From 3e7679d9139ec641bd37b08201f88fe0a9ae9efa Mon Sep 17 00:00:00 2001
From: Aleksandr Saitgalin <cred1tor@yandex.ru>
Date: Tue, 4 Jan 2022 15:43:40 +0600
Subject: [PATCH] fix #12124

add a transaction for updating user and group
so the user doesn't lose gems when saving the group fails
---
 website/server/controllers/api-v3/groups.js | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/website/server/controllers/api-v3/groups.js b/website/server/controllers/api-v3/groups.js
index 2339539086..4bf6611c44 100644
--- a/website/server/controllers/api-v3/groups.js
+++ b/website/server/controllers/api-v3/groups.js
@@ -137,8 +137,20 @@ api.createGroup = {
       user.party._id = group._id;
     }
 
-    const results = await Promise.all([user.save(), group.save()]);
-    const savedGroup = results[1];
+    let savedGroup;
+    const session = await Group.startSession();
+
+    try {
+      session.startTransaction();
+      await user.save({ session });
+      savedGroup = await group.save({ session });
+      await session.commitTransaction();
+    } catch (error) {
+      await session.abortTransaction();
+      throw error;
+    } finally {
+      session.endSession();
+    }
 
     // Instead of populate we make a find call manually because of https://github.com/Automattic/mongoose/issues/3833
     // await Q.ninvoke(savedGroup, 'populate', ['leader', nameFields]);