fix(tenant): prevent ghost rows in SHOW TENANTS after DROP TENANT

SHOW TENANTS derives its row set from the union of catalog-registered
tenants and every active user's tenant_id. When DROP TENANT removed the
catalog row but left the auto-provisioned <name>_admin user in place, the
union query resurfaced the dropped tenant as a ghost row — same id, empty
name — making it appear the drop had failed or that a nameless tenant
still existed.

Add reconcile_tenant_users, called before the catalog row is removed:

  * The lifecycle-owned <name>_admin (auto-provisioned by CREATE TENANT)
    is hard-dropped through the canonical DROP USER path so ownership
    reassignment, session invalidation, and catalog removal all run.

  * Any other user in the tenant is operator-owned. The drop is refused
    with SQLSTATE 42501 and the remaining usernames are surfaced in the
    error, so no real account is ever silently hard-deleted by a tenant
    drop.

When no catalog is wired up there is no persisted StoredTenant to surface
as a ghost in the union, so reconcile_tenant_users returns early without
performing any work.

Author: farhan-syah

nodedb/src/control/server/pgwire/ddl/tenant/drop.rs

@@ -15,6 +15,7 @@ use crate::control::metadata_proposer::propose_catalog_entry;
 use crate::control::security::audit::AuditEvent;
 use crate::control::security::identity::AuthenticatedIdentity;
 use crate::control::state::SharedState;
+use crate::types::TenantId;
 
 use super::super::super::types::sqlstate_error;
 use super::super::parse_utils::strip_if_exists;
@@ -77,6 +78,21 @@ pub fn drop_tenant(
         ));
     }
 
+    // Reconcile the tenant's users before removing the tenant row.
+    //
+    // `SHOW TENANTS` derives its row set from the union of catalog
+    // tenants and every user's `tenant_id`, so any user left pointing
+    // at this tenant resurrects it as a ghost row (retained id, empty
+    // name) after the catalog row is gone. To keep `DROP TENANT`
+    // consistent with `DROP USER` (hard-delete, disappears from
+    // `SHOW`), the tenant's users must be reconciled here:
+    //
+    //   * the lifecycle-owned `<name>_admin` auto-provisioned by
+    //     `CREATE TENANT` is dropped as part of the tenant lifecycle;
+    //   * any other user is real and operator-owned — refuse the drop
+    //     (`42501`) and name them, so nobody is silently hard-deleted.
+    reconcile_tenant_users(state, identity, tenant_id)?;
+
     let entry = CatalogEntry::DeleteTenant { tenant_id: tid };
     let log_index = propose_catalog_entry(state, &entry)
         .map_err(|e| sqlstate_error("XX000", &format!("metadata propose: {e}")))?;
@@ -102,3 +118,83 @@ pub fn drop_tenant(
 
     Ok(vec![Response::Execution(Tag::new("DROP TENANT"))])
 }
+
+/// Reconcile the users that belong to `tenant_id` before its catalog
+/// row is removed, so the tenant cannot survive as a ghost in
+/// `SHOW TENANTS` (which unions catalog tenants with every user's
+/// `tenant_id`).
+///
+/// The lifecycle-owned `<name>_admin` auto-provisioned by
+/// `CREATE TENANT` is hard-dropped through the canonical `DROP USER`
+/// path. Any other user is operator-owned: the drop is refused with
+/// `42501` and the remaining users are named, so no real account is
+/// ever silently hard-deleted by a tenant drop.
+fn reconcile_tenant_users(
+    state: &SharedState,
+    identity: &AuthenticatedIdentity,
+    tenant_id: TenantId,
+) -> PgWireResult<()> {
+    // Tenant identity — its name, hence the `<name>_admin` of the
+    // lifecycle-owned admin — lives only in the catalog. Without a
+    // catalog there is no persisted `StoredTenant` to surface as a
+    // ghost in `SHOW TENANTS`' catalog union, and no name to
+    // reconstruct the admin from, so there is nothing to reconcile.
+    let Some(tenant_name) = state
+        .credentials
+        .catalog()
+        .as_ref()
+        .and_then(|cat| cat.load_all_tenants().ok())
+        .and_then(|all| {
+            all.into_iter()
+                .find(|t| t.tenant_id == tenant_id.as_u64())
+                .map(|t| t.name)
+        })
+    else {
+        return Ok(());
+    };
+    let admin_username = super::create::default_admin_username(&tenant_name);
+
+    // The same active-user set `SHOW TENANTS` unions over — reconciling
+    // exactly this set is what clears the ghost.
+    let members: Vec<String> = state
+        .credentials
+        .list_user_details()
+        .into_iter()
+        .filter(|u| u.tenant_id == tenant_id)
+        .map(|u| u.username)
+        .collect();
+
+    let mut lifecycle_admin = None;
+    let mut others = Vec::new();
+    for username in members {
+        if username == admin_username {
+            lifecycle_admin = Some(username);
+        } else {
+            others.push(username);
+        }
+    }
+
+    if !others.is_empty() {
+        others.sort();
+        return Err(sqlstate_error(
+            "42501",
+            &format!(
+                "cannot drop tenant: {} user(s) still belong to it; drop or \
+                 reassign them first: {}",
+                others.len(),
+                others.join(", ")
+            ),
+        ));
+    }
+
+    // Only the lifecycle-owned admin remains (if any): hard-delete it
+    // through the canonical `DROP USER` handler so ownership
+    // reassignment, session invalidation, and catalog + redb removal
+    // all run — the same guarantees `DROP USER` gives directly.
+    if let Some(admin) = lifecycle_admin {
+        let parts = ["DROP", "USER", admin.as_str()];
+        super::super::user::drop_user(state, identity, &parts)?;
+    }
+
+    Ok(())
+}