fix(db): commit writes before response to close register->login race

FastAPI (>=0.106) runs yield-dependency teardown after the response
is sent, so get_db's teardown commit made /auth/register return 201
before the INSERT was durable; an immediate follow-up /auth/login
read the pre-commit snapshot and got 401. This is the intermittent
'registered but cannot log in' behavior.

- add db.commit_now() and call it in mutating routes (register,
  conversation create/delete, secret put/delete) so writes are
  durable before the response is sent
- start_run already committed early (worker thread dependency)

Verified live: 3x login(401)->register(201)->immediate-login(200),
single-label/case-insensitive emails 201/200. 96 tests, ruff,
pyright green.

Author: beacoder

app/db.py

@@ -57,7 +57,14 @@ def get_session_factory() -> sessionmaker[Session]:
 
 
 def get_db() -> Iterator[Session]:
-    """FastAPI dependency yielding a request-scoped session."""
+    """FastAPI dependency yielding a request-scoped session.
+
+    The commit happens BEFORE the response is returned: since
+    FastAPI 0.106, teardown of yield-dependencies runs after the
+    response has been sent, so committing in teardown would let a
+    client that fires a follow-up request immediately (register ->
+    login) read against the pre-commit snapshot and fail.
+    """
     factory = get_session_factory()
     db = factory()
     try:
@@ -70,6 +77,13 @@ def get_db() -> Iterator[Session]:
         db.close()
 
 
+def commit_now(db: Session) -> None:
+    """Commit immediately for mutating routes, so the write is durable
+    before the response is sent (see get_db docstring). Idempotent: a
+    later commit of a clean session is a no-op."""
+    db.commit()
+
+
 def reset_engine_for_tests(db_url: str) -> Engine:
     """Point the module-level singletons at a fresh (test) database."""
     global _engine, _session_factory

app/routes/auth.py

@@ -15,7 +15,7 @@
     hash_password,
     verify_password,
 )
-from ..db import get_db
+from ..db import commit_now, get_db
 from ..models import User, new_id
 from ..schemas import RefreshIn, RegisterIn, TokenPair, UserOut
 
@@ -71,6 +71,7 @@ def register(body: RegisterIn, db: Session = Depends(get_db)) -> TokenPair:
     )
     db.add(user)
     db.flush()
+    commit_now(db)
     return _token_pair(user)
 
 

app/routes/conversations.py

@@ -10,7 +10,7 @@
 from sqlalchemy.orm import Session
 
 from ..controller.manager import Controller, get_controller
-from ..db import get_db
+from ..db import commit_now, get_db
 from ..models import Conversation, Run, User, new_id
 from ..routes.auth import authenticate_user
 from ..schemas import (
@@ -55,6 +55,7 @@ def create_conversation(
     conversation = Conversation(id=new_id("cnv"), user_id=user.id, title=body.title)
     db.add(conversation)
     db.flush()
+    commit_now(db)
     return ConversationOut(
         id=conversation.id,
         title=conversation.title,
@@ -103,6 +104,7 @@ def delete_conversation(
 ) -> None:
     conversation = _own_conversation(db, user, conversation_id)
     db.delete(conversation)
+    commit_now(db)
 
 
 @router.post("/{conversation_id}/runs", response_model=RunOut, status_code=status.HTTP_202_ACCEPTED)

app/routes/secrets.py

@@ -12,7 +12,7 @@
 from sqlalchemy.orm import Session
 
 from ..core import secrets_store
-from ..db import get_db
+from ..db import commit_now, get_db
 from ..models import Secret, User, new_id
 from ..routes.auth import authenticate_user
 from ..schemas import SecretIn, SecretOut
@@ -33,6 +33,7 @@ def put_secret(
     if existing is not None:
         existing.value_encrypted = secrets_store.encrypt(body.value)
         db.flush()
+        commit_now(db)
         return SecretOut(name=name, created_at=existing.created_at)
     secret = Secret(
         id=new_id("sec"),
@@ -42,6 +43,7 @@ def put_secret(
     )
     db.add(secret)
     db.flush()
+    commit_now(db)
     return SecretOut(name=name, created_at=secret.created_at)
 
 
@@ -63,3 +65,4 @@ def delete_secret(
     if secret is None:
         raise HTTPException(status.HTTP_404_NOT_FOUND, "secret not found")
     db.delete(secret)
+    commit_now(db)