soft-delete

Summary

Deleting a record sets deletedAt; no row is removed, and every read excludes rows where it is set.

Why it matters

Society records are evidence — who was let in, who was billed. A hard delete loses the visitor log an incident needs.

Implications

• Every query filters deletedAt: null. buildWhereClause() in the service base class adds it; a hand-written query that skips the base class must add it itself.
• Deleted data is never exposed through the API, including through field resolvers.
• Seed scenario packages/db/prisma/data/user/03_deleted_user.json exists to test exactly this.

Related

• layered-architecture

Sources

• AGENTS.md — "Security requirements"
• packages/db/prisma/schema.prisma