fix!: removed .commit() from repository level

core/auth/fetch_sub.py

@@ -1,14 +1,11 @@
-from sqlalchemy.ext.asyncio import AsyncSession
-
 from db.models import User
+from db.session import UnitOfWork
 from repositories.users import UserRepository
 from schemas.jwt import ServiceJWTPayload
 
 
-async def fetch_subject_from_service(
-    payload: ServiceJWTPayload, session: AsyncSession
-) -> User | None:
-    repo = UserRepository(session)
+async def fetch_subject_from_service(payload: ServiceJWTPayload, uow: UnitOfWork) -> User | None:
+    repo = UserRepository(uow)
 
     if payload.acting_as.startswith("telegram:"):
         telegram_id = int(payload.acting_as.split("telegram:")[1])

core/auth/jwt.py

@@ -2,18 +2,18 @@ from datetime import UTC, datetime
 
 from fastapi import HTTPException
 from pydantic import ValidationError
-from sqlalchemy.ext.asyncio import AsyncSession
 
 from core.auth.fetch_sub import fetch_subject_from_service
 from core.secrets import decode_jwt, decode_user_jwt, get_kid_from_token
+from db.session import UnitOfWork
 from repositories.service_signatures import get_active_signature_by_kid
 from repositories.users import UserRepository
 from schemas.dto import AuthContext
 from schemas.jwt import ServiceJWTPayload, UserJWTPayload
 
 
-async def authorize_bot(kid: str, token: str, session: AsyncSession) -> AuthContext:
-    signature = await get_active_signature_by_kid(session, kid)
+async def authorize_bot(kid: str, token: str, uow: UnitOfWork) -> AuthContext:
+    signature = await get_active_signature_by_kid(uow.session, kid)
 
     if not signature:
         raise HTTPException(401, detail="Invalid service signature")
@@ -28,18 +28,18 @@ async def authorize_bot(kid: str, token: str, session: AsyncSession) -> AuthCont
     if payload.exp < datetime.now(UTC).timestamp():
         raise HTTPException(status_code=401, detail="Access token expired")
 
-    subject = await fetch_subject_from_service(payload, session)
+    subject = await fetch_subject_from_service(payload, uow)
     if not subject:
         raise HTTPException(status_code=401, detail="User not found")
 
     return AuthContext(subject, auth_method="service", service=kid)
 
 
-async def authorize(token: str, session: AsyncSession, service: str | None = None) -> AuthContext:
+async def authorize(token: str, uow: UnitOfWork, service: str | None = None) -> AuthContext:
     kid = get_kid_from_token(token)
 
     if kid:
-        return await authorize_bot(kid, token, session)
+        return await authorize_bot(kid, token, uow)
 
     content = decode_user_jwt(token)
 
@@ -51,7 +51,7 @@ async def authorize(token: str, session: AsyncSession, service: str | None = Non
     if payload.exp < datetime.now(UTC).timestamp():
         raise HTTPException(status_code=401, detail="Access token expired")
 
-    repo = UserRepository(session)
+    repo = UserRepository(uow)
     user = await repo.get_user_by_id(int(payload.sub))
 
     if not user:

core/deps.py

@@ -1,10 +1,9 @@
 from fastapi import Depends, HTTPException, Request
-from sqlalchemy.ext.asyncio import AsyncSession
 
 from config import cfg
 from core.auth import jwt
 from core.secrets import get_kid_from_token
-from db.session import get_db
+from db.session import UnitOfWork, get_uow
 from external.pally import PallyClient
 from repositories.service_signatures import get_active_signature_by_kid
 from schemas.dto import AuthContext, ServiceIdentity
@@ -12,7 +11,7 @@ from services.subscriptions import sync_user_subscription
 
 
 async def get_auth_context(
-    request: Request, session: AsyncSession = Depends(get_db)
+    request: Request, uow: UnitOfWork = Depends(get_uow)
 ) -> AuthContext | None:
     auth = request.headers.get("Authorization")
 
@@ -21,14 +20,14 @@ async def get_auth_context(
 
     if auth.startswith("Bearer"):
         token = auth.removeprefix("Bearer ").strip()
-        ctx = await jwt.authorize(token, session)
-        await sync_user_subscription(session, user=ctx.user)
-        await session.commit()
+        ctx = await jwt.authorize(token, uow)
+        await sync_user_subscription(uow.session, user=ctx.user)
+        await uow.commit()
         return ctx
 
 
 async def get_service_identity(
-    request: Request, session: AsyncSession = Depends(get_db)
+    request: Request, uow: UnitOfWork = Depends(get_uow)
 ) -> ServiceIdentity | None:
     auth = request.headers.get("Authorization")
     if not auth:
@@ -39,7 +38,7 @@ async def get_service_identity(
         kid = get_kid_from_token(token)
         if not kid:
             raise HTTPException(401, detail="No kid provided.")
-        signature = await get_active_signature_by_kid(session, kid)
+        signature = await get_active_signature_by_kid(uow.session, kid)
         if not signature:
             raise HTTPException(401, detail="Invalid signature")
         return ServiceIdentity(service=signature.kid)