Fix Deleting Attachments Via API

[Iwantexpresso]

Fixes # 6859

Fixed an error that was caused by the delete_obj function attempting to audit an access obj.id's that were already deleted. This happened when attempting to delete an attachment or {table}attachment record via the API (both via direct API delete and using the "delete" button on the data entry form).

Checklist

• Self-review the PR after opening it to make sure the changes look good and
  self-explanatory (or properly documented)
• Add relevant issue to release milestone
• Add pr to documentation list
• Add automated tests

Testing instructions

GUI deletion:

• Create a collection object with an attachment and save it.
• Delete the attachment in a new tab through the form meta menu share link
• Make sure the deletion is successful and no errors are raised through this deletion method

API deletion:

• Create a collection object with an attachment and save it.
• Create a query to retrieve the Collection object attachment ID.
  A query like this should help you get it:

• Use the COA ID to Delete the attachment through the tables API page by using the DELETE request for Collectionobjectattachment( this page https://your specify instance/documentation/api/tables/)

• Make sure the deletion is successful and no errors are raised for this deletion method

Summary by CodeRabbit

• Bug Fixes
  • Fixed an issue in the deletion process where dependent objects could be accessed after being deleted, causing errors. The deletion flow now safely manages dependent objects during recursive deletion operations.

[coderabbitai]

📝 Walkthrough

Walkthrough

The delete_obj function in the CRUD API is modified to cache object IDs before deletion. This prevents accidental references to invalidated Django model instances when executing deleter callbacks and processing recursive deletions of dependent objects.

Changes

Deletion Flow Safety

Layer / File(s)	Summary
Deletion Flow with ID Caching specifyweb/specify/api/crud.py	delete_obj caches obj.id before deletion, conditionally invokes deleter only when the cached ID exists, and caches each dependent's id before recursion to avoid referencing deleted instances.

🚥 Pre-merge checks | ✅ 4 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Automatic Tests	⚠️ Warning	PR fixes critical attachment deletion bug but lacks automatic tests. Code changes object deletion behavior, which requires automated test coverage for regression prevention.	Add automated tests for attachment deletion via API (e.g., collectionobjectattachment) to verify the fix and prevent regression of issue #6859.
Testing Instructions	⚠️ Warning	Testing instructions not formally documented in repository. PR mentions GUI and API deletion workflows but no clear testing docs for affected components found.	Add PR testing instructions covering API DELETE for attachments, cascade deletion verification, and GUI workflow. Add automated tests to test_api.py for attachment deletion with dependent objects to validate ID caching fix.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'Fix Deleting Attachments Via API' directly relates to the main change: fixing a deletion flow issue for attachments accessed through the API.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch issue-6859

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

• Generate code and open pull requests
• Plan features and break down work
• Investigate incidents and troubleshoot customer tickets together
• Automate recurring tasks and respond to alerts with triggers
• Summarize progress and report instantly

Built for teams:

• Shared memory across your entire org—no repeating context
• Per-thread sandboxes to safely plan and execute work
• Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}