refactor: rename cascade_delete to cascade_delete_related_objects

The function now only deletes related objects, not the root record.
This allows async_delete_task to call obj.delete() on the top-level
object via ORM, which fires Django signals (post_delete notifications,
pghistory audit, Pro signals like product_post_delete).

bulk_delete_findings uses execute_delete_sql to delete the finding
rows themselves after cascade_delete_related_objects cleans children.

Author: valentijnscholten

dojo/finding/helper.py

@@ -770,7 +770,10 @@ def bulk_delete_findings(finding_qs, chunk_size=1000):
     Chunked with per-chunk transaction.atomic() for crash safety.
     """
     from dojo.signals import pre_bulk_delete_findings  # noqa: PLC0415 circular import
-    from dojo.utils_cascade_delete import cascade_delete  # noqa: PLC0415 circular import
+    from dojo.utils_cascade_delete import (  # noqa: PLC0415 circular import
+        cascade_delete_related_objects,
+        execute_delete_sql,
+    )
 
     pre_bulk_delete_findings.send(sender=Finding, finding_qs=finding_qs)
     bulk_clear_finding_m2m(finding_qs)
@@ -782,8 +785,10 @@ def bulk_delete_findings(finding_qs, chunk_size=1000):
         ),
         start=1,
     ):
+        chunk_qs = Finding.objects.filter(id__in=chunk_ids)
         with transaction.atomic():
-            cascade_delete(Finding, Finding.objects.filter(id__in=chunk_ids), skip_relations={Finding}, skip_m2m_for={Finding})
+            cascade_delete_related_objects(Finding, chunk_qs, skip_relations={Finding}, skip_m2m_for={Finding})
+            execute_delete_sql(chunk_qs)
         logger.info(
             "bulk_delete_findings: deleted chunk %d (%d findings)",
             chunk_num, len(chunk_ids),

dojo/utils.py

@@ -2052,8 +2052,9 @@ def async_delete_task(obj, **kwargs):
     Delete an object and all its related objects using the SQL cascade walker.
 
     Handles Python-level concerns (duplicates, integrators, M2M, file cleanup,
-    product grading) explicitly, then uses cascade_delete() for efficient
-    bottom-up SQL deletion of all FK-related tables.
+    product grading) explicitly, then uses cascade_delete_related_objects() for
+    efficient bottom-up SQL deletion of all FK-related tables. The top-level
+    object is deleted via ORM obj.delete() to fire Django signals.
 
     Accepts **kwargs for _pgh_context injected by dojo_dispatch_task.
     Uses PgHistoryTask base class (default) to preserve pghistory context for audit trail.
@@ -2062,7 +2063,7 @@ def async_delete_task(obj, **kwargs):
         bulk_delete_findings,
         prepare_duplicates_for_delete,
     )
-    from dojo.utils_cascade_delete import cascade_delete  # noqa: PLC0415 circular import
+    from dojo.utils_cascade_delete import cascade_delete_related_objects  # noqa: PLC0415 circular import
 
     logger.debug("ASYNC_DELETE: Deleting %s: %s", _get_object_name(obj), obj)
     if not isinstance(obj, ASYNC_DELETE_SUPPORTED_TYPES):
@@ -2108,18 +2109,21 @@ def async_delete_task(obj, **kwargs):
         # Step 4: Delete the main scope findings
         bulk_delete_findings(finding_qs, chunk_size=chunk_size)
 
-    # Step 5: Delete the top-level object and all remaining children (Tests,
-    # Engagements, Endpoints, etc.) via cascade_delete. Findings are already
-    # gone, so skip_relations={Finding} avoids walking empty relations.
+    # Step 5: Delete all remaining related objects (Tests, Engagements,
+    # Endpoints, etc.) via SQL cascade. Findings are already gone, so
+    # skip_relations={Finding} avoids walking empty relations.
     # Single transaction is fine here — the heavy relations (Findings,
     # Endpoint_Status) are already deleted; only lightweight rows remain.
     pk_query = type(obj).objects.filter(pk=obj.pk)
     with transaction.atomic():
-        cascade_delete(type(obj), pk_query, skip_relations={Finding})
+        cascade_delete_related_objects(type(obj), pk_query, skip_relations={Finding})
 
-    # Step 6: Recalculate product grade once (not per-object)
-    # The custom delete() methods on Finding/Test/Engagement each call
-    # perform_product_grading — cascade_delete bypasses custom delete().
+    # Step 6: Delete the top-level object via ORM to fire Django signals
+    # (post_delete notifications, pghistory audit, Pro signals).
+    # All children are already gone so this is a single-row DELETE.
+    obj.delete()
+
+    # Step 7: Recalculate product grade once (not per-object)
     if product:
         perform_product_grading(product)
 

dojo/utils_cascade_delete.py

@@ -60,14 +60,15 @@ def execute_update_sql(query, **updatespec):
     return execute_compiled_sql(*get_update_sql(query, **updatespec))
 
 
-def cascade_delete(from_model, instance_pk_query, skip_relations=None, skip_m2m_for=None, base_model=None, level=0):
+def cascade_delete_related_objects(from_model, instance_pk_query, skip_relations=None, skip_m2m_for=None, base_model=None, level=0):
     """
     Recursively walk Django model relations and execute compiled SQL
-    to perform cascade DELETE / SET_NULL without the Collector.
+    to perform cascade DELETE / SET_NULL on related objects without the Collector.
 
-    Walks from_model._meta.related_objects to discover all FK relations,
-    recurses into CASCADE children first (bottom-up), then deletes at the
-    current level. No query execution until recursion unwinds.
+    At level 0 (the root), only related objects are deleted — the root records
+    themselves are NOT deleted. This allows the caller to use ORM obj.delete()
+    on the root to fire Django signals (notifications, audit, etc.).
+    At deeper levels, records are deleted after their children.
 
     Includes any related object in Dojo-Pro
 
@@ -81,7 +82,7 @@ def cascade_delete(from_model, instance_pk_query, skip_relations=None, skip_m2m_
         level: Recursion depth (for logging only).
 
     Returns:
-        Number of records deleted at this level.
+        Number of records deleted at this level (0 at level 0 since root is not deleted).
 
     """
     if skip_relations is None:
@@ -131,7 +132,7 @@ def cascade_delete(from_model, instance_pk_query, skip_relations=None, skip_m2m_
                 related_model._meta.pk.name,
             )
             # Recurse into children first (bottom-up deletion)
-            cascade_delete(
+            cascade_delete_related_objects(
                 related_model, related_pk_query,
                 skip_relations=skip_relations,
                 skip_m2m_for=skip_m2m_for,
@@ -180,16 +181,22 @@ def cascade_delete(from_model, instance_pk_query, skip_relations=None, skip_m2m_
                     m2m_count, through_model._meta.db_table,
                 )
 
-    # After all children and M2M are deleted, delete records at this level
+    # At level 0, do NOT delete root records — the caller handles that
+    # (e.g. via ORM obj.delete() to fire Django signals).
     if level == 0:
-        del_query = instance_pk_query
-    else:
-        filterspec = {f"{from_model._meta.pk.name}__in": models.Subquery(instance_pk_query)}
-        del_query = from_model.objects.filter(**filterspec)
+        logger.debug(
+            "cascade_delete_related_objects level 0: related objects deleted for %s (root not deleted)",
+            from_model.__name__,
+        )
+        return 0
+
+    # At deeper levels, delete records after their children are gone
+    filterspec = {f"{from_model._meta.pk.name}__in": models.Subquery(instance_pk_query)}
+    del_query = from_model.objects.filter(**filterspec)
 
     count = execute_delete_sql(del_query)
     logger.debug(
-        "cascade_delete level %d: deleted %d %s records",
+        "cascade_delete_related_objects level %d: deleted %d %s records",
         level, count, from_model.__name__,
     )
     return count