feat: add soft delete support for users, projects, and organizations

backend/alembic/versions/4b4c96034900_add_soft_delete_columns.py

@@ -0,0 +1,132 @@
+"""Add soft delete columns
+
+Revision ID: 4b4c96034900
+Revises: c14aa06f723a
+Create Date: 2026-07-08 12:00:00.000000
+
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+# revision identifiers, used by Alembic.
+revision: str = "4b4c96034900"
+down_revision: Union[str, Sequence[str], None] = "c14aa06f723a"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    """Upgrade schema."""
+
+    # --- users ---
+    op.add_column(
+        "users",
+        sa.Column(
+            "deleted_at",
+            sa.DateTime(timezone=True),
+            nullable=True,
+        ),
+    )
+    op.add_column(
+        "users",
+        sa.Column(
+            "deleted_by_id",
+            postgresql.UUID(as_uuid=True),
+            nullable=True,
+        ),
+    )
+    op.create_foreign_key(
+        "fk_users_deleted_by_id_users",
+        "users",
+        "users",
+        ["deleted_by_id"],
+        ["id"],
+        ondelete="SET NULL",
+    )
+
+    # --- projects ---
+    op.add_column(
+        "projects",
+        sa.Column(
+            "deleted_at",
+            sa.DateTime(timezone=True),
+            nullable=True,
+        ),
+    )
+    op.add_column(
+        "projects",
+        sa.Column(
+            "deleted_by_id",
+            postgresql.UUID(as_uuid=True),
+            nullable=True,
+        ),
+    )
+    op.create_foreign_key(
+        "fk_projects_deleted_by_id_users",
+        "projects",
+        "users",
+        ["deleted_by_id"],
+        ["id"],
+        ondelete="SET NULL",
+    )
+
+    # --- organizations ---
+    op.add_column(
+        "organizations",
+        sa.Column(
+            "deleted_at",
+            sa.DateTime(timezone=True),
+            nullable=True,
+        ),
+    )
+    op.add_column(
+        "organizations",
+        sa.Column(
+            "deleted_by_id",
+            postgresql.UUID(as_uuid=True),
+            nullable=True,
+        ),
+    )
+    op.create_foreign_key(
+        "fk_organizations_deleted_by_id_users",
+        "organizations",
+        "users",
+        ["deleted_by_id"],
+        ["id"],
+        ondelete="SET NULL",
+    )
+
+
+def downgrade() -> None:
+    """Downgrade schema."""
+
+    # --- organizations ---
+    op.drop_constraint(
+        "fk_organizations_deleted_by_id_users",
+        "organizations",
+        type_="foreignkey",
+    )
+    op.drop_column("organizations", "deleted_by_id")
+    op.drop_column("organizations", "deleted_at")
+
+    # --- projects ---
+    op.drop_constraint(
+        "fk_projects_deleted_by_id_users",
+        "projects",
+        type_="foreignkey",
+    )
+    op.drop_column("projects", "deleted_by_id")
+    op.drop_column("projects", "deleted_at")
+
+    # --- users ---
+    op.drop_constraint(
+        "fk_users_deleted_by_id_users",
+        "users",
+        type_="foreignkey",
+    )
+    op.drop_column("users", "deleted_by_id")
+    op.drop_column("users", "deleted_at")

backend/app/models/organization.py

@@ -19,6 +19,12 @@
 
 from app.database.base import Base
 
+# Forward reference for type annotations
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from app.models.user import User
+
 
 class OrganizationType(str, Enum):
     COMPANY = "company"
@@ -180,6 +186,28 @@ class Organization(Base):
         backref="organizations",
     )
 
+    # ==========================================================
+    # Soft Delete
+    # ==========================================================
+
+    deleted_at: Mapped[datetime | None] = mapped_column(
+        DateTime(timezone=True),
+        nullable=True,
+        default=None,
+    )
+
+    deleted_by_id: Mapped[uuid.UUID | None] = mapped_column(
+        UUID(as_uuid=True),
+        ForeignKey("users.id", ondelete="SET NULL"),
+        nullable=True,
+        default=None,
+    )
+
+    deleted_by: Mapped[User | None] = relationship(
+        "User",
+        foreign_keys=[deleted_by_id],
+    )
+
     # ==========================================================
     # Audit
     # ==========================================================

backend/app/models/project.py

@@ -19,6 +19,12 @@
 
 from app.database.base import Base
 
+# Forward reference for type annotations
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from app.models.user import User
+
 
 class ProjectStage(str, Enum):
     IDEA = "idea"
@@ -184,6 +190,28 @@ class Project(Base):
         default=False,
     )
 
+    # ----------------------------------------------------------
+    # Soft Delete
+    # ----------------------------------------------------------
+
+    deleted_at: Mapped[datetime | None] = mapped_column(
+        DateTime(timezone=True),
+        nullable=True,
+        default=None,
+    )
+
+    deleted_by_id: Mapped[uuid.UUID | None] = mapped_column(
+        UUID(as_uuid=True),
+        ForeignKey("users.id", ondelete="SET NULL"),
+        nullable=True,
+        default=None,
+    )
+
+    deleted_by: Mapped[User | None] = relationship(
+        "User",
+        foreign_keys=[deleted_by_id],
+    )
+
     # ----------------------------------------------------------
     # Audit
     # ----------------------------------------------------------

backend/app/models/user.py

@@ -6,12 +6,13 @@
 from sqlalchemy import (
     Boolean,
     DateTime,
+    ForeignKey,
     String,
     Text,
     func,
 )
 from sqlalchemy.dialects.postgresql import UUID
-from sqlalchemy.orm import Mapped, mapped_column
+from sqlalchemy.orm import Mapped, mapped_column, relationship
 
 from app.database.base import Base
 
@@ -195,6 +196,29 @@ class User(Base):
         unique=True,
     )
 
+    # ------------------------------------------------------------------
+    # Soft Delete
+    # ------------------------------------------------------------------
+
+    deleted_at: Mapped[datetime | None] = mapped_column(
+        DateTime(timezone=True),
+        nullable=True,
+        default=None,
+    )
+
+    deleted_by_id: Mapped[uuid.UUID | None] = mapped_column(
+        UUID(as_uuid=True),
+        ForeignKey("users.id", ondelete="SET NULL"),
+        nullable=True,
+        default=None,
+    )
+
+    deleted_by: Mapped[User | None] = relationship(
+        "User",
+        foreign_keys=[deleted_by_id],
+        remote_side="User.id",
+    )
+
     # ------------------------------------------------------------------
     # Audit
     # ------------------------------------------------------------------

backend/app/routers/organizations.py

@@ -303,6 +303,7 @@ def disable_hiring(
 def delete_organization(
     organization_id: uuid.UUID,
     db: Session = Depends(get_db),
+    current_user: User = Depends(get_current_user),
 ):
 
     organization = OrganizationService.get_organization(
@@ -316,7 +317,78 @@ def delete_organization(
             detail="Organization not found",
         )
 
-    OrganizationService.delete_organization(
+    OrganizationService.soft_delete_organization(
+        db,
+        organization,
+        deleted_by_id=current_user.id,
+    )
+
+
+@router.patch(
+    "/{organization_id}/restore-soft-delete",
+    response_model=OrganizationResponse,
+)
+def restore_organization_soft_delete(
+    organization_id: uuid.UUID,
+    db: Session = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+):
+
+    organization = OrganizationService.get_organization_including_deleted(
+        db, organization_id
+    )
+
+    if organization is None:
+        raise HTTPException(
+            status_code=404,
+            detail="Organization not found",
+        )
+
+    if organization.deleted_at is None:
+        raise HTTPException(
+            status_code=400,
+            detail="Organization is not deleted",
+        )
+
+    if organization.owner_id != current_user.id and not current_user.is_superuser:
+        raise HTTPException(
+            status_code=403,
+            detail="Permission denied",
+        )
+
+    return OrganizationService.restore_soft_deleted_organization(
+        db,
+        organization,
+    )
+
+
+@router.delete(
+    "/{organization_id}/hard",
+    status_code=status.HTTP_204_NO_CONTENT,
+)
+def hard_delete_organization(
+    organization_id: uuid.UUID,
+    db: Session = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+):
+
+    if not current_user.is_superuser:
+        raise HTTPException(
+            status_code=403,
+            detail="Only admins can permanently delete organizations",
+        )
+
+    organization = OrganizationService.get_organization_including_deleted(
+        db, organization_id
+    )
+
+    if organization is None:
+        raise HTTPException(
+            status_code=404,
+            detail="Organization not found",
+        )
+
+    OrganizationService.hard_delete_organization(
         db,
         organization,
     )