refactor: remove db.commit() from business services, callers use UnitOfWork (Tier 3)

backend/app/domain/unit_of_work.py

@@ -10,6 +10,16 @@ Usage in routers::
 If an exception propagates, ``__exit__`` issues a rollback automatically.
 Services should **never** call ``db.commit()``; they use ``db.add()`` /
 ``db.flush()`` to stage work and let the caller decide when to commit.
+
+**Documented exceptions** (services that may commit internally):
+- ``audit_service.log_action`` — called from 15+ routers; commits to ensure
+  audit records persist even when callers do not.
+- Import services (atomic_import, sigma_import, etc.) — self-contained sync ops.
+- Background jobs (campaign_scheduler, intel_service, stale_detection,
+  mitre_sync) — self-contained operations.
+- Self-contained batch ops (e.g. detection_rule_service.auto_associate_rules,
+  snapshot_service.create_snapshot, campaign_service.generate_campaign_from_*,
+  osint_enrichment_service.enrich_technique_with_cves).
 """
 
 from __future__ import annotations

backend/app/routers/osint.py

@@ -10,6 +10,7 @@ from sqlalchemy.orm import Session
 
 from app.database import get_db
 from app.dependencies.auth import get_current_user, require_any_role
+from app.domain.unit_of_work import UnitOfWork
 from app.models.user import User
 from app.services.osint_enrichment_service import (
     enrich_technique_with_cves,
@@ -82,12 +83,14 @@ def review_osint_item(
     user: User = Depends(get_current_user),
 ):
     """Mark an OSINT item as reviewed."""
+    with UnitOfWork(db) as uow:
         item = mark_osint_reviewed(db, str(item_id))
         if not item:
             raise HTTPException(
                 status_code=status.HTTP_404_NOT_FOUND,
                 detail="OSINT item not found",
             )
+        uow.commit()
     return {"id": str(item.id), "reviewed": True}
 
 

backend/app/routers/scores.py

@@ -11,6 +11,7 @@ from sqlalchemy.orm import Session
 
 from app.database import get_db
 from app.dependencies.auth import get_current_user, require_role
+from app.domain.unit_of_work import UnitOfWork
 from app.models.user import User
 from app.services.scoring_service import (
     score_technique_by_mitre_id,
@@ -127,6 +128,7 @@ def update_scoring_config(
     Weights are persisted in the database and survive restarts.
     Validation enforces that all weights are non-negative and sum to 100.
     """
+    with UnitOfWork(db) as uow:
         result = update_scoring_weights(
             db,
             tests=payload.tests,
@@ -135,6 +137,7 @@ def update_scoring_config(
             freshness=payload.freshness,
             platform_diversity=payload.platform_diversity,
         )
+        uow.commit()
 
     from app.services.score_cache import invalidate
     invalidate()

backend/app/routers/worklogs.py

@@ -10,6 +10,7 @@ from sqlalchemy.orm import Session
 
 from app.database import get_db
 from app.dependencies.auth import get_current_user, require_any_role
+from app.domain.unit_of_work import UnitOfWork
 from app.models.user import User
 from app.services import worklog_service
 
@@ -57,6 +58,7 @@ def create(
     user: User = Depends(require_any_role("red_tech", "blue_tech", "red_lead", "blue_lead")),
 ):
     """Create a manually-logged worklog entry."""
+    with UnitOfWork(db) as uow:
         wl = worklog_service.create_worklog(
             db,
             entity_type=body.entity_type,
@@ -68,6 +70,8 @@ def create(
             duration_seconds=body.duration_seconds,
             description=body.description,
         )
+        uow.commit()
+    db.refresh(wl)
     return wl
 
 

backend/app/services/osint_enrichment_service.py

@@ -181,12 +181,10 @@ def get_osint_items_for_technique(
 
 
 def mark_osint_reviewed(db: Session, item_id: str) -> OsintItem | None:
-    """Mark an OSINT item as reviewed."""
+    """Mark an OSINT item as reviewed. Does not commit; caller uses UnitOfWork."""
     item = db.query(OsintItem).filter(OsintItem.id == item_id).first()
     if item:
         item.reviewed = True
-        db.commit()
-        db.refresh(item)
     return item
 
 

backend/app/services/scoring_config_service.py

@@ -82,9 +82,7 @@ def update_scoring_weights(
     row.weight_freshness = new.freshness
     row.weight_platform_diversity = new.platform_diversity
 
-    db.commit()
+    # Does not commit; caller (router) uses UnitOfWork.
-    db.refresh(row)
-
     return _weights_dict(new)
 
 

backend/app/services/worklog_service.py

@@ -39,8 +39,7 @@ def create_worklog(
     )
     wl.integrity_hash = _compute_hash(wl)
     db.add(wl)
-    db.commit()
+    # Does not commit; caller (router) uses UnitOfWork.
-    db.refresh(wl)
     return wl