Multi-step writes run without transactions (partial campaign/character on failure) #35

New issue

Closed

opened 2026-08-23 05:42:05 +00:00 by nasandre · 2 comments

nasandre commented

2026-08-23 05:42:05 +00:00

Owner

Medium (data integrity)

A transaction helper exists but is unused:

`backend/src/config/database.ts:217` — `withTransaction` (BEGIN/COMMIT/ROLLBACK)
Zero call sites in services

Affected flows:

`campaignService.createCampaign` (:440-487): INSERT campaign → replacePlayers → creator insert → replaceEvents/systems/routes/factions/contacts/sessions — 9 sequential writes; a failure mid-way leaves a partial campaign
`campaignService.updateCampaign` (:489-546): UPDATE + up to 7 replace* calls
`characterService.createCharacter`: INSERT character + skills + augments + equipment loop
`replacePlayers` deletes all rows then re-inserts in a loop — failure after DELETE loses all players

Suggested fix

Wrap create/update flows in `withTransaction` (needs the query helper to accept an optional client).

## Medium (data integrity) A transaction helper exists but is unused: - \`backend/src/config/database.ts:217\` — \`withTransaction\` (BEGIN/COMMIT/ROLLBACK) - Zero call sites in services Affected flows: - \`campaignService.createCampaign\` (:440-487): INSERT campaign → replacePlayers → creator insert → replaceEvents/systems/routes/factions/contacts/sessions — 9 sequential writes; a failure mid-way leaves a partial campaign - \`campaignService.updateCampaign\` (:489-546): UPDATE + up to 7 replace* calls - \`characterService.createCharacter\`: INSERT character + skills + augments + equipment loop - \`replacePlayers\` deletes all rows then re-inserts in a loop — failure after DELETE loses all players ## Suggested fix Wrap create/update flows in \`withTransaction\` (needs the query helper to accept an optional client).

nasandre added the

Bug

label

2026-08-23 05:42:05 +00:00

nasandre commented

2026-08-23 06:18:49 +00:00

Author

Owner

✅ Fixed:

Added withTransaction(fn) using AsyncLocalStorage — any query() issued inside joins the same Postgres transaction automatically (zero call-site churn)
Wrapped: createCampaign (INSERT + players + events + systems + routes + factions + contacts + sessions), updateCampaign child replacement block, createCharacter (row + skills + talents + augments + kit)
SQLite path gets BEGIN/COMMIT/ROLLBACK as well

✅ **Fixed**: - Added `withTransaction(fn)` using AsyncLocalStorage — any `query()` issued inside joins the same Postgres transaction automatically (zero call-site churn) - Wrapped: `createCampaign` (INSERT + players + events + systems + routes + factions + contacts + sessions), `updateCampaign` child replacement block, `createCharacter` (row + skills + talents + augments + kit) - SQLite path gets BEGIN/COMMIT/ROLLBACK as well

nasandre referenced this issue from a commit

2026-08-23 06:55:48 +00:00

Fix issues #30-#40: security hardening, edit mode, mobile nav, transactions

nasandre commented

2026-08-23 06:56:39 +00:00

Author

Owner

✅ Fixed (commit 05b5453) — new withTransaction() helper using AsyncLocalStorage; any query() inside automatically joins the transaction (zero call-site changes). Wrapped createCampaign (all 9 writes), updateCampaign child replacement, createCharacter (row + skills + talents + augments + kit). SQLite gets BEGIN/COMMIT/ROLLBACK too.

✅ **Fixed** (commit `05b5453`) — new `withTransaction()` helper using AsyncLocalStorage; any `query()` inside automatically joins the transaction (zero call-site changes). Wrapped createCampaign (all 9 writes), updateCampaign child replacement, createCharacter (row + skills + talents + augments + kit). SQLite gets BEGIN/COMMIT/ROLLBACK too.

nasandre closed this issue

2026-08-23 06:56:39 +00:00