fix: Missing transaction in save causing deadlocks (#8866)

server/routes/api/notifications/notifications.test.ts

@@ -2,6 +2,7 @@ import queryString from "query-string";
 import { v4 as uuidv4 } from "uuid";
 import { randomElement } from "@shared/random";
 import { NotificationEventType } from "@shared/types";
+import NotificationSettingsHelper from "@server/models/helpers/NotificationSettingsHelper";
 import {
   buildCollection,
   buildDocument,
@@ -697,3 +698,40 @@ describe("#notifications.update_all", () => {
     expect(body.data.total).toBe(2);
   });
 });
+
+describe("#notifications.unsubscribe", () => {
+  it("should allow unsubscribe with valid token", async () => {
+    const user = await buildUser();
+    const token = NotificationSettingsHelper.unsubscribeToken(
+      user.id,
+      NotificationEventType.UpdateDocument
+    );
+
+    const res = await server.get(
+      `/api/notifications.unsubscribe?userId=${user.id}&token=${token}&eventType=documents.update&follow=true`,
+      {
+        redirect: "manual",
+      }
+    );
+    expect(res.status).toBe(302);
+    expect(res.headers.get("location")).toContain(
+      "/settings/notifications?success"
+    );
+
+    const events = (await user.reload()).notificationSettings;
+    expect(events).not.toContain("documents.update");
+  });
+
+  it("should not allow unsubscribe with invalid token", async () => {
+    const user = await buildUser();
+
+    const res = await server.get(
+      `/api/notifications.unsubscribe?userId=${user.id}&token=invalid-token&eventType=documents.update&follow=true`,
+      {
+        redirect: "manual",
+      }
+    );
+    expect(res.status).toBe(302);
+    expect(res.headers.get("location")).toContain("?notice=invalid-auth");
+  });
+});

server/routes/api/notifications/notifications.ts

@@ -53,7 +53,7 @@ const handleUnsubscribe = async (
   });
 
   user.setNotificationEventType(eventType, false);
-  await user.save();
+  await user.save({ transaction });
   ctx.redirect(`${user.team.url}/settings/notifications?success`);
 };