Tenant deletion cascades completely

Incomplete tenant deletion leaves orphaned records that violate both contractual data-isolation guarantees and GDPR Art. 17 (Right to Erasure). CWE-404 (Improper Resource Shutdown or Release) covers the defect. Orphaned records create concrete risks: a future tenant who is assigned a recycled UUID can inadvertently access predecessor data; orphaned API keys remain valid credentials; and billing records for deleted tenants create accounting liabilities. The ISO 25010 functional suitability requirement is simple — delete means delete.

Use database cascade deletes as the primary mechanism and supplement with explicit cleanup for external systems. In schema.prisma, add onDelete: Cascade on every relation to Organization:

model Project {
  id             String       @id
  organizationId String
  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
}

For external data, implement a cleanup routine in src/app/api/orgs/[id]/route.ts:

async function deleteOrganization(orgId: string) {
  await db.organization.delete({ where: { id: orgId } }) // cascades handle DB relations
  await deleteS3Prefix(`tenants/${orgId}/`)
  await algolia.deleteBy({ filters: `organizationId:${orgId}` })
  await redis.del(`tenant:${orgId}:*`)
}

Wrap the DB delete and cleanup in a transaction or saga pattern so a failed external cleanup triggers a retry, not a partial deletion state.