Kinto / kinto / 22113539843

100%

master: 100%

push

github

Fix purge_deleted() to only delete tombstones on PostgreSQL backend (#3644)

The purge_deleted() method's base class contract and docstring specify
that it deletes "tombstones" (soft-deleted objects). The memory backend
correctly operates only on tombstone storage (self._cemetery). However,
the PostgreSQL backend's DELETE queries lacked a deleted = TRUE filter,
meaning purge_deleted with a before timestamp or max_retained would
delete both live records and tombstones.

This can result in silent data loss when running the purge_deleted
maintenance script.

What changed:
- Added AND deleted = TRUE to the before-path DELETE query
- Added WHERE deleted = TRUE to the max_retained-path CTE so the
  ranking window only considers tombstones
- Added three test cases that create live records + tombstones, call
  purge_deleted, and verify only tombstones are removed

Test coverage:
- test_purge_deleted_with_before_only_deletes_tombstones: Tests the
  before parameter path with mixed live/deleted objects
- test_purge_deleted_with_max_retained_only_affects_tombstones: Tests
  the max_retained parameter with 3 live + 5 tombstones
- test_purge_deleted_without_before_only_deletes_tombstones: Tests
  purging all tombstones while preserving live records

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

1522 of 1522 branches covered (100.0%)

51 of 51 new or added lines in 1 file covered. (100.0%)

7792 of 7792 relevant lines covered (100.0%)

3.0 hits per line