fix(db): erase revenue records with deleted analytics owners

[maskjelly]

Description

Website deletion previously left revenue analytics, including customer and profile identifiers and metadata, in ClickHouse. This adds analytics.revenue to the purge registry used by direct deletion and the deleted-owner sweep.

Slice

• Issue: Closes fix(db): website deletion leaves customer identifiers and metadata in revenue records (GDPR ISSUE) #1113
• Type / area: bug · analytics / database
• Suggested labels: bug, analytics (author cannot apply upstream labels)
• Scope: revenue erasure and revenue-only owner discovery
• Base: staging
• Dependencies or overlapping PRs: None; fix(api): restrict public sharing to unfiltered overview queries #1117 and fix(dashboard): enforce image proxy limits while streaming #1118 fix separate audit findings.

Changes

• Delete rows tied to a deleted website and owner-level rows with a null or empty website ID. Preserve rows tied to transferred websites.
• Use synced_at in retry scans so recently delivered historical payments count as recent.
• Keep the existing asynchronous ClickHouse mutation lifecycle. A follow-up removed a broad replica wait that could exceed the shared 30-second client timeout.
• Add unit tests and a ClickHouse integration test that polls for the eventual result. Wire the database package's integration suite into test:integration so the new test runs without a skip gate.

Validation

• bun run lint: passed.
• bun run check-types: 37/37 tasks passed.
• bun test src/clickhouse/purge.test.ts: 5 passed.
• The ClickHouse integration test was not run locally because no local ClickHouse service is available. CI and maintainer validation remain needed.

Merge notes

This is an independent change based on current staging. Mutation submission precedes the API response, while completion can be asynchronous; the existing retry sweep handles submission failures. CI runs the database integration command against its ClickHouse service. Maintainer review is still required.

Before merge

• Maintainer applies the suggested labels and reviews the change.
• Run the fork CI workflow (currently action_required with zero jobs) and confirm the ClickHouse integration suite passes.
• Resolve the Vercel authorization check failures shown on the PR.

AI disclosure: implemented and tested with Codex. Source and local test results were reviewed during implementation; maintainer human review is required.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 4b23c3e6-2e14-459a-a7dc-227cd153c442

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[vercel]

@maskjelly is attempting to deploy a commit to the Databuddy OSS Team on Vercel.

A member of the Team first needs to authorize it.

[greptile-apps]

Confidence Score: 4/5

[Critical impact] Adds revenue record deletion to the data purge system.

The revenue deletion changes have no established blocking behavior defect, but the two explicit test-code requirements must be satisfied before merging.

Findings

1.  New tests skip by default ▶
2.  Mocks use unnecessary async ▶

Summary

Revenue now participates in website deletion and deleted-owner retry scans.

• Deleting a website also removes its revenue records.
• Purge batches wait for replicas before they are acknowledged.

Acknowledged tradeoff: maskjelly states that waiting for replicas can increase purge duration or fail when a replica is unavailable.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Website deletion or deleted-owner retry] --> B[Purge tenant rows including revenue]
  B --> C[Wait for replica completion]
  C -->|Success| D[Call batch callback]
  D --> E[Retry job records purge audit]
  C -->|Failure| F[Existing error and retry path]

Loading

_{Reviews (1) · Last reviewed commit: "fix(db): erase revenue records with dele..." · Reviewed by Greptile}