v1.0.176: spec_current cascade fix + keep_ids DoS limit

deploy/db/supplements.py

@@ -28,25 +28,31 @@ def get(supp_id):
 
 
 def delete_by_document(contract_id, filename):
-    """Delete supplement+document by contract+filename (cascade: spec_events first)."""
-    row = query(
+    """Delete ALL supplements+documents by contract+filename (cascade: spec_events first).
+    Handles duplicates from previously failed uploads."""
+    rows = query(
         """SELECT s.id as sid, s.document_id FROM supplements s
            JOIN documents d ON d.id = s.document_id
            WHERE s.contract_id = %s AND d.filename = %s""",
         (contract_id, filename),
     )
-    if row:
-        r = row[0]
-        # 1. Delete spec_current for this contract (FK to spec_events)
-        execute("DELETE FROM spec_current WHERE contract_id = %s", (contract_id,))
+    if not rows:
+        return False
+
+    for r in rows:
+        # 1. Delete spec_current rows referencing this supplement's events
+        execute(
+            """DELETE FROM spec_current WHERE contract_id = %s
+               AND last_event_id IN (SELECT id FROM spec_events WHERE supplement_id = %s)""",
+            (contract_id, r["sid"]),
+        )
         # 2. Delete spec_events referencing this supplement
         execute("DELETE FROM spec_events WHERE supplement_id = %s", (r["sid"],))
         # 3. Delete supplement
         execute("DELETE FROM supplements WHERE id = %s", (r["sid"],))
         # 4. Delete document
         execute("DELETE FROM documents WHERE id = %s", (r["document_id"],))
-        return True
-    return False
+    return True
 
 
 def delete(supp_id):