From db047b535673dba397a7def5175cac1b715a88de Mon Sep 17 00:00:00 2001
From: Diksha Dabhole <dikshadabhole78@gmail.com>
Date: Sat, 13 Jun 2026 10:10:47 +0530
Subject: [PATCH] fix: delete uploaded files from disk when session is deleted
 (#90)

---
 backend/routes/sessions.py | 11 +++++++++++
 backend/tests/test_api.py  | 18 ++++++++++++++++++
 2 files changed, 29 insertions(+)

diff --git a/backend/routes/sessions.py b/backend/routes/sessions.py
index 002551e..bc32923 100644
--- a/backend/routes/sessions.py
+++ b/backend/routes/sessions.py
@@ -1,5 +1,7 @@
 """Sessions routes — /api/sessions — full CRUD"""
 
+import os
+import shutil
 import uuid
 from fastapi import APIRouter, HTTPException
 from models.schemas import SessionCreate, SessionUpdate, BulkSessionRenameRequest
@@ -87,6 +89,15 @@ async def delete_session(session_id: str):
         rag_service.delete_session_index(session_id)
     except Exception:
         pass
+        
+    upload_dir = f"./data/uploads/{session_id}"
+    if os.path.exists(upload_dir):
+        try:
+            shutil.rmtree(upload_dir)
+        except Exception:
+            # Continue even if directory deletion fails (e.g. file lock)
+            pass
+            
     return {"status": "deleted", "session_id": session_id}
 
 
diff --git a/backend/tests/test_api.py b/backend/tests/test_api.py
index fb389a2..fa08d34 100644
--- a/backend/tests/test_api.py
+++ b/backend/tests/test_api.py
@@ -2,6 +2,7 @@
 
 import json
 import tempfile
+import os
 from unittest.mock import AsyncMock, patch
 
 from fastapi.testclient import TestClient
@@ -61,6 +62,23 @@ def test_delete_session():
     assert r2.status_code == 200
 
 
+def test_delete_session_removes_files():
+    r = client.post("/api/sessions/", json={"title": "To Delete With Files"})
+    sid = r.json()["id"]
+    
+    upload_dir = f"./data/uploads/{sid}"
+    os.makedirs(upload_dir, exist_ok=True)
+    with open(os.path.join(upload_dir, "test.txt"), "w") as f:
+        f.write("dummy")
+        
+    assert os.path.exists(upload_dir)
+    
+    r2 = client.delete(f"/api/sessions/{sid}")
+    assert r2.status_code == 200
+    
+    assert not os.path.exists(upload_dir)
+
+
 def test_get_messages_empty():
     r = client.post("/api/sessions/", json={"title": "Msg Test"})
     sid = r.json()["id"]