[BUG] ResourceServiceImpl.onPluginCreated performs multiple writes non-transactionally

[Aias00]

• severity: High
• files: shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/ResourceServiceImpl.java:211-217
• description: onPluginCreated (an @EventListener(PluginCreatedEvent.class)) calls this.createOne(resourceDO) (insert + publisher.onCreated which triggers PermissionServiceImpl.onResourcesCreated inserting a permission row) and then insertResourceBatch(...) (batch insert + batch permission insert). The method has no @Transactional annotation, unlike onPluginDeleted (line 224, which IS @Transactional). A failure mid-way leaves orphaned resource/permission rows.
• impact: Partial-failure leaves resources with missing data-permission resources, or permissions for resources that were not fully created.
• suggested_fix: Add @Transactional(rollbackFor = Exception.class) to onPluginCreated, mirroring onPluginDeleted.
• confidence: High
• related_existing: none.

---

Identified during the 2026-08-02 deep re-scan; full list in docs/scan2-2026-08-02/00-consolidated-critical-high.md.

[github-actions]

👋 Hello @Aias00

A new issue has been opened by @Aias00:

• Title: [BUG] ResourceServiceImpl.onPluginCreated performs multiple writes non-transactionally
• Link: [BUG] ResourceServiceImpl.onPluginCreated performs multiple writes non-transactionally #6622

Please review when you have time. Thank you! 🙏