Model.destroy with limit and composite primary key - deleting more rows than expected

Sequelize: 3.7.0 (worked on 2.x) DB: Postgresql 9.3

Syntax

GroupMember
    .destroy({
        where: { groupId: groupId, userId: memberId },
        limit: 1,
        force: true
    })
    .then(...);

Where GroupMember is a model NOT an instance.

Generated query

DELETE FROM 
    "GroupMembers" 
WHERE "groupId" IN 
    (
        SELECT 
            "groupId" 
        FROM 
            "GroupMembers" 
        WHERE "groupId" = 'a1522be6-cfe5-443d-83e0-01c95d477a81' 
              AND "userId" = '4e5622c0-705d-4a64-9f83-8c45eca0fe49' LIMIT 1
    )

This query ignores the “userId” where codition and deletes all with “groupId” instead of “groupId” AND “userId”.

Expected query

DELETE FROM 
    "GroupMembers" 
WHERE ctid IN (
      SELECT 
            ctid 
      FROM "GroupMembers"
      WHERE "groupId" = 'a1522be6-cfe5-443d-83e0-01c95d477a81' 
            AND "userId" = '4e5622c0-705d-4a64-9f83-8c45eca0fe49' 
      LIMIT 1
)

Postgres does not support LIMIT for DELETE statements, thus hidden ctid column and subselect are to be used to apply LIMIT.

More info

• Model definition:

    var GroupMember = sequelize.define('GroupMember', {
            groupId: {
                type: DataTypes.UUID,
                allowNull: false,
                comment: 'Group id',
                references: 'Groups',
                referencesKey: 'id'
            },
            userId: {
                type: DataTypes.UUID,
                allowNull: false,
                comment: 'User id',
                references: 'Users',
                referencesKey: 'id'
            }
        }
    );

• GroupMembers has a composite primary key - "GroupMembers_pkey" PRIMARY KEY, btree ("groupId", "userId")

[mickhansen]

GroupMember
    .destroy({
        where: { groupId: groupId, userId: memberId },
        limit: 1,
        force: true
    })

This will likely never work. But i assume you would expect calling destroy on an instance of GroupMember to work (which effectively does the same as the above code but should have more information)

[armellarcier]

@mickhansen could you elaborate on your comment ?

This will likely never work.

This may lead to corruption and I can’t see the problem with the usage that the reporter @tiblu made of the API…