fix(db): cascade soft-delete tasks and events on session delete

go/api/database/client.go

@@ -2,13 +2,18 @@ package database
 
 import (
 	"context"
+	"errors"
 	"time"
 
 	a2a "github.com/a2aproject/a2a-go/v2/a2a"
 	"github.com/kagent-dev/kagent/go/api/v1alpha2"
 	"github.com/pgvector/pgvector-go"
 )
 
+// ErrSessionIDInUse means the requested session id is already active on a
+// different session (possibly owned by another user).
+var ErrSessionIDInUse = errors.New("session id already in use")
+
 type QueryOptions struct {
 	Limit    int
 	After    time.Time

go/core/internal/database/client_postgres.go

@@ -11,6 +11,7 @@ import (
 
 	a2a "github.com/a2aproject/a2a-go/v2/a2a"
 	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
 	"github.com/jackc/pgx/v5/pgtype"
 	"github.com/jackc/pgx/v5/pgxpool"
 	dbpkg "github.com/kagent-dev/kagent/go/api/database"
@@ -83,7 +84,7 @@ func (c *postgresClient) DeleteAgent(ctx context.Context, agentID string) error
 // ── Sessions ──────────────────────────────────────────────────────────────────
 
 func (c *postgresClient) StoreSession(ctx context.Context, session *dbpkg.Session) error {
-	return c.withTx(ctx, func(q *dbgen.Queries) error {
+	err := c.withTx(ctx, func(q *dbgen.Queries) error {
 		params := dbgen.UpsertSessionParams{
 			ID:      session.ID,
 			UserID:  session.UserID,
@@ -96,6 +97,11 @@ func (c *postgresClient) StoreSession(ctx context.Context, session *dbpkg.Sessio
 		}
 		return q.UpsertSession(ctx, params)
 	})
+	var pgErr *pgconn.PgError
+	if errors.As(err, &pgErr) && pgErr.ConstraintName == "session_id_active_unique" {
+		return dbpkg.ErrSessionIDInUse
+	}
+	return err
 }
 
 func (c *postgresClient) GetSession(ctx context.Context, sessionID, userID string) (*dbpkg.Session, error) {
@@ -146,7 +152,24 @@ func (c *postgresClient) ListSessionsForAgentAllUsers(ctx context.Context, agent
 }
 
 func (c *postgresClient) DeleteSession(ctx context.Context, sessionID, userID string) error {
-	return c.q.SoftDeleteSession(ctx, dbgen.SoftDeleteSessionParams{ID: sessionID, UserID: userID})
+	return c.withTx(ctx, func(q *dbgen.Queries) error {
+		if _, err := q.GetSession(ctx, dbgen.GetSessionParams{ID: sessionID, UserID: userID}); err != nil {
+			if errors.Is(err, pgx.ErrNoRows) {
+				return nil
+			}
+			return err
+		}
+		if err := q.SoftDeleteTasksBySession(ctx, &sessionID); err != nil {
+			return err
+		}
+		if err := q.SoftDeleteEventsBySession(ctx, &sessionID); err != nil {
+			return err
+		}
+		if err := q.DeleteSessionSharesBySession(ctx, sessionID); err != nil {
+			return err
+		}
+		return q.SoftDeleteSession(ctx, dbgen.SoftDeleteSessionParams{ID: sessionID, UserID: userID})
+	})
 }
 
 // ── Session Shares ─────────────────────────────────────────────────────────────

go/core/internal/database/client_test.go

@@ -234,6 +234,24 @@ func TestStoreSessionIdempotence(t *testing.T) {
 	assert.Equal(t, "Updated", *retrieved.Name, "Session should have updated name")
 }
 
+func TestStoreSessionRejectsIDUsedByAnotherUser(t *testing.T) {
+	db := setupTestDB(t)
+	client := NewClient(db)
+	ctx := context.Background()
+
+	agentID := "agent-1"
+	first := &dbpkg.Session{ID: "shared-id", UserID: "user-a", AgentID: &agentID}
+	require.NoError(t, client.StoreSession(ctx, first), "first user should get the id")
+
+	second := &dbpkg.Session{ID: "shared-id", UserID: "user-b", AgentID: &agentID}
+	err := client.StoreSession(ctx, second)
+	require.ErrorIs(t, err, dbpkg.ErrSessionIDInUse, "a second user must not claim an id already active for another user")
+
+	// Once the first user's session is gone, the id is free again.
+	require.NoError(t, client.DeleteSession(ctx, "shared-id", "user-a"))
+	require.NoError(t, client.StoreSession(ctx, second), "id should be reusable after the original session is deleted")
+}
+
 func TestListSessionsOrdersByRecentActivity(t *testing.T) {
 	db := setupTestDB(t)
 	client := NewClient(db)

go/core/internal/database/queries/events.sql

@@ -57,3 +57,6 @@ LIMIT $2;
 -- name: SoftDeleteEvent :exec
 UPDATE event SET deleted_at = NOW()
 WHERE id = $1 AND deleted_at IS NULL;
+
+-- name: SoftDeleteEventsBySession :exec
+UPDATE event SET deleted_at = NOW() WHERE session_id = $1 AND deleted_at IS NULL;

go/core/internal/database/queries/session_shares.sql

@@ -21,3 +21,6 @@ WHERE token = $1 AND session_id = $2 AND user_id = $3;
 INSERT INTO session_share_access (user_id, share_id, accessed_at)
 VALUES ($1, $2, NOW())
 ON CONFLICT (user_id, share_id) DO UPDATE SET accessed_at = NOW();
+
+-- name: DeleteSessionSharesBySession :exec
+DELETE FROM session_share WHERE session_id = $1;

go/core/internal/database/queries/tasks.sql

@@ -33,3 +33,6 @@ WHERE upserted_task.session_id IS NOT NULL
 
 -- name: SoftDeleteTask :exec
 UPDATE task SET deleted_at = NOW() WHERE id = $1 AND deleted_at IS NULL;
+
+-- name: SoftDeleteTasksBySession :exec
+UPDATE task SET deleted_at = NOW() WHERE session_id = $1 AND deleted_at IS NULL;

go/core/internal/httpserver/handlers/sessions.go

@@ -2,6 +2,7 @@ package handlers
 
 import (
 	"context"
+	stderrors "errors"
 	"fmt"
 	"net/http"
 	"strconv"
@@ -178,6 +179,10 @@ func (h *SessionsHandler) HandleCreateSession(w ErrorResponseWriter, r *http.Req
 		"name", sessionRequest.Name)
 
 	if err := h.DatabaseService.StoreSession(r.Context(), session); err != nil {
+		if stderrors.Is(err, database.ErrSessionIDInUse) {
+			w.RespondWithError(errors.NewConflictError("Session ID is already in use", err))
+			return
+		}
 		w.RespondWithError(errors.NewInternalServerError("Failed to create session", err))
 		return
 	}

go/core/pkg/migrations/core/000007_session_id_unique.down.sql

@@ -0,0 +1 @@
+DROP INDEX IF EXISTS session_id_active_unique;

go/core/pkg/migrations/core/000007_session_id_unique.up.sql

@@ -0,0 +1,5 @@
+-- A session's client-supplied id was only unique per (id, user_id), so two
+-- different users could create sessions with the same id. Deleting one then
+-- cascaded to the other user's tasks and events, which are keyed by session_id
+-- alone. This index makes id unique among live sessions so that can't happen.
+CREATE UNIQUE INDEX IF NOT EXISTS session_id_active_unique ON session (id) WHERE deleted_at IS NULL;