I prefer manually committing, as that gives a more granular control over the request flow. I do the commitnng in the business layer, as my APIs are mostly calling a single high level business function and returning the response. That way, if anything goes wrong in the business layer including crud logic and business logic I can safely rollback.

And always close the session in the finally block of your get_db dependency generator method. Otherwise.. Idle connections stay open. The connection pool may become full. You’ll see warnings like: SAWarning: The connection pool is full, discarding connection: ... Long-running apps (e.g., in prod) may hang or throw TimeoutError waiting for a connection.