When the GraphQL failed (SQL permission issue), the file remains orphan on disk

[niolap]

Currently, the logic is the following (as described here https://github.com/graphile-contrib/postgraphile-plugin-upload-field/blob/master/README.md):

1. Upload file on disk
2. Insert/update row in the column table (SQL command)

The issue is that if the SQL command fails, the file stays on disk and is orphan.
As I manage my user permission via PostgreSQL RLS, if a user wants to insert 1000 files with no permission on the table, then I will have 1000 Oephan files on disk.

How could we prevent this?