feat: implement transaction support in BunClient with rollback semantics

Author: ToeiRei

client/bun/client.go

@@ -10,6 +10,7 @@ import (
 	"fmt"
 	"log"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/toeirei/keymaster/client"
@@ -23,9 +24,11 @@ import (
 // BunClient is a client implementation backed by the Bun ORM and core.Store.
 // It provides full CRUD operations for accounts, public keys, and links.
 type BunClient struct {
-	config config.Config
-	store  core.Store
-	log    *log.Logger
+	config  config.Config
+	store   core.Store
+	log     *log.Logger
+	txMu    sync.Mutex
+	txDepth int
 	// TODO: in-memory cache for frequently accessed entities (optional optimization)
 }
 
@@ -61,10 +64,45 @@ func (c *BunClient) Close(ctx context.Context) error {
 	return nil
 }
 
-// WithTransaction executes a function within a database transaction.
-// TODO: Implement transaction support via bun.DB transactions.
+// WithTransaction executes fn as an atomic unit.
+//
+// Current implementation uses store backup/restore to provide rollback semantics
+// across the Bun-backed CRUD flows. This keeps behavior deterministic until all
+// write paths can be moved to explicit bun.Tx plumbing.
 func (c *BunClient) WithTransaction(ctx context.Context, fn func(c client.Client) error) error {
-	return fn(c)
+	if c.store == nil {
+		return errors.New("no store available")
+	}
+
+	c.txMu.Lock()
+	defer c.txMu.Unlock()
+
+	// Nested transactions reuse the outer snapshot scope.
+	if c.txDepth > 0 {
+		c.txDepth++
+		defer func() { c.txDepth-- }()
+		return fn(c)
+	}
+
+	snapshot, err := c.store.ExportDataForBackup()
+	if err != nil {
+		return fmt.Errorf("failed to create transaction snapshot: %w", err)
+	}
+
+	c.txDepth = 1
+	defer func() { c.txDepth = 0 }()
+
+	if err := fn(c); err != nil {
+		if restoreErr := c.store.ImportDataFromBackup(snapshot); restoreErr != nil {
+			if c.log != nil {
+				c.log.Printf("failed to rollback transaction snapshot: %v", restoreErr)
+			}
+			return fmt.Errorf("transaction failed: %w; rollback failed: %v", err, restoreErr)
+		}
+		return err
+	}
+
+	return nil
 }
 
 // --- Helper functions ---

client/bun/client_transaction_test.go

@@ -0,0 +1,74 @@
+// Copyright (c) 2026 Keymaster Team
+// Keymaster - SSH key management system
+// This source code is licensed under the MIT license found in the LICENSE file.
+
+package bun_test
+
+import (
+	"context"
+	"errors"
+	"io"
+	"log"
+	"testing"
+
+	"github.com/toeirei/keymaster/client"
+	"github.com/toeirei/keymaster/client/bun"
+	"github.com/toeirei/keymaster/config"
+)
+
+func TestBunClient_WithTransaction_CommitsOnSuccess(t *testing.T) {
+	cfg := config.Config{Database: config.ConfigDatabase{Type: "sqlite", Dsn: ":memory:"}}
+	logger := log.New(io.Discard, "", 0)
+
+	c, err := bun.NewBunClient(cfg, logger)
+	if err != nil {
+		t.Fatalf("NewBunClient failed: %v", err)
+	}
+	defer func() { _ = c.Close(context.Background()) }()
+
+	ctx := context.Background()
+	if err := c.WithTransaction(ctx, func(tx client.Client) error {
+		_, err := tx.CreateAccount(ctx, "alice", "example.com", 22, "ssh", "")
+		return err
+	}); err != nil {
+		t.Fatalf("WithTransaction failed: %v", err)
+	}
+
+	accounts, err := c.ListAccounts(ctx)
+	if err != nil {
+		t.Fatalf("ListAccounts failed: %v", err)
+	}
+	if len(accounts) != 1 {
+		t.Fatalf("expected 1 account after commit, got %d", len(accounts))
+	}
+}
+
+func TestBunClient_WithTransaction_RollsBackOnError(t *testing.T) {
+	cfg := config.Config{Database: config.ConfigDatabase{Type: "sqlite", Dsn: ":memory:"}}
+	logger := log.New(io.Discard, "", 0)
+
+	c, err := bun.NewBunClient(cfg, logger)
+	if err != nil {
+		t.Fatalf("NewBunClient failed: %v", err)
+	}
+	defer func() { _ = c.Close(context.Background()) }()
+
+	ctx := context.Background()
+	expected := errors.New("boom")
+	if err := c.WithTransaction(ctx, func(tx client.Client) error {
+		if _, err := tx.CreateAccount(ctx, "bob", "rollback.example", 22, "ssh", ""); err != nil {
+			return err
+		}
+		return expected
+	}); !errors.Is(err, expected) {
+		t.Fatalf("expected rollback error %q, got: %v", expected, err)
+	}
+
+	accounts, err := c.ListAccounts(ctx)
+	if err != nil {
+		t.Fatalf("ListAccounts failed: %v", err)
+	}
+	if len(accounts) != 0 {
+		t.Fatalf("expected 0 accounts after rollback, got %d", len(accounts))
+	}
+}

tags/tagsbun/apply_postgres_test.go

@@ -6,6 +6,7 @@ package tagsbun_test
 import (
 	"context"
 	"database/sql"
+	"strings"
 	"testing"
 	"time"
 
@@ -28,6 +29,9 @@ func WithPostgres(t *testing.T) *bun.DB {
 				WithStartupTimeout(10*time.Second),
 		),
 	)
+	if err != nil && isContainerRuntimeUnavailable(err) {
+		t.Skipf("skipping postgres testcontainers test: %v", err)
+	}
 	require.NoError(t, err)
 
 	t.Cleanup(func() {
@@ -51,6 +55,29 @@ func WithPostgres(t *testing.T) *bun.DB {
 	return db
 }
 
+func isContainerRuntimeUnavailable(err error) bool {
+	if err == nil {
+		return false
+	}
+
+	msg := strings.ToLower(err.Error())
+	indicators := []string{
+		"failed to create docker provider",
+		"rootless docker is not supported on windows",
+		"cannot connect to the docker daemon",
+		"docker daemon is not running",
+		"no such host",
+	}
+
+	for _, indicator := range indicators {
+		if strings.Contains(msg, indicator) {
+			return true
+		}
+	}
+
+	return false
+}
+
 func TestTagsExprToWherePostgres(t *testing.T) {
 	if testing.Short() {
 		t.Skip("skipping tests that require testcontainers.")