fix(data): supprimer un compte emporte ses contrats

DATA-012. delete_user supprimait les lignes Contract et laissait les PDF.
Des contrats nominatifs signes restaient donc sur le serveur apres la
suppression du compte, sans plus aucune reference en base : invisibles pour
l application, ingerables par elle, et toujours des donnees personnelles.

Les chemins sont lus **avant** que les lignes partent — apres, plus rien ne
dit ou sont les fichiers — et les fichiers sont retires **apres** le commit.
L ordre compte dans ce sens et pas dans l autre : un echec entre les deux
doit laisser un fichier sans ligne, ce qui est recuperable et correspond
exactement a l etat precedent, plutot qu une ligne sans fichier, qui est un
telechargement en 500 pour toujours.

Un fichier deja absent est journalise en info et ignore ; un fichier
impossible a retirer est journalise en erreur avec ce que ca implique — il
devient orphelin, donc plus rien dans l application ne proposera jamais de
le supprimer. Rien ici ne peut faire echouer la suppression du compte : le
compte est la partie que quelqu un a demandee.

Le nombre de fichiers retires part dans le journal d authentification, a
cote de account.deleted.

554 tests.

app/routes/users/accounts.py

@@ -42,6 +42,7 @@ from app.routes.users._shared import (
     update_user_gamertags,
 )
 from app.routes.users.blueprint import users_bp
+from app.storage import discard_documents
 from app.validators import CreateUserSchema, EditUserSchema
 
 
@@ -249,6 +250,15 @@ def delete_user(user_id):
         db.or_(OneOnOneRequest.player_id == user_id, OneOnOneRequest.coach_id == user_id),
     ).delete(synchronize_session=False)
     UserGamertag.query.filter_by(user_id=user_id).delete()
+
+    # Read the file paths before the rows go: afterwards there is nothing
+    # left to say where the PDFs are (DATA-012). The files themselves are
+    # removed after the commit, below.
+    contract_files = [
+        path
+        for contract in Contract.query.filter_by(player_id=user_id).all()
+        for path in (contract.file_path, contract.signed_file_path)
+    ]
     Contract.query.filter_by(player_id=user_id).delete()
     TryoutRegistration.query.filter_by(player_id=user_id).delete()
     TeamPlayer.query.filter_by(player_id=user_id).delete()
@@ -265,6 +275,12 @@ def delete_user(user_id):
     deleted_username, deleted_role = user.username, user.role
     db.session.delete(user)
     db.session.commit()
+
+    # After the commit, deliberately. A failure here leaves a file with no
+    # row — recoverable, and exactly what happened before this existed —
+    # rather than a row with no file, which is a download that 500s for ever.
+    discarded = discard_documents(contract_files)
+
     log_auth_event(
         'account.deleted',
         actor=current_user.username,
@@ -272,6 +288,7 @@ def delete_user(user_id):
         target=deleted_username,
         target_id=user_id,
         role=deleted_role,
+        contract_files_removed=discarded,
     )
     flash(
         _('User %(deleted_username)s has been removed.', deleted_username=deleted_username),

app/storage.py

@@ -43,6 +43,48 @@ def documents_root():
     return os.path.join(os.path.dirname(package_dir), 'documents')
 
 
+def discard_documents(stored_paths):
+    """Remove these documents from disk. Returns how many went (DATA-012).
+
+    `delete_user` removed the Contract rows and left the PDFs. Signed,
+    named contracts therefore stayed on the server after the account was
+    deleted, with nothing in the database pointing at them — invisible to
+    the application, unmanageable through it, and still personal data.
+
+    Call this **after** the commit that removed the rows, never before: a
+    failure between the two should leave a file with no row (recoverable,
+    and what the previous behaviour produced anyway) rather than a row with
+    no file (a download that 500s for ever).
+
+    A path that cannot be removed is logged and skipped. Nothing here should
+    be able to abort the deletion of an account.
+    """
+    import logging
+
+    logger = logging.getLogger(__name__)
+    removed = 0
+    for stored_path in stored_paths:
+        if not stored_path:
+            continue
+        target = document_path(stored_path)
+        try:
+            os.remove(target)
+            removed += 1
+        except FileNotFoundError:
+            # Already gone. Two contracts sharing a stem, or a previous
+            # attempt: not a problem, and not worth an error line.
+            logger.info('Document already absent: %s', target)
+        except OSError as exc:
+            logger.error(
+                'Could not remove %s (%s). It is now an orphan: no database row '
+                'refers to it, so nothing in the application will ever offer to '
+                'delete it again.',
+                target,
+                exc,
+            )
+    return removed
+
+
 def document_path(stored_path):
     """Absolute path of a document, from what the database holds.