user-owned-module

name	user-owned-module
description	Wire a new user-owned module into user deletion. Use whenever a change adds a table with a FK to users, or writes files under uploads/ or data/ keyed by user, conversation, or any other per-user id. Covers purge_user_data(), the file cleanup registry, and the FK-cascade trap.

User-Owned Module → User Deletion

purge_user_data() in src/fim_one/web/services/user_deletion.py is the single path both admin deletion and self-serve account deletion funnel through. A module that stores per-user state and is not wired in there fails in one of two ways, neither of which any existing test catches:

• Orphaned files. ORM cascade deletes rows. It knows nothing about disk, so uploads/ and data/ keep the user's content forever after the account is gone.
• A hard 500 on delete. A new table with a FK to users and no ondelete cascade makes db.delete(user) raise a FK violation. SQLite now runs with PRAGMA foreign_keys=ON, so this fails in dev too — but only if someone actually deletes a user.

What to add

Find the block marked # 3. Clean up file-system resources before the DB delete. in user_deletion.py.

Files

Collect the ids your module keys on, then remove each path. Deletion must be tolerant of missing paths — the account may be deleted before the module ever wrote anything:

shutil.rmtree(some_dir / some_id, ignore_errors=True)
(some_dir / f"{some_id}.json").unlink(missing_ok=True)

For a glob-shaped layout (one file per user, name-prefixed), glob and unlink rather than assuming a directory exists.

Rows

If the new table has a FK to users without ondelete="CASCADE", add an explicit FK-safe DELETE in the same function, ordered before the parent row goes. Prefer declaring the cascade on the FK when the relationship genuinely is ownership; the explicit delete is for the cases where it is not.

Current registry

Keep this table and the one in CLAUDE.md in step with the code.

Module	Path	Method
conversations	data/sandbox/{conv_id}/, uploads/conversations/{conv_id}/, data/workspaces/{conv_id}/, data/dag_checkpoints/{conv_id}.json	shutil.rmtree / unlink
knowledge_bases	uploads/kb/{kb_id}/, data/vector_store/user_{user_id}/	shutil.rmtree
user uploads	uploads/user_{user_id}/	shutil.rmtree
avatar	uploads/avatars/{user_id}_*	glob + unlink

Test it

Deletion is the one path where "it looked fine" is worthless: the failure shows up only once real user data exists. Add a case to tests/test_user_deletion.py that creates the module's rows and its files, deletes the user, and asserts both are gone.