[VS-NfD] Implement pond purge #193

New Issue

fable-5 · 2026-07-30T01:43:31+02:00

fable-5 commented

2026-07-30 01:43:31 +02:00

Plan reference: 20-massnahmenplan.md -> Phase 2
ADR: n/a
Effort: M (3 AT)
Depends on: —

Context

Deletion must actually delete. A trashed pond that stays in the database
forever is an unbounded residue of classified content and unanswerable in
a "deletion and destruction" chapter of the operations manual.

Current state

Pond.deletedAt / deletedBy implement a pond-level trash
(apps/api/prisma/schema.prisma:175,186, ADR 0013).
Purge exists only for pages: apps/api/src/trash/trash.service.ts
(purgeNow:96, purgeDuePages:104, purgePage:121) and the endpoint
apps/api/src/trash/trash.controller.ts:26. No equivalent for ponds.

Acceptance criteria

Retention-driven and manual pond purge exist and remove, in one
transaction-safe sequence: pages, revisions, page_updates,
page_content_cache rows (including the search vector),
attachments on disk, labels, links, comments, favorites, watches, and
pond-level grants.
Quota counters are corrected; the operation is idempotent and
resumable (a purge that races another is a no-op, as for pages).
Audit event recorded for both manual and retention purge.
DB test proves nothing referencing the pond survives, and a follow-up
search for content of the purged pond returns nothing.
docs/architecture/operations.md documents retention behaviour;
operations manual (#229) covers it under deletion and destruction.

Out of scope

Purge of user accounts (already covered by existing pseudonymization) and
the orphan-file sweep (#194).

**Plan reference:** `20-massnahmenplan.md` -> Phase 2 **ADR:** n/a **Effort:** M (3 AT) **Depends on:** — ## Context Deletion must actually delete. A trashed pond that stays in the database forever is an unbounded residue of classified content and unanswerable in a "deletion and destruction" chapter of the operations manual. ## Current state - `Pond.deletedAt` / `deletedBy` implement a pond-level trash (`apps/api/prisma/schema.prisma:175,186`, ADR 0013). - Purge exists **only for pages**: `apps/api/src/trash/trash.service.ts` (`purgeNow:96`, `purgeDuePages:104`, `purgePage:121`) and the endpoint `apps/api/src/trash/trash.controller.ts:26`. No equivalent for ponds. ## Acceptance criteria - [ ] Retention-driven and manual pond purge exist and remove, in one transaction-safe sequence: pages, revisions, `page_updates`, `page_content_cache` rows (including the search vector), attachments on disk, labels, links, comments, favorites, watches, and pond-level grants. - [ ] Quota counters are corrected; the operation is idempotent and resumable (a purge that races another is a no-op, as for pages). - [ ] Audit event recorded for both manual and retention purge. - [ ] DB test proves nothing referencing the pond survives, and a follow-up search for content of the purged pond returns nothing. - [ ] `docs/architecture/operations.md` documents retention behaviour; operations manual (#229) covers it under deletion and destruction. ## Out of scope Purge of user accounts (already covered by existing pseudonymization) and the orphan-file sweep (#194).

fable-5 added this to the M24 — VS-NfD: security quick wins milestone 2026-07-30 01:43:31 +02:00

fable-5 added the

area:storage

effort:M

vs-nfd

labels 2026-07-30 01:43:31 +02:00

fable-5 referenced this issue

2026-07-30 01:43:31 +02:00

[VS-NfD] Implement the orphan-file sweep and resolve `Attachment.deletedAt` #194

fable-5 referenced this issue

2026-07-30 01:43:57 +02:00

[VS-NfD] Write the operations manual (installation, update, backup/restore, deletion, role separation) #229