fix: EventSession.commit() discards eager-loaded relations on watched models

fix: Depends(db) resolved twice in one request opens two sessions and silently discards writes

docs/module/db.md

@@ -54,7 +54,7 @@ db = Database(
 
 ## Committing before the response
 
-[`db.install(app)`](../reference/db.md#fastapi_toolsets.db.Database) adds a middleware that commits the request's session when the response starts, after the endpoint returns and before the body is sent. With the middleware installed, the dependency does not commit again.
+[`db.install(app)`](../reference/db.md#fastapi_toolsets.db.Database) adds a middleware that commits the request's session when the response starts, after the endpoint returns and before the body is sent. The dependency commits only if the middleware did not: when a function-scoped dependency unwinds before the response, or when the response never passes through the middleware. Either way the request is committed exactly once.
 
 The request is committed as a single transaction:
 

pyproject.toml

@@ -101,7 +101,7 @@ exclude = ["*.md"]
 extend-select = ["E712"]
 
 [tool.ruff.lint.flake8-bugbear]
-extend-immutable-calls = ["fastapi.Depends"]
+extend-immutable-calls = ["fastapi.Depends", "fastapi.Security"]
 
 [tool.ruff.lint.per-file-ignores]
 "tests/**" = ["RUF012", "RUF059", "SIM117", "DTZ001", "S110", "BLE001"]

src/fastapi_toolsets/crud/search.py

@@ -160,9 +160,11 @@ def build_search_filters(
             column = field
 
         # Build the filter (cast to String only when needed, to preserve
-        # pg_trgm GIN index usability on already-String columns)
+        # pg_trgm GIN index usability on already-String columns).
         column_as_string = (
-            column if isinstance(column.type, String) else column.cast(String)
+            column
+            if isinstance(column.type, String) and not isinstance(column.type, Enum)
+            else column.cast(String)
         )
         if config.case_sensitive:
             filters.append(column_as_string.like(f"%{query}%"))

src/fastapi_toolsets/db/core.py

@@ -66,10 +66,8 @@ class _CommitOnResponseMiddleware:
 
         async def send_wrapper(message: Message) -> None:
             if message["type"] == "http.response.start":
-                # ``scope["state"]`` is the same dict ``request.state`` writes
-                # to, so this is the session stashed by the dependency.
                 state = scope.get("state")
-                session = state.get(self.state_attr) if state else None
+                session = state.pop(self.state_attr, None) if state else None
                 if session is not None and session.in_transaction():
                     await session.commit()
             await send(message)
@@ -158,7 +156,6 @@ class Database:
         # Private, per-instance state attribute; cannot collide with another
         # Database or be mismatched against the middleware.
         self._state_attr = f"_ft_db_session_{id(self):x}"
-        self._middleware_installed = False
         self._disposed = False
 
     async def _dispose(self) -> None:
@@ -206,7 +203,6 @@ class Database:
             ```
         """
         app.add_middleware(_CommitOnResponseMiddleware, state_attr=self._state_attr)
-        self._middleware_installed = True
 
         inner_lifespan = app.router.lifespan_context
 
@@ -243,10 +239,17 @@ class Database:
                 return await UserCrud.get(session, [User.id == user_id])
             ```
         """
+        borrowed = getattr(request.state, self._state_attr, None)
+        if borrowed is not None:
+            yield borrowed
+            return
         async with self._open() as session:
             setattr(request.state, self._state_attr, session)
             yield session
-            if not self._middleware_installed and session.in_transaction():
+            if (
+                getattr(request.state, self._state_attr, None) is session
+                and session.in_transaction()
+            ):
                 await session.commit()
 
     @asynccontextmanager

src/fastapi_toolsets/models/watched.py

@@ -8,6 +8,7 @@ from typing import Any
 from sqlalchemy import event, select, tuple_
 from sqlalchemy import inspect as sa_inspect
 from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy.orm import selectinload
 from sqlalchemy.orm.attributes import set_committed_value as _sa_set_committed_value
 
 from ..logger import get_logger
@@ -189,17 +190,44 @@ async def _invoke_callback(
         await result
 
 
+def _loaded_relationships(obj: Any) -> set[str]:
+    """Relationship keys currently loaded on *obj*."""
+    state = sa_inspect(obj)
+    unloaded = state.unloaded
+    return {
+        rel.key
+        for rel in state.mapper.relationships
+        if rel.key not in unloaded and rel.lazy not in ("dynamic", "write_only")
+    }
+
+
+def _snapshot_loaded_relationships(session: Any) -> dict[int, set[str]]:
+    """Record loaded relationships for the tracked objects, keyed by ``id``."""
+    objs = list(session.info.get(_SESSION_CREATES, []))
+    objs += [obj for obj, _ in session.info.get(_SESSION_UPDATES, {}).values()]
+    return {id(obj): _loaded_relationships(obj) for obj in objs}
+
+
 async def _batch_reload(
-    session: AsyncSession, model: type, pk_tuples: list[tuple[Any, ...]]
+    session: AsyncSession,
+    model: type,
+    objs: list[Any],
+    preloaded: dict[int, set[str]],
 ) -> None:
-    """Re-populate all rows of *model* identified by *pk_tuples* in one round trip."""
+    """Re-populate all rows of *model* in one round trip."""
     pk_cols = sa_inspect(model, raiseerr=True).primary_key
+    pk_tuples = [sa_inspect(obj).key[1] for obj in objs]
     where = (
         pk_cols[0].in_([pk[0] for pk in pk_tuples])
         if len(pk_cols) == 1
         else tuple_(*pk_cols).in_(pk_tuples)
     )
     q = select(model).where(where).execution_options(populate_existing=True)
+    loaded: set[str] = set()
+    for obj in objs:
+        loaded |= preloaded.get(id(obj), set())
+    if loaded:
+        q = q.options(*(selectinload(getattr(model, key)) for key in loaded))
     await session.execute(q)
 
 
@@ -207,6 +235,7 @@ class EventSession(AsyncSession):
     """AsyncSession subclass that dispatches lifecycle callbacks after commit."""
 
     async def commit(self) -> None:
+        preloaded = _snapshot_loaded_relationships(self)
         await super().commit()
 
         creates: list[Any] = self.info.pop(_SESSION_CREATES, [])
@@ -249,25 +278,25 @@ class EventSession(AsyncSession):
         # session.get() per object.
         create_items: list[Any] = []
         update_items: list[tuple[Any, dict[str, dict[str, Any]]]] = []
-        pk_by_type: dict[type, list[tuple[Any, ...]]] = {}
+        objs_by_type: dict[type, list[Any]] = {}
 
         for obj in creates:
             state = sa_inspect(obj, raiseerr=False)
             if state is None or state.detached or state.transient:  # pragma: no cover
                 continue
             create_items.append(obj)
-            pk_by_type.setdefault(type(obj), []).append(state.key[1])
+            objs_by_type.setdefault(type(obj), []).append(obj)
 
         for obj, changes in field_changes.values():
             state = sa_inspect(obj, raiseerr=False)
             if state is None or state.detached or state.transient:  # pragma: no cover
                 continue
             update_items.append((obj, changes))
-            pk_by_type.setdefault(type(obj), []).append(state.key[1])
+            objs_by_type.setdefault(type(obj), []).append(obj)
 
-        for model, pk_tuples in pk_by_type.items():
+        for model, objs in objs_by_type.items():
             try:
-                await _batch_reload(self, model, pk_tuples)
+                await _batch_reload(self, model, objs, preloaded)
             except Exception as exc:
                 _logger.error(_CALLBACK_ERROR_MSG, exc_info=exc)
 

tests/test_crud_search.py

@@ -388,6 +388,76 @@ class TestBuildSearchFilters:
 
         assert "CAST" in str(filters[0])
 
+    def test_casts_enum_column(self):
+        """Enum subclasses String but maps to a native DB enum, which has no ILIKE."""
+        from fastapi_toolsets.crud.search import build_search_filters
+
+        filters, _ = build_search_filters(Order, "PEND", search_fields=[Order.status])
+
+        assert "CAST" in str(filters[0])
+
+
+class TestSearchEnumColumn:
+    """Searching an enum column must reach the database, not just build SQL."""
+
+    @pytest.mark.anyio
+    async def test_search_int_backed_enum(self, db_session: AsyncSession):
+        """Enum(int, Enum) stores names, so the cast makes 'PEND' match PENDING."""
+        await OrderCrud.create(
+            db_session, OrderCreate(name="a", status=OrderStatus.PENDING)
+        )
+        await OrderCrud.create(
+            db_session, OrderCreate(name="b", status=OrderStatus.SHIPPED)
+        )
+
+        result = await OrderCrud.offset_paginate(
+            db_session,
+            search="PEND",
+            search_fields=[Order.status],
+            schema=OrderRead,
+        )
+
+        assert result.pagination.total_count == 1
+        assert result.data[0].status is OrderStatus.PENDING
+
+    @pytest.mark.anyio
+    async def test_search_str_backed_enum(self, db_session: AsyncSession):
+        """Same for Enum(str, Enum) — still a native DB enum, still needs the cast."""
+        await OrderCrud.create(
+            db_session,
+            OrderCreate(name="a", status=OrderStatus.PENDING, color=Color.BLUE),
+        )
+        await OrderCrud.create(
+            db_session,
+            OrderCreate(name="b", status=OrderStatus.PENDING, color=Color.RED),
+        )
+
+        result = await OrderCrud.offset_paginate(
+            db_session,
+            search="BLU",
+            search_fields=[Order.color],
+            schema=OrderRead,
+        )
+
+        assert result.pagination.total_count == 1
+        assert result.data[0].color is Color.BLUE
+
+    @pytest.mark.anyio
+    async def test_search_mixed_enum_and_string_columns(self, db_session: AsyncSession):
+        """An enum column alongside a plain String column (the get_searchable_fields shape)."""
+        await OrderCrud.create(
+            db_session, OrderCreate(name="widget", status=OrderStatus.SHIPPED)
+        )
+
+        result = await OrderCrud.offset_paginate(
+            db_session,
+            search="widget",
+            search_fields=[Order.name, Order.status, Order.color],
+            schema=OrderRead,
+        )
+
+        assert result.pagination.total_count == 1
+
 
 class TestSearchConfig:
     """Tests for SearchConfig options."""

tests/test_db.py

@@ -6,7 +6,7 @@ from contextlib import asynccontextmanager
 from unittest.mock import AsyncMock, MagicMock, patch
 
 import pytest
-from fastapi import Depends, FastAPI
+from fastapi import Depends, FastAPI, Security
 from fastapi.responses import StreamingResponse
 from httpx import ASGITransport, AsyncClient
 from pydantic import PostgresDsn
@@ -287,23 +287,37 @@ class TestDatabaseDependency:
             break
 
     @pytest.mark.anyio
-    async def test_skips_commit_when_middleware_installed(self, engine, session_maker):
-        """With ``install()``, the dependency must NOT commit — the middleware owns it.
+    async def test_second_resolution_borrows_session(self, engine):
+        """A second ``Depends(db)`` in one request reuses the stashed session."""
+        db = Database(engine=engine)
+        request = _make_request()
 
-        Here no middleware actually runs (we call the dependency directly), so the
-        open transaction is rolled back on session close and nothing persists.
-        """
+        owner_gen = db(request)
+        owner = await anext(owner_gen)
+        borrower_gen = db(request)
+        assert await anext(borrower_gen) is owner
+
+        with pytest.raises(StopAsyncIteration):  # teardown runs borrower-first
+            await anext(borrower_gen)
+        assert owner.in_transaction()  # the borrower must not close what it borrowed
+
+        with pytest.raises(StopAsyncIteration):
+            await anext(owner_gen)
+
+    @pytest.mark.anyio
+    async def test_commits_when_middleware_did_not_run(self, engine, session_maker):
+        """``install()`` is per-``Database``, but the commit is per-request."""
         db = Database(engine=engine)
         db.install(FastAPI())
 
         async for session in db(_make_request()):
-            role = Role(name="mw_owns_commit")
+            role = Role(name="mw_never_ran")
             session.add(role)
             await session.flush()
 
         async with session_maker() as verify:
-            result = await RoleCrud.first(verify, [Role.name == "mw_owns_commit"])
-            assert result is None
+            result = await RoleCrud.first(verify, [Role.name == "mw_never_ran"])
+            assert result is not None
 
 
 class TestDatabaseSession:
@@ -1523,6 +1537,55 @@ def _build_app(db: Database) -> FastAPI:
         await session.commit()
         return {"id": str(role.id), "name": role.name}
 
+    async def _scoped_writer(
+        body: RoleCreate, session: AsyncSession = Security(db, scopes=["roles:write"])
+    ) -> int:
+        # Security scopes give this a different dependency cache key than the
+        # endpoint's plain ``Depends(db)``. Without borrowing it opens a second
+        # session, and whichever one the middleware does not hold is discarded.
+        await RoleCrud.create(session, RoleCreate(name=f"{body.name}_sub"))
+        return id(session)
+
+    @app.post("/roles-two-cache-keys")
+    async def create_via_two_cache_keys(
+        body: RoleCreate,
+        sub_session_id: int = Depends(_scoped_writer),
+        session: AsyncSession = Depends(db),
+    ) -> dict:
+        await RoleCrud.create(session, body)
+        return {"same_session": sub_session_id == id(session)}
+
+    async def _fn_writer(
+        body: RoleCreate, session: AsyncSession = Depends(db, scope="function")
+    ) -> None:
+        # ``scope="function"`` unwinds before the response is sent, taking the
+        # session with it — so the commit cannot be left to the middleware.
+        await RoleCrud.create(session, RoleCreate(name=f"{body.name}_fn"))
+
+    @app.post("/roles-function-scope")
+    async def create_with_function_scope(
+        body: RoleCreate,
+        boom: bool = False,
+        _: None = Depends(_fn_writer),
+        session: AsyncSession = Depends(db),
+    ) -> dict:
+        await RoleCrud.create(session, body)
+        if boom:
+            raise RuntimeError("boom after write")
+        return {"ok": True}
+
+    @app.post("/roles-function-scope-borrower")
+    async def function_scope_borrows(
+        body: RoleCreate,
+        session: AsyncSession = Depends(db),
+        _: None = Depends(_fn_writer),
+    ) -> dict:
+        # Flipped order: the request-scoped dependency owns the session and the
+        # function-scoped one borrows it. The borrower unwinds early but must not
+        # commit or close — the commit still belongs to the middleware.
+        await RoleCrud.create(session, body)
+        return {"ok": True}
+
     @app.get("/roles-stream/{name}")
     async def stream_role(
         name: str, session: AsyncSession = Depends(db)
@@ -1619,6 +1682,62 @@ class TestCommitIntegration:
         # The write made before the stream began is durably committed.
         assert await _row_exists(session_maker, "streamed_role")
 
+    @pytest.mark.anyio
+    async def test_two_cache_keys_share_one_session(self, engine, session_maker):
+        """Two resolutions of ``Depends(db)`` in one request must share a session."""
+        app = _build_app(Database(engine=engine))
+        transport = ASGITransport(app=app)
+        async with AsyncClient(transport=transport, base_url="http://test") as client:
+            resp = await client.post("/roles-two-cache-keys", json={"name": "two_keys"})
+
+        assert resp.status_code == 200
+        assert resp.json()["same_session"] is True
+        assert await _row_exists(session_maker, "two_keys")
+        assert await _row_exists(session_maker, "two_keys_sub")
+
+    @pytest.mark.anyio
+    async def test_function_scope_commits_before_response(self, engine, session_maker):
+        """``scope="function"`` unwinds before response-start, so the dependency
+        commits on its way out instead of leaving it to the middleware."""
+        app = _build_app(Database(engine=engine))
+        transport = ASGITransport(app=app)
+        async with AsyncClient(transport=transport, base_url="http://test") as client:
+            resp = await client.post("/roles-function-scope", json={"name": "fn_scope"})
+
+        assert resp.status_code == 200
+        assert await _row_exists(session_maker, "fn_scope")
+        assert await _row_exists(session_maker, "fn_scope_fn")
+
+    @pytest.mark.anyio
+    async def test_function_scope_borrower_leaves_commit_to_middleware(
+        self, engine, session_maker
+    ):
+        """A function-scoped *borrower* unwinds early but owns nothing."""
+        app = _build_app(Database(engine=engine))
+        transport = ASGITransport(app=app)
+        async with AsyncClient(transport=transport, base_url="http://test") as client:
+            resp = await client.post(
+                "/roles-function-scope-borrower", json={"name": "fn_borrow"}
+            )
+
+        assert resp.status_code == 200
+        assert await _row_exists(session_maker, "fn_borrow")
+        assert await _row_exists(session_maker, "fn_borrow_fn")
+
+    @pytest.mark.anyio
+    async def test_function_scope_error_rolls_back(self, engine, session_maker):
+        """The early commit must still not fire when the request fails."""
+        app = _build_app(Database(engine=engine))
+        transport = ASGITransport(app=app, raise_app_exceptions=False)
+        async with AsyncClient(transport=transport, base_url="http://test") as client:
+            resp = await client.post(
+                "/roles-function-scope?boom=true", json={"name": "fn_ghost"}
+            )
+
+        assert resp.status_code == 500
+        assert not await _row_exists(session_maker, "fn_ghost")
+        assert not await _row_exists(session_maker, "fn_ghost_fn")
+
     @pytest.mark.anyio
     async def test_multi_write_atomicity(self, engine, session_maker):
         """When the 2nd write fails, the 1st must roll back too (one txn)."""

tests/test_models.py

@@ -6,9 +6,16 @@ from types import SimpleNamespace
 from unittest.mock import patch
 
 import pytest
-from sqlalchemy import String
+from sqlalchemy import ForeignKey, String, select
+from sqlalchemy import inspect as sa_inspect
 from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
-from sqlalchemy.orm import DeclarativeBase, Mapped, mapped_column
+from sqlalchemy.orm import (
+    DeclarativeBase,
+    Mapped,
+    mapped_column,
+    relationship,
+    selectinload,
+)
 
 import fastapi_toolsets.models.watched as _watched_module
 from fastapi_toolsets.models import (
@@ -107,6 +114,27 @@ async def _watched_on_update(obj, event_type, changes):
     _test_events.append({"event": "update", "obj_id": obj.id, "changes": changes})
 
 
+class RelTarget(MixinBase, UUIDMixin):
+    __tablename__ = "mixin_rel_targets"
+
+    name: Mapped[str] = mapped_column(String(50))
+
+
+class RelOwner(MixinBase, UUIDMixin):
+    """Watched model with a relationship, to check eager loads survive commit."""
+
+    __tablename__ = "mixin_rel_owners"
+
+    title: Mapped[str] = mapped_column(String(50))
+    target_id: Mapped[uuid.UUID] = mapped_column(ForeignKey("mixin_rel_targets.id"))
+    target: Mapped[RelTarget] = relationship()
+
+
+@listens_for(RelOwner, [ModelEvent.CREATE, ModelEvent.UPDATE])
+async def _rel_owner_handler(obj, event_type, changes):
+    _test_events.append({"event": event_type.value, "obj_id": obj.id})
+
+
 class WatchAllModel(MixinBase, UUIDMixin):
     """Model without __watched_fields__ — watches all mapped fields by default."""
 
@@ -355,6 +383,62 @@ async def mixin_session_maker():
         await engine.dispose()
 
 
+class TestEventSessionPreservesEagerLoads:
+    """EventSession.commit() must not discard relations an eager load populated."""
+
+    async def _seed_eager(self, session):
+        target = RelTarget(name="t")
+        session.add(target)
+        await session.flush()
+        owner = RelOwner(title="o", target_id=target.id)
+        session.add(owner)
+        await session.flush()
+        loaded = (
+            await session.execute(
+                select(RelOwner)
+                .where(RelOwner.id == owner.id)
+                .options(selectinload(RelOwner.target))
+            )
+        ).scalar_one()
+        assert "target" not in sa_inspect(loaded).unloaded
+        return loaded
+
+    @pytest.mark.anyio
+    async def test_eager_load_survives_commit(self, mixin_session):
+        """expire_on_commit=False: the reload must not expire the relation."""
+        owner = await self._seed_eager(mixin_session)
+
+        await mixin_session.commit()
+
+        assert "target" not in sa_inspect(owner).unloaded
+        assert owner.target.name == "t"
+
+    @pytest.mark.anyio
+    async def test_eager_load_survives_commit_expire_on_commit(
+        self, mixin_session_expire
+    ):
+        """expire_on_commit=True: what was loaded must be recorded before the commit."""
+        owner = await self._seed_eager(mixin_session_expire)
+
+        await mixin_session_expire.commit()
+
+        assert "target" not in sa_inspect(owner).unloaded
+        assert owner.target.name == "t"
+
+    @pytest.mark.anyio
+    async def test_unloaded_relation_stays_unloaded(self, mixin_session):
+        """Only what was loaded is restored: the reload must not eager-load extra."""
+        target = RelTarget(name="t")
+        mixin_session.add(target)
+        await mixin_session.flush()
+        owner = RelOwner(title="o", target_id=target.id)
+        mixin_session.add(owner)
+
+        await mixin_session.commit()
+
+        assert "target" in sa_inspect(owner).unloaded
+
+
 class TestUUIDMixin:
     @pytest.mark.anyio
     async def test_uuid_generated_by_db(self, mixin_session):
@@ -1013,10 +1097,10 @@ class TestEventCallbacks:
 
         real_batch_reload = _watched_module._batch_reload
 
-        async def racing_batch_reload(session, model, pk_tuples):
-            if any(pk[0] == doomed_id for pk in pk_tuples):
+        async def racing_batch_reload(session, model, objs, preloaded):
+            if any(getattr(o, "id", None) == doomed_id for o in objs):
                 await kill_doomed_row_once()
-            return await real_batch_reload(session, model, pk_tuples)
+            return await real_batch_reload(session, model, objs, preloaded)
 
         # Patch the batched reload EventSession.commit() uses to pick up
         # server defaults, so this test still exercises the race.
@@ -1039,7 +1123,7 @@ class TestEventCallbacks:
         obj = WatchedModel(status="active", other="x")
         mixin_session.add(obj)
 
-        async def failing_batch_reload(session, model, pk_tuples):
+        async def failing_batch_reload(session, model, objs, preloaded):
             raise RuntimeError("reload failed")
 
         with (

uv.lock

@@ -973,15 +973,15 @@ wheels = [
 
 [[package]]
 name = "pymdown-extensions"
-version = "11.0"
+version = "11.0.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "markdown" },
     { name = "pyyaml" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/47/67/f1e79672a5f91985577c7984c9709ca110e4fd37fe7fd167b60422e6ccc2/pymdown_extensions-11.0.tar.gz", hash = "sha256:8269cef0247f9e2d0a62fcea10860aba05c1cbab5470fd4b63230b96434dc589", size = 857049, upload-time = "2026-06-23T02:27:45.146Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/21/a9/5f0c535ba3b08fe09270c16808e053a968868242ecbd5676d4e3a488bf28/pymdown_extensions-11.0.1.tar.gz", hash = "sha256:dd2905ae6fc5b75582fafb139a1266ffc754705efa902aa50067fa7ff4f94ec0", size = 857113, upload-time = "2026-07-02T17:59:22.955Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/af/b6/1ae53367e28b9cffa3be7574e13fbe4589694272fd47710fbdbafd3d63c6/pymdown_extensions-11.0-py3-none-any.whl", hash = "sha256:fbc4acb641814fa9d17521bbd21a5240ef739a662f11c06330c4b78c93e954d6", size = 269415, upload-time = "2026-06-23T02:27:43.826Z" },
+    { url = "https://files.pythonhosted.org/packages/d6/54/da572c98c0b77626a91b5d3b89f0231d8bff5125c225420908632f8b342d/pymdown_extensions-11.0.1-py3-none-any.whl", hash = "sha256:db3943a62bab7e03af1364f0c4083e64b91fb097675a4b6cceccfbe9a77e5eb2", size = 269455, upload-time = "2026-07-02T17:59:21.271Z" },
 ]
 
 [[package]]