort
 
 from app.api.jwt_utils import decode_access_token
 from app.api.errors import api_error
+from app import db
 from app.models.user import User
 
 logger = logging.getLogger(__name__)
@@ -62,7 +63,7 @@ def jwt_required(f):
             return api_error('Access token is invalid or expired', 401)
 
         user_id = int(payload.get('sub', 0))
-        user    = User.query.get(user_id)
+        user    = db.session.get(User, user_id)
 
         if user is None:
             return api_error('User not found', 401)