feat: let users delete operator chats

Signed-off-by: zebbern <185730623+zebbern@users.noreply.github.com>

Author: zebbern

backend/src/operator/__tests__/operator.repository.spec.ts

@@ -78,17 +78,23 @@ function chainable(rows: unknown[], calls: QueryCall[], query: number) {
   return self;
 }
 
-function repositoryWithSelects(selectResults: unknown[][], insertResults: unknown[][] = []) {
+function repositoryWithSelects(
+  selectResults: unknown[][],
+  insertResults: unknown[][] = [],
+  deleteResults: unknown[][] = [],
+) {
   const calls: QueryCall[] = [];
   let query = 0;
   let insert = 0;
+  let deletion = 0;
   const tx = {
     select: mock(() => {
       const current = query++;
       return chainable(selectResults[current] ?? [], calls, current);
     }),
     insert: mock(() => chainable(insertResults[insert++] ?? [], calls, query++)),
     update: mock(() => chainable([], calls, query++)),
+    delete: mock(() => chainable(deleteResults[deletion++] ?? [], calls, query++)),
   };
   const db = {
     transaction: mock(async (handler: (executor: typeof tx) => Promise<unknown>) => handler(tx)),
@@ -98,6 +104,7 @@ function repositoryWithSelects(selectResults: unknown[][], insertResults: unknow
     repository: new OperatorRepository(db as never, audit as unknown as AuditLogService),
     tx,
     calls,
+    audit,
   };
 }
 
@@ -151,6 +158,61 @@ function createActionInput(argumentsValue: Record<string, unknown>) {
   };
 }
 
+describe('OperatorRepository.deleteSession', () => {
+  it('locks and deletes an owned session with no active turn', async () => {
+    const { repository, tx, calls, audit } = repositoryWithSelects(
+      [[session], []],
+      [],
+      [[session]],
+    );
+
+    await expect(
+      repository.deleteSession({
+        sessionId: SESSION_ID,
+        owner: { organizationId: auth.organizationId!, userId: auth.userId! },
+        auth,
+      }),
+    ).resolves.toEqual(session);
+
+    expect(calls.find((call) => call.query === 0 && call.method === 'for')?.args).toEqual([
+      'update',
+    ]);
+    expect(tx.delete).toHaveBeenCalledTimes(1);
+    expect(audit.recordDurableWithExecutor).toHaveBeenCalledWith(tx, auth, {
+      action: 'operator.session.delete',
+      resourceType: 'operator_session',
+      resourceId: SESSION_ID,
+      resourceName: 'Session',
+    });
+  });
+
+  it('rejects deletion while a durable turn is active', async () => {
+    const { repository, tx } = repositoryWithSelects([[session], [{ id: ACTIVE_TURN_ID }]]);
+
+    await expect(
+      repository.deleteSession({
+        sessionId: SESSION_ID,
+        owner: { organizationId: auth.organizationId!, userId: auth.userId! },
+        auth,
+      }),
+    ).rejects.toThrow('Stop or wait for the active Operator turn before deleting');
+    expect(tx.delete).not.toHaveBeenCalled();
+  });
+
+  it('does not delete a session outside the requested owner scope', async () => {
+    const { repository, tx } = repositoryWithSelects([[]]);
+
+    await expect(
+      repository.deleteSession({
+        sessionId: SESSION_ID,
+        owner: { organizationId: 'another-org', userId: 'another-user' },
+        auth,
+      }),
+    ).resolves.toBeUndefined();
+    expect(tx.delete).not.toHaveBeenCalled();
+  });
+});
+
 describe('OperatorRepository.createTurn', () => {
   it('locks the session before rejecting a distinct active turn', async () => {
     const { repository, tx, calls } = repositoryWithSelects([

backend/src/operator/__tests__/operator.service.spec.ts

@@ -105,6 +105,7 @@ describe('OperatorService', () => {
   beforeEach(() => {
     repository = {
       createSession: vi.fn().mockResolvedValue(sessionRecord()),
+      deleteSession: vi.fn().mockResolvedValue(sessionRecord()),
       findSession: vi.fn().mockResolvedValue(sessionRecord()),
       createTurn: vi
         .fn()
@@ -295,6 +296,16 @@ describe('OperatorService', () => {
     );
   });
 
+  it('deletes only within the authenticated user owner scope', async () => {
+    await service.deleteSession(auth, SESSION_ID);
+
+    expect(repository.deleteSession).toHaveBeenCalledWith({
+      sessionId: SESSION_ID,
+      owner: { organizationId: 'operator-org', userId: 'operator-user' },
+      auth,
+    });
+  });
+
   it('keeps legacy route-only turn rows readable in the public session projection', async () => {
     const legacyContext = {
       path: '/workflows/55555555-5555-4555-8555-555555555555',

backend/src/operator/operator.controller.ts

@@ -1,6 +1,7 @@
 import {
   Body,
   Controller,
+  Delete,
   Get,
   HttpCode,
   HttpStatus,
@@ -9,7 +10,7 @@ import {
   Post,
   Res,
 } from '@nestjs/common';
-import { ApiOkResponse, ApiOperation, ApiTags } from '@nestjs/swagger';
+import { ApiNoContentResponse, ApiOkResponse, ApiOperation, ApiTags } from '@nestjs/swagger';
 import type { Response } from 'express';
 import { ZodValidationPipe } from 'nestjs-zod';
 
@@ -134,6 +135,17 @@ export class OperatorController {
     return this.operatorService.updateSession(auth, params.id, body);
   }
 
+  @Delete('sessions/:id')
+  @HttpCode(HttpStatus.NO_CONTENT)
+  @ApiOperation({ summary: 'Delete an Operator session owned by the current user' })
+  @ApiNoContentResponse({ description: 'Operator session deleted successfully' })
+  async deleteSession(
+    @CurrentAuth() auth: AuthContext | null,
+    @Param(new ZodValidationPipe(OperatorIdParamSchema)) params: OperatorIdParamDto,
+  ): Promise<void> {
+    await this.operatorService.deleteSession(auth, params.id);
+  }
+
   @Post('sessions/:id/turns')
   @HttpCode(HttpStatus.ACCEPTED)
   @ApiOperation({ summary: 'Submit a durable Operator turn' })

backend/src/operator/operator.repository.ts

@@ -251,6 +251,56 @@ export class OperatorRepository {
     });
   }
 
+  async deleteSession(input: {
+    sessionId: string;
+    owner: { organizationId: string; userId: string };
+    auth: AuthContext;
+  }): Promise<OperatorSessionRecord | undefined> {
+    return this.db.transaction(async (tx) => {
+      const [session] = await tx
+        .select()
+        .from(operatorSessionsTable)
+        .where(
+          and(
+            eq(operatorSessionsTable.id, input.sessionId),
+            eq(operatorSessionsTable.organizationId, input.owner.organizationId),
+            eq(operatorSessionsTable.userId, input.owner.userId),
+          ),
+        )
+        .for('update')
+        .limit(1);
+      if (!session) return undefined;
+
+      const [activeTurn] = await tx
+        .select({ id: operatorTurnsTable.id })
+        .from(operatorTurnsTable)
+        .where(
+          and(
+            eq(operatorTurnsTable.sessionId, session.id),
+            inArray(operatorTurnsTable.status, [...ACTIVE_OPERATOR_TURN_STATUSES]),
+          ),
+        )
+        .limit(1);
+      if (activeTurn) {
+        throw new ConflictException('Stop or wait for the active Operator turn before deleting');
+      }
+
+      const [deleted] = await tx
+        .delete(operatorSessionsTable)
+        .where(eq(operatorSessionsTable.id, session.id))
+        .returning();
+      if (!deleted) return undefined;
+
+      await this.auditLogService.recordDurableWithExecutor(tx, input.auth, {
+        action: 'operator.session.delete',
+        resourceType: 'operator_session',
+        resourceId: deleted.id,
+        resourceName: deleted.title,
+      });
+      return deleted;
+    });
+  }
+
   async listTurns(sessionId: string): Promise<OperatorTurnRecord[]> {
     return this.db
       .select()

backend/src/operator/operator.service.ts

@@ -194,6 +194,16 @@ export class OperatorService {
     return this.toSessionSummary(updated, latestTurn ?? null, latestTurnActions);
   }
 
+  async deleteSession(auth: AuthContext | null, sessionId: string): Promise<void> {
+    const user = this.requireUserAuth(auth);
+    const deleted = await this.repository.deleteSession({
+      sessionId,
+      owner: { organizationId: user.organizationId, userId: user.userId },
+      auth: user,
+    });
+    if (!deleted) throw new NotFoundException('Operator session not found');
+  }
+
   async createTurn(
     auth: AuthContext | null,
     sessionId: string,

frontend/src/hooks/queries/useOperatorQueries.ts

@@ -83,12 +83,16 @@ export function operatorSessionHasActiveTurn(
   if (!latestTurn) return false;
   if (!ACTIVE_TURN_STATUSES.has(latestTurn.status)) return false;
   const activityLatestTurn = activitySummary?.latestTurn;
-  if (activityLatestTurn?.id === latestTurn.id) {
-    return ACTIVE_TURN_STATUSES.has(activityLatestTurn.status);
+  if (activitySummary && activityLatestTurn?.id === latestTurn.id) {
+    return operatorSessionSummaryHasActiveTurn(activitySummary);
   }
   return true;
 }
 
+export function operatorSessionSummaryHasActiveTurn(session: OperatorSessionSummary): boolean {
+  return Boolean(session.latestTurn && ACTIVE_TURN_STATUSES.has(session.latestTurn.status));
+}
+
 export function getOperatorSessionLatestTurnError(session: OperatorSessionDetail): string | null {
   const latestTurn = session.turns[session.turns.length - 1];
   return latestTurn?.status === 'failed' ? latestTurn.error : null;
@@ -561,6 +565,19 @@ export function useUpdateOperatorSession() {
   });
 }
 
+export function useDeleteOperatorSession() {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: (sessionId: string) => api.operator.deleteSession(sessionId),
+    meta: { suppressGlobalError: true },
+    onSuccess: (_result, sessionId) => {
+      queryClient.removeQueries({ queryKey: queryKeys.operator.session(sessionId) });
+      void queryClient.invalidateQueries({ queryKey: queryKeys.operator.sessions() });
+    },
+  });
+}
+
 export function useCreateOperatorTurn() {
   const queryClient = useQueryClient();