feat: delete capabilities — delete child, transaction, spending, investment, parent - #8
feat: delete capabilities — delete child, transaction, spending, investment, parent#8isaJrKai wants to merge 2 commits into
Conversation
Adds familyId to all 9 financial models (Child, ParentProfile, Account, Transaction, SpendingCategory, SpendingEntry, Investment, TokenLedgerEntry, Goal). Each new signup gets their own familyId. All queries and mutations are scoped by familyId — families cannot see or modify each other's data. Changes: 1. Schema: add familyId column + index to 9 models. FamilySettings changes from singleton to per-family (keyed by familyId). 2. Migration: SQL to add columns, backfill existing data to founder's family, make NOT NULL, add indexes. 3. auth.ts: auto-generate familyId on signup + founder setup. getAuthUser() returns familyId. 4. db-queries.ts: getFullState(familyId) scopes all queries. All mutation functions accept familyId, include it in creates, and verify ownership on updates/deletes. 5. API routes: /api/state and /api/mutations pass familyId from getAuthUser() to all queries/mutations. BEFORE MERGING: run the migration SQL on Neon.
…stment, parent
Adds 8 delete functions to the mutations API:
- deleteTransaction — removes a single transaction
- deleteSpendingEntry — removes a spending entry
- closeInvestment — marks investment as closed (preserves audit trail)
- deleteInvestment — permanently deletes investment + related transactions
- deleteChild — DESTRUCTIVE: cascades to all child's data (accounts,
transactions, spending, investments, tokens, goals)
- deleteParent — cascades to spending entries + goals
- deleteSpendingCategory — removes a spending category
- resetFamilyData — NUCLEAR: deletes ALL family data, keeps User account
All delete functions verify familyId ownership before operating. A user
cannot delete another family's data.
Also adds corresponding client-side functions in src/lib/mutations.ts
so the frontend can call these via persistMutation().
Phase 3 (next PR) will add the UI: delete buttons on cards, confirmation
modals, and a Danger Zone section in settings.
|
Warning Review limit reached
Next review available in: 11 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (8)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
What this adds
Adds 8 delete functions to the mutations API. Parents can now remove data they created — they're in control.
Delete functions
deleteTransactiondeleteSpendingEntrycloseInvestmentdeleteInvestmentdeleteChilddeleteParentdeleteSpendingCategoryresetFamilyDataSecurity
All delete functions verify
familyIdownership before operating. A user cannot delete another family's data — the query returns "not found or access denied" if thefamilyIddoesn't match.Files changed (3 files)
src/lib/db-queries.ts— 8 new delete functionssrc/app/api/mutations/route.ts— 8 new action casessrc/lib/mutations.ts— 8 new client-side functionsVerification
npx tsc --noEmit— cleannpx eslint— cleanVercel env vars
None needed.
Deployment risk
Zero downtime. These are new API endpoints — existing functionality is unaffected. The UI to trigger these doesn't exist yet (Phase 3).
Depends on
PR #7 (multi-family isolation) — this branch is built on top of PR #7 for familyId scoping. Merge PR #7 first, then this one.
Next phase
Phase 3 (PR #9): Delete UI — delete buttons on cards, confirmation modals (two-step for destructive actions), "Danger Zone" section in settings.