Remove mastodon posts on delete and OTP

backend/tests/test_api.py

@@ -273,7 +273,50 @@ def test_admin_can_remove_user_with_owned_data():
 
     removed = client.delete(f'/api/admin/users/{user_id}', headers=headers)
     assert removed.status_code == 200
-    assert client.get('/api/auth/me', params={'token': user_headers['Authorization'].removeprefix('Bearer ')}).status_code == 401
+    assert client.get('/api/auth/me', params={'token': user_token}).status_code == 401
+
+
+def test_deleting_link_removes_all_mastodon_posts_first():
+    owner_headers = login_headers('alice')
+    created = client.post('/api/links', headers=owner_headers, json={
+        'title': 'Remote cleanup',
+        'url': 'https://example.com/remote-cleanup',
+    })
+    assert created.status_code == 201
+    link_id = created.json()['id']
+    with get_connection() as conn:
+        conn.execute(
+            'UPDATE links SET mastodon_posted = 1, mastodon_post_id = ?, mastodon_post_ids = ? WHERE id = ?',
+            ('post-2', json.dumps(['post-1', 'post-2']), link_id),
+        )
+        conn.commit()
+
+    with patch('backend.app.api.links.plugin_manager.delete_mastodon_posts', return_value={'status': 'deleted', 'count': 2}) as delete_posts:
+        deleted = client.delete(f'/api/links/{link_id}', headers=owner_headers)
+    assert deleted.status_code == 200
+    delete_posts.assert_called_once()
+    assert delete_posts.call_args.args[0]['mastodon_post_ids'] == ['post-1', 'post-2']
+    assert client.delete(f'/api/links/{link_id}', headers=owner_headers).status_code == 404
+
+
+def test_link_is_kept_when_mastodon_cleanup_fails():
+    owner_headers = login_headers('alice')
+    created = client.post('/api/links', headers=owner_headers, json={
+        'title': 'Failed remote cleanup',
+        'url': 'https://example.com/failed-remote-cleanup',
+    })
+    link_id = created.json()['id']
+    with get_connection() as conn:
+        conn.execute(
+            'UPDATE links SET mastodon_posted = 1, mastodon_post_id = ?, mastodon_post_ids = ? WHERE id = ?',
+            ('post-failed', json.dumps(['post-failed']), link_id),
+        )
+        conn.commit()
+    with patch('backend.app.api.links.plugin_manager.delete_mastodon_posts', return_value={'status': 'failed', 'reason': 'remote refused'}):
+        deleted = client.delete(f'/api/links/{link_id}', headers=owner_headers)
+    assert deleted.status_code == 502
+    assert 'remote refused' in deleted.json()['detail']
+    assert client.get('/api/links').json()
 
 
 def test_admin_can_toggle_privileges_without_removing_last_admin():