fix(db): report write errors, multi-step changes all or nothing (FLAW-14)

Store.execInTx runs related statements in one transaction and returns
the first error. Used for deleting and moving folders (with the trash),
shared folders, folder shares and mounts, deleting task lists and
accounts, pinning, and the password reset (new password and the end of
all other links together). Writes whose success the API reports now
pass their error to the client (logout, new password, setup, sharing
mode, new group, restore, unlinking a note block), follow-up tasks and
alarm markers log failures. Remaining ignored writes are listed as
intentional in flaws.md.

Found on the way: DeleteTaskList unlinked all tasks before checking
ownership, so a stranger with the list ID could empty it; viewers could
unlink tasks from note blocks. Both fixed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/alarms.go

@@ -150,7 +150,9 @@ func (s *Server) startAlarmTicker() {
 			}
 
 			if sentAny {
-				_ = s.store.MarkTaskAlarmSent(a.TaskID)
+				if err := s.store.MarkTaskAlarmSent(a.TaskID); err != nil {
+					slog.Error("Alarm als gesendet markieren fehlgeschlagen (wird erneut gesendet)", "task_id", a.TaskID, "error", err)
+				}
 			} else if gaveUp, _ := s.store.RecordTaskAlarmFailure(a.TaskID); gaveUp {
 				slog.Warn("Aufgaben-Alarm nach 3 Fehlversuchen aufgegeben", "task_id", a.TaskID, "title", a.Title)
 			}

internal/api/handlers_admin.go

@@ -319,7 +319,10 @@ func (s *Server) handleAdminUpdateSettings(w http.ResponseWriter, r *http.Reques
 	}
 	// A stricter mode takes away what is no longer allowed (shares, group memberships, assignments)
 	if settings.SharingMode != previousMode {
-		_, _ = s.store.PruneSharing(settings.SharingMode, false)
+		if _, err := s.store.PruneSharing(settings.SharingMode, false); err != nil {
+			writeError(w, http.StatusInternalServerError, "Freigaben konnten nicht angepasst werden: "+err.Error())
+			return
+		}
 	}
 	settings.SMTPConfiguredViaEnv = strings.TrimSpace(s.cfg.SMTPHost) != ""
 	writeJSON(w, http.StatusOK, settings)

internal/api/handlers_auth.go

@@ -128,7 +128,10 @@ func (s *Server) handleFirstBootSetup(w http.ResponseWriter, r *http.Request) {
 		}
 		sys.AllowRegistration = req.AllowRegistration
 		sys.SharingMode = storage.NormalizeSharingMode(req.SharingMode)
-		_ = s.store.UpdateSystemSettings(sys)
+		if err := s.store.UpdateSystemSettings(sys); err != nil {
+			writeError(w, http.StatusInternalServerError, "Einstellungen konnten nicht gespeichert werden: "+err.Error())
+			return
+		}
 		// In organization mode the first admin starts in an organization named after the instance
 		if sys.SharingMode == storage.SharingOrganizations {
 			if org, err := s.store.CreateOrganization(sys.InstanceName); err == nil {
@@ -216,7 +219,10 @@ func (s *Server) handleRegister(w http.ResponseWriter, r *http.Request) {
 	}
 
 	if validInvite != nil {
-		_ = s.store.MarkUserInviteUsed(validInvite.ID, user.ID)
+		// Otherwise the code could be used again
+		if err := s.store.MarkUserInviteUsed(validInvite.ID, user.ID); err != nil {
+			slog.Error("Einladungscode konnte nicht als benutzt markiert werden", "invite", validInvite.ID, "error", err)
+		}
 		if validInvite.OrganizationID != "" {
 			_ = s.store.SetUserOrganization(user.ID, validInvite.OrganizationID)
 			user.OrganizationID = validInvite.OrganizationID
@@ -397,7 +403,11 @@ func (s *Server) handleLogout(w http.ResponseWriter, r *http.Request) {
 			} else {
 				exp = time.Now().Add(30 * 24 * time.Hour)
 			}
-			_ = s.store.RevokeToken(tokenStr, userID, exp)
+			// The session must really end; the client is told if it did not
+			if err := s.store.RevokeToken(tokenStr, userID, exp); err != nil {
+				writeError(w, http.StatusInternalServerError, "Abmelden fehlgeschlagen")
+				return
+			}
 		}
 	}
 	// Streams are not tied to one session; other devices reconnect with a new ticket on their own
@@ -456,7 +466,10 @@ func (s *Server) handleUpdateUserSettings(w http.ResponseWriter, r *http.Request
 			writeError(w, http.StatusInternalServerError, "Fehler beim Hashen des Passworts")
 			return
 		}
-		_ = s.store.UpdateUserPassword(userID, hash)
+		if err := s.store.UpdateUserPassword(userID, hash); err != nil {
+			writeError(w, http.StatusInternalServerError, "Passwort konnte nicht gespeichert werden")
+			return
+		}
 		s.wsHub.DisconnectUser(userID)
 	}
 	u, err := s.store.UpdateUserFull(

internal/api/handlers_tasklists.go

@@ -72,7 +72,7 @@ func (s *Server) handleDeleteTaskList(w http.ResponseWriter, r *http.Request) {
 	listID := chi.URLParam(r, "id")
 	audienceBefore := s.store.GetTaskListUserIDs(listID)
 	if err := s.store.DeleteTaskList(userID, listID); err != nil {
-		writeError(w, http.StatusInternalServerError, err.Error())
+		writeError(w, http.StatusNotFound, err.Error())
 		return
 	}
 	s.broadcastTaskListChange(listID, audienceBefore, "TASK_LIST_DELETED")

internal/api/handlers_teams.go

@@ -52,7 +52,10 @@ func (s *Server) handleCreateTeamDirect(w http.ResponseWriter, r *http.Request)
 		return
 	}
 	// Automatically add creator to team as group admin
-	_ = s.store.AddTeamMember(team.ID, userID, "admin")
+	if err := s.store.AddTeamMember(team.ID, userID, "admin"); err != nil {
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
 	team.Members, _ = s.store.GetTeamMembers(team.ID)
 	writeJSON(w, http.StatusCreated, team)
 }

internal/api/handlers_thoughts.go

@@ -284,7 +284,10 @@ func (s *Server) handleUpdateThought(w http.ResponseWriter, r *http.Request) {
 func (s *Server) handleUnlinkEnhancedTask(w http.ResponseWriter, r *http.Request) {
 	userID := auth.GetUserID(r.Context())
 	thoughtID := chi.URLParam(r, "id")
-	s.store.UnlinkTaskFromDocBlock(userID, thoughtID)
+	if err := s.store.UnlinkTaskFromDocBlock(userID, thoughtID); err != nil {
+		writeStoreError(w, http.StatusNotFound, err)
+		return
+	}
 	writeJSON(w, http.StatusOK, map[string]bool{"unlinked": true})
 }
 
@@ -297,7 +300,6 @@ func (s *Server) handleDeleteThought(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	audience := s.taskAudience(th)
-	s.store.UnlinkTaskFromDocBlock(userID, thoughtID)
 	if err := s.store.DeleteThought(userID, thoughtID); err != nil {
 		writeStoreError(w, http.StatusInternalServerError, err)
 		return

internal/api/server.go

@@ -32,7 +32,7 @@ type Server struct {
 
 	demo          demoState     // periodic reset in demo mode (demo.go)
 	streamTickets streamTickets // one-time tickets for WebSocket/SSE (streamticket.go)
-	loginGuard *loginGuard // brute-force protection (loginguard.go)
+	loginGuard    *loginGuard   // brute-force protection (loginguard.go)
 }
 
 func NewServer(cfg *config.Config, store *storage.Store, wsHub *ws.Hub, staticFS fs.FS) *Server {