Function purgeOrganizationData

apps/cloud/src/db/org-deletion.ts:54–95

(
  db: DrizzleDb,
  organizationId: string,
  deletedAt: Date,
)

 * nothing and keeps the first mark.
 */
export const purgeOrganizationData = (
  db: DrizzleDb,
  organizationId: string,
  deletedAt: Date,
): Promise<void> =>
  db.transaction(async (tx) => {
    // Executor tenant tables — every row is scoped by `tenant = organizationId`.
    await tx.delete(tool).where(eq(tool.tenant, organizationId));
    await tx.delete(definition).where(eq(definition.tenant, organizationId));
    await tx.delete(connection).where(eq(connection.tenant, organizationId));
    await tx.delete(integration).where(eq(integration.tenant, organizationId));
    await tx.delete(oauth_client).where(eq(oauth_client.tenant, organizationId));
    await tx.delete(oauth_session).where(eq(oauth_session.tenant, organizationId));
    await tx.delete(tool_policy).where(eq(tool_policy.tenant, organizationId));
    await tx.delete(plugin_storage).where(eq(plugin_storage.tenant, organizationId));
    await tx.delete(subject).where(eq(subject.tenant, organizationId));
    await tx.delete(artifact).where(eq(artifact.tenant, organizationId));

    // Secrets, OAuth tokens, and cached specs live in `blob`, namespaced by
    // owner: `o:<org>/<plugin>` (org scope) and `u:<org>:<subject>/<plugin>`
    // (per-user scope). Match both prefixes for this org.
    const esc = escapeLike(organizationId);
    await tx
      .delete(blob)
      .where(
        or(
          sql`${blob.namespace} LIKE ${`o:${esc}/%`} ESCAPE '\\'`,
          sql`${blob.namespace} LIKE ${`u:${esc}:%`} ESCAPE '\\'`,
        ),
      );

    // Identity mirror: the memberships go, the organization row stays as a
    // tombstone (see the header). `accounts` are intentionally left: a user
    // may belong to other orgs.
    await tx.delete(memberships).where(eq(memberships.organizationId, organizationId));
    await tx
      .update(organizations)
      .set({
        deletedAt: sql`coalesce(${organizations.deletedAt}, ${deletedAt.toISOString()}::timestamptz)`,
      })
      .where(eq(organizations.id, organizationId));
  });