Soft-deleted conversations remain accessible through console APIs
- Dominant language
- TypeScript
- Stars
- 156k
- Forks
- 24.6k
- Avg merge
- 22h 9m
- Merged PRs (30d)
- 610
Description
### Self Checks
- [x] I have read the [Contributing Guide](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md) and [Language Policy](https://github.com/langgenius/dify/issues/1542).
- [x] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general).
- [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones.
- [x] I confirm that I am using English to submit this report, otherwise it will be closed.
- [x] 【中文用户 & Non English User】请使用英语提交,否则会被关闭 :)
- [x] Please do not modify this template :) and fill in all the required fields.
### Dify version
main
### Cloud or Self Hosted
Self Hosted (Source)
### Steps to reproduce
1. Run Dify from the current `main` branch.
2. Create a chat conversation and add at least one message.
3. Delay or stop the asynchronous conversation cleanup worker.
4. Delete the conversation from the console.
5. Request the deleted conversation through `GET /console/api/apps/{app_id}/chat-conversations/{conversation_id}`.
6. Request its messages through `GET /console/api/apps/{app_id}/chat-messages?conversation_id={conversation_id}`.
The delete path commits `Conversation.is_deleted = true` before scheduling physical cleanup. The conversation list already excludes these rows, but both direct read queries omit the soft-delete predicate.
### ✔️ Expected Behavior
Once deletion succeeds, the conversation detail and message history endpoints should return 404 immediately, regardless of asynchronous cleanup progress.
### ❌ Actual Behavior
Until asynchronous cleanup physically removes the row, both endpoints can still return the soft-deleted conversation and its messages. This can be especially visible when the cleanup queue is delayed or unavailable.
Contributor guide
Research direction
Reproduce the issue with the asynchronous cleanup worker delayed, then inspect the direct-read queries behind the conversation detail and message-history endpoints. Compare them with the conversation list query, which already excludes soft-deleted rows. Done means both endpoints return 404 immediately after deletion, before physical cleanup occurs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 65/100