🐛Deleted associated roles_users rows when user is destroyed (#10243)

closes #8843

core/server/models/user.js

@@ -37,6 +37,18 @@ User = ghostBookshelf.Model.extend({
         ghostBookshelf.Model.prototype.emitChange.bind(this)(this, eventToTrigger, options);
     },
 
+    /**
+     * @TODO:
+     *
+     * The user model does not use bookshelf-relations yet.
+     * Therefor we have to remove the relations manually.
+     */
+    onDestroying(model, options) {
+        return (options.transacting || ghostBookshelf.knex)('roles_users')
+            .where('user_id', model.id)
+            .del();
+    },
+
     onDestroyed: function onDestroyed(model, options) {
         if (_.includes(activeStates, model.previous('status'))) {
             model.emitChange('deactivated', options);
@@ -556,6 +568,23 @@ User = ghostBookshelf.Model.extend({
             });
     },
 
+    destroy: function destroy(unfilteredOptions) {
+        const options = this.filterOptions(unfilteredOptions, 'destroy', {extraAllowedProperties: ['id']});
+
+        const destroyUser = () => {
+            return ghostBookshelf.Model.destroy.call(this, options);
+        };
+
+        if (!options.transacting) {
+            return ghostBookshelf.transaction((transacting) => {
+                options.transacting = transacting;
+                return destroyUser();
+            });
+        }
+
+        return destroyUser();
+    },
+
     /**
      * We override the owner!
      * Owner already has a slug -> force setting a new one by setting slug to null

core/test/functional/api/v2/admin/users_spec.js

@@ -7,6 +7,7 @@ const ObjectId = require('bson-objectid');
 const testUtils = require('../../../../utils');
 const localUtils = require('./utils');
 const config = require('../../../../../../core/server/config');
+const db = require('../../../../../../core/server/data/db');
 const models = require('../../../../../../core/server/models');
 const ghost = testUtils.startGhost;
 let request;
@@ -332,32 +333,49 @@ describe('User API V2', function () {
 
         describe('Destroy', function () {
             it('[success] Destroy active user', function () {
+                const userId = testUtils.existingData.users[1].id;
+
                 return request
-                    .get(localUtils.API.getApiQuery(`posts/?filter=author_id:${testUtils.existingData.users[1].id}`))
+                    .get(localUtils.API.getApiQuery(`posts/?filter=author_id:${userId}`))
                     .set('Origin', config.get('url'))
                     .expect(200)
                     .then((res) => {
                         res.body.posts.length.should.eql(7);
 
                         return request
-                            .delete(localUtils.API.getApiQuery(`users/${testUtils.existingData.users[1].id}`))
+                            .delete(localUtils.API.getApiQuery(`users/${userId}`))
                             .set('Origin', config.get('url'))
                             .expect(204);
                     })
                     .then(() => {
                         return request
-                            .get(localUtils.API.getApiQuery(`users/${testUtils.existingData.users[1].id}/`))
+                            .get(localUtils.API.getApiQuery(`users/${userId}/`))
                             .set('Origin', config.get('url'))
                             .expect(404);
                     })
                     .then(() => {
                         return request
-                            .get(localUtils.API.getApiQuery(`posts/?filter=author_id:${testUtils.existingData.users[1].id}`))
+                            .get(localUtils.API.getApiQuery(`posts/?filter=author_id:${userId}`))
                             .set('Origin', config.get('url'))
                             .expect(200);
                     })
                     .then((res) => {
                         res.body.posts.length.should.eql(0);
+
+                        return db.knex('roles_users')
+                            .where({
+                                user_id: userId
+                            })
+                            .select();
+                    })
+                    .then((models) => {
+                        models.length.should.eql(0);
+
+                        return db.knex('roles_users')
+                            .select();
+                    })
+                    .then((models) => {
+                        models.length.should.greaterThan(0);
                     });
             });