Add soft-delete + recovery and tree-wide graph endpoints

Tree and person soft-delete + restore (owner-only for trees, editor for people) with recovery listings (?deleted=true); the worker already purges past the 30-day window. Adds tree-wide GET /relationships and /events so the family/pedigree view loads the whole graph in a few calls. 27 tests pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Justin Paul <justin@jpaul.me>

backend/app/services/event_service.py

@@ -91,6 +91,20 @@ async def create_event(
     return event
 
 
+async def list_events(
+    session: AsyncSession, *, viewer_id: uuid.UUID, tree: Tree
+) -> list[Event]:
+    """All events in the tree — lets the family view compute birth/death years."""
+    if not await privacy.can_view_tree(session, user_id=viewer_id, tree=tree):
+        raise Forbidden("not permitted to view this tree")
+    stmt = (
+        select(Event)
+        .where(Event.tree_id == tree.id, Event.deleted_at.is_(None))
+        .order_by(Event.date_start.nulls_last(), Event.created_at)
+    )
+    return list((await session.execute(stmt)).scalars().all())
+
+
 async def list_events_for_person(
     session: AsyncSession, *, viewer_id: uuid.UUID, tree: Tree, person_id: uuid.UUID
 ) -> list[Event]:

backend/app/services/person_service.py

@@ -4,6 +4,7 @@ person through the privacy engine. Each returned Person gets a transient
 """
 
 import uuid
+from datetime import UTC, datetime
 
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
@@ -112,6 +113,77 @@ async def get_person(
     return person
 
 
+async def delete_person(
+    session: AsyncSession, *, actor: User, tree: Tree, person_id: uuid.UUID
+) -> None:
+    if not await privacy.can_edit_tree(session, user_id=actor.id, tree=tree):
+        raise Forbidden("not an editor of this tree")
+    person = (
+        await session.execute(
+            select(Person).where(
+                Person.id == person_id, Person.tree_id == tree.id, Person.deleted_at.is_(None)
+            )
+        )
+    ).scalar_one_or_none()
+    if person is None:
+        raise NotFound("person not found")
+    person.deleted_at = datetime.now(UTC)
+    record_audit(
+        session,
+        action="delete",
+        entity_type="Person",
+        entity_id=person.id,
+        tree_id=tree.id,
+        actor_user_id=actor.id,
+    )
+    await session.commit()
+
+
+async def restore_person(
+    session: AsyncSession, *, actor: User, tree: Tree, person_id: uuid.UUID
+) -> Person:
+    if not await privacy.can_edit_tree(session, user_id=actor.id, tree=tree):
+        raise Forbidden("not an editor of this tree")
+    person = (
+        await session.execute(
+            select(Person).where(
+                Person.id == person_id, Person.tree_id == tree.id, Person.deleted_at.is_not(None)
+            )
+        )
+    ).scalar_one_or_none()
+    if person is None:
+        raise NotFound("deleted person not found")
+    person.deleted_at = None
+    record_audit(
+        session,
+        action="restore",
+        entity_type="Person",
+        entity_id=person.id,
+        tree_id=tree.id,
+        actor_user_id=actor.id,
+    )
+    await session.commit()
+    await session.refresh(person)
+    await _attach_primary_name(session, person)
+    return person
+
+
+async def list_deleted_persons(
+    session: AsyncSession, *, viewer_id: uuid.UUID, tree: Tree
+) -> list[Person]:
+    if not await privacy.can_view_tree(session, user_id=viewer_id, tree=tree):
+        raise Forbidden("not permitted to view this tree")
+    stmt = (
+        select(Person)
+        .where(Person.tree_id == tree.id, Person.deleted_at.is_not(None))
+        .order_by(Person.deleted_at.desc())
+    )
+    persons = list((await session.execute(stmt)).scalars().all())
+    for person in persons:
+        await _attach_primary_name(session, person)
+    return persons
+
+
 async def list_persons(
     session: AsyncSession, *, viewer_id: uuid.UUID, tree: Tree
 ) -> list[Person]:

backend/app/services/relationship_service.py

@@ -73,6 +73,20 @@ async def create_relationship(
     return relationship
 
 
+async def list_relationships(
+    session: AsyncSession, *, viewer_id: uuid.UUID, tree: Tree
+) -> list[Relationship]:
+    """All relationships in the tree — powers the family/pedigree view in one call."""
+    if not await privacy.can_view_tree(session, user_id=viewer_id, tree=tree):
+        raise Forbidden("not permitted to view this tree")
+    stmt = (
+        select(Relationship)
+        .where(Relationship.tree_id == tree.id, Relationship.deleted_at.is_(None))
+        .order_by(Relationship.created_at)
+    )
+    return list((await session.execute(stmt)).scalars().all())
+
+
 async def list_relationships_for_person(
     session: AsyncSession, *, viewer_id: uuid.UUID, tree: Tree, person_id: uuid.UUID
 ) -> list[Relationship]:

backend/app/services/tree_service.py

@@ -3,6 +3,7 @@ authorization basis) and an audit entry. Reads go through the privacy engine.
 """
 
 import uuid
+from datetime import UTC, datetime
 
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
@@ -59,3 +60,55 @@ async def get_tree(session: AsyncSession, *, viewer_id: uuid.UUID, tree_id: uuid
     if not await privacy.can_view_tree(session, user_id=viewer_id, tree=tree):
         raise Forbidden("not permitted to view this tree")
     return tree
+
+
+async def _owned_tree(session: AsyncSession, *, actor: User, tree_id: uuid.UUID) -> Tree:
+    """Load a tree (including soft-deleted) and require the actor be its owner."""
+    tree = await BaseRepository(session, Tree).get(tree_id, include_deleted=True)
+    if tree is None:
+        raise NotFound("tree not found")
+    role = await privacy.get_membership_role(session, actor.id, tree.id)
+    if role is not MembershipRole.owner:
+        raise Forbidden("only the owner can delete or restore a tree")
+    return tree
+
+
+async def delete_tree(session: AsyncSession, *, actor: User, tree_id: uuid.UUID) -> None:
+    tree = await _owned_tree(session, actor=actor, tree_id=tree_id)
+    if tree.deleted_at is None:
+        tree.deleted_at = datetime.now(UTC)
+        record_audit(
+            session,
+            action="delete",
+            entity_type="Tree",
+            entity_id=tree.id,
+            tree_id=tree.id,
+            actor_user_id=actor.id,
+        )
+        await session.commit()
+
+
+async def restore_tree(session: AsyncSession, *, actor: User, tree_id: uuid.UUID) -> Tree:
+    tree = await _owned_tree(session, actor=actor, tree_id=tree_id)
+    if tree.deleted_at is not None:
+        tree.deleted_at = None
+        record_audit(
+            session,
+            action="restore",
+            entity_type="Tree",
+            entity_id=tree.id,
+            tree_id=tree.id,
+            actor_user_id=actor.id,
+        )
+        await session.commit()
+    return tree
+
+
+async def list_deleted_trees_for_user(session: AsyncSession, *, user: User) -> list[Tree]:
+    stmt = (
+        select(Tree)
+        .join(TreeMembership, TreeMembership.tree_id == Tree.id)
+        .where(TreeMembership.user_id == user.id, Tree.deleted_at.is_not(None))
+        .order_by(Tree.deleted_at.desc())
+    )
+    return list((await session.execute(stmt)).scalars().all())