DELETE method in lookup-server does not delete all data

How to use GitHub

• Please use the 👍 reaction to show that you are affected by the same issue.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

Steps to reproduce

1. Setup a lookup server
2. Setup Nextcloud 31.0.0 with https://github.com/nextcloud/server/issues/25290 applied
3. Select at least one data item to be publicly shared
4. Wait for backgroundRetry job to run/force execution
5. Find data in the database on the lookup-server:

MariaDB [lookup_db]> select * from users;
+----+--------------------------+---------------------+
| id | federationId             | timestamp           |
+----+--------------------------+---------------------+
| 15 | admin@nxt-30.as59645.net | 2025-03-09 13:46:20 |
+----+--------------------------+---------------------+
2 rows in set (0.000 sec)

MariaDB [lookup_db]> select * from store;
+----+--------+---------+--------------------+-------+
| id | userId | k       | v                  | valid |
+----+--------+---------+--------------------+-------+
| 55 |     15 | name    | admin              |     0 |
| 56 |     15 | email   | wadawd@example.com |     0 |
| 57 |     15 | address | awdawdawdwa        |     0 |
+----+--------+---------+--------------------+-------+

6. Issue a delete call:

% cat delete_user.json ; curl -k -X DELETE -d @delete_user.json 'https://nxt-lookup.as59645.net/users' -v 
{"message":{"data":{"federationId":"admin@nxt-30.as59645.net"},"type":"lookupserver","signer":"admin@nxt-30.as59645.net","timestamp":1741527139},"signature":"oWu9+IpLt5LvzqHbyEsU2EY7J3HLD\/4tTI0hjKraNNWHpz49qTpa5eHQUX9sdtF1zkdB9yXv\/dHVIvkzDFkA97O3Z0qFaDFGS+MksrHboDPqcsBuCIiIVuClfDGfYAJPwdQ8RQ72fTLH\/7KvzbyVyv41Wiv7NTualA\/vQf\/aIJn5lCafXMKwq0LN1qIE9+mEfHoJwjLbbTFZJ+tg3DUu2zcQMzA8KteGyVmPCGdxl1QTTbVWMjOTFGaRvb6+kMF38jqwVJAcvK4wryg3tl7zzBhYGXTHIvj1iInO13\/WObHSnCzafJ0GOyG5upEGg\/KsprjNWjGw47tQOw36uaNLxg=="}

* Host nxt-lookup.as59645.net:443 was resolved.
* IPv6: 2a06:d1c0:dead:1:2342::1
* IPv4: 193.104.168.214
*   Trying [2a06:d1c0:dead:1:2342::1]:443...
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / x25519 / id-ecPublicKey
* ALPN: server accepted h2
* Server certificate:
*  subject: CN=nxt-lookup.as59645.net
*  start date: Mar  9 07:27:41 2025 GMT
*  expire date: Jun  7 07:27:40 2025 GMT
*  issuer: C=US; O=Let's Encrypt; CN=E5
*  SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
*   Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA384
*   Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using sha256WithRSAEncryption
* Connected to nxt-lookup.as59645.net (2a06:d1c0:dead:1:2342::1) port 443
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://nxt-lookup.as59645.net/users
* [HTTP/2] [1] [:method: DELETE]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: nxt-lookup.as59645.net]
* [HTTP/2] [1] [:path: /users]
* [HTTP/2] [1] [user-agent: curl/8.11.1]
* [HTTP/2] [1] [accept: */*]
* [HTTP/2] [1] [content-length: 511]
* [HTTP/2] [1] [content-type: application/x-www-form-urlencoded]
> DELETE /users HTTP/2
> Host: nxt-lookup.as59645.net
> User-Agent: curl/8.11.1
> Accept: */*
> Content-Length: 511
> Content-Type: application/x-www-form-urlencoded
> 
* upload completely sent off: 511 bytes
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
< HTTP/2 200 
< server: nginx/1.26.3
< date: Sun, 09 Mar 2025 13:50:28 GMT
< content-type: text/html; charset=UTF-8
< vary: Accept-Encoding
< referrer-policy: no-referrer
< strict-transport-security: max-age=31536000; includeSubDomains; preload;
< x-content-type-options: nosniff
< x-frame-options: SAMEORIGIN
< x-robots-tag: noindex, nofollow
< x-xss-protection: 1; mode=block
< 
* Connection #0 to host nxt-lookup.as59645.net left intact

7. Find that not all data was deleted

MariaDB [lookup_db]> select * from users;
+----+--------------------------+---------------------+
| id | federationId             | timestamp           |
+----+--------------------------+---------------------+
| 15 | admin@nxt-30.as59645.net | 2025-03-09 13:46:20 |
+----+--------------------------+---------------------+
2 rows in set (0.002 sec)

MariaDB [lookup_db]> select * from store;
Empty set (0.001 sec)

Expected behaviour

There is an expectation that calling a (somewhat undocumented) delete function leads to all data being deleted.

Actual behaviour

Not all data is deleted. Crucially, the users' creation timestamp as well as the userId and mapping to an instance is preserved.

Notes

This showed up while debugging the behavior in https://github.com/nextcloud/server/issues/51335

Start at the DELETE /users endpoint and inspect how it removes records from the users and store tables. Reproduce the request against a lookup server, then verify that the users record, creation timestamp, userId, and instance mapping are also removed rather than only the store rows.