@takosjp/yurucommu-core 3.4.3 → 3.4.4

package/src/backend/routes/posts/delete-cascade.ts

@@ -19,8 +19,8 @@
  * the remote `handleDelete` inbox path so neither can orphan rows.
  */
 
-import { and, eq, inArray, isNull, ne, or, sql } from "drizzle-orm";
-import type { Database } from "../../../db/index.ts";
+import { and, asc, eq, gt, inArray, isNull, or, sql } from "drizzle-orm";
+import type { D1Statement, Database } from "../../../db/index.ts";
 import type { IObjectStorage } from "../../runtime/types.ts";
 import {
   activities,
@@ -28,15 +28,24 @@ import {
   announces,
   bookmarks,
   communities,
-  inbox as inboxTable,
+  D1_MAX_BATCH_STATEMENTS,
   likes,
   mediaUploads,
   objectRecipients,
   objects,
+  runBatch,
   storyShares,
   storyViews,
   storyVotes,
 } from "../../../db/index.ts";
+import { activityProjectionDeleteStatements } from "../../lib/activity-delete-cascade.ts";
+import { chunkForInClause, D1_IN_CHUNK } from "../../lib/chunk.ts";
+
+type CascadeObject = {
+  apId: string;
+  attributedTo: string;
+  attachmentsJson: string;
+};
 
 /**
  * Reap the `media_uploads` rows attached to a single object.
@@ -51,8 +60,8 @@ import {
  * `attachmentMatches` semantics. There is no engine-level CASCADE for this edge,
  * so without this the upload rows orphan on every runtime.
  *
- * Returns silently when the object row is already gone (caller may delete the
- * object before or after calling this) or has no attachments.
+ * The caller supplies a still-present object snapshot; this returns silently
+ * when that snapshot has no attachments.
  *
  * When a `media` object-store binding is provided, the backing R2 blobs for the
  * reaped uploads are best-effort deleted by `r2_key` (mirroring the
@@ -67,22 +76,19 @@ import {
  * dropping to zero. The DB-row delete is unconditional (the reaped rows belong
  * to this object's reap set regardless).
  */
-async function deleteAttachedMediaUploads(
+async function deleteAttachedMediaUploadsForObject(
   db: Database,
-  objectApId: string,
+  obj: CascadeObject,
+  removedObjectApIds: ReadonlySet<string>,
   media?: IObjectStorage,
-): Promise<string[]> {
-  const obj = await db
-    .select({
-      attributedTo: objects.attributedTo,
-      attachmentsJson: objects.attachmentsJson,
-    })
-    .from(objects)
-    .where(eq(objects.apId, objectApId))
-    .get();
-
-  // No object row (already deleted) or no attachment payload: nothing to reap.
-  if (!obj || !obj.attachmentsJson || obj.attachmentsJson === "[]") return [];
+): Promise<{
+  mediaKeys: string[];
+  mediaUploadIds: string[];
+}> {
+  // No attachment payload: nothing to reap.
+  if (!obj.attachmentsJson || obj.attachmentsJson === "[]") {
+    return { mediaKeys: [], mediaUploadIds: [] };
+  }
 
   const attachmentsJson = obj.attachmentsJson;
 
@@ -110,42 +116,47 @@ async function deleteAttachedMediaUploads(
       attachmentsJson.includes(mediaUrlForKey(m.r2Key)),
   );
 
-  if (orphaned.length === 0) return [];
+  if (orphaned.length === 0) {
+    return { mediaKeys: [], mediaUploadIds: [] };
+  }
 
-  // Before any R2 purge, find which of these `r2_key`s are still referenced by
-  // ANOTHER (different `ap_id`), still-present object of the same author. Such
-  // a key must NOT have its blob deleted — another object still shows it. We
-  // run this read while the rows are still present so an OTHER object whose
-  // `attachments_json` happens to point back at this object's reap set is
-  // honoured; the lookup is scoped to the author's own objects (indexed) and
-  // excludes the object being reaped.
+  // Before any R2 purge, find which keys are still referenced by an object of
+  // the same author OUTSIDE the complete set being removed. This matters for a
+  // batch containing two posts that share one blob: checking only "another
+  // object" would make each target keep the other target's key, then leak the
+  // row and blob after both objects disappear.
   const stillReferencedKeys = new Set<string>();
   if (media) {
-    // For each orphaned key, ask SQL (indexed by attributedTo) whether ANOTHER
-    // present object of this author still references it — instead of loading
-    // EVERY other object's attachmentsJson into memory and substring-scanning
-    // them all (O(objects × keys), unbounded for a prolific author). `orphaned`
-    // is only this object's own attachments (a handful), so this is a small,
-    // bounded set of indexed lookups. Uses instr() (literal substring), NOT
-    // `LIKE '%<key>%'`: a 73-char `uploads/<64-hex>.png` key in a `%...%` pattern
-    // exceeds D1's LIKE pattern-complexity limit (SQLITE_ERROR 7500, ~50 chars).
-    // Mirrors media.ts findReferencingObject.
+    // Page only matching AP-IDs and stop at the first survivor. A NOT IN list
+    // cannot safely carry an unbounded removal set through D1's 100-parameter
+    // ceiling; keyset pages keep every query constant-sized without loading a
+    // prolific author's complete object history. instr() is literal and avoids
+    // D1's long-LIKE complexity failure.
     for (const m of orphaned) {
-      const ref = await db
-        .select({ apId: objects.apId })
-        .from(objects)
-        .where(
-          and(
-            eq(objects.attributedTo, obj.attributedTo),
-            ne(objects.apId, objectApId),
-            or(
-              sql`instr(${objects.attachmentsJson}, ${m.r2Key}) > 0`,
-              sql`instr(${objects.attachmentsJson}, ${mediaUrlForKey(m.r2Key)}) > 0`,
-            ),
+      let cursor: string | undefined;
+      while (true) {
+        const referenceMatch = and(
+          eq(objects.attributedTo, obj.attributedTo),
+          or(
+            sql`instr(${objects.attachmentsJson}, ${m.r2Key}) > 0`,
+            sql`instr(${objects.attachmentsJson}, ${mediaUrlForKey(m.r2Key)}) > 0`,
           ),
-        )
-        .get();
-      if (ref) stillReferencedKeys.add(m.r2Key);
+          cursor ? gt(objects.apId, cursor) : undefined,
+        );
+        const refs = await db
+          .select({ apId: objects.apId })
+          .from(objects)
+          .where(referenceMatch)
+          .orderBy(asc(objects.apId))
+          .limit(D1_IN_CHUNK);
+        if (refs.some((ref) => !removedObjectApIds.has(ref.apId))) {
+          stillReferencedKeys.add(m.r2Key);
+          break;
+        }
+        if (refs.length < D1_IN_CHUNK) break;
+        cursor = refs.at(-1)?.apId;
+        if (!cursor) break;
+      }
     }
   }
 
@@ -158,10 +169,6 @@ async function deleteAttachedMediaUploads(
   const idsToDelete = media
     ? orphaned.filter((m) => !stillReferencedKeys.has(m.r2Key)).map((m) => m.id)
     : orphaned.map((m) => m.id);
-  if (idsToDelete.length > 0) {
-    await db.delete(mediaUploads).where(inArray(mediaUploads.id, idsToDelete));
-  }
-
   // Return the keys whose reference count has now dropped to zero. The caller
   // purges them via purgeMediaBlobs AFTER it deletes the objects row, so the
   // IRREVERSIBLE R2 delete is the trailing step: if the objects-row delete fails
@@ -169,9 +176,12 @@ async function deleteAttachedMediaUploads(
   // surviving with a permanently-deleted blob (a broken image with no recovery).
   // Keys still embedded in another present object's `attachments_json` are kept
   // (blob + media_uploads row) so shared media isn't lost.
-  return media
-    ? orphaned.map((m) => m.r2Key).filter((k) => !stillReferencedKeys.has(k))
-    : [];
+  return {
+    mediaKeys: media
+      ? orphaned.map((m) => m.r2Key).filter((k) => !stillReferencedKeys.has(k))
+      : [],
+    mediaUploadIds: idsToDelete,
+  };
 }
 
 /**
@@ -286,45 +296,199 @@ export async function reapReplacedMediaUrl(
  * a `media` binding is passed, the backing R2 blobs are best-effort deleted too
  * so storage does not leak; pass `c.env.MEDIA` from the request context.
  *
- * Does not touch the `objects` row or `activities` (SET NULL, not CASCADE).
+ * Does not touch the `objects` row or `activities` (SET NULL, not CASCADE),
+ * but cancels every durable notification/delivery projection of Activities
+ * that target the object.
  */
 export async function deleteObjectCascade(
   db: Database,
   objectApId: string,
   media?: IObjectStorage,
 ): Promise<string[]> {
-  // Reap the media_uploads rows + child rows while the object row (and its
-  // attachments_json) is still readable. Returns the R2 keys whose blobs are now
-  // unreferenced — the caller MUST purge them via purgeMediaBlobs AFTER it has
-  // deleted the objects row, so the irreversible R2 delete is the trailing step.
-  const mediaKeys = await deleteAttachedMediaUploads(db, objectApId, media);
-  await db.delete(likes).where(eq(likes.objectApId, objectApId));
-  await db.delete(announces).where(eq(announces.objectApId, objectApId));
-  await db.delete(bookmarks).where(eq(bookmarks.objectApId, objectApId));
-  await db
-    .delete(objectRecipients)
-    .where(eq(objectRecipients.objectApId, objectApId));
-  await db.delete(storyViews).where(eq(storyViews.storyApId, objectApId));
-  await db.delete(storyVotes).where(eq(storyVotes.storyApId, objectApId));
-  await db.delete(storyShares).where(eq(storyShares.storyApId, objectApId));
+  return await deleteObjectsCascade(db, [objectApId], media);
+}
+
+/**
+ * Prepare one local object's complete child/projection cleanup without writing
+ * it. Local delete owners compose this with counters, the outbound Delete,
+ * durable fanout intent, and final object removal in one D1 batch.
+ */
+export async function prepareObjectDeleteCascade(
+  db: Database,
+  objectApId: string,
+  media?: IObjectStorage,
+): Promise<{
+  mediaKeys: string[];
+  statements: readonly [D1Statement, ...D1Statement[]];
+}> {
+  const obj = await db
+    .select({
+      apId: objects.apId,
+      attributedTo: objects.attributedTo,
+      attachmentsJson: objects.attachmentsJson,
+    })
+    .from(objects)
+    .where(eq(objects.apId, objectApId))
+    .get();
+
+  const mediaPlan = obj
+    ? await deleteAttachedMediaUploadsForObject(
+        db,
+        obj,
+        new Set([objectApId]),
+        media,
+      )
+    : { mediaKeys: [], mediaUploadIds: [] };
 
-  // Reap NOTIFICATION inbox rows that pointed at this object (a Like / Announce /
-  // reply-Create that notified a local user). After the object row is gone the
-  // notifications query's leftJoin(objects) yields NULL, so these would otherwise
-  // render as dangling notifications (blank content, dead link) AND keep inflating
-  // the unread badge (the inbox row stays read=0). Delete the INBOX rows only, via
-  // a subquery (D1-param-safe) — NOT the `activities` rows, which may include the
-  // outbound federation Delete that must survive to be delivered.
-  await db
-    .delete(inboxTable)
-    .where(
-      inArray(
-        inboxTable.activityApId,
-        db
-          .select({ id: activities.apId })
-          .from(activities)
-          .where(eq(activities.objectApId, objectApId)),
+  const mediaDeleteStatements = chunkForInClause(mediaPlan.mediaUploadIds).map(
+    (ids) =>
+      db
+        .delete(mediaUploads)
+        .where(inArray(mediaUploads.id, ids)) as D1Statement,
+  );
+
+  return {
+    mediaKeys: [...new Set(mediaPlan.mediaKeys)],
+    statements: [
+      ...mediaDeleteStatements,
+      db.delete(likes).where(eq(likes.objectApId, objectApId)) as D1Statement,
+      db
+        .delete(announces)
+        .where(eq(announces.objectApId, objectApId)) as D1Statement,
+      db
+        .delete(bookmarks)
+        .where(eq(bookmarks.objectApId, objectApId)) as D1Statement,
+      db
+        .delete(objectRecipients)
+        .where(eq(objectRecipients.objectApId, objectApId)) as D1Statement,
+      db
+        .delete(storyViews)
+        .where(eq(storyViews.storyApId, objectApId)) as D1Statement,
+      db
+        .delete(storyVotes)
+        .where(eq(storyVotes.storyApId, objectApId)) as D1Statement,
+      db
+        .delete(storyShares)
+        .where(eq(storyShares.storyApId, objectApId)) as D1Statement,
+      ...activityProjectionDeleteStatements(
+        db,
+        eq(activities.objectApId, objectApId),
       ),
+    ] as [D1Statement, ...D1Statement[]],
+  };
+}
+
+/**
+ * Reap every child row for a set of objects without deleting the object rows.
+ * This is the set-shaped counterpart to {@link deleteObjectCascade}; callers
+ * still own the final object delete and trailing {@link purgeMediaBlobs}.
+ *
+ * The old bulk callers invoked the singular helper once per object. On D1 that
+ * meant one attachment read plus eight serial delete round-trips per post: five
+ * empty posts took about ten seconds in a real workerd probe and larger domain
+ * purges could outlive the request. Here each <=90-id D1-safe chunk issues one
+ * atomic twelve-statement batch, so latency scales by chunks rather than posts.
+ */
+export async function deleteObjectsCascade(
+  db: Database,
+  objectApIds: string[],
+  media?: IObjectStorage,
+): Promise<string[]> {
+  const uniqueApIds = [...new Set(objectApIds)];
+  if (uniqueApIds.length === 0) return [];
+
+  const cascadeObjects: CascadeObject[] = [];
+  for (const chunk of chunkForInClause(uniqueApIds)) {
+    cascadeObjects.push(
+      ...(await db
+        .select({
+          apId: objects.apId,
+          attributedTo: objects.attributedTo,
+          attachmentsJson: objects.attachmentsJson,
+        })
+        .from(objects)
+        .where(inArray(objects.apId, chunk))),
     );
-  return mediaKeys;
+  }
+  if (cascadeObjects.length === 0) return [];
+  const existingApIds = cascadeObjects.map((obj) => obj.apId);
+  const removedObjectApIds = new Set(existingApIds);
+
+  // Remote attachments are normally ordinary remote URLs with no local
+  // media_uploads rows. Discover the small set of authors that actually own a
+  // managed upload before entering the per-object media GC, otherwise every
+  // image post would reintroduce one serial indexed read during defederation.
+  const objectsWithAttachments = cascadeObjects.filter(
+    (obj) => obj.attachmentsJson && obj.attachmentsJson !== "[]",
+  );
+  const authorsWithUploads = new Set<string>();
+  if (objectsWithAttachments.length > 0) {
+    const authors = [
+      ...new Set(objectsWithAttachments.map((obj) => obj.attributedTo)),
+    ];
+    for (const chunk of chunkForInClause(authors)) {
+      const rows = await db
+        .selectDistinct({ uploaderApId: mediaUploads.uploaderApId })
+        .from(mediaUploads)
+        .where(inArray(mediaUploads.uploaderApId, chunk));
+      for (const row of rows) authorsWithUploads.add(row.uploaderApId);
+    }
+  }
+
+  const mediaKeys = new Set<string>();
+  const mediaUploadIds = new Set<string>();
+  for (const obj of objectsWithAttachments) {
+    if (!authorsWithUploads.has(obj.attributedTo)) continue;
+    const plan = await deleteAttachedMediaUploadsForObject(
+      db,
+      obj,
+      removedObjectApIds,
+      media,
+    );
+    for (const key of plan.mediaKeys) mediaKeys.add(key);
+    for (const id of plan.mediaUploadIds) mediaUploadIds.add(id);
+  }
+  const mediaStatements = chunkForInClause([...mediaUploadIds]).map(
+    (ids) =>
+      db
+        .delete(mediaUploads)
+        .where(inArray(mediaUploads.id, ids)) as D1Statement,
+  );
+  for (
+    let offset = 0;
+    offset < mediaStatements.length;
+    offset += D1_MAX_BATCH_STATEMENTS
+  ) {
+    const page = mediaStatements.slice(
+      offset,
+      offset + D1_MAX_BATCH_STATEMENTS,
+    );
+    await runBatch(db, page as [D1Statement, ...D1Statement[]]);
+  }
+
+  for (const chunk of chunkForInClause(existingApIds)) {
+    // Cancel every notification/delivery projection of retained Activities
+    // that target these objects. A queued Create/Update must not be delivered
+    // after its object has disappeared, and an in-flight/terminal push job or
+    // claim must not retain that deleted payload. Keep the Activity ledger rows
+    // themselves; callers may need history/Undo, and the new outbound Delete
+    // Activity is created only after this cascade so it remains unaffected.
+    await runBatch(db, [
+      db.delete(likes).where(inArray(likes.objectApId, chunk)),
+      db.delete(announces).where(inArray(announces.objectApId, chunk)),
+      db.delete(bookmarks).where(inArray(bookmarks.objectApId, chunk)),
+      db
+        .delete(objectRecipients)
+        .where(inArray(objectRecipients.objectApId, chunk)),
+      db.delete(storyViews).where(inArray(storyViews.storyApId, chunk)),
+      db.delete(storyVotes).where(inArray(storyVotes.storyApId, chunk)),
+      db.delete(storyShares).where(inArray(storyShares.storyApId, chunk)),
+      ...activityProjectionDeleteStatements(
+        db,
+        inArray(activities.objectApId, chunk),
+      ),
+    ]);
+  }
+
+  return [...mediaKeys];
 }