fix: add missing Commit() to write callers

After NewSession() auto-begins a transaction, callers that perform
writes must explicitly call Commit() for changes to persist. Without
this, writes are silently rolled back when Close() is called.

Affected callers:
- user deletion notification cron
- caldav token generation/deletion
- token cleanup cron
- mark-all-notifications-read endpoint
- saved filter view cron
- project background delete
- typesense reindex
- export cleanup cron
- task last-updated listener
- saved filter view listener
- SSO team cleanup cron
- migration status start/finish
- background set/remove handlers
- orphaned task position cleanup
- file creation

pkg/cmd/maintenance.go

@@ -46,6 +46,11 @@ var deleteOrphanTaskPositions = &cobra.Command{
 			return
 		}
 
+		if err := s.Commit(); err != nil {
+			log.Errorf("Could not commit orphaned task position deletion: %s", err)
+			return
+		}
+
 		if count == 0 {
 			log.Infof("No orphaned task positions found.")
 			return

pkg/files/files.go

@@ -107,7 +107,8 @@ func CreateWithMime(f io.ReadSeeker, realname string, realsize uint64, a web.Aut
 		_ = s.Rollback()
 		return
 	}
-	return
+
+	return file, s.Commit()
 }
 
 func CreateWithMimeAndSession(s *xorm.Session, f io.ReadSeeker, realname string, realsize uint64, a web.Auth, mime string, checkFileSizeLimit bool) (file *File, err error) {

pkg/models/export.go

@@ -452,6 +452,9 @@ func RegisterOldExportCleanupCron() {
 
 		log.Debugf(logPrefix+"Removed %d old user data exports...", len(fs))
 
+		if err := s.Commit(); err != nil {
+			log.Errorf(logPrefix+"Error committing export cleanup: %s", err)
+		}
 	})
 	if err != nil {
 		log.Fatalf("Could not register old export cleanup cron: %s", err)

pkg/models/listeners.go

@@ -486,7 +486,12 @@ func (s *HandleTaskUpdateLastUpdated) Handle(msg *message.Message) (err error) {
 	sess := db.NewSession()
 	defer sess.Close()
 
-	return updateTaskLastUpdated(sess, &Task{ID: taskIDInt})
+	err = updateTaskLastUpdated(sess, &Task{ID: taskIDInt})
+	if err != nil {
+		return err
+	}
+
+	return sess.Commit()
 }
 
 // RemoveTaskFromTypesense represents a listener
@@ -751,10 +756,13 @@ func (l *UpdateTaskInSavedFilterViews) Handle(msg *message.Message) (err error)
 		task := make(map[int64]*Task, 1)
 		task[event.Task.ID] = event.Task // Will be filled with all data by the Typesense connector
 
-		return reindexTasksInTypesense(s, task)
+		err = reindexTasksInTypesense(s, task)
+		if err != nil {
+			return err
+		}
 	}
 
-	return nil
+	return s.Commit()
 }
 
 ///////

pkg/models/project.go

@@ -1291,8 +1291,12 @@ func (p *Project) DeleteBackgroundFileIfExists() (err error) {
 	if err != nil && files.IsErrFileDoesNotExist(err) {
 		return nil
 	}
+	if err != nil {
+		_ = s.Rollback()
+		return err
+	}
 
-	return err
+	return s.Commit()
 }
 
 // SetProjectBackground sets a background file as project background in the db

pkg/models/saved_filters.go

@@ -534,6 +534,10 @@ func RegisterAddTaskToFilterViewCron() {
 				log.Errorf("%sError recalculating task positions for view %d: %s", logPrefix, data.view.ID, err)
 			}
 		}
+
+		if err := s.Commit(); err != nil {
+			log.Errorf("%sError committing: %s", logPrefix, err)
+		}
 	})
 	if err != nil {
 		log.Fatalf("Could register add task to filter view cron: %s", err)

pkg/models/typesense.go

@@ -244,7 +244,7 @@ func ReindexAllTasks() (err error) {
 		return fmt.Errorf("could update last sync state: %s", err.Error())
 	}
 
-	return
+	return s.Commit()
 }
 
 func reindexTasksInTypesense(s *xorm.Session, tasks map[int64]*Task) (err error) {

pkg/modules/auth/openid/cron.go

@@ -65,6 +65,10 @@ func RegisterEmptyOpenIDTeamCleanupCron() {
 			log.Errorf(logPrefix+"Error removing empty openid team: %s", err)
 			return
 		}
+
+		if err := s.Commit(); err != nil {
+			log.Errorf(logPrefix+"Error committing: %s", err)
+		}
 	})
 	if err != nil {
 		log.Fatalf("Could not register empty openid teams cleanup cron: %s", err)

pkg/modules/background/handler/background.go

@@ -161,6 +161,10 @@ func (bp *BackgroundProvider) SetBackground(c *echo.Context) error {
 		return err
 	}
 
+	if err := s.Commit(); err != nil {
+		return err
+	}
+
 	return c.JSON(http.StatusOK, project)
 }
 
@@ -403,11 +407,13 @@ func RemoveProjectBackground(c *echo.Context) error {
 
 	project, auth, err := checkProjectBackgroundRights(s, c)
 	if err != nil {
+		_ = s.Rollback()
 		return err
 	}
 
 	err = project.DeleteBackgroundFileIfExists()
 	if err != nil {
+		_ = s.Rollback()
 		return err
 	}
 
@@ -416,6 +422,11 @@ func RemoveProjectBackground(c *echo.Context) error {
 	project.BackgroundBlurHash = ""
 	err = models.UpdateProject(s, project, auth, true)
 	if err != nil {
+		_ = s.Rollback()
+		return err
+	}
+
+	if err := s.Commit(); err != nil {
 		return err
 	}
 

pkg/modules/migration/migration_status.go

@@ -48,7 +48,12 @@ func StartMigration(m MigratorName, u *user.User) (status *Status, err error) {
 		StartedAt:    time.Now(),
 	}
 	_, err = s.Insert(status)
-	return
+	if err != nil {
+		_ = s.Rollback()
+		return
+	}
+
+	return status, s.Commit()
 }
 
 // FinishMigration sets the finished at time and calls it a day
@@ -59,7 +64,12 @@ func FinishMigration(status *Status) (err error) {
 	status.FinishedAt = time.Now()
 
 	_, err = s.Where("id = ?", status.ID).Update(status)
-	return
+	if err != nil {
+		_ = s.Rollback()
+		return
+	}
+
+	return s.Commit()
 }
 
 // GetMigrationStatus returns the migration status for a migration and a user

pkg/routes/api/v1/notifications.go

@@ -49,6 +49,11 @@ func MarkAllNotificationsAsRead(c *echo.Context) error {
 
 	err = notifications.MarkAllNotificationsAsRead(s, a.GetID())
 	if err != nil {
+		_ = s.Rollback()
+		return err
+	}
+
+	if err := s.Commit(); err != nil {
 		return err
 	}
 

pkg/user/caldav_token.go

@@ -22,7 +22,13 @@ func GenerateNewCaldavToken(u *User) (token *Token, err error) {
 	s := db.NewSession()
 	defer s.Close()
 
-	return generateHashedToken(s, u, TokenCaldavAuth)
+	token, err = generateHashedToken(s, u, TokenCaldavAuth)
+	if err != nil {
+		_ = s.Rollback()
+		return
+	}
+
+	return token, s.Commit()
 }
 
 func GetCaldavTokens(u *User) (tokens []*Token, err error) {
@@ -36,5 +42,11 @@ func DeleteCaldavTokenByID(u *User, id int64) error {
 	s := db.NewSession()
 	defer s.Close()
 
-	return removeTokenByID(s, u, TokenCaldavAuth, id)
+	err := removeTokenByID(s, u, TokenCaldavAuth, id)
+	if err != nil {
+		_ = s.Rollback()
+		return err
+	}
+
+	return s.Commit()
 }

pkg/user/delete.go

@@ -37,6 +37,7 @@ func RegisterDeletionNotificationCron() {
 
 func notifyUsersScheduledForDeletion() {
 	s := db.NewSession()
+	defer s.Close()
 	users := []*User{}
 	err := s.Where(builder.NotNull{"deletion_scheduled_at"}).
 		Find(&users)
@@ -83,6 +84,10 @@ func notifyUsersScheduledForDeletion() {
 			log.Errorf("Could update user %d last deletion reminder sent date: %s", user.ID, err)
 		}
 	}
+
+	if err := s.Commit(); err != nil {
+		log.Errorf("Could not commit user deletion notifications: %s", err)
+	}
 }
 
 // RequestDeletion creates a user deletion confirm token and sends a notification to the user

pkg/user/token.go

@@ -140,6 +140,10 @@ func RegisterTokenCleanupCron() {
 		if deleted > 0 {
 			log.Debugf(logPrefix+"Deleted %d old password reset tokens", deleted)
 		}
+
+		if err := s.Commit(); err != nil {
+			log.Errorf(logPrefix+"Error committing token cleanup: %s", err)
+		}
 	})
 	if err != nil {
 		log.Fatalf("Could not register token cleanup cron: %s", err)