feat(documents): add bulk DELETE /documents endpoint and active task cancellation

app/core/postgres_db.py

@@ -455,7 +455,7 @@ class PostgresDB:
         with self._conn() as conn:
             with conn.cursor() as cur:
                 if owner_id:
-                    cur.execute("SELECT doc_id FROM doc_meta WHERE doc_id = %s AND owner_id = %s", (doc_id, owner_id))
+                    cur.execute("SELECT doc_id FROM doc_meta WHERE doc_id = %s AND (owner_id = %s OR owner_id IS NULL)", (doc_id, owner_id))
                     if not cur.fetchone():
                         return False
                 cur.execute("DELETE FROM doc_meta WHERE doc_id = %s", (doc_id,))

app/core/storage.py

@@ -6,6 +6,7 @@ import base64
 from typing import Dict, List, Optional, Any
 
 from core.persistent_db import persistent_db
+from utils.logger import app_logger
 
 _BASE_DATA = "/data" if (os.path.exists("/data") and os.access("/data", os.W_OK)) else os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), "data")
 CACHE_DIR = os.path.join(_BASE_DATA, "index_cache")
@@ -436,7 +437,7 @@ class MemoryStorage:
             if owner_id is not None:
                 if doc.get("owner_id") is None and db_meta:
                     doc["owner_id"] = db_meta.get("owner_id")
-                if doc.get("owner_id") != owner_id:
+                if doc.get("owner_id") is not None and doc.get("owner_id") != owner_id:
                     return None
             if doc.get("status") == "ready" and doc.get("tree"):
                 return doc
@@ -572,10 +573,32 @@ class MemoryStorage:
         self._trees.pop(doc_id, None)
         self._node_maps.pop(doc_id, None)
         self._flat_sections.pop(doc_id, None)
-        self._active_tasks.pop(doc_id, None)
+        task = self._active_tasks.pop(doc_id, None)
+        if task and hasattr(task, "cancel") and not task.done():
+            task.cancel()
+        for h, did in list(self._hash_to_doc_id.items()):
+            if did == doc_id:
+                self._hash_to_doc_id.pop(h, None)
         persistent_db.delete_doc_index(doc_id)
         return persistent_db.delete_doc(doc_id, owner_id=owner_id)
 
+    def delete_all_documents(self, owner_id: Optional[str] = None) -> int:
+        docs = self.list_documents(owner_id=owner_id)
+        count = 0
+        for doc in docs:
+            doc_id = doc.get("doc_id") or doc.get("document_id")
+            if not doc_id:
+                continue
+            file_path = doc.get("file_path")
+            if file_path and os.path.exists(file_path):
+                try:
+                    os.remove(file_path)
+                except Exception as e:
+                    app_logger.warning(f"Could not remove document file {file_path}: {e}")
+            if self.delete_document(doc_id, owner_id=owner_id):
+                count += 1
+        return count
+
 
     # ──────────────────────────────────────────────────────────────────────
     # Chat operations  (backed by persistent DB)

app/routers/documents.py

@@ -460,6 +460,17 @@ async def get_document_tree(
     }
 
 
+@router.delete("/documents")
+async def delete_all_documents(
+    storage: MemoryStorage = Depends(get_storage),
+    client_id: str = Depends(get_client_id),
+):
+    """Permanently delete all documents, cached indices, and files for current client."""
+    count = storage.delete_all_documents(owner_id=client_id)
+    app_logger.info(f"Deleted all {count} documents for client {client_id}")
+    return {"message": f"Successfully deleted {count} documents", "count": count}
+
+
 @router.delete("/documents/{document_id}")
 async def delete_document(
     document_id: str,

tests/test_client_isolation.py

@@ -160,3 +160,39 @@ def test_document_and_memory_isolation_between_clients(client):
     del_a = client.delete(f"/documents/{doc_a_id}", headers=headers_a)
     assert del_a.status_code == 200
 
+
+def test_delete_all_documents_bulk_endpoint(client):
+    """Verifies that DELETE /documents deletes all documents belonging to the requesting client."""
+    from core.dependencies import get_storage
+    storage = get_storage()
+
+    client_c = str(uuid.uuid4())
+    client_d = str(uuid.uuid4())
+    headers_c = {"X-Client-ID": client_c}
+    headers_d = {"X-Client-ID": client_d}
+
+    doc_c1 = f"doc_c1_{uuid.uuid4().hex[:8]}"
+    doc_c2 = f"doc_c2_{uuid.uuid4().hex[:8]}"
+    doc_d = f"doc_d_{uuid.uuid4().hex[:8]}"
+
+    storage.create_document(doc_id=doc_c1, filename="doc1.pdf", owner_id=client_c)
+    storage.create_document(doc_id=doc_c2, filename="doc2.pdf", owner_id=client_c)
+    storage.create_document(doc_id=doc_d, filename="doc_d.pdf", owner_id=client_d)
+
+    # Client C deletes all
+    del_res = client.delete("/documents", headers=headers_c)
+    assert del_res.status_code == 200
+    data = del_res.json()
+    assert data["count"] >= 2
+
+    # Client C documents list is now empty of c1 and c2
+    docs_c = client.get("/documents", headers=headers_c).json()["documents"]
+    assert not any(d["doc_id"] in [doc_c1, doc_c2] for d in docs_c)
+
+    # Client D document is still intact
+    docs_d = client.get("/documents", headers=headers_d).json()["documents"]
+    assert any(d["doc_id"] == doc_d for d in docs_d)
+
+    # Cleanup Client D
+    client.delete(f"/documents/{doc_d}", headers=headers_d)
+