v1.3.1 - hotfix: settings could not save new API credentials on SQLite (#195)
🔎 What happened
Saving a NEWLY ENTERED API credential (ComicVine key, Prowlarr key, SABnzbd key, and so on) on a SQLite install of v1.3.0 failed every time with "Transaction API error: Transaction already closed... 5000 ms". The settings save encrypted credentials INSIDE its database transaction, and the encryption helper looked up its key with a separate database query - on v1.3.0's single-connection SQLite tuning that query queued behind the very transaction that was waiting for it. A guaranteed self-deadlock, killed by the 5-second transaction timeout.
Who was affected: fresh installs (the setup wizard saves through this exact path) and anyone re-entering or changing a credential. Long-configured installs mostly never noticed, because unchanged masked values skip encryption entirely. Download client credentials (qBittorrent, SABnzbd client entries) were already encrypted outside the transaction and were never affected.
🛡️ The fix
- The encryption key is now resolved once per process and cached - it is static for the lifetime of the container, and this also removes a database query from every credential read
- All settings encryption now happens BEFORE the database transaction opens, matching how download clients and hoster accounts were already handled
- The settings transaction got real timeout headroom (30s) for genuinely slow storage - if your database lives on a network share or an Unraid /mnt/user path, saves are no longer racing a 5-second clock
🧪 Verified
- New regression test: the encryption key is fetched exactly once across repeated encrypt/decrypt calls
- Live check against a SQLite database: saving a fresh credential now returns success and stores the encrypted value - the identical request was a guaranteed timeout before
- Full suites green: vitest 430/430, tsc clean, production build OK
📦 Upgrading
docker compose pull && docker compose down && docker compose up -d - no schema changes, no config changes. If you hit this bug during setup, just re-enter the credential and save again after updating.