fix(transactions): prevent nested transaction from destroying outer EntityManager on connection error

.github/workflows/push.yml

@@ -58,6 +58,17 @@ jobs:
                     - { name: "SummitOrderServiceTest", filter: "--filter SummitOrderServiceTest" }
                     - { name: "SummitRSVPServiceTest", filter: "--filter SummitRSVPServiceTest" }
                     - { name: "SummitRSVPInvitationServiceTest", filter: "--filter SummitRSVPInvitationServiceTest" }
+                    - { name: "SummitServiceTest", filter: "--filter SummitServiceTest" }
+                    - { name: "SpeakerServiceRegistrationTest", filter: "--filter SpeakerServiceRegistrationTest" }
+                    - { name: "PresentationServiceTest", filter: "--filter PresentationServiceTest" }
+                    - { name: "SummitPromoCodeServiceTest", filter: "--filter SummitPromoCodeServiceTest" }
+                    - { name: "SummitScheduleSettingsServiceTest", filter: "--filter SummitScheduleSettingsServiceTest" }
+                    - { name: "SummitSelectedPresentationListServiceTest", filter: "--filter SummitSelectedPresentationListServiceTest" }
+                    - { name: "SelectionPlanOrderExtraQuestionTypeServiceTest", filter: "--filter SelectionPlanOrderExtraQuestionTypeServiceTest" }
+                    - { name: "SummitSelectionPlanServiceTest", filter: "--filter SummitSelectionPlanServiceTest" }
+                    - { name: "SummitRegistrationInvitationServiceTest", filter: "--filter SummitRegistrationInvitationServiceTest" }
+                    - { name: "SummitSubmissionInvitationServiceTest", filter: "--filter SummitSubmissionInvitationServiceTest" }
+                    - { name: "MemberServiceTest", filter: "--filter MemberServiceTest" }
                     - { name: "EntityModelUnitTests", filter: "tests/Unit/Entities/" }
                     - { name: "AuditUnitTests", filter: "tests/Unit/Audit/" }
                     - { name: "AuditOtlpStrategyTest", filter: "--filter AuditOtlpStrategyTest" }
@@ -101,9 +112,11 @@ jobs:
             REGISTRATION_DEFAULT_LIVE_STRIPE_PRIVATE_KEY:
             REGISTRATION_DEFAULT_LIVE_STRIPE_PUBLISHABLE_KEY:
             REGISTRATION_DEFAULT_LIVE_WEBHOOK_SECRET:
-            REGISTRATION_DEFAULT_TEST_STRIPE_PRIVATE_KEY: sk_test_12345
-            REGISTRATION_DEFAULT_TEST_STRIPE_PUBLISHABLE_KEY: pk_12345
+            REGISTRATION_DEFAULT_TEST_STRIPE_PRIVATE_KEY: ${{ secrets.TEST_STRIPE_SECRET_KEY || 'sk_test_12345' }}
+            REGISTRATION_DEFAULT_TEST_STRIPE_PUBLISHABLE_KEY: ${{ secrets.TEST_STRIPE_PUBLISHABLE_KEY || 'pk_12345' }}
             REGISTRATION_DEFAULT_TEST_WEBHOOK_SECRET: whsec_12345
+            TEST_STRIPE_SECRET_KEY: ${{ secrets.TEST_STRIPE_SECRET_KEY || 'sk_test_dummy_key' }}
+            TEST_STRIPE_PUBLISHABLE_KEY: ${{ secrets.TEST_STRIPE_PUBLISHABLE_KEY || 'pk_test_dummy_key' }}
             BOOKABLE_ROOMS_DEFAULT_PAYMENT_PROVIDER: Stripe
             BOOKABLE_ROOMS_DEFAULT_STRIPE_TEST_MODE: true
             BOOKABLE_ROOMS_DEFAULT_LIVE_STRIPE_PRIVATE_KEY:

app/Models/Foundation/Main/Member.php

@@ -587,6 +587,7 @@ public function setTeamMemberships($team_memberships)
     public function setGroups($groups)
     {
         $this->groups = $groups;
+        $this->groupMembershipCache = [];
     }
 
     /**
@@ -2059,6 +2060,7 @@ public function getMembershipType(): ?string
 
     public function clearGroups():void{
         $this->groups->clear();
+        $this->groupMembershipCache = [];
     }
     /**
      * @param Group $group
@@ -2067,13 +2069,17 @@ public function add2Group(Group $group)
     {
         if ($this->groups->contains($group)) return;
         $this->groups->add($group);
+        // belongsToGroup() memoizes per instance against the DB; a mutation makes
+        // that memo stale (the fresh row/removal becomes visible after flush).
+        $this->groupMembershipCache = [];
     }
 
     public function removeFromGroup(Group $group)
     {
         if (!$this->groups->contains($group)) return;
         $this->groups->removeElement($group);
         //$group->removeMember($this);
+        $this->groupMembershipCache = [];
     }
 
     /**

app/Models/OAuth2/ResourceServerContext.php

@@ -423,6 +423,13 @@ private function syncMemberFields(Member $member, ?string $user_email, ?string $
                     $member_by_email->getId()
                 ));
                 $member_by_email->setEmail(sprintf("%s-invalid@invalid", $member_by_email->getId()));
+                // Member.Email is unique: flush the invalidation NOW, inside the still-open
+                // transaction, so the resolved member's own email UPDATE below can never be
+                // ordered first by the UnitOfWork and hit the unique index while the former
+                // owner still holds the email. Rolled back with the transaction if anything
+                // later fails. Same flush-now idiom as MemberService::registerExternalUser's
+                // twin guard (add($entity, true)).
+                $this->member_repository->add($member_by_email, true);
             }
             $member->setEmail($user_email);
         }