Delete profiles before deleting project (#3561)

This avoids an issue which Ozz ran into where the `ON CASCADE DELETE`
relationships would attempt to delete rows from rule_type before
deleting from rule_instances. This would fail because there is a foreign
key relation from rule_instances to rule_type which prevents deletion of
in-use rule types.

The old entity_profile_rules table had a foreign key reference to
rule_type marked as `ON DELETE CASCADE`, and relied on logic in the code
to prevent the deletion of rule instances which are in use.

database/query/profiles.sql

@@ -106,7 +106,6 @@ JOIN entity_profile_rules ON entity_profiles.id = entity_profile_rules.entity_pr
 WHERE entity_profile_rules.rule_type_id = $1
 GROUP BY profiles.id;
 
-
 -- name: CountProfilesByEntityType :many
 SELECT COUNT(p.id) AS num_profiles, ep.entity AS profile_entity
 FROM profiles AS p
@@ -115,3 +114,7 @@ GROUP BY ep.entity;
 
 -- name: CountProfilesByName :one
 SELECT COUNT(*) AS num_named_profiles FROM profiles WHERE lower(name) = lower(sqlc.arg(name));
+
+-- used when cleaning up a project to avoid FK dependency issues between rule_types and rule_instances
+-- name: DeleteProfilesInProject :exec
+DELETE FROM profiles WHERE project_id = $1;

internal/projects/deleter.go

@@ -145,6 +145,13 @@ func (p *projectDeleter) DeleteProject(
 		}
 	}
 
+	// Delete the project's profiles. This avoids foreign key issues with
+	// rule_instances when deleting rows from rule_type.
+	err = querier.DeleteProfilesInProject(ctx, proj)
+	if err != nil {
+		return fmt.Errorf("unable to delete profiles: %w", err)
+	}
+
 	// no role assignments for this project
 	// we can safely delete it.
 	l.Debug().Msg("deleting project from database")

internal/projects/deleter_test.go

@@ -45,6 +45,7 @@ func TestDeleteProjectOneProjectWithNoParents(t *testing.T) {
 	mockStore := mockdb.NewMockStore(ctrl)
 	mockStore.EXPECT().GetProjectByID(gomock.Any(), proj).Return(
 		db.Project{ID: proj}, nil)
+	mockStore.EXPECT().DeleteProfilesInProject(gomock.Any(), proj)
 	mockStore.EXPECT().DeleteProject(gomock.Any(), proj).
 		Return([]db.DeleteProjectRow{
 			{ID: proj},
@@ -90,6 +91,7 @@ func TestDeleteProjectWithOneParent(t *testing.T) {
 		}, nil)
 	mockStore.EXPECT().ListProvidersByProjectID(gomock.Any(), []uuid.UUID{proj}).
 		Return([]db.Provider{}, nil)
+	mockStore.EXPECT().DeleteProfilesInProject(gomock.Any(), proj)
 	mockStore.EXPECT().DeleteProject(gomock.Any(), proj).
 		Return([]db.DeleteProjectRow{
 			{
@@ -141,6 +143,7 @@ func TestDeleteProjectProjectInThreeNodeHierarchy(t *testing.T) {
 		}, nil)
 	mockStore.EXPECT().ListProvidersByProjectID(gomock.Any(), []uuid.UUID{proj}).
 		Return([]db.Provider{}, nil)
+	mockStore.EXPECT().DeleteProfilesInProject(gomock.Any(), proj)
 	mockStore.EXPECT().DeleteProject(gomock.Any(), proj).
 		Return([]db.DeleteProjectRow{
 			{
@@ -198,6 +201,7 @@ func TestDeleteMiddleProjectInThreeNodeHierarchy(t *testing.T) {
 		}, nil)
 	mockStore.EXPECT().ListProvidersByProjectID(gomock.Any(), []uuid.UUID{proj}).
 		Return([]db.Provider{}, nil)
+	mockStore.EXPECT().DeleteProfilesInProject(gomock.Any(), proj).Return(nil)
 	mockStore.EXPECT().DeleteProject(gomock.Any(), proj).
 		Return([]db.DeleteProjectRow{
 			{
@@ -247,6 +251,7 @@ func TestDeleteProjectWithProvider(t *testing.T) {
 	mockStore := mockdb.NewMockStore(ctrl)
 	mockStore.EXPECT().GetProjectByID(gomock.Any(), proj).Return(
 		db.Project{ID: proj}, nil)
+	mockStore.EXPECT().DeleteProfilesInProject(gomock.Any(), proj)
 	mockStore.EXPECT().DeleteProject(gomock.Any(), proj).
 		Return([]db.DeleteProjectRow{
 			{ID: proj},
@@ -302,6 +307,7 @@ func TestCleanupUnmanaged(t *testing.T) {
 	mockStore.EXPECT().GetProjectByID(gomock.Any(), projThree).Return(
 		db.Project{ID: projThree}, nil).Times(2)
 	// Project 3 has no other admins, so it will be deleted.
+	mockStore.EXPECT().DeleteProfilesInProject(gomock.Any(), projThree).Return(nil)
 	mockStore.EXPECT().DeleteProject(gomock.Any(), projThree).Return(
 		[]db.DeleteProjectRow{
 			{ID: projThree},