fix(db): report write errors, multi-step changes all or nothing (FLAW-14)

Store.execInTx runs related statements in one transaction and returns
the first error. Used for deleting and moving folders (with the trash),
shared folders, folder shares and mounts, deleting task lists and
accounts, pinning, and the password reset (new password and the end of
all other links together). Writes whose success the API reports now
pass their error to the client (logout, new password, setup, sharing
mode, new group, restore, unlinking a note block), follow-up tasks and
alarm markers log failures. Remaining ignored writes are listed as
intentional in flaws.md.

Found on the way: DeleteTaskList unlinked all tasks before checking
ownership, so a stranger with the list ID could empty it; viewers could
unlink tasks from note blocks. Both fixed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/storage/folders.go

@@ -105,15 +105,19 @@ func (s *Store) CreateFolder(userID, folderPath string) (string, error) {
 		var existsID string
 		err := s.db.QueryRow(`SELECT id FROM workspace_folders WHERE shared_folder_id = ? AND sub_path = ?`, sfID, subPath).Scan(&existsID)
 		if err == sql.ErrNoRows {
-			_, _ = s.db.Exec(`INSERT INTO workspace_folders (id, user_id, shared_folder_id, path, sub_path, created_at) VALUES (?, ?, ?, ?, ?, ?)`,
-				id, userID, sfID, clean, subPath, now)
+			if _, err := s.db.Exec(`INSERT INTO workspace_folders (id, user_id, shared_folder_id, path, sub_path, created_at) VALUES (?, ?, ?, ?, ?, ?)`,
+				id, userID, sfID, clean, subPath, now); err != nil {
+				return "", err
+			}
 		}
 	} else {
 		var existsID string
 		err := s.db.QueryRow(`SELECT id FROM workspace_folders WHERE user_id = ? AND path = ? AND (shared_folder_id = '' OR shared_folder_id IS NULL)`, userID, clean).Scan(&existsID)
 		if err == sql.ErrNoRows {
-			_, _ = s.db.Exec(`INSERT INTO workspace_folders (id, user_id, shared_folder_id, path, sub_path, created_at) VALUES (?, ?, '', ?, '', ?)`,
-				id, userID, clean, now)
+			if _, err := s.db.Exec(`INSERT INTO workspace_folders (id, user_id, shared_folder_id, path, sub_path, created_at) VALUES (?, ?, '', ?, '', ?)`,
+				id, userID, clean, now); err != nil {
+				return "", err
+			}
 		}
 	}
 
@@ -127,6 +131,7 @@ func (s *Store) DeleteFolder(userID, folderPath string) ([]string, error) {
 	}
 
 	var deletedDocIDs []string
+	var writes []sqlStmt
 	seenDocID := make(map[string]bool)
 
 	mounts, _, err := s.getUserFolderMounts(userID)
@@ -138,8 +143,7 @@ func (s *Store) DeleteFolder(userID, folderPath string) ([]string, error) {
 				shFolder, sfErr := s.GetSharedFolderByID(userID, sfID)
 				if sfErr == nil && !shFolder.IsOwner {
 					// Collaborator removing mount/share
-					_ = s.DeleteSharedFolder(userID, sfID)
-					return []string{}, nil
+					return []string{}, s.DeleteSharedFolder(userID, sfID)
 				}
 				rows, qErr := s.db.Query(`SELECT id FROM documents WHERE shared_folder_id = ?`, sfID)
 				if qErr == nil {
@@ -152,7 +156,7 @@ func (s *Store) DeleteFolder(userID, folderPath string) ([]string, error) {
 					}
 					_ = rows.Close()
 				}
-				_, _ = s.db.Exec(`DELETE FROM workspace_folders WHERE shared_folder_id = ?`, sfID)
+				writes = append(writes, stmt(`DELETE FROM workspace_folders WHERE shared_folder_id = ?`, sfID))
 			} else {
 				// Subfolder inside a shared folder
 				rows, qErr := s.db.Query(
@@ -169,8 +173,8 @@ func (s *Store) DeleteFolder(userID, folderPath string) ([]string, error) {
 					}
 					_ = rows.Close()
 				}
-				_, _ = s.db.Exec(`DELETE FROM workspace_folders WHERE shared_folder_id = ? AND (sub_path = ? OR sub_path LIKE ?)`,
-					sfID, subPath, subPath+"/%")
+				writes = append(writes, stmt(`DELETE FROM workspace_folders WHERE shared_folder_id = ? AND (sub_path = ? OR sub_path LIKE ?)`,
+					sfID, subPath, subPath+"/%"))
 			}
 		}
 	}
@@ -195,13 +199,18 @@ func (s *Store) DeleteFolder(userID, folderPath string) ([]string, error) {
 
 	// The notes of the folder go to the trash; restoring one creates its folder again
 	for _, id := range deletedDocIDs {
-		_ = s.trashDocument(userID, id)
+		writes = append(writes, trashStmts(userID, id)...)
 	}
 
 	// Also clear any personal folder placements for shared notes in this folder
-	_, _ = s.db.Exec(`UPDATE doc_user_folders SET folder_path = '' WHERE user_id = ? AND (folder_path = ? OR folder_path LIKE ?)`, userID, clean, clean+"/%")
-	_, _ = s.db.Exec(`DELETE FROM workspace_folders WHERE user_id = ? AND (path = ? OR path LIKE ?)`, userID, clean, clean+"/%")
+	writes = append(writes,
+		stmt(`UPDATE doc_user_folders SET folder_path = '' WHERE user_id = ? AND (folder_path = ? OR folder_path LIKE ?)`, userID, clean, clean+"/%"),
+		stmt(`DELETE FROM workspace_folders WHERE user_id = ? AND (path = ? OR path LIKE ?)`, userID, clean, clean+"/%"))
 
+	// All of it or nothing: no folder disappears while its notes stay behind, or the other way round
+	if err := s.execInTx(writes...); err != nil {
+		return nil, err
+	}
 	return deletedDocIDs, nil
 }
 
@@ -247,7 +256,9 @@ func (s *Store) MoveDocument(userID, docID, targetFolderPath string) (*domain.Do
 		}
 
 		// Remove personal override if any
-		_, _ = s.db.Exec(`DELETE FROM doc_user_folders WHERE user_id = ? AND doc_id = ?`, userID, docID)
+		if _, err := s.db.Exec(`DELETE FROM doc_user_folders WHERE user_id = ? AND doc_id = ?`, userID, docID); err != nil {
+			return nil, err
+		}
 
 		doc.SharedFolderID = targetFolderID
 		doc.SubFolderPath = subPath
@@ -355,10 +366,10 @@ func (s *Store) MoveFolder(userID, sourcePath, targetParentPath string) (string,
 				suffix := strings.TrimPrefix(doc.FolderPath, cleanSource)
 				nextDocFolder = newFolderPath + suffix
 			}
-			_, moveErr := s.MoveDocument(userID, doc.ID, nextDocFolder)
-			if moveErr == nil {
-				movedDocIDs = append(movedDocIDs, doc.ID)
+			if _, moveErr := s.MoveDocument(userID, doc.ID, nextDocFolder); moveErr != nil {
+				return "", movedDocIDs, fmt.Errorf("Notiz %q verschieben: %w", doc.Title, moveErr)
 			}
+			movedDocIDs = append(movedDocIDs, doc.ID)
 		}
 	}
 
@@ -366,8 +377,12 @@ func (s *Store) MoveFolder(userID, sourcePath, targetParentPath string) (string,
 	targetSFID, targetSub, isTargetSF := matchMountPath(newFolderPath, mounts)
 	sourceSFID, sourceSub, isSourceSF := matchMountPath(cleanSource, mounts)
 
+	var remap []sqlStmt
 	wfRows, qErr := s.db.Query(`SELECT id, user_id, shared_folder_id, path, sub_path FROM workspace_folders`)
-	if qErr == nil {
+	if qErr != nil {
+		return "", movedDocIDs, qErr
+	}
+	{
 		type wfRecord struct {
 			id, uid, sfID, path, subPath string
 		}
@@ -402,10 +417,10 @@ func (s *Store) MoveFolder(userID, sourcePath, targetParentPath string) (string,
 						newSub = targetSub + "/" + folderName + suffix
 					}
 					if isTargetSF {
-						_, _ = s.db.Exec(`UPDATE workspace_folders SET shared_folder_id = ?, sub_path = ? WHERE id = ?`, targetSFID, newSub, r.id)
+						remap = append(remap, stmt(`UPDATE workspace_folders SET shared_folder_id = ?, sub_path = ? WHERE id = ?`, targetSFID, newSub, r.id))
 					} else {
 						newP := newFolderPath + suffix
-						_, _ = s.db.Exec(`UPDATE workspace_folders SET shared_folder_id = '', sub_path = '', path = ? WHERE id = ?`, newP, r.id)
+						remap = append(remap, stmt(`UPDATE workspace_folders SET shared_folder_id = '', sub_path = '', path = ? WHERE id = ?`, newP, r.id))
 					}
 				}
 			} else if r.path == cleanSource || strings.HasPrefix(r.path, cleanSource+"/") {
@@ -418,24 +433,29 @@ func (s *Store) MoveFolder(userID, sourcePath, targetParentPath string) (string,
 					} else {
 						newSub = targetSub + "/" + folderName + suffix
 					}
-					_, _ = s.db.Exec(`UPDATE workspace_folders SET shared_folder_id = ?, sub_path = ?, path = ? WHERE id = ?`, targetSFID, newSub, newP, r.id)
+					remap = append(remap, stmt(`UPDATE workspace_folders SET shared_folder_id = ?, sub_path = ?, path = ? WHERE id = ?`, targetSFID, newSub, newP, r.id))
 				} else {
-					_, _ = s.db.Exec(`UPDATE workspace_folders SET path = ? WHERE id = ?`, newP, r.id)
+					remap = append(remap, stmt(`UPDATE workspace_folders SET path = ? WHERE id = ?`, newP, r.id))
 				}
 			}
 		}
 	}
 
-	_, _ = s.CreateFolder(userID, newFolderPath)
-
+	if err := s.execInTx(remap...); err != nil {
+		return "", movedDocIDs, err
+	}
+	if _, err := s.CreateFolder(userID, newFolderPath); err != nil {
+		return "", movedDocIDs, err
+	}
 	return newFolderPath, movedDocIDs, nil
 }
 
 // syncSharedFolderContents ensures all documents and subfolders under cleanMount owned by ownerID are linked to folderID.
-func (s *Store) syncSharedFolderContents(ownerID, folderID, cleanMount string) {
+func (s *Store) syncSharedFolderContents(ownerID, folderID, cleanMount string) error {
 	if ownerID == "" || folderID == "" || cleanMount == "" {
-		return
+		return nil
 	}
+	var links []sqlStmt
 
 	// 1. Link all documents owned by ownerID in cleanMount to this shared folder
 	rows, err := s.db.Query(`SELECT id, folder_path FROM documents WHERE user_id = ? AND is_archived = 0 AND (folder_path = ? OR folder_path LIKE ?)`,
@@ -458,8 +478,8 @@ func (s *Store) syncSharedFolderContents(ownerID, folderID, cleanMount string) {
 			} else if strings.HasPrefix(de.fp, cleanMount+"/") {
 				subPath = strings.TrimPrefix(de.fp, cleanMount+"/")
 			}
-			_, _ = s.db.Exec(`UPDATE documents SET shared_folder_id = ?, sub_folder_path = ? WHERE id = ?`,
-				folderID, subPath, de.id)
+			links = append(links, stmt(`UPDATE documents SET shared_folder_id = ?, sub_folder_path = ? WHERE id = ?`,
+				folderID, subPath, de.id))
 		}
 	}
 
@@ -482,10 +502,11 @@ func (s *Store) syncSharedFolderContents(ownerID, folderID, cleanMount string) {
 			if strings.HasPrefix(wfe.path, cleanMount+"/") {
 				subP = strings.TrimPrefix(wfe.path, cleanMount+"/")
 			}
-			_, _ = s.db.Exec(`UPDATE workspace_folders SET shared_folder_id = ?, sub_path = ? WHERE id = ?`,
-				folderID, subP, wfe.id)
+			links = append(links, stmt(`UPDATE workspace_folders SET shared_folder_id = ?, sub_path = ? WHERE id = ?`,
+				folderID, subP, wfe.id))
 		}
 	}
+	return s.execInTx(links...)
 }
 
 func (s *Store) CreateSharedFolder(userID, folderName, initialMountPath string) (*domain.SharedFolder, error) {
@@ -506,7 +527,9 @@ func (s *Store) CreateSharedFolder(userID, folderName, initialMountPath string)
 		WHERE f.owner_id = ? AND (m.mount_path = ? OR f.name = ?)
 	`, userID, userID, cleanMount, cleanName).Scan(&existingID)
 	if err == nil && existingID != "" {
-		s.syncSharedFolderContents(userID, existingID, cleanMount)
+		if err := s.syncSharedFolderContents(userID, existingID, cleanMount); err != nil {
+			return nil, err
+		}
 		return s.GetSharedFolderByID(userID, existingID)
 	}
 
@@ -529,7 +552,9 @@ func (s *Store) CreateSharedFolder(userID, folderName, initialMountPath string)
 		return nil, err
 	}
 
-	s.syncSharedFolderContents(userID, folderID, cleanMount)
+	if err := s.syncSharedFolderContents(userID, folderID, cleanMount); err != nil {
+		return nil, err
+	}
 
 	var ownerName string
 	_ = s.db.QueryRow(`SELECT display_name FROM users WHERE id = ?`, userID).Scan(&ownerName)
@@ -756,13 +781,16 @@ func (s *Store) CreateFolderShare(currentUserID, folderID, targetType, targetIde
 	if ownerMount == "" {
 		ownerMount = f.Name
 	}
-	s.syncSharedFolderContents(f.OwnerID, folderID, ownerMount)
+	if err := s.syncSharedFolderContents(f.OwnerID, folderID, ownerMount); err != nil {
+		return nil, err
+	}
 
+	var mounts []sqlStmt
 	if cleanType == "user" {
-		_, _ = s.db.Exec(`
+		mounts = append(mounts, stmt(`
 			INSERT OR IGNORE INTO workspace_folder_mounts (user_id, folder_id, mount_path, created_at, updated_at)
 			VALUES (?, ?, ?, ?, ?)
-		`, targetID, folderID, f.Name, now, now)
+		`, targetID, folderID, f.Name, now, now))
 	} else if cleanType == "team" {
 		mRows, err := s.db.Query(`SELECT user_id FROM team_members WHERE team_id = ?`, targetID)
 		if err == nil {
@@ -775,13 +803,16 @@ func (s *Store) CreateFolderShare(currentUserID, folderID, targetType, targetIde
 			}
 			_ = mRows.Close()
 			for _, uid := range memberIDs {
-				_, _ = s.db.Exec(`
+				mounts = append(mounts, stmt(`
 					INSERT OR IGNORE INTO workspace_folder_mounts (user_id, folder_id, mount_path, created_at, updated_at)
 					VALUES (?, ?, ?, ?, ?)
-				`, uid, folderID, f.Name, now, now)
+				`, uid, folderID, f.Name, now, now))
 			}
 		}
 	}
+	if err := s.execInTx(mounts...); err != nil {
+		return nil, err
+	}
 
 	return &domain.FolderShare{
 		ID:         shareID,
@@ -806,24 +837,21 @@ func (s *Store) DeleteFolderShare(currentUserID, folderID, shareID string) error
 
 	// Only the owner manages shares; everyone else can only leave the folder
 	if !f.IsOwner {
-		_, err = s.db.Exec(`DELETE FROM workspace_folder_shares WHERE folder_id = ? AND target_type = 'user' AND target_id = ? AND (id = ? OR target_id = ?)`,
-			folderID, currentUserID, cleanID, cleanID)
-		_, _ = s.db.Exec(`DELETE FROM workspace_folder_mounts WHERE folder_id = ? AND user_id = ?`, folderID, currentUserID)
-		return err
+		return s.execInTx(
+			stmt(`DELETE FROM workspace_folder_shares WHERE folder_id = ? AND target_type = 'user' AND target_id = ? AND (id = ? OR target_id = ?)`,
+				folderID, currentUserID, cleanID, cleanID),
+			stmt(`DELETE FROM workspace_folder_mounts WHERE folder_id = ? AND user_id = ?`, folderID, currentUserID))
 	}
 
 	var targetType, targetID string
 	_ = s.db.QueryRow(`SELECT target_type, target_id FROM workspace_folder_shares WHERE folder_id = ? AND (id = ? OR target_id = ?)`,
 		folderID, cleanID, cleanID).Scan(&targetType, &targetID)
 
-	_, err = s.db.Exec(`DELETE FROM workspace_folder_shares WHERE folder_id = ? AND (id = ? OR target_id = ?)`, folderID, cleanID, cleanID)
-	if err != nil {
-		return err
-	}
+	writes := []sqlStmt{stmt(`DELETE FROM workspace_folder_shares WHERE folder_id = ? AND (id = ? OR target_id = ?)`, folderID, cleanID, cleanID)}
 	if targetType == "user" && targetID != "" {
-		_, _ = s.db.Exec(`DELETE FROM workspace_folder_mounts WHERE folder_id = ? AND user_id = ?`, folderID, targetID)
+		writes = append(writes, stmt(`DELETE FROM workspace_folder_mounts WHERE folder_id = ? AND user_id = ?`, folderID, targetID))
 	}
-	return nil
+	return s.execInTx(writes...)
 }
 
 func (s *Store) DeleteSharedFolder(currentUserID, folderID string) error {
@@ -835,12 +863,12 @@ func (s *Store) DeleteSharedFolder(currentUserID, folderID string) error {
 		return s.DeleteFolderShare(currentUserID, folderID, currentUserID)
 	}
 
-	_, _ = s.db.Exec(`UPDATE documents SET shared_folder_id = '', sub_folder_path = '' WHERE shared_folder_id = ?`, folderID)
-	_, _ = s.db.Exec(`DELETE FROM workspace_folder_mounts WHERE folder_id = ?`, folderID)
-	_, _ = s.db.Exec(`DELETE FROM workspace_folder_shares WHERE folder_id = ?`, folderID)
-	_, _ = s.db.Exec(`DELETE FROM workspace_folders WHERE shared_folder_id = ?`, folderID)
-	_, err = s.db.Exec(`DELETE FROM workspace_shared_folders WHERE id = ?`, folderID)
-	return err
+	return s.execInTx(
+		stmt(`UPDATE documents SET shared_folder_id = '', sub_folder_path = '' WHERE shared_folder_id = ?`, folderID),
+		stmt(`DELETE FROM workspace_folder_mounts WHERE folder_id = ?`, folderID),
+		stmt(`DELETE FROM workspace_folder_shares WHERE folder_id = ?`, folderID),
+		stmt(`DELETE FROM workspace_folders WHERE shared_folder_id = ?`, folderID),
+		stmt(`DELETE FROM workspace_shared_folders WHERE id = ?`, folderID))
 }
 
 // GetSharedFolderDocIDs returns all non-archived document IDs belonging to a shared folder.