Saving All Or Nothing with Database Transactions

Hi @tomgobich

I’m having trouble handling transactions after my refactor. How would you approach this?

type Params = {
  payload: Infer<typeof forgotPasswordValidator>
}

type SendPasswordResetResult = { status: 'sent' } | { status: 'rate_limited' }

@inject()
export default class SendPasswordResetEmail {
  constructor(protected rateLimiterService: RateLimiterService) {}

  async handle({ payload }: Params): Promise<SendPasswordResetResult> {
    const ipLimiter = this.rateLimiterService.forgotPasswordIpLimiter()
    const emailLimiter = this.rateLimiterService.forgotPasswordEmailLimiter()

    const ipKey = this.rateLimiterService.forgotPasswordIpKey()
    const emailKey = this.rateLimiterService.forgotPasswordEmailKey(payload.email)

    try {
      await ipLimiter.consume(ipKey)
      await emailLimiter.consume(emailKey)

      const user = await User.query().where('email', payload.email).first()
      const { token, hash } = generateTokenAndHash()

      if (!user) return { status: 'sent' }
      // Transaction is needed here

      await RevokePasswordResetTokens.handle({ user })
      await CreatePasswordResetToken.handle({ user, hash })

      PasswordResetRequested.dispatch(user, token)

      return { status: 'sent' }
    } catch (error) {
      if (error instanceof errors.E_TOO_MANY_REQUESTS) {
        return { status: 'rate_limited' }
      }

      throw error
    }
  }
}

  

    

      Copied!
      

        

      
    
  
  
    
    
    
    
  

// This class revokes all active password‑reset tokens for the user
export default class RevokePasswordResetTokens {
  static async handle({ user }: Params) {
    await validPasswordResetTokens(user).update({
      revokedAt: DateTime.now(),
      revokedBy: 'user',
      revokedReason: 'new_token_requested',
    })
  }
}

  

    

      Copied!
      

        

      
    
  
  
    
    
    
    
  

// This query returns all valid password‑reset tokens for the user,
export function validPasswordResetTokens(user: User) {
  return user
    .related('passwordResetTokens')
    .query()
    .whereNull('usedAt')
    .whereNull('revokedAt')
    .where('expiresAt', '>=', DateTime.now().toSQL())
}

  

    

      Copied!
      

        

      
    
  
  
    
    
    
    
  

// This class creates a new password‑reset tokens record,
// storing a hash that expires in 15 minutes.
export default class CreatePasswordResetToken {
  static async handle({ user, hash }: Params) {
    await user.related('passwordResetTokens').create({
      hash,
      expiresAt: DateTime.now().plus({ minutes: 15 }),
    })
  }
}

  

    

      Copied!
      

        

      
    
  
  
    
    
    
    
  

I suppose I have to start it like this, but after that I’m stuck:

await db.transaction(async (trx) => {
  await RevokePasswordResetTokens.handle({ user, trx })
  await CreatePasswordResetToken.handle({ user, hash, trx })
})

  

    

      Copied!