fix(finding): run Finding.delete() for each finding the merge action deletes

dojo/finding/ui/views.py

@@ -2374,7 +2374,12 @@ def merge_finding_product(request, pid):
                         )
                     elif form.cleaned_data["finding_action"] == "delete":
                         finding_action = "deleted"
-                        findings_to_merge.delete()
+                        # Detach the target first, or the cluster cascade delete can remove it.
+                        Finding.objects.filter(
+                            pk=finding_to_merge_into.pk, duplicate_finding__in=findings_to_merge,
+                        ).update(duplicate=False, duplicate_finding=None)
+                        for finding_to_delete in findings_to_merge:
+                            finding_helper.delete_finding_with_conflict_retry(finding_to_delete, push_to_jira=None)
 
                     notes_entry = ("Finding consists of merged findings from the following "
                                    f"findings which have been {finding_action}: {notes_entry[:-1]}")

unittests/test_bulk_finding_authorization.py

@@ -8,6 +8,7 @@
 findings to a group.
 """
 
+from django.test import override_settings
 from django.urls import reverse
 
 from dojo.authorization.authorization import user_has_permission
@@ -265,3 +266,29 @@ def test_staff_can_still_delete_findings_through_the_merge_route(self):
         )
         self._merge_as(staff, "delete")
         self.assertFalse(Finding.objects.filter(id=self.target.id).exists())
+
+    def test_merge_delete_promotes_a_new_original_for_the_duplicate_cluster(self):
+        staff = Dojo_User.objects.create(
+            username="merge_delete_cluster_staff", is_active=True, is_staff=True,
+        )
+        duplicate = Finding.objects.exclude(test=self.test).first()
+        Finding.objects.filter(id=duplicate.id).update(duplicate=True, duplicate_finding=self.target)
+        self._merge_as(staff, "delete")
+        duplicate.refresh_from_db()
+        self.assertFalse(
+            duplicate.duplicate,
+            msg=f"duplicate of the deleted finding was not promoted, persisted duplicate_finding_id={duplicate.duplicate_finding_id}",
+        )
+
+    @override_settings(DUPLICATE_CLUSTER_CASCADE_DELETE=True)
+    def test_merge_delete_keeps_a_target_that_is_a_duplicate_of_a_deleted_finding(self):
+        staff = Dojo_User.objects.create(
+            username="merge_delete_cascade_staff", is_active=True, is_staff=True,
+        )
+        Finding.objects.filter(id=self.anchor.id).update(duplicate=True, duplicate_finding=self.target)
+        self._merge_as(staff, "delete")
+        self.assertFalse(Finding.objects.filter(id=self.target.id).exists())
+        self.assertTrue(
+            Finding.objects.filter(id=self.anchor.id, duplicate=False).exists(),
+            msg="the cascade delete removed the merge target, or left it marked as a duplicate",
+        )