fix: Cleanup S3 Attachments (#1217)

* fix: Server error if attempting to load an unknown attachment

* fix: Migration should cascade delete to document attachments

* fix: Delete S3 attachments along with documents

server/api/utils.js

@@ -1,11 +1,13 @@
 // @flow
+import debug from 'debug';
 import Router from 'koa-router';
 import subDays from 'date-fns/sub_days';
 import { AuthenticationError } from '../errors';
-import { Document } from '../models';
+import { Document, Attachment } from '../models';
 import { Op } from '../sequelize';
 
 const router = new Router();
+const log = debug('utils');
 
 router.post('utils.gc', async ctx => {
   const { token } = ctx.body;
@@ -14,15 +16,33 @@ router.post('utils.gc', async ctx => {
     throw new AuthenticationError('Invalid secret token');
   }
 
-  await Document.scope('withUnpublished').destroy({
-    where: {
-      deletedAt: {
-        [Op.lt]: subDays(new Date(), 30),
-      },
+  log('Permanently deleting documents older than 30 days…');
+
+  const where = {
+    deletedAt: {
+      [Op.lt]: subDays(new Date(), 30),
     },
+  };
+
+  const documents = await Document.scope('withUnpublished').findAll({
+    attributes: ['id'],
+    where,
+  });
+  const documentIds = documents.map(d => d.id);
+
+  await Attachment.destroy({
+    where: {
+      documentId: documentIds,
+    },
+  });
+
+  await Document.scope('withUnpublished').destroy({
+    where,
     force: true,
   });
 
+  log(`Deleted ${documentIds.length} documents`);
+
   ctx.body = {
     success: true,
   };