@memberjunction/server 5.29.0 → 5.30.0

package/src/resolvers/SyncDataResolver.ts

@@ -1,6 +1,6 @@
 import { Arg, Ctx, Field, InputType, Mutation, ObjectType, registerEnumType } from 'type-graphql';
 import { AppContext, UserPayload } from '../types.js';
-import { BaseEntity, CompositeKey, EntityDeleteOptions, EntitySaveOptions, LogError, Metadata, RunView, UserInfo } from '@memberjunction/core';
+import { BaseEntity, CompositeKey, DatabaseProviderBase, EntityDeleteOptions, EntitySaveOptions, LogError, Metadata, RunView, UserInfo } from '@memberjunction/core';
 import { RequireSystemUser } from '../directives/RequireSystemUser.js';
 import { CompositeKeyInputType, CompositeKeyOutputType } from '../generic/KeyInputOutputTypes.js';
 import { MJDatasetItemEntity } from '@memberjunction/core-entities';
@@ -213,30 +213,40 @@ export class SyncDataResolver {
 
     protected async SyncSingleItemDeleteWithFilter(entityName: string, filter: string, result: ActionItemOutputType, user: UserInfo, userPayload: UserPayload) {
         try {
-            // here we will iterate through the result of a RunView on the entityname/filter and delete each matching record
-            let overallSuccess: boolean = true;
-            let combinedErrorMessage: string = "";
+            // Run the view to find matching records, then delete them all atomically —
+            // any single failure rolls back the entire batch so the dataset stays consistent.
             const rv = new RunView();
             const data = await rv.RunView<BaseEntity>({
                 EntityName: entityName,
                 ExtraFilter: filter,
                 ResultType: 'entity_object'
             }, user);
-            if (data && data.Success) {
+
+            if (!data || !data.Success) {
+                result.Success = false;
+                result.ErrorMessage = 'Failed to run the view to get the list of items to delete for entity: ' + entityName + ' with filter: ' + filter + '\n';
+                return;
+            }
+
+            if (data.Results.length === 0) {
+                result.Success = true;
+                return;
+            }
+
+            const provider = Metadata.Provider as DatabaseProviderBase;
+            await provider.BeginTransaction();
+            try {
                 for (const entityObject of data.Results) {
                     if (!await entityObject.Delete()) {
-                        overallSuccess = false;
-                        combinedErrorMessage += 'Failed to delete the item :' + entityObject.LatestResult.CompleteMessage + '\n';
+                        throw new Error('Failed to delete the item: ' + entityObject.LatestResult.CompleteMessage);
                     }
                 }
-                result.Success = overallSuccess
-                if (!overallSuccess) {
-                    result.ErrorMessage = combinedErrorMessage
-                }
-            }
-            else {
+                await provider.CommitTransaction();
+                result.Success = true;
+            } catch (txErr) {
+                await provider.RollbackTransaction();
                 result.Success = false;
-                result.ErrorMessage = 'Failed to run the view to get the list of items to delete for entity: ' + entityName + ' with filter: ' + filter + '\n';
+                result.ErrorMessage = typeof txErr === 'string' ? txErr : (txErr as Error).message;
             }
         }
         catch (e) {

package/src/resolvers/SyncRolesUsersResolver.ts

@@ -1,6 +1,6 @@
 import { Arg, Ctx, Field, InputType, Mutation, ObjectType, registerEnumType } from 'type-graphql';
 import { AppContext, UserPayload } from '../types.js';
-import { EntityDeleteOptions, EntitySaveOptions, LogError, Metadata, RunView, UserInfo } from '@memberjunction/core';
+import { DatabaseProviderBase, EntityDeleteOptions, EntitySaveOptions, LogError, Metadata, RunView, UserInfo } from '@memberjunction/core';
 import { UUIDsEqual } from '@memberjunction/global';
 import { RequireSystemUser } from '../directives/RequireSystemUser.js';
 import { MJRoleEntity, MJUserEntity, MJUserRoleEntity } from '@memberjunction/core-entities';
@@ -87,24 +87,36 @@ export class SyncRolesAndUsersResolver {
     @Arg('data', () => RolesAndUsersInputType ) data: RolesAndUsersInputType,
     @Ctx() context: AppContext
     ) {
+        // Wrap roles + users in one DB transaction so a user-sync failure
+        // rolls back any role changes made earlier in this call. Prior code
+        // attempted this with a TransactionGroup but ran into nesting issues —
+        // direct DB transactions per the plan doc avoid that.
         try {
-            // first we sync the roles, then the users 
-            const roleResult = await this.SyncRoles(data.Roles, context);
-            if (roleResult?.Success) {
-                const usersResult = await this.SyncUsers(data.Users, context);
-                if (usersResult?.Success) {
-                    // refresh the user cache, don't set an auto-refresh
-                    // interval here becuase that is alreayd done at startup
-                    // and will keep going on its own as per the config. This is a
-                    // special one-time refresh since we made changes here.
-                    await UserCache.Instance.Refresh(context.dataSource);
+            const provider = Metadata.Provider as DatabaseProviderBase;
+            await provider.BeginTransaction();
+            try {
+                const roleResult = await this.DoSyncRoles(data.Roles, context.userPayload.userRecord, context.userPayload);
+                if (!roleResult.Success) {
+                    await provider.RollbackTransaction();
+                    return roleResult;
                 }
+
+                const usersResult = await this.DoSyncUsers(data.Users, context.userPayload.userRecord, context.userPayload);
+                if (!usersResult.Success) {
+                    await provider.RollbackTransaction();
+                    return usersResult;
+                }
+
+                await provider.CommitTransaction();
+
+                // refresh the user cache — one-time, since the normal auto-refresh is already scheduled
+                await UserCache.Instance.Refresh(context.dataSource);
                 return usersResult;
+            } catch (txErr) {
+                await provider.RollbackTransaction();
+                throw txErr;
             }
-            else {
-                return roleResult;
-            }
-        } 
+        }
         catch (err) {
             LogError(err);
             throw new Error('Error syncing roles and users\n\n' + err);
@@ -121,76 +133,93 @@ export class SyncRolesAndUsersResolver {
     @Arg('roles', () => [RoleInputType]) roles: RoleInputType[],
     @Ctx() context: AppContext
     ) : Promise<SyncRolesAndUsersResultType> {
+        // Wrap delete + add + update of roles in one DB transaction so any failure
+        // rolls back the whole batch. Keeps the sync idempotent across retries.
         try {
-            // we iterate through the provided roles and we remove roles that are not in the input and add roles that are new
-            // and update roles that already exist
-            const rv = new RunView();
-            const result = await rv.RunView<MJRoleEntity>({
-                EntityName: "MJ: Roles",
-                ResultType: 'entity_object'
-            }, context.userPayload.userRecord);
-    
-            if (result && result.Success) {
-                const currentRoles = result.Results;
-                if (await this.DeleteRemovedRoles(currentRoles, roles, context.userPayload.userRecord, context.userPayload)) {
-                    if ( await this.AddNewRoles(currentRoles, roles, context.userPayload.userRecord, context.userPayload)) {
-                        return await this.UpdateExistingRoles(currentRoles, roles, context.userPayload);
-                    }
+            const provider = Metadata.Provider as DatabaseProviderBase;
+            await provider.BeginTransaction();
+            try {
+                const result = await this.DoSyncRoles(roles, context.userPayload.userRecord, context.userPayload);
+                if (result.Success) {
+                    await provider.CommitTransaction();
+                } else {
+                    await provider.RollbackTransaction();
                 }
+                return result;
+            } catch (txErr) {
+                await provider.RollbackTransaction();
+                throw txErr;
             }
-
-            return { Success: false }; // if we get here, something went wrong
         } catch (err) {
             LogError(err);
             throw new Error('Error syncing roles and users\n\n' + err);
         }
     }
 
-    protected async UpdateExistingRoles(currentRoles: MJRoleEntity[], futureRoles: RoleInputType[], userPayload: UserPayload): Promise<SyncRolesAndUsersResultType> {
-        // go through the future roles and update any that are in the current roles
-        const md = new Metadata();
-        let ok: boolean = true;
+    /**
+     * Transaction-free core of SyncRoles — expected to be invoked inside an outer transaction.
+     * Throws on any Save/Delete failure so the outer transaction rolls back. A returned
+     * `{ Success: true }` means every operation succeeded.
+     */
+    protected async DoSyncRoles(roles: RoleInputType[], user: UserInfo, userPayload: UserPayload): Promise<SyncRolesAndUsersResultType> {
+        const rv = new RunView();
+        const result = await rv.RunView<MJRoleEntity>({
+            EntityName: "MJ: Roles",
+            ResultType: 'entity_object'
+        }, user);
+
+        if (!result || !result.Success) {
+            return { Success: false };
+        }
+
+        const currentRoles = result.Results;
+        await this.DeleteRemovedRoles(currentRoles, roles, user, userPayload);
+        await this.AddNewRoles(currentRoles, roles, user, userPayload);
+        await this.UpdateExistingRoles(currentRoles, roles, userPayload);
+        return { Success: true };
+    }
 
+    protected async UpdateExistingRoles(currentRoles: MJRoleEntity[], futureRoles: RoleInputType[], userPayload: UserPayload): Promise<void> {
+        // go through the future roles and update any that are in the current roles
         for (const update of futureRoles) {
             const currentRole = currentRoles.find(r => r.Name.trim().toLowerCase() === update.Name.trim().toLowerCase());
             if (currentRole) {
                 currentRole.Description = update.Description;
-                ok = ok && await currentRole.Save();  
+                if (!await currentRole.Save()) {
+                    throw new Error(`Failed to update role '${currentRole.Name}': ${currentRole.LatestResult?.CompleteMessage ?? 'unknown error'}`);
+                }
             }
         }
-        return { Success: ok };
     }
 
-    protected async AddNewRoles(currentRoles: MJRoleEntity[], futureRoles: RoleInputType[], user: UserInfo, userPayload: UserPayload): Promise<boolean> {
+    protected async AddNewRoles(currentRoles: MJRoleEntity[], futureRoles: RoleInputType[], user: UserInfo, userPayload: UserPayload): Promise<void> {
         // go through the future roles and add any that are not in the current roles
         const md = new Metadata();
-        let ok: boolean = true;
 
         for (const add of futureRoles) {
             if (!currentRoles.find(r => r.Name.trim().toLowerCase() === add.Name.trim().toLowerCase())) {
                 const role = await md.GetEntityObject<MJRoleEntity>("MJ: Roles", user);
                 role.Name = add.Name;
                 role.Description = add.Description;
-                ok = ok && await role.Save();  
+                if (!await role.Save()) {
+                    throw new Error(`Failed to create role '${add.Name}': ${role.LatestResult?.CompleteMessage ?? 'unknown error'}`);
+                }
             }
         }
-        return ok;
     }
 
 
-    protected async DeleteRemovedRoles(currentRoles: MJRoleEntity[], futureRoles: RoleInputType[], user: UserInfo, userPayload: UserPayload): Promise<boolean> {
+    protected async DeleteRemovedRoles(currentRoles: MJRoleEntity[], futureRoles: RoleInputType[], user: UserInfo, userPayload: UserPayload): Promise<void> {
         const rv = new RunView();
-        let ok: boolean = true;
 
         // iterate through the existing roles and remove any that are not in the input
         for (const remove of currentRoles) {
             if (!this.IsStandardRole(remove.Name)) {
                 if (!futureRoles.find(r => r.Name.trim().toLowerCase() === remove.Name.trim().toLowerCase())) {
-                    ok = ok && await this.DeleteSingleRole(remove, rv, user, userPayload);
-                }    
+                    await this.DeleteSingleRole(remove, rv, user, userPayload);
+                }
             }
         }
-        return ok;
     }
 
     public get StandardRoles(): string[] {
@@ -200,10 +229,8 @@ export class SyncRolesAndUsersResolver {
         return this.StandardRoles.find(r => r.toLowerCase() === roleName.toLowerCase()) !== undefined;
     }
 
-    protected async DeleteSingleRole(role: MJRoleEntity, rv: RunView, user: UserInfo, userPayload: UserPayload): Promise<boolean> {
+    protected async DeleteSingleRole(role: MJRoleEntity, rv: RunView, user: UserInfo, userPayload: UserPayload): Promise<void> {
         // first, remove all the UserRole records that match this role
-        let ok: boolean = true;
-
         const r2 = await rv.RunView<MJUserRoleEntity>({
             EntityName: "MJ: User Roles",
             ExtraFilter: "RoleID = '" + role.ID + "'",
@@ -211,11 +238,15 @@ export class SyncRolesAndUsersResolver {
         }, user);
         if (r2.Success) {
             for (const ur of r2.Results) {
-                ok = ok && await ur.Delete(); // remove the user role
+                if (!await ur.Delete()) {
+                    throw new Error(`Failed to delete user-role link for role '${role.Name}': ${ur.LatestResult?.CompleteMessage ?? 'unknown error'}`);
+                }
             }
         }
 
-        return ok && role.Delete(); // remove the role
+        if (!await role.Delete()) {
+            throw new Error(`Failed to delete role '${role.Name}': ${role.LatestResult?.CompleteMessage ?? 'unknown error'}`);
+        }
     }
 
     /**
@@ -229,39 +260,53 @@ export class SyncRolesAndUsersResolver {
     @Arg('users', () => [UserInputType]) users: UserInputType[],
     @Ctx() context: AppContext
     ) : Promise<SyncRolesAndUsersResultType> {
+        // Wrap delete + add + update + role-sync of users in one DB transaction.
         try {
-            // first, we sync up the users and then the user roles. 
-            // for syncing users we first remove users that are no longer in the input, then we add new users and update existing users
-            const rv = new RunView();
-            const result = await rv.RunView<MJUserEntity>({
-                EntityName: "MJ: Users",
-                ResultType: 'entity_object'
-            }, context.userPayload.userRecord);
-            if (result && result.Success) {
-                // go through current users and remove those that are not in the input
-                const currentUsers = result.Results;
-                if (await this.DeleteRemovedUsers(currentUsers, users, context.userPayload.userRecord, context.userPayload)) {
-                    if (await this.AddNewUsers(currentUsers, users, context.userPayload)) {
-                        if (await this.UpdateExistingUsers(currentUsers, users, context.userPayload)) {
-                            if (await this.SyncUserRoles(users, context.userPayload.userRecord, context.userPayload)) {
-                                return { Success: true };
-                            }    
-                        }
-                    }
+            const provider = Metadata.Provider as DatabaseProviderBase;
+            await provider.BeginTransaction();
+            try {
+                const result = await this.DoSyncUsers(users, context.userPayload.userRecord, context.userPayload);
+                if (result.Success) {
+                    await provider.CommitTransaction();
+                } else {
+                    await provider.RollbackTransaction();
                 }
+                return result;
+            } catch (txErr) {
+                await provider.RollbackTransaction();
+                throw txErr;
             }
-
-            return { Success: false }; // if we get here, something went wrong
         } catch (err) {
             LogError(err);
             throw new Error('Error syncing roles and users\n\n' + err);
         }
     }
 
-    protected async UpdateExistingUsers(currentUsers: MJUserEntity[], futureUsers: UserInputType[], userPayload: UserPayload): Promise<boolean> {  
-        // go through the future users and update any that are in the current users
-        let ok: boolean = true;
+    /**
+     * Transaction-free core of SyncUsers — expected to be invoked inside an outer transaction.
+     * Throws on any Save/Delete failure so the outer transaction rolls back.
+     */
+    protected async DoSyncUsers(users: UserInputType[], user: UserInfo, userPayload: UserPayload): Promise<SyncRolesAndUsersResultType> {
+        const rv = new RunView();
+        const result = await rv.RunView<MJUserEntity>({
+            EntityName: "MJ: Users",
+            ResultType: 'entity_object'
+        }, user);
 
+        if (!result || !result.Success) {
+            return { Success: false };
+        }
+
+        const currentUsers = result.Results;
+        await this.DeleteRemovedUsers(currentUsers, users, user, userPayload);
+        await this.AddNewUsers(currentUsers, users, userPayload);
+        await this.UpdateExistingUsers(currentUsers, users, userPayload);
+        await this.SyncUserRoles(users, user, userPayload);
+        return { Success: true };
+    }
+
+    protected async UpdateExistingUsers(currentUsers: MJUserEntity[], futureUsers: UserInputType[], userPayload: UserPayload): Promise<void> {
+        // go through the future users and update any that are in the current users
         for (const update of futureUsers) {
             const current = currentUsers.find(c => c.Email?.trim().toLowerCase() === update.Email?.trim().toLowerCase());
             if (current) {
@@ -270,23 +315,26 @@ export class SyncRolesAndUsersResolver {
                 current.FirstName = update.FirstName;
                 current.LastName = update.LastName;
                 current.Title = update.Title;
-                ok = ok && await current.Save();  
+                if (!await current.Save()) {
+                    throw new Error(`Failed to update user '${current.Email}': ${current.LatestResult?.CompleteMessage ?? 'unknown error'}`);
+                }
             }
         }
-        return ok;
     }
-    protected async AddNewUsers(currentUsers: MJUserEntity[], futureUsers: UserInputType[], userPayload: UserPayload): Promise<boolean> {
+
+    protected async AddNewUsers(currentUsers: MJUserEntity[], futureUsers: UserInputType[], userPayload: UserPayload): Promise<void> {
         // add users that are not in the current users
         const md = new Metadata();
-        let ok: boolean = true;
 
         for (const add of futureUsers) {
             const match = currentUsers.find(currentUser => currentUser.Email?.trim().toLowerCase() === add.Email?.trim().toLowerCase());
             if (match) {
                 // make sure the IsActive bit is set to true
                 match.IsActive = true;
-                ok = ok && await match.Save();  
-            }  
+                if (!await match.Save()) {
+                    throw new Error(`Failed to reactivate user '${match.Email}': ${match.LatestResult?.CompleteMessage ?? 'unknown error'}`);
+                }
+            }
             else {
                 const user = await md.GetEntityObject<MJUserEntity>("MJ: Users", userPayload.userRecord);
                 user.Name = add.Name;
@@ -297,33 +345,27 @@ export class SyncRolesAndUsersResolver {
                 user.Title = add.Title;
                 user.IsActive = true;
 
-                ok = ok && await user.Save();  
+                if (!await user.Save()) {
+                    throw new Error(`Failed to create user '${add.Email}': ${user.LatestResult?.CompleteMessage ?? 'unknown error'}`);
+                }
             }
         }
-        return ok;
     }
 
-    protected async DeleteRemovedUsers(currentUsers: MJUserEntity[], futureUsers: UserInputType[], u: UserInfo, userPayload: UserPayload): Promise<boolean> {
+    protected async DeleteRemovedUsers(currentUsers: MJUserEntity[], futureUsers: UserInputType[], u: UserInfo, userPayload: UserPayload): Promise<void> {
         // remove users that are not in the future users
         const rv = new RunView();
-        const md = new Metadata();
-
-        let ok: boolean = true;
-        //const tg = await md.CreateTransactionGroup(); HAVING PROBLEMS with this, so skipping for now, I think the entire thing is wrapped in a transaction and that's causing issues with two styles of trans wrappers
         for (const remove of currentUsers) {
             if (remove.Type.trim().toLowerCase() !== 'owner') {
                 if (!futureUsers.find(r => r.Email.trim().toLowerCase() === remove.Email.trim().toLowerCase())) {
-                    ok = ok && await this.DeleteSingleUser(remove, rv, u, userPayload);
+                    await this.DeleteSingleUser(remove, rv, u, userPayload);
                 }
             }
         }
-        return ok;
     }
 
-    protected async DeleteSingleUser(user: MJUserEntity, rv: RunView, u: UserInfo, userPayload: UserPayload): Promise<boolean> {
+    protected async DeleteSingleUser(user: MJUserEntity, rv: RunView, u: UserInfo, userPayload: UserPayload): Promise<void> {
         // first, remove all the UserRole records that match this user
-        let ok: boolean = true;
-
         const r2 = await rv.RunView<MJUserRoleEntity>({
             EntityName: "MJ: User Roles",
             ExtraFilter: "UserID = '" + user.ID + "'",
@@ -331,21 +373,23 @@ export class SyncRolesAndUsersResolver {
         }, u);
         if (r2.Success) {
             for (const ur of r2.Results) {
-                //ur.TransactionGroup = tg;
-                ok = ok && await ur.Delete(); // remove the user role
+                if (!await ur.Delete()) {
+                    throw new Error(`Failed to delete user-role link for user '${user.Email}': ${ur.LatestResult?.CompleteMessage ?? 'unknown error'}`);
+                }
             }
         }
         if (await user.Delete()) {
-            return ok;
+            return;
         }
-        else {
-            // in some cases there are a lot of fkey constraints that prevent the user from being deleted, so we mark the user as inactive instead
-            user.IsActive = false;
-            return await user.Save() && ok;
+        // FK constraint fallback: when the user has dependent records that block hard delete,
+        // we mark the user inactive instead. A failure to soft-delete IS a real error and rolls back.
+        user.IsActive = false;
+        if (!await user.Save()) {
+            throw new Error(`Failed to delete or deactivate user '${user.Email}': ${user.LatestResult?.CompleteMessage ?? 'unknown error'}`);
         }
     }
 
-    protected async SyncUserRoles(users: UserInputType[], u: UserInfo, userPayload: UserPayload): Promise<boolean> {
+    protected async SyncUserRoles(users: UserInputType[], u: UserInfo, userPayload: UserPayload): Promise<void> {
         // for each user in the users array, make sure there is a User Role that matches. First, get a list of all DATABASE user and roels so we have that for fast lookup in memory
         const rv = new RunView();
         const md = new Metadata();
@@ -363,51 +407,43 @@ export class SyncRolesAndUsersResolver {
             ResultType: 'entity_object'
         }, u);
 
-        // await both 
-        const [uResult,rResult, urResult] = await Promise.all([p1, p2, p3]);
-
-        if (uResult.Success && rResult.Success && urResult.Success) {
-            // we have the DB users and roles, and user roles
-            const dbUsers = uResult.Results;
-            const dbRoles = rResult.Results;    
-            const dbUserRoles = urResult.Results;
-            let ok: boolean = true;
-
-            // now, we can do lookups in memory from those DB roles and Users for their ID values
-            // now we will iterate through the users input type and for each role, make sure it is in there     
-            //const tg = await md.CreateTransactionGroup();
-            for (const user of users) {
-                const dbUser = dbUsers.find(u => u.Email.trim().toLowerCase() === user.Email.trim().toLowerCase());
-                if (dbUser) {
-                    for (const role of user.Roles) {
-                        const dbRole = dbRoles.find(r => r.Name.trim().toLowerCase() === role.Name.trim().toLowerCase());
-                        if (dbRole) {
-                            // now we need to make sure there is a user role that matches this user and role
-                            if (!dbUserRoles.find(ur => UUIDsEqual(ur.UserID, dbUser.ID) && UUIDsEqual(ur.RoleID, dbRole.ID))) {
-                                // we need to add a user role
-                                const ur = await md.GetEntityObject<MJUserRoleEntity>("MJ: User Roles", u);
-                                ur.UserID = dbUser.ID;
-                                ur.RoleID = dbRole.ID;
-                                ok = ok && await ur.Save();  
-                            }
-                        }
+        const [uResult, rResult, urResult] = await Promise.all([p1, p2, p3]);
+
+        if (!uResult.Success || !rResult.Success || !urResult.Success) {
+            throw new Error(`Failed to load users/roles/user-roles for SyncUserRoles`);
+        }
+
+        const dbUsers = uResult.Results;
+        const dbRoles = rResult.Results;
+        const dbUserRoles = urResult.Results;
+
+        // Saves/Deletes below run inside the outer SyncUsers/SyncRolesAndUsers transaction.
+        for (const user of users) {
+            const dbUser = dbUsers.find(u => u.Email.trim().toLowerCase() === user.Email.trim().toLowerCase());
+            if (!dbUser) continue;
+
+            for (const role of user.Roles) {
+                const dbRole = dbRoles.find(r => r.Name.trim().toLowerCase() === role.Name.trim().toLowerCase());
+                if (dbRole && !dbUserRoles.find(ur => UUIDsEqual(ur.UserID, dbUser.ID) && UUIDsEqual(ur.RoleID, dbRole.ID))) {
+                    const ur = await md.GetEntityObject<MJUserRoleEntity>("MJ: User Roles", u);
+                    ur.UserID = dbUser.ID;
+                    ur.RoleID = dbRole.ID;
+                    if (!await ur.Save()) {
+                        throw new Error(`Failed to assign role '${dbRole.Name}' to user '${dbUser.Email}': ${ur.LatestResult?.CompleteMessage ?? 'unknown error'}`);
                     }
-                    // now, we check for DB user roles that are NOT in the user.Roles property as they are no longer part of the user's roles
-                    const thisUserDBRoles = dbUserRoles.filter(ur => UUIDsEqual(ur.UserID, dbUser.ID));
-                    for (const dbUserRole of thisUserDBRoles) {
-                        const role = user.Roles.find(r => r.Name.trim().toLowerCase() === dbRoles.find(rr => UUIDsEqual(rr.ID, dbUserRole.RoleID))?.Name.trim().toLowerCase());
-                        if (!role && !this.IsStandardRole(dbUserRole.Role)) {
-                            // this user role is no longer in the user's roles, we need to remove it
-                            //dbUserRole.TransactionGroup = tg;
-                            ok = ok && await dbUserRole.Delete(); // remove the user role - we use await for the DELETE, not the save
-                        }
+                }
+            }
+
+            // Check for DB user roles that are NOT in the user.Roles input — those need to be removed
+            const thisUserDBRoles = dbUserRoles.filter(ur => UUIDsEqual(ur.UserID, dbUser.ID));
+            for (const dbUserRole of thisUserDBRoles) {
+                const role = user.Roles.find(r => r.Name.trim().toLowerCase() === dbRoles.find(rr => UUIDsEqual(rr.ID, dbUserRole.RoleID))?.Name.trim().toLowerCase());
+                if (!role && !this.IsStandardRole(dbUserRole.Role)) {
+                    if (!await dbUserRole.Delete()) {
+                        throw new Error(`Failed to remove role from user '${dbUser.Email}': ${dbUserRole.LatestResult?.CompleteMessage ?? 'unknown error'}`);
                     }
                 }
             }
-            return ok;
-        }
-        else {
-            return false;
         }
     }
 }