fix: cascade websites on user/team delete + filter soft-deleted in list queries

src/app/(collect)/p/[slug]/route.ts

@@ -21,6 +21,7 @@ export async function GET(request: Request, { params }: { params: Promise<{ slug
         return findPixel({
           where: {
             slug,
+            deletedAt: null,
           },
         });
       },
@@ -34,6 +35,7 @@ export async function GET(request: Request, { params }: { params: Promise<{ slug
     pixel = await findPixel({
       where: {
         slug,
+        deletedAt: null,
       },
     });
 

src/app/(collect)/q/[slug]/route.ts

@@ -19,6 +19,7 @@ export async function GET(request: Request, { params }: { params: Promise<{ slug
         return findLink({
           where: {
             slug,
+            deletedAt: null,
           },
         });
       },
@@ -32,6 +33,7 @@ export async function GET(request: Request, { params }: { params: Promise<{ slug
     link = await findLink({
       where: {
         slug,
+        deletedAt: null,
       },
     });
 

src/queries/prisma/link.ts

@@ -1,5 +1,6 @@
 import type { Prisma } from '@/generated/prisma/client';
 import prisma from '@/lib/prisma';
+import redis from '@/lib/redis';
 import type { QueryFilters } from '@/lib/types';
 
 export async function findLink(criteria: Prisma.LinkFindUniqueArgs) {
@@ -47,6 +48,7 @@ export async function getTeamLinks(teamId: string, filters?: QueryFilters) {
     {
       where: {
         teamId,
+        deletedAt: null,
       },
     },
     filters,
@@ -58,9 +60,25 @@ export async function createLink(data: Prisma.LinkUncheckedCreateInput) {
 }
 
 export async function updateLink(linkId: string, data: any) {
-  return prisma.client.link.update({ where: { id: linkId }, data });
+  // Fetch the old slug so we can invalidate its cache entry if the slug changes.
+  const previous = await prisma.client.link.findUnique({
+    where: { id: linkId },
+    select: { slug: true },
+  });
+  const link = await prisma.client.link.update({ where: { id: linkId }, data });
+  if (redis.enabled) {
+    await redis.client.del(`link:${link.slug}`);
+    if (previous && previous.slug !== link.slug) {
+      await redis.client.del(`link:${previous.slug}`);
+    }
+  }
+  return link;
 }
 
 export async function deleteLink(linkId: string) {
-  return prisma.client.link.delete({ where: { id: linkId } });
+  const link = await prisma.client.link.delete({ where: { id: linkId } });
+  if (redis.enabled) {
+    await redis.client.del(`link:${link.slug}`);
+  }
+  return link;
 }

src/queries/prisma/pixel.ts

@@ -1,5 +1,6 @@
 import type { Prisma } from '@/generated/prisma/client';
 import prisma from '@/lib/prisma';
+import redis from '@/lib/redis';
 import type { QueryFilters } from '@/lib/types';
 
 export async function findPixel(criteria: Prisma.PixelFindUniqueArgs) {
@@ -30,6 +31,7 @@ export async function getUserPixels(userId: string, filters?: QueryFilters) {
     {
       where: {
         userId,
+        deletedAt: null,
       },
     },
     filters,
@@ -41,6 +43,7 @@ export async function getTeamPixels(teamId: string, filters?: QueryFilters) {
     {
       where: {
         teamId,
+        deletedAt: null,
       },
     },
     filters,
@@ -52,9 +55,25 @@ export async function createPixel(data: Prisma.PixelUncheckedCreateInput) {
 }
 
 export async function updatePixel(pixelId: string, data: any) {
-  return prisma.client.pixel.update({ where: { id: pixelId }, data });
+  // Fetch the old slug so we can invalidate its cache entry if the slug changes.
+  const previous = await prisma.client.pixel.findUnique({
+    where: { id: pixelId },
+    select: { slug: true },
+  });
+  const pixel = await prisma.client.pixel.update({ where: { id: pixelId }, data });
+  if (redis.enabled) {
+    await redis.client.del(`pixel:${pixel.slug}`);
+    if (previous && previous.slug !== pixel.slug) {
+      await redis.client.del(`pixel:${previous.slug}`);
+    }
+  }
+  return pixel;
 }
 
 export async function deletePixel(pixelId: string) {
-  return prisma.client.pixel.delete({ where: { id: pixelId } });
+  const pixel = await prisma.client.pixel.delete({ where: { id: pixelId } });
+  if (redis.enabled) {
+    await redis.client.del(`pixel:${pixel.slug}`);
+  }
+  return pixel;
 }

src/queries/prisma/team.ts

@@ -2,6 +2,7 @@ import { Prisma, type Team } from '@/generated/prisma/client';
 import { ROLES } from '@/lib/constants';
 import { uuid } from '@/lib/crypto';
 import prisma from '@/lib/prisma';
+import redis from '@/lib/redis';
 import type { PageResult, QueryFilters } from '@/lib/types';
 
 import TeamFindManyArgs = Prisma.TeamFindManyArgs;
@@ -144,6 +145,40 @@ export async function deleteTeam(teamId: string) {
   const { client, transaction } = prisma;
   const cloudMode = !!process.env.CLOUD_MODE;
 
+  const [links, pixels, boards, websites] = await Promise.all([
+    client.link.findMany({
+      where: { teamId },
+      select: { id: true, slug: true, deletedAt: true },
+    }),
+    client.pixel.findMany({
+      where: { teamId },
+      select: { id: true, slug: true, deletedAt: true },
+    }),
+    client.board.findMany({ where: { teamId }, select: { id: true } }),
+    client.website.findMany({ where: { teamId }, select: { id: true, deletedAt: true } }),
+  ]);
+  const websiteIds = websites.map(w => w.id);
+  const entityIds = [
+    ...links.map(l => l.id),
+    ...pixels.map(p => p.id),
+    ...boards.map(b => b.id),
+    ...websiteIds,
+  ];
+  // Only invalidate Redis cache for slugs/keys that are still live (not already soft-deleted).
+  const linkSlugs = links.filter(l => !l.deletedAt).map(l => l.slug);
+  const pixelSlugs = pixels.filter(p => !p.deletedAt).map(p => p.slug);
+  const liveWebsiteIds = websites.filter(w => !w.deletedAt).map(w => w.id);
+
+  const invalidateRedis = async () => {
+    if (redis.enabled && (linkSlugs.length || pixelSlugs.length || liveWebsiteIds.length)) {
+      await Promise.all([
+        ...linkSlugs.map(slug => redis.client.del(`link:${slug}`)),
+        ...pixelSlugs.map(slug => redis.client.del(`pixel:${slug}`)),
+        ...liveWebsiteIds.map(id => redis.client.del(`website:${id}`)),
+      ]);
+    }
+  };
+
   if (cloudMode) {
     return transaction([
       client.team.update({
@@ -154,7 +189,25 @@ export async function deleteTeam(teamId: string) {
           id: teamId,
         },
       }),
-    ]);
+      client.share.deleteMany({ where: { entityId: { in: entityIds } } }),
+      // deletedAt: null avoids restamping rows that were already soft-deleted earlier.
+      client.link.updateMany({
+        data: { deletedAt: new Date() },
+        where: { teamId, deletedAt: null },
+      }),
+      client.pixel.updateMany({
+        data: { deletedAt: new Date() },
+        where: { teamId, deletedAt: null },
+      }),
+      client.board.deleteMany({ where: { teamId } }),
+      client.website.updateMany({
+        data: { deletedAt: new Date() },
+        where: { teamId, deletedAt: null },
+      }),
+    ]).then(async result => {
+      await invalidateRedis();
+      return result;
+    });
   }
 
   return transaction([
@@ -163,10 +216,28 @@ export async function deleteTeam(teamId: string) {
         teamId,
       },
     }),
+    client.share.deleteMany({ where: { entityId: { in: entityIds } } }),
+    client.link.deleteMany({ where: { teamId } }),
+    client.pixel.deleteMany({ where: { teamId } }),
+    client.board.deleteMany({ where: { teamId } }),
+    // Mirror deleteWebsite cleanup order for team-owned websites:
+    client.sessionReplaySaved.deleteMany({ where: { websiteId: { in: websiteIds } } }),
+    client.sessionReplay.deleteMany({ where: { websiteId: { in: websiteIds } } }),
+    client.revenue.deleteMany({ where: { websiteId: { in: websiteIds } } }),
+    client.eventData.deleteMany({ where: { websiteId: { in: websiteIds } } }),
+    client.sessionData.deleteMany({ where: { websiteId: { in: websiteIds } } }),
+    client.websiteEvent.deleteMany({ where: { websiteId: { in: websiteIds } } }),
+    client.session.deleteMany({ where: { websiteId: { in: websiteIds } } }),
+    client.report.deleteMany({ where: { websiteId: { in: websiteIds } } }),
+    client.segment.deleteMany({ where: { websiteId: { in: websiteIds } } }),
+    client.website.deleteMany({ where: { id: { in: websiteIds } } }),
     client.team.delete({
       where: {
         id: teamId,
       },
     }),
-  ]);
+  ]).then(async result => {
+    await invalidateRedis();
+    return result;
+  });
 }

src/queries/prisma/user.ts

@@ -2,6 +2,7 @@ import { Prisma } from '@/generated/prisma/client';
 import { ROLES } from '@/lib/constants';
 import { getRandomChars } from '@/lib/generate';
 import prisma from '@/lib/prisma';
+import redis from '@/lib/redis';
 import type { QueryFilters, Role } from '@/lib/types';
 
 import UserFindManyArgs = Prisma.UserFindManyArgs;
@@ -103,16 +104,6 @@ export async function deleteUser(userId: string) {
   const { client, transaction } = prisma;
   const cloudMode = !!process.env.CLOUD_MODE;
 
-  const websites = await client.website.findMany({
-    where: { userId },
-  });
-
-  let websiteIds = [];
-
-  if (websites.length > 0) {
-    websiteIds = websites.map(a => a.id);
-  }
-
   const teams = await client.team.findMany({
     where: {
       members: {
@@ -126,13 +117,57 @@ export async function deleteUser(userId: string) {
 
   const teamIds = teams.map(a => a.id);
 
+  // Cloud mode keeps owned teams (and their team-owned content), so cleanup
+  // only covers user-direct rows. Non-cloud hard-deletes owned teams below,
+  // so we must also clean up team-owned content (websites included).
+  const ownedFilter = cloudMode
+    ? { userId }
+    : { OR: [{ userId }, { teamId: { in: teamIds } }] };
+
+  const [links, pixels, boards, websites] = await Promise.all([
+    client.link.findMany({
+      where: ownedFilter,
+      select: { id: true, slug: true, deletedAt: true },
+    }),
+    client.pixel.findMany({
+      where: ownedFilter,
+      select: { id: true, slug: true, deletedAt: true },
+    }),
+    client.board.findMany({ where: ownedFilter, select: { id: true } }),
+    client.website.findMany({
+      where: ownedFilter,
+      select: { id: true, deletedAt: true },
+    }),
+  ]);
+  const websiteIds = websites.map(w => w.id);
+  const entityIds = [
+    ...links.map(l => l.id),
+    ...pixels.map(p => p.id),
+    ...boards.map(b => b.id),
+    ...websiteIds,
+  ];
+  // Only invalidate Redis cache for slugs/keys that are still live (not already soft-deleted).
+  const linkSlugs = links.filter(l => !l.deletedAt).map(l => l.slug);
+  const pixelSlugs = pixels.filter(p => !p.deletedAt).map(p => p.slug);
+  const liveWebsiteIds = websites.filter(w => !w.deletedAt).map(w => w.id);
+
+  const invalidateRedis = async () => {
+    if (redis.enabled && (linkSlugs.length || pixelSlugs.length || liveWebsiteIds.length)) {
+      await Promise.all([
+        ...linkSlugs.map(slug => redis.client.del(`link:${slug}`)),
+        ...pixelSlugs.map(slug => redis.client.del(`pixel:${slug}`)),
+        ...liveWebsiteIds.map(id => redis.client.del(`website:${id}`)),
+      ]);
+    }
+  };
+
   if (cloudMode) {
     return transaction([
       client.website.updateMany({
         data: {
           deletedAt: new Date(),
         },
-        where: { id: { in: websiteIds } },
+        where: { id: { in: websiteIds }, deletedAt: null },
       }),
       client.user.update({
         data: {
@@ -143,22 +178,35 @@ export async function deleteUser(userId: string) {
           id: userId,
         },
       }),
-    ]);
+      client.share.deleteMany({ where: { entityId: { in: entityIds } } }),
+      // deletedAt: null avoids restamping rows that were already soft-deleted earlier.
+      // Spread `ownedFilter` (which is `{ userId }` in cloud mode) for consistency
+      // with everything else in the function.
+      client.link.updateMany({
+        data: { deletedAt: new Date() },
+        where: { ...ownedFilter, deletedAt: null },
+      }),
+      client.pixel.updateMany({
+        data: { deletedAt: new Date() },
+        where: { ...ownedFilter, deletedAt: null },
+      }),
+      client.board.deleteMany({ where: { userId } }),
+    ]).then(async result => {
+      await invalidateRedis();
+      return result;
+    });
   }
 
   return transaction([
-    client.eventData.deleteMany({
-      where: { websiteId: { in: websiteIds } },
-    }),
-    client.sessionData.deleteMany({
-      where: { websiteId: { in: websiteIds } },
-    }),
-    client.websiteEvent.deleteMany({
-      where: { websiteId: { in: websiteIds } },
-    }),
-    client.session.deleteMany({
-      where: { websiteId: { in: websiteIds } },
-    }),
+    // Website-dependent rows (mirror deleteWebsite cleanup at queries/prisma/website.ts):
+    client.sessionReplaySaved.deleteMany({ where: { websiteId: { in: websiteIds } } }),
+    client.sessionReplay.deleteMany({ where: { websiteId: { in: websiteIds } } }),
+    client.revenue.deleteMany({ where: { websiteId: { in: websiteIds } } }),
+    client.eventData.deleteMany({ where: { websiteId: { in: websiteIds } } }),
+    client.sessionData.deleteMany({ where: { websiteId: { in: websiteIds } } }),
+    client.websiteEvent.deleteMany({ where: { websiteId: { in: websiteIds } } }),
+    client.session.deleteMany({ where: { websiteId: { in: websiteIds } } }),
+    client.segment.deleteMany({ where: { websiteId: { in: websiteIds } } }),
     client.teamUser.deleteMany({
       where: {
         OR: [
@@ -194,6 +242,10 @@ export async function deleteUser(userId: string) {
         ],
       },
     }),
+    client.share.deleteMany({ where: { entityId: { in: entityIds } } }),
+    client.link.deleteMany({ where: ownedFilter }),
+    client.pixel.deleteMany({ where: ownedFilter }),
+    client.board.deleteMany({ where: ownedFilter }),
     client.website.deleteMany({
       where: { id: { in: websiteIds } },
     }),
@@ -202,5 +254,8 @@ export async function deleteUser(userId: string) {
         id: userId,
       },
     }),
-  ]);
+  ]).then(async result => {
+    await invalidateRedis();
+    return result;
+  });
 }