Skip to content

fix(vendor): return 409 instead of 500 when deleting a vendor with linked records - #625

Open
prince-shakyaa wants to merge 1 commit into
GenAI-Security-Project:mainfrom
prince-shakyaa:fix/vendor-delete-500
Open

prince-shakyaa wants to merge 1 commit into
GenAI-Security-Project:mainfrom
prince-shakyaa:fix/vendor-delete-500

Conversation

@prince-shakyaa

Copy link
Copy Markdown

Fixes #624

What was wrong

DELETE /vendor/api/v1/vendors/{id} returned a 500 for any vendor that had an invoice, a FinDrive file or an email. Those rows still point at the vendor, so the database refused the delete and the IntegrityError wasn't caught. Only brand-new vendors with nothing attached could be deleted.

What changed

  • The route now catches the IntegrityError, rolls back and returns a 409 saying the vendor has linked records and can't be deleted. This matches how fix(vendor): block invoice edits after approval or payment #614 handles edits to approved or paid invoices, and keeps the invoice and payment history intact.
  • Deleting a vendor with nothing attached still works as before, and deleting another vendor is still a 403.

I went with the 409 because it's the smallest change and doesn't lose any data. If you'd rather have a soft delete (mark the vendor inactive), I'm happy to switch to that.

Testing

  • New tests/unit/vendor/test_vendor_delete.py: vendor with an invoice, a file or an email gets a 409 and stays in the DB; an unused vendor is deleted; another vendor's delete is a 403.
  • Without the fix, the invoice, file and email tests fail with the same IntegrityError as in the issue.
  • tests/unit/vendor: all pass.
  • tests/unit overall: everything passes except the 3 tests in tests/unit/agents/test_specialized_agents.py, which fail the same way on main.

…nked records

Deleting a vendor that still had invoices, files or emails hit a database
constraint and came back as an uncaught 500. Catch it, roll back and return
a 409 so nothing is lost and the caller gets a clear answer.
@prince-shakyaa

prince-shakyaa commented Nov 5, 2026 •

Copy link
Copy Markdown
Author

Hi @saikishu @e2hln, this fixes #624. Deleting a vendor that still has invoices, files or emails now returns a 409 instead of a 500, so nothing gets deleted and the caller knows why. It's the same approach as #614. Tests are in tests/unit/vendor/test_vendor_delete.py.

If you'd prefer a soft delete instead, I can switch it.
Thanks.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug] Deleting a vendor that has invoices or files fails with a 500 error

1 participant