Properly delete files when a package is removed

Both CarrierWave and ProjectStatistics relies on record deletion to
cleanup storage and update statistics.

We delete Packages instead of PackageFiles and the record deletion is
performed by the DB.

This commit introduce a dependent: :destroy on Package-PackageFiles
relation.

ee/app/models/packages/package.rb

 # frozen_string_literal: true
 class Packages::Package < ApplicationRecord
   belongs_to :project
-  has_many :package_files
+  # package_files must be destroyed by ruby code in order to properly remove carrierwave uploads and update project statistics
+  has_many :package_files, dependent: :destroy # rubocop:disable Cop/ActiveRecordDependent
   has_one :maven_metadatum, inverse_of: :package
 
   accepts_nested_attributes_for :maven_metadatum

ee/changelogs/unreleased/ac-fix-packages-deletion.yml

+---
+title: Properly delete files when a package is removed
+merge_request: 15634
+author:
+type: fixed

ee/spec/factories/packages.rb

@@ -39,6 +39,7 @@ FactoryBot.define do
       file_name 'my-app-1.0-20180724.124855-1.jar'
       file_sha1 '4f0bfa298744d505383fbb57c554d4f5c12d88b3'
       file_type 'jar'
+      size { 100.kilobytes }
     end
 
     trait(:pom) do
@@ -46,6 +47,7 @@ FactoryBot.define do
       file_name 'my-app-1.0-20180724.124855-1.pom'
       file_sha1 '19c975abd49e5102ca6c74a619f21e0cf0351c57'
       file_type 'pom'
+      size { 200.kilobytes }
     end
 
     trait(:xml) do
@@ -53,6 +55,7 @@ FactoryBot.define do
       file_name 'maven-metadata.xml'
       file_sha1 '42b1bdc80de64953b6876f5a8c644f20204011b0'
       file_type 'xml'
+      size { 300.kilobytes }
     end
 
     trait(:npm) do
@@ -60,6 +63,7 @@ FactoryBot.define do
       file_name 'foo-1.0.1.tgz'
       file_sha1 'be93151dc23ac34a82752444556fe79b32c7a1ad'
       file_type 'tgz'
+      size { 400.kilobytes }
     end
 
     trait :object_storage do

ee/spec/models/packages/package_spec.rb

@@ -4,7 +4,7 @@ require 'rails_helper'
 RSpec.describe Packages::Package, type: :model do
   describe 'relationships' do
     it { is_expected.to belong_to(:project) }
-    it { is_expected.to have_many(:package_files) }
+    it { is_expected.to have_many(:package_files).dependent(:destroy) }
   end
 
   describe 'validations' do
@@ -39,6 +39,18 @@ RSpec.describe Packages::Package, type: :model do
     end
   end
 
+  describe '#destroy' do
+    let(:package) { create(:npm_package) }
+    let(:package_file) { package.package_files.first }
+    let(:project_statistics) { ProjectStatistics.for_project_ids(package.project.id).first }
+
+    it 'affects project statistics' do
+      expect { package.destroy! }
+        .to change { project_statistics.reload.packages_size }
+              .from(package_file.size).to(0)
+    end
+  end
+
   describe '.by_name_and_file_name' do
     let!(:package) { create(:npm_package) }
     let!(:package_file) { package.package_files.first }