fix(ddl): report tenant-teardown purge counts in the drop-user audit trail

DROP USER during tenant teardown purged the user's owned objects
outright but recorded the same "no owned objects required reassignment"
audit detail as a user with nothing owned, misreporting a destructive
purge as a no-op. purge_owned_for_tenant_teardown now returns the
purged count, and the audit detail distinguishes reassignment, no
ownership, and teardown purge outcomes.

Author: farhan-syah

nodedb/src/control/server/shared/ddl/neutral/user/drop.rs

@@ -19,6 +19,16 @@ use super::super::auth_support::{require_tenant_admin, status, strip_if_exists};
 use super::reassign_owned::reassign_owned_and_sweep_grants;
 use super::tenant_purge::purge_owned_for_tenant_teardown;
 
+/// How a dropped user's owned objects were disposed of, for the audit trail.
+enum OwnershipDisposition {
+    /// Objects were reassigned to the named tenant administrator.
+    Reassigned(String),
+    /// The user owned nothing that required reassignment.
+    NoneOwned,
+    /// Tenant teardown purged the given number of owned objects outright.
+    Purged(usize),
+}
+
 /// DROP USER [IF EXISTS] <name>
 pub fn drop_user(
     state: &SharedState,
@@ -106,11 +116,22 @@ fn drop_user_inner(
     // user, BEFORE removing the user row. Fail-closed: any error here
     // aborts the drop, because a partially-reassigned-then-deleted user
     // is exactly the dangling-reference bug this guards against.
-    let admin_name = if tenant_teardown {
-        purge_owned_for_tenant_teardown(state, username, user_tenant)?;
-        None
+    //
+    // During tenant teardown the owned objects are purged outright (the
+    // tenant is going away), so the audit trail must record the destructive
+    // purge — not misreport it as "nothing owned" the way the reassign path's
+    // `None` does.
+    let disposition = if tenant_teardown {
+        OwnershipDisposition::Purged(purge_owned_for_tenant_teardown(
+            state,
+            username,
+            user_tenant,
+        )?)
     } else {
-        reassign_owned_and_sweep_grants(state, username, user_tenant)?
+        match reassign_owned_and_sweep_grants(state, username, user_tenant)? {
+            Some(admin_name) => OwnershipDisposition::Reassigned(admin_name),
+            None => OwnershipDisposition::NoneOwned,
+        }
     };
 
     // `DropUser` fully removes the identity record on every node —
@@ -145,11 +166,18 @@ fn drop_user_inner(
     };
 
     if dropped {
-        let detail = match admin_name {
-            Some(admin_name) => {
+        let detail = match disposition {
+            OwnershipDisposition::Reassigned(admin_name) => {
                 format!("dropped user '{username}' (ownership reassigned to '{admin_name}')")
             }
-            None => format!("dropped user '{username}' (no owned objects required reassignment)"),
+            OwnershipDisposition::NoneOwned => {
+                format!("dropped user '{username}' (no owned objects required reassignment)")
+            }
+            OwnershipDisposition::Purged(purged) => {
+                format!(
+                    "dropped user '{username}' (tenant teardown purged {purged} owned object(s))"
+                )
+            }
         };
         state.audit_record(
             AuditEvent::PrivilegeChange,

nodedb/src/control/server/shared/ddl/neutral/user/tenant_purge.rs

@@ -11,16 +11,20 @@ use crate::types::TenantId;
 use super::super::super::result::DdlError;
 use super::reassign_owned::{OwnerKind, ddl_err, propose, sweep_grants};
 
+/// Purge every object owned by the tenant administrator during `DROP TENANT`,
+/// returning the number of owned objects deleted so the caller can record an
+/// accurate audit trail for the destructive teardown.
 pub(super) fn purge_owned_for_tenant_teardown(
     state: &SharedState,
     username: &str,
     tenant: TenantId,
-) -> Result<(), DdlError> {
+) -> Result<usize, DdlError> {
     let catalog = state.credentials.catalog();
     let mut owned = catalog
         .owners_for_user(username, tenant.as_u64())
         .map_err(|e| ddl_err(format!("load owner rows: {e}")))?;
     owned.sort_by_key(|owner| owner.object_type == object_type::COLLECTION);
+    let purged = owned.len();
 
     for owner in owned {
         let kind = OwnerKind::from_object_type(&owner.object_type).ok_or_else(|| {
@@ -48,7 +52,8 @@ pub(super) fn purge_owned_for_tenant_teardown(
                 );
         }
     }
-    sweep_grants(state, catalog, username)
+    sweep_grants(state, catalog, username)?;
+    Ok(purged)
 }
 
 fn purge_collection_rls_policies(