From 255bea47386c15b52539003e02e2a46beefac719 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Wed, 29 Jul 2026 15:31:55 +0000
Subject: [PATCH] Make risk delete prove document mapping cleanup

Removing junction rows before deleteRisk hid missing soft-delete
cleanup in e2e. Assert deleteRisk succeeds only after deleteDocument
clears mappings, and document links must be removed first.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>
---
 e2e/console/mapping_test.go   | 39 ++++++++++++++++++++++++++++++++++-
 pkg/coredata/risk_document.go | 27 ------------------------
 pkg/probo/risk_service.go     |  5 -----
 3 files changed, 38 insertions(+), 33 deletions(-)

diff --git a/e2e/console/mapping_test.go b/e2e/console/mapping_test.go
index ad65c712e..c20c86e1b 100644
--- a/e2e/console/mapping_test.go
+++ b/e2e/console/mapping_test.go
@@ -814,9 +814,20 @@ func TestRiskDocumentMapping_DeleteDocumentClearsRiskDocumentLink(t *testing.T)
 	linkedDocumentIDs = loadRiskLinkedDocumentIDs(t, owner, riskID)
 	assert.NotContains(t, linkedDocumentIDs, documentID)
 	assert.Empty(t, linkedDocumentIDs)
+
+	_, err = owner.Do(`
+		mutation DeleteRisk($input: DeleteRiskInput!) {
+			deleteRisk(input: $input) {
+				deletedRiskId
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{"riskId": riskID},
+	})
+	require.NoError(t, err)
 }
 
-func TestRiskDocumentMapping_DeleteRiskWithActiveDocumentMapping(t *testing.T) {
+func TestRiskDocumentMapping_DeleteRiskRequiresUnlinkedDocuments(t *testing.T) {
 	t.Parallel()
 	owner := testutil.NewClient(t, testutil.RoleOwner)
 
@@ -841,6 +852,32 @@ func TestRiskDocumentMapping_DeleteRiskWithActiveDocumentMapping(t *testing.T) {
 	})
 	require.NoError(t, err)
 
+	_, err = owner.Do(`
+		mutation DeleteRisk($input: DeleteRiskInput!) {
+			deleteRisk(input: $input) {
+				deletedRiskId
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{"riskId": riskID},
+	})
+	require.Error(t, err)
+
+	_, err = owner.Do(`
+		mutation($input: DeleteRiskDocumentMappingInput!) {
+			deleteRiskDocumentMapping(input: $input) {
+				deletedRiskId
+				deletedDocumentId
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"riskId":     riskID,
+			"documentId": documentID,
+		},
+	})
+	require.NoError(t, err)
+
 	_, err = owner.Do(`
 		mutation DeleteRisk($input: DeleteRiskInput!) {
 			deleteRisk(input: $input) {
diff --git a/pkg/coredata/risk_document.go b/pkg/coredata/risk_document.go
index f2acb93f0..17b9c6428 100644
--- a/pkg/coredata/risk_document.go
+++ b/pkg/coredata/risk_document.go
@@ -108,33 +108,6 @@ WHERE
 	return err
 }
 
-func (rp RiskDocument) DeleteByRiskID(
-	ctx context.Context,
-	conn pg.Tx,
-	scope Scoper,
-	riskID gid.GID,
-) error {
-	q := `
-DELETE
-FROM
-    risks_documents
-WHERE
-    %s
-    AND risk_id = @risk_id;
-`
-
-	q = fmt.Sprintf(q, scope.SQLFragment())
-
-	args := pgx.StrictNamedArgs{
-		"risk_id": riskID,
-	}
-	maps.Copy(args, scope.SQLArguments())
-
-	_, err := conn.Exec(ctx, q, args)
-
-	return err
-}
-
 func (rp RiskDocument) DeleteByDocumentIDs(
 	ctx context.Context,
 	conn pg.Tx,
diff --git a/pkg/probo/risk_service.go b/pkg/probo/risk_service.go
index d892359e1..66a4a0b3c 100644
--- a/pkg/probo/risk_service.go
+++ b/pkg/probo/risk_service.go
@@ -612,15 +612,10 @@ func (s RiskService) Delete(
 	riskID gid.GID,
 ) error {
 	risk := &coredata.Risk{}
-	riskDocument := &coredata.RiskDocument{}
 
 	return s.svc.pg.WithTx(
 		ctx,
 		func(ctx context.Context, tx pg.Tx) error {
-			if err := riskDocument.DeleteByRiskID(ctx, tx, scope, riskID); err != nil {
-				return fmt.Errorf("cannot delete risk document mappings: %w", err)
-			}
-
 			return risk.Delete(ctx, tx, scope, riskID)
 		},
 	)