From ae908be7166ea55773a50b0c82d4b83788197ad7 Mon Sep 17 00:00:00 2001
From: kolaente <k@knt.li>
Date: Wed, 10 Jun 2026 21:32:14 +0200
Subject: [PATCH] fix: dispatch pending events after user creation commits

The register handler, local/LDAP login and the OIDC callback all queue
the user.created event via DispatchOnCommit but never called
DispatchPending, so the event was silently dropped and its queue entry
leaked. Flush after commit and discard on rollback.
---
 pkg/modules/auth/openid/openid.go  | 9 +++++++++
 pkg/routes/api/v1/login.go         | 5 +++++
 pkg/routes/api/v1/user_register.go | 5 +++++
 3 files changed, 19 insertions(+)

diff --git a/pkg/modules/auth/openid/openid.go b/pkg/modules/auth/openid/openid.go
index 381570f42..b1fa3961a 100644
--- a/pkg/modules/auth/openid/openid.go
+++ b/pkg/modules/auth/openid/openid.go
@@ -27,6 +27,7 @@ import (
 	"strings"
 
 	"code.vikunja.io/api/pkg/db"
+	"code.vikunja.io/api/pkg/events"
 	"code.vikunja.io/api/pkg/log"
 	"code.vikunja.io/api/pkg/models"
 	"code.vikunja.io/api/pkg/modules/auth"
@@ -187,6 +188,9 @@ func HandleCallback(c *echo.Context) error {
 
 	s := db.NewSession()
 	defer s.Close()
+	// Discards events queued during a rolled-back transaction (e.g. user
+	// creation); a no-op once DispatchPending has run.
+	defer events.CleanupPending(s)
 
 	// Check if we have seen this user before
 	u, err := getOrCreateUser(s, cl, provider, idToken)
@@ -212,6 +216,9 @@ func HandleCallback(c *echo.Context) error {
 	if err := enforceTOTPIfRequired(s, u, cb.TOTPPasscode); err != nil {
 		if commitErr := s.Commit(); commitErr != nil {
 			log.Errorf("Error committing session after failed OIDC TOTP attempt for user %d: %v", u.ID, commitErr)
+		} else {
+			// The user creation above was committed, so its events are real.
+			events.DispatchPending(c.Request().Context(), s)
 		}
 		if user.IsErrInvalidTOTPPasscode(err) {
 			user.HandleFailedTOTPAuth(u)
@@ -233,6 +240,8 @@ func HandleCallback(c *echo.Context) error {
 		return err
 	}
 
+	events.DispatchPending(c.Request().Context(), s)
+
 	// Create token
 	return auth.NewUserAuthTokenResponse(u, c, false)
 }
diff --git a/pkg/routes/api/v1/login.go b/pkg/routes/api/v1/login.go
index 6c7eb686a..7385ed1f6 100644
--- a/pkg/routes/api/v1/login.go
+++ b/pkg/routes/api/v1/login.go
@@ -53,6 +53,9 @@ func Login(c *echo.Context) (err error) {
 
 	s := db.NewSession()
 	defer s.Close()
+	// Discards events queued during a rolled-back transaction (e.g. LDAP user
+	// creation); a no-op once DispatchPending has run.
+	defer events.CleanupPending(s)
 
 	var user *user2.User
 	if config.AuthLdapEnabled.GetBool() {
@@ -127,6 +130,8 @@ func Login(c *echo.Context) (err error) {
 		return err
 	}
 
+	events.DispatchPending(c.Request().Context(), s)
+
 	// Create token
 	return auth.NewUserAuthTokenResponse(user, c, u.LongToken)
 }
diff --git a/pkg/routes/api/v1/user_register.go b/pkg/routes/api/v1/user_register.go
index 9db52c88a..a051f9767 100644
--- a/pkg/routes/api/v1/user_register.go
+++ b/pkg/routes/api/v1/user_register.go
@@ -22,6 +22,7 @@ import (
 
 	"code.vikunja.io/api/pkg/config"
 	"code.vikunja.io/api/pkg/db"
+	"code.vikunja.io/api/pkg/events"
 	"code.vikunja.io/api/pkg/log"
 	"code.vikunja.io/api/pkg/metrics"
 	"code.vikunja.io/api/pkg/models"
@@ -79,14 +80,18 @@ func RegisterUser(c *echo.Context) error {
 	})
 	if err != nil {
 		_ = s.Rollback()
+		events.CleanupPending(s)
 		return err
 	}
 
 	if err := s.Commit(); err != nil {
 		_ = s.Rollback()
+		events.CleanupPending(s)
 		return err
 	}
 
+	events.DispatchPending(c.Request().Context(), s)
+
 	// Bust the cached user count so the new registration shows up in metrics
 	// immediately instead of after the regular cache expiry.
 	if config.MetricsEnabled.GetBool() {