fix: close leaked database sessions

Add defer s.Close() to sessions that were never closed:
- auth.GetAuthFromClaims inline session
- models.deleteUsers cron function
- notifications.notify database insert

pkg/models/user_delete.go

@@ -42,6 +42,7 @@ func RegisterUserDeletionCron() {
 
 func deleteUsers() {
 	s := db.NewSession()
+	defer s.Close()
 	users := []*user.User{}
 	err := s.Where(builder.Lt{"deletion_scheduled_at": time.Now()}).
 		Find(&users)

pkg/modules/auth/auth.go

@@ -155,7 +155,9 @@ func GetAuthFromClaims(c *echo.Context) (a web.Auth, err error) {
 	// check if we have a token in context and use it if that's the case
 	if c.Get("api_token") != nil {
 		apiToken := c.Get("api_token").(*models.APIToken)
-		u, err := user.GetUserByID(db.NewSession(), apiToken.OwnerID)
+		s := db.NewSession()
+		defer s.Close()
+		u, err := user.GetUserByID(s, apiToken.OwnerID)
 		if err != nil {
 			return nil, err
 		}

pkg/notifications/notification.go

@@ -109,6 +109,7 @@ func notifyDB(notifiable Notifiable, notification Notification) (err error) {
 	}
 
 	s := db.NewSession()
+	defer s.Close()
 	dbNotification := &DatabaseNotification{
 		NotifiableID: notifiable.RouteForDB(),
 		Notification: content,