refactor: move transaction management from services to API endpoints

- Services now use db.flush() instead of db.commit() for database operations
- API endpoints handle transaction commit after service calls
- Remove db.rollback() from services (let exception handlers manage this)
- Ensures consistent transaction boundaries at API layer

This pattern gives API endpoints full control over when to commit,
allowing for better error handling and potential multi-operation transactions.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

app/api/v1/admin/code_quality.py

@@ -142,6 +142,7 @@ async def trigger_scan(
     scan = code_quality_service.run_scan(
         db, triggered_by=f"manual:{current_user.username}"
     )
+    db.commit()
 
     return ScanResponse(
         id=scan.id,
@@ -338,6 +339,7 @@ async def assign_violation(
         due_date=request.due_date,
         priority=request.priority,
     )
+    db.commit()
 
     return {
         "id": assignment.id,
@@ -371,6 +373,7 @@ async def resolve_violation(
         resolved_by=current_user.id,
         resolution_note=request.resolution_note,
     )
+    db.commit()
 
     return {
         "id": violation.id,
@@ -402,6 +405,7 @@ async def ignore_violation(
         ignored_by=current_user.id,
         reason=request.reason,
     )
+    db.commit()
 
     return {
         "id": violation.id,
@@ -432,6 +436,7 @@ async def add_comment(
         user_id=current_user.id,
         comment=request.comment,
     )
+    db.commit()
 
     return {
         "id": comment.id,

app/api/v1/admin/content_pages.py

@@ -149,6 +149,7 @@ def create_platform_page(
         display_order=page_data.display_order,
         created_by=current_user.id,
     )
+    db.commit()
 
     return page.to_dict()
 
@@ -211,6 +212,7 @@ def update_page(
         display_order=page_data.display_order,
         updated_by=current_user.id,
     )
+    db.commit()
     return page.to_dict()
 
 
@@ -222,3 +224,4 @@ def delete_page(
 ):
     """Delete a content page."""
     content_page_service.delete_page_or_raise(db, page_id)
+    db.commit()

app/api/v1/admin/marketplace.py

@@ -83,6 +83,7 @@ async def create_marketplace_import_job(
         vendor=vendor,
         user=current_admin,
     )
+    db.commit()
 
     logger.info(
         f"Admin {current_admin.username} created import job {job.id} "

app/api/v1/admin/settings.py

@@ -113,6 +113,7 @@ def create_setting(
             "value_type": setting_data.value_type,
         },
     )
+    db.commit()
 
     return result
 
@@ -140,6 +141,7 @@ def update_setting(
         target_id=key,
         details={"old_value": str(old_value), "new_value": update_data.value},
     )
+    db.commit()
 
     return result
 
@@ -168,6 +170,7 @@ def upsert_setting(
         target_id=setting_data.key,
         details={"category": setting_data.category},
     )
+    db.commit()
 
     return result
 
@@ -204,5 +207,6 @@ def delete_setting(
         target_id=key,
         details={},
     )
+    db.commit()
 
     return {"message": message}

app/api/v1/admin/users.py

@@ -83,6 +83,7 @@ def create_user(
         role=user_data.role,
         current_admin_id=current_admin.id,
     )
+    db.commit()
 
     return UserDetailResponse(
         id=user.id,
@@ -175,6 +176,7 @@ def update_user(
         role=update_data.get("role"),
         is_active=update_data.get("is_active"),
     )
+    db.commit()
 
     return UserDetailResponse(
         id=user.id,
@@ -206,6 +208,7 @@ def toggle_user_status(
         user_id=user_id,
         current_admin_id=current_admin.id,
     )
+    db.commit()
 
     return UserStatusToggleResponse(message=message, is_active=user.is_active)
 
@@ -222,5 +225,6 @@ def delete_user(
         user_id=user_id,
         current_admin_id=current_admin.id,
     )
+    db.commit()
 
     return UserDeleteResponse(message=message)

app/api/v1/admin/vendor_domains.py

@@ -68,6 +68,7 @@ def add_vendor_domain(
     domain = vendor_domain_service.add_domain(
         db=db, vendor_id=vendor_id, domain_data=domain_data
     )
+    db.commit()
 
     return VendorDomainResponse(
         id=domain.id,
@@ -186,6 +187,7 @@ def update_vendor_domain(
     domain = vendor_domain_service.update_domain(
         db=db, domain_id=domain_id, domain_update=domain_update
     )
+    db.commit()
 
     return VendorDomainResponse(
         id=domain.id,
@@ -224,6 +226,7 @@ def delete_vendor_domain(
 
     # Delete domain
     message = vendor_domain_service.delete_domain(db, domain_id)
+    db.commit()
 
     return DomainDeletionResponse(
         message=message, domain=domain_name, vendor_id=vendor_id
@@ -259,6 +262,7 @@ def verify_domain_ownership(
     - 502: DNS query failed
     """
     domain, message = vendor_domain_service.verify_domain(db, domain_id)
+    db.commit()
 
     return DomainVerificationResponse(
         message=message,

app/api/v1/admin/vendor_themes.py

@@ -136,6 +136,7 @@ async def update_vendor_theme(
     # Service handles all validation and raises appropriate exceptions
     # Global exception handler converts them to proper HTTP responses
     theme = vendor_theme_service.update_theme(db, vendor_code, theme_data)
+    db.commit()
     return VendorThemeResponse(**theme.to_dict())
 
 
@@ -185,6 +186,7 @@ async def apply_theme_preset(
     # Raises ThemePresetNotFoundException if preset doesn't exist
     # Global exception handler converts to HTTP 404
     theme = vendor_theme_service.apply_theme_preset(db, vendor_code, preset_name)
+    db.commit()
 
     return ThemePresetResponse(
         message=f"Applied {preset_name} preset successfully",
@@ -226,4 +228,5 @@ async def delete_vendor_theme(
     # Service handles deletion and raises exceptions if needed
     # Global exception handler converts them to proper HTTP responses
     result = vendor_theme_service.delete_theme(db, vendor_code)
+    db.commit()
     return ThemeDeleteResponse(message=result.get("message", "Theme deleted successfully"))

app/api/v1/admin/vendors.py

@@ -50,6 +50,7 @@ def create_vendor(
     The vendor inherits owner and contact information from its parent company.
     """
     vendor = admin_service.create_vendor(db=db, vendor_data=vendor_data)
+    db.commit()
 
     return VendorCreateResponse(
         # Vendor fields
@@ -204,6 +205,7 @@ def update_vendor(
     """
     vendor = vendor_service.get_vendor_by_identifier(db, vendor_identifier)
     vendor = admin_service.update_vendor(db, vendor.id, vendor_update)
+    db.commit()
     return _build_vendor_detail_response(vendor)
 
 
@@ -303,4 +305,5 @@ def delete_vendor(
 
     vendor = vendor_service.get_vendor_by_identifier(db, vendor_identifier)
     message = admin_service.delete_vendor(db, vendor.id)
+    db.commit()
     return {"message": message}

app/api/v1/shop/auth.py

@@ -83,6 +83,7 @@ def register_customer(
     customer = customer_service.register_customer(
         db=db, vendor_id=vendor.id, customer_data=customer_data
     )
+    db.commit()
 
     logger.info(
         f"New customer registered: {customer.email} for vendor {vendor.subdomain}",

app/api/v1/shop/cart.py

@@ -112,6 +112,7 @@ def add_to_cart(
         product_id=cart_data.product_id,
         quantity=cart_data.quantity,
     )
+    db.commit()
 
     logger.info(
         f"[SHOP_API] add_to_cart result: {result}",
@@ -165,6 +166,7 @@ def update_cart_item(
         product_id=product_id,
         quantity=cart_data.quantity,
     )
+    db.commit()
 
     return CartOperationResponse(**result)
 
@@ -201,6 +203,7 @@ def remove_from_cart(
     result = cart_service.remove_from_cart(
         db=db, vendor_id=vendor.id, session_id=session_id, product_id=product_id
     )
+    db.commit()
 
     return CartOperationResponse(**result)
 
@@ -230,5 +233,6 @@ def clear_cart(
     )
 
     result = cart_service.clear_cart(db=db, vendor_id=vendor.id, session_id=session_id)
+    db.commit()
 
     return ClearCartResponse(**result)

app/api/v1/shop/orders.py

@@ -68,6 +68,7 @@ def place_order(
     order = order_service.create_order(
         db=db, vendor_id=vendor.id, order_data=order_data
     )
+    db.commit()
 
     logger.info(
         f"Order {order.order_number} placed for vendor {vendor.subdomain}, "

app/api/v1/vendor/content_pages.py

@@ -191,6 +191,7 @@ def create_vendor_page(
         display_order=page_data.display_order,
         created_by=current_user.id,
     )
+    db.commit()
 
     return page.to_dict()
 
@@ -226,6 +227,7 @@ def update_vendor_page(
         display_order=page_data.display_order,
         updated_by=current_user.id,
     )
+    db.commit()
 
     return page.to_dict()
 
@@ -247,3 +249,4 @@ def delete_vendor_page(
 
     # Delete with ownership check in service layer
     content_page_service.delete_vendor_page(db, page_id, current_user.vendor_id)
+    db.commit()

app/api/v1/vendor/inventory.py

@@ -36,7 +36,9 @@ def set_inventory(
     db: Session = Depends(get_db),
 ):
     """Set exact inventory quantity (replaces existing)."""
-    return inventory_service.set_inventory(db, current_user.token_vendor_id, inventory)
+    result = inventory_service.set_inventory(db, current_user.token_vendor_id, inventory)
+    db.commit()
+    return result
 
 
 @router.post("/inventory/adjust", response_model=InventoryResponse)
@@ -46,7 +48,9 @@ def adjust_inventory(
     db: Session = Depends(get_db),
 ):
     """Adjust inventory (positive to add, negative to remove)."""
-    return inventory_service.adjust_inventory(db, current_user.token_vendor_id, adjustment)
+    result = inventory_service.adjust_inventory(db, current_user.token_vendor_id, adjustment)
+    db.commit()
+    return result
 
 
 @router.post("/inventory/reserve", response_model=InventoryResponse)
@@ -56,7 +60,9 @@ def reserve_inventory(
     db: Session = Depends(get_db),
 ):
     """Reserve inventory for an order."""
-    return inventory_service.reserve_inventory(db, current_user.token_vendor_id, reservation)
+    result = inventory_service.reserve_inventory(db, current_user.token_vendor_id, reservation)
+    db.commit()
+    return result
 
 
 @router.post("/inventory/release", response_model=InventoryResponse)
@@ -66,7 +72,9 @@ def release_reservation(
     db: Session = Depends(get_db),
 ):
     """Release reserved inventory (cancel order)."""
-    return inventory_service.release_reservation(db, current_user.token_vendor_id, reservation)
+    result = inventory_service.release_reservation(db, current_user.token_vendor_id, reservation)
+    db.commit()
+    return result
 
 
 @router.post("/inventory/fulfill", response_model=InventoryResponse)
@@ -76,7 +84,9 @@ def fulfill_reservation(
     db: Session = Depends(get_db),
 ):
     """Fulfill reservation (complete order, remove from stock)."""
-    return inventory_service.fulfill_reservation(db, current_user.token_vendor_id, reservation)
+    result = inventory_service.fulfill_reservation(db, current_user.token_vendor_id, reservation)
+    db.commit()
+    return result
 
 
 @router.get("/inventory/product/{product_id}", response_model=ProductInventorySummary)
@@ -119,9 +129,11 @@ def update_inventory(
     db: Session = Depends(get_db),
 ):
     """Update inventory entry."""
-    return inventory_service.update_inventory(
+    result = inventory_service.update_inventory(
         db, current_user.token_vendor_id, inventory_id, inventory_update
     )
+    db.commit()
+    return result
 
 
 @router.delete("/inventory/{inventory_id}", response_model=InventoryMessageResponse)
@@ -132,4 +144,5 @@ def delete_inventory(
 ):
     """Delete inventory entry."""
     inventory_service.delete_inventory(db, current_user.token_vendor_id, inventory_id)
+    db.commit()
     return InventoryMessageResponse(message="Inventory deleted successfully")

app/api/v1/vendor/marketplace.py

@@ -47,6 +47,7 @@ async def import_products_from_marketplace(
     import_job = marketplace_import_job_service.create_import_job(
         db, request, vendor, current_user
     )
+    db.commit()
 
     # Process in background
     background_tasks.add_task(

app/api/v1/vendor/orders.py

@@ -106,6 +106,7 @@ def update_order_status(
         order_id=order_id,
         order_update=order_update,
     )
+    db.commit()
 
     logger.info(
         f"Order {order.order_number} status updated to {order.status} "

app/api/v1/vendor/products.py

@@ -92,6 +92,7 @@ def add_product_to_catalog(
     product = product_service.create_product(
         db=db, vendor_id=current_user.token_vendor_id, product_data=product_data
     )
+    db.commit()
 
     logger.info(
         f"Product {product.id} added to catalog by user {current_user.username} "
@@ -115,6 +116,7 @@ def update_product(
         product_id=product_id,
         product_update=product_data,
     )
+    db.commit()
 
     logger.info(
         f"Product {product_id} updated by user {current_user.username} "
@@ -134,6 +136,7 @@ def remove_product_from_catalog(
     product_service.delete_product(
         db=db, vendor_id=current_user.token_vendor_id, product_id=product_id
     )
+    db.commit()
 
     logger.info(
         f"Product {product_id} removed from catalog by user {current_user.username} "
@@ -161,6 +164,7 @@ def publish_from_marketplace(
     product = product_service.create_product(
         db=db, vendor_id=current_user.token_vendor_id, product_data=product_data
     )
+    db.commit()
 
     logger.info(
         f"Marketplace product {marketplace_product_id} published to catalog "

app/api/v1/vendor/team.py

@@ -150,6 +150,7 @@ def invite_team_member(
             email=invitation.email,
             role_name="staff",
         )
+    db.commit()
 
     logger.info(
         f"Invitation sent: {invitation.email} to {vendor.vendor_code} "
@@ -189,6 +190,7 @@ def accept_invitation(acceptance: InvitationAccept, db: Session = Depends(get_db
         first_name=acceptance.first_name,
         last_name=acceptance.last_name,
     )
+    db.commit()
 
     logger.info(
         f"Invitation accepted: {result['user'].email} "
@@ -272,6 +274,7 @@ def update_team_member(
         new_role_id=update_data.role_id,
         is_active=update_data.is_active,
     )
+    db.commit()
 
     logger.info(
         f"Team member updated: {user_id} in {vendor.vendor_code} "
@@ -307,6 +310,7 @@ def remove_team_member(
     vendor = request.state.vendor
 
     vendor_team_service.remove_team_member(db=db, vendor=vendor, user_id=user_id)
+    db.commit()
 
     logger.info(
         f"Team member removed: {user_id} from {vendor.vendor_code} "
@@ -344,6 +348,8 @@ def bulk_remove_team_members(
             failed_count += 1
             errors.append({"user_id": user_id, "error": str(e)})
 
+    db.commit()
+
     logger.info(
         f"Bulk remove completed: {success_count} removed, {failed_count} failed "
         f"in {vendor.vendor_code}"