Skip to content

feat(entutils): centralize soft-delete with mixin + interceptor#4340

Draft
tothandras wants to merge 2 commits into
mainfrom
soft-delete-centralization
Draft

feat(entutils): centralize soft-delete with mixin + interceptor#4340
tothandras wants to merge 2 commits into
mainfrom
soft-delete-centralization

Conversation

@tothandras
Copy link
Copy Markdown
Contributor

Introduce pkg/framework/entutils/softdelete with:

  • Time-windowed read filter (ActivePredicate + Interceptor) so adapters no longer hand-roll Or(DeletedAtIsNil(), DeletedAtGT(now)) on every query.
  • Skip(ctx) / IsSkipped(ctx) for callers that legitimately need to see tombstoned rows or filter deleted_at against a non-now reference.
  • Hook on OpDelete/OpDeleteOne that rewrites mutations to OpUpdate*
    • SetDeletedAt(clock.Now()), enforcing the project policy that soft-delete entities are never hard-deleted.
  • Cascade registry (Register / RunCascade) so generated per-entity walkers can register from init() without creating a cycle with the generated db package. NoCascade edge annotation reserved for future per-edge opt-outs.

Pilot adoption on Grant and CustomerSubjects (both leaves with no outgoing soft-delete edges, so cascade infrastructure is present but not exercised by these two). The grant adapter now translates IncludeDeleted via softdelete.Skip and skips the filter in ListActiveGrantsBetween, which intentionally inspects deleted_at against a non-now reference.

Enables gen.FeatureIntercept on openmeter/ent so the Interceptor() fires; this triggers ent's standard split between db/runtime.go and db/runtime/runtime.go and adds db/intercept/. No DB-schema diff (mixin contributes only Hooks/Interceptors, no fields).

Existing manual DeletedAtIsNil/DeletedAtGT call sites and entitlementHook.PreDelete are intentionally left in place; removing them is the follow-up that audits the remaining 24 schemas.

Overview

Fixes #(issue)

Notes for reviewer

Introduce pkg/framework/entutils/softdelete with:
- Time-windowed read filter (ActivePredicate + Interceptor) so adapters no
  longer hand-roll Or(DeletedAtIsNil(), DeletedAtGT(now)) on every query.
- Skip(ctx) / IsSkipped(ctx) for callers that legitimately need to see
  tombstoned rows or filter deleted_at against a non-now reference.
- Hook on OpDelete/OpDeleteOne that rewrites mutations to OpUpdate*
  + SetDeletedAt(clock.Now()), enforcing the project policy that
  soft-delete entities are never hard-deleted.
- Cascade registry (Register / RunCascade) so generated per-entity
  walkers can register from init() without creating a cycle with the
  generated db package. NoCascade edge annotation reserved for future
  per-edge opt-outs.

Pilot adoption on Grant and CustomerSubjects (both leaves with no
outgoing soft-delete edges, so cascade infrastructure is present but
not exercised by these two). The grant adapter now translates
IncludeDeleted via softdelete.Skip and skips the filter in
ListActiveGrantsBetween, which intentionally inspects deleted_at
against a non-now reference.

Enables gen.FeatureIntercept on openmeter/ent so the Interceptor()
fires; this triggers ent's standard split between db/runtime.go and
db/runtime/runtime.go and adds db/intercept/. No DB-schema diff (mixin
contributes only Hooks/Interceptors, no fields).

Existing manual DeletedAtIsNil/DeletedAtGT call sites and
entitlementHook.PreDelete are intentionally left in place; removing
them is the follow-up that audits the remaining 24 schemas.
@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented May 11, 2026

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 3836b1b4-a4a0-42de-ad1f-9e775f08ec5f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch soft-delete-centralization

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Build on the previous TimeMixin / softdelete pilot by closing two gaps.

1. Auto-cascade walker (entsoftdelete extension) — new entc extension at
   pkg/framework/entutils/entsoftdelete emits softDeleteCascade<Node>
   per soft-delete node, plus an init() that registers it with the
   runtime registry. Two-pass edge discovery: PASS 1 walks outgoing
   edge.To (parent->child, child owns FK); PASS 2 walks inbound edge.To
   declared on other tables that reference this node when this node has
   no reverse edge.From. Closes the Customer -> AppStripeCustomer chain
   automatically (the schema has no reverse edge on Customer and
   AppStripeCustomer.customer is an edge.To with Field('customer_id')
   and OwnFK()). softdelete.RunCascadeFor lets walkers recurse without
   constructing synthetic ent.Mutations; registry signature now takes
   (any, []any) so int-ID junction tables work alongside string-ID
   top-level entities. Cascade UPDATEs are OpUpdate (not OpDelete) so
   the soft-delete delete-rewrite hook does not re-enter recursively;
   init() ordering is irrelevant.

2. Project-wide TimeMixin adoption — entutils.TimeMixin now contributes
   the soft-delete Interceptor() and Hooks() directly, so every schema
   using TimeMixin (~30 entities, 46 use sites) inherits read-side
   filtering, the delete-rewrite hook, and the cascade walker without
   per-schema edits. Removes the pilot-only softdelete.SoftDeleteMixin{}
   entry from Grant; CustomerSubjects keeps it because it carries a
   hand-rolled deleted_at field (no TimeMixin).

3. Hard-delete escape hatch — softdelete.AllowHardDelete(ctx) lets
   adapters intentionally bypass the delete-rewrite hook for flows that
   physically remove rows (line replacement, plan/addon ratecard edits
   where the partial-unique index over deleted_at IS NULL cannot
   accommodate tombstones). Applied at billing/adapter/gatheringlines.go
   (BillingInvoiceLine + BillingInvoiceUsageBasedLineConfig),
   billing/adapter/invoicelinesplitgroup.go (BillingInvoiceSplitLineGroup),
   productcatalog/plan/adapter/plan.go (PlanPhase), and
   productcatalog/addon/adapter/addon.go (AddonRateCard).

4. Gitignore cleanup — root-anchored patterns (/.devenv/,
   /.pre-commit-config.yaml) missed the copies devenv leaks into
   subdirectories that host a 'nix develop' invocation (notably
   openmeter/ent/ where entc.go runs). Match .devenv/, .direnv/,
   .pre-commit-config.yaml, .nvmrc at any depth; explicitly re-include
   the root .nvmrc with !/.nvmrc because AGENTS.md documents it as the
   GitHub Actions Node version source-of-truth.

The DB schema is unchanged (no new columns, no FK changes), so no atlas
migration is generated. 'make lint-go' reports 0 issues; the softdelete
unit tests cover Skip / AllowHardDelete / ActivePredicate /
RunCascadeFor. Postgres-dependent integration tests are not run here.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants