fix: ensure all objects, files, and history are hard deleted on org cascade delete

Signed-off-by: Sarah Funkhouser <147884153+golanglemonade@users.noreply.github.com>

Author: golanglemonade

.task/checksum/generate-ent-smart

@@ -1 +1 @@
-8f951e1a0020299ee9450a72fdfa0456
+2d307e5e6ca1c7bab36a399e0475c471

.task/checksum/generate-graphql-smart

@@ -1 +1 @@
-f0f7821ffee1b805d010e873c4106a75
+5669f9c138c1b8e0909f504ac0877f3b

.task/checksum/generate-openapi-smart

@@ -1 +1 @@
-673005be2e9496ae3902b1e0f281124f
+ea6b375ad70ff3d16b671f9c17e8f609

internal/ent/checksum/.history_schema_checksum

@@ -1 +1 @@
-001a87c385f673386bb8cd60ec25c1b4a6bc53b30912f6ecb2eef46289b08d62
+f3c3132eb648cc67fca2b288f3650ab193b68a70cb72df25abceda4241420697

internal/ent/checksum/.schema_checksum

@@ -1 +1 @@
-ac6af5b3c4a1d30cefe12c7f70dc5f2ec7cce30d4e4d3cf78c3c6ba6b9461e3d
+92f81d84248650b5231e1cd2cc1e05f36d89cee66fa2e329179464a08af2789c

internal/ent/generate/entc.go

@@ -273,7 +273,14 @@ func getEntHistoryGqlExtension() *entgql.Extension {
 	return gqlExt
 }
 
+// skipper defines what will bypass history logs, this includes
+// purge history on cascade delete as well as
+// if the caller has the cap to bypass audit logs, give to the integration caller
 const skipper = `
+    if PurgeHistoryEnabled(ctx) {
+        return true
+    }
+
     caller, _ := auth.CallerFromContext(ctx)
 
     return caller.HasInLineage(auth.CapBypassAuditLog)

internal/ent/generate/templates/ent/edge_cleanup.tmpl

@@ -31,17 +31,32 @@ import (
 			   {{- range $edge := $node.Edges }}
 					{{/* if the edge has our custom annotation applied */}}
 					{{- if $annotation := $edge.Annotations.OPENLANE_CASCADE }}
+						{{/* schemas that opt out of history tracking have no history table to purge */}}
+						{{- $trackedHistory := or ( not $edge.Type.Annotations.History ) (eq $edge.Type.Annotations.History.Exclude false) }}
 						{{/* use the client to delete records where the edge schema has a field (provided by the annotation) containing the ID provided by the func */}}
 						{{/* special case for child fields */}}
 						{{- if eq $annotation.Field "Child" }}
 						if exists, err := FromContext(ctx).{{ $edge.Type.Name }}.Query().Where({{ $edge.Type.Name | lower }}.HasParentWith({{ $edge.Type.Name | lower }}.ID(id))).Exist(ctx); err == nil && exists {
+							{{- if $trackedHistory }}
+							{{/* the history rows are matched by a sub-select on the records being removed, so this has to run first */}}
+							if err := Purge{{ $edge.Type.Name }}History(ctx, {{ $edge.Type.Name | lower }}.HasParentWith({{ $edge.Type.Name | lower }}.ID(id))); err != nil {
+								return err
+							}
+							{{- end }}
+
 							if organizationCount, err := FromContext(ctx).{{ $edge.Type.Name  }}.Delete().Where({{ $edge.Type.Name  | lower }}.HasParentWith({{ $edge.Type.Name  | lower }}.ID(id))).Exec(ctx); err != nil {
 								logx.FromContext(ctx).Error().Err(err).Int("count", {{ $edge.Type.Name  | lower }}Count).Msg("error deleting child {{ $edge.Type.Name | lower }}")
 								return err
 							}
 						}
 						{{- else if hasSuffix $annotation.Field "ID" }}
 						if exists, err := FromContext(ctx).{{ $edge.Type.Name }}.Query().Where(({{ $edge.Type.Name | lower }}.{{ $annotation.Field }}(id))).Exist(ctx); err == nil && exists {
+							{{- if $trackedHistory }}
+							if err := Purge{{ $edge.Type.Name }}History(ctx, {{ $edge.Type.Name | lower }}.{{ $annotation.Field }}(id)); err != nil {
+								return err
+							}
+							{{- end }}
+
 							if {{ $edge.Type.Name | lower }}Count, err := FromContext(ctx).{{ $edge.Type.Name }}.Delete().Where({{ $edge.Type.Name | lower }}.{{ $annotation.Field }}(id)).Exec(ctx); err != nil {
 								logx.FromContext(ctx).Error().Err(err).Int("count", {{ $edge.Type.Name  | lower }}Count).Msg("error deleting {{ $edge.Type.Name | lower }}")
 								return err
@@ -63,6 +78,12 @@ import (
 							}
 						}
 						if exists, err := FromContext(ctx).{{ $edge.Type.Name }}.Query().Where(({{ $edge.Type.Name | lower }}.Has{{ $annotation.Field }}With({{ $node.Name | lower }}.ID(id)))).Exist(ctx); err == nil && exists {
+							{{- if $trackedHistory }}
+							if err := Purge{{ $edge.Type.Name }}History(ctx, {{ $edge.Type.Name | lower }}.Has{{ $annotation.Field }}With({{ $node.Name | lower }}.ID(id))); err != nil {
+								return err
+							}
+							{{- end }}
+
 							if {{ $edge.Type.Name | lower }}Count, err := FromContext(ctx).{{ $edge.Type.Name }}.Delete().Where({{ $edge.Type.Name | lower }}.Has{{ $annotation.Field }}With({{ $node.Name | lower }}.ID(id))).Exec(ctx); err != nil {
 								logx.FromContext(ctx).Error().Err(err).Int("count", {{ $edge.Type.Name  | lower }}Count).Msg("error deleting {{ $edge.Type.Name | lower }}")
 								return err
@@ -74,8 +95,21 @@ import (
 			   {{- if $annotation := $node.Annotations.OPENLANE_CASCADE_THROUGH }}
 			   {{- range $schema := $annotation.Schemas }}
 					{{- $field := $schema.Through }}
+					{{/* the through schema is named by the annotation, so its node has to be looked up to know whether it tracks history */}}
+					{{- $throughHistory := false }}
+					{{- range $through := $.Nodes }}
+						{{- if eq $through.Name $field }}
+							{{- $throughHistory = or ( not $through.Annotations.History ) (eq $through.Annotations.History.Exclude false) }}
+						{{- end }}
+					{{- end }}
 					{{/* use the client to delete records where the edge has a field and a through schema (provided by the annotation) containing the ID provided by the func */}}
 					if exists, err := FromContext(ctx).{{ $field }}.Query().Where(({{ $field | lower }}.Has{{ $schema.Field }}With({{ $schema.Field | lower }}.ID(id)))).Exist(ctx); err == nil && exists {
+						{{- if $throughHistory }}
+						if err := Purge{{ $field }}History(ctx, {{ $field | lower }}.Has{{ $schema.Field }}With({{ $schema.Field | lower }}.ID(id))); err != nil {
+							return err
+						}
+						{{- end }}
+
 						if {{ $field | lower }}Count, err := FromContext(ctx).{{ $field }}.Delete().Where({{ $field | lower }}.Has{{ $schema.Field }}With({{ $schema.Field | lower }}.ID(id))).Exec(ctx); err != nil {
 							logx.FromContext(ctx).Error().Err(err).Int("count", {{ $field | lower }}Count).Msg("error deleting {{ $field | lower }}")
 							return err

internal/ent/generate/templates/ent/history_cleanup.tmpl

@@ -0,0 +1,70 @@
+{{/* The line below tells Intellij/GoLand to enable the autocompletion based on the *gen.Graph type. */}}
+{{/* gotype: entgo.io/ent/entc/gen.Graph */}}
+
+{{ define "history_cleanup" }}
+
+{{/* Add the base header for the generated file */}}
+{{ $pkg := base $.Config.Package }}
+{{ template "header" $ }}
+
+import (
+	"entgo.io/ent/dialect/sql"
+	"github.com/theopenlane/core/internal/ent/generated/predicate"
+	"github.com/theopenlane/core/internal/ent/hooks/contextx"
+	"github.com/theopenlane/core/pkg/logx"
+	"github.com/theopenlane/entx/history"
+	{{- range $node := $.Nodes }}
+		{{- if or ( not $node.Annotations.History ) (eq $node.Annotations.History.Exclude false) }}
+	"github.com/theopenlane/core/internal/ent/historygenerated/{{ $node.Name | lower }}history"
+		{{- end }}
+	{{- end }}
+)
+
+// PurgeHistoryEnabled reports whether the current operation is purging history rather than recording
+// it. The generated history hooks use this as their skipper, a delete that is purging history must
+// not write a new row recording that delete, it would undo the purge that ran just before it
+func PurgeHistoryEnabled(ctx context.Context) bool {
+	return contextx.PurgeHistoryEnabled(ctx)
+}
+
+	{{- range $node := $.Nodes }}
+		{{/* only schemas that actually track history have a history table to purge */}}
+		{{- if or ( not $node.Annotations.History ) (eq $node.Annotations.History.Exclude false) }}
+			{{- $pkgName := $node.Name | lower }}
+
+			{{/* the ids are matched with a sub-select instead of being loaded into memory, an
+			     organization can own hundreds of thousands of records and materializing every id
+			     to build an IN list would blow up both memory and the statement size */}}
+// Purge{{ $node.Name }}History removes the history rows belonging to every {{ $pkgName }} matching
+// the given predicates. It is a no-op unless the context opts in via contextx.WithPurgeHistory, so
+// deletes that should keep their audit trail are unaffected.
+// This has to run before the {{ $pkgName }} records themselves are deleted, the rows are matched
+// with a sub-select against the {{ $pkgName }} table rather than by loading the ids
+func Purge{{ $node.Name }}History(ctx context.Context, ps ...predicate.{{ $node.Name }}) error {
+	if !contextx.PurgeHistoryEnabled(ctx) {
+		return nil
+	}
+
+	client := FromContext(ctx)
+	if client == nil || client.HistoryClient == nil {
+		return nil
+	}
+
+	refs := sql.Select({{ $pkgName }}.FieldID).From(sql.Table({{ $pkgName }}.Table))
+	for _, p := range ps {
+		p(refs)
+	}
+
+	if _, err := client.HistoryClient.{{ $node.Name }}History.Delete().Where(func(s *sql.Selector) {
+		s.Where(sql.In({{ $pkgName }}history.FieldRef, refs))
+	}).Exec(history.WithContext(ctx)); err != nil {
+		logx.FromContext(ctx).Error().Err(err).Msg("error purging {{ $pkgName }} history")
+
+		return err
+	}
+
+	return nil
+}
+		{{- end }}
+	{{- end }}
+{{ end }}