From 0161b211205b4e1854c0a61ac4fc2680516303c5 Mon Sep 17 00:00:00 2001
From: Bryan Frimin <bryan@probo.com>
Date: Thu, 28 May 2026 12:20:57 -0700
Subject: [PATCH] Best effort connector delete

Signed-off-by: Bryan Frimin <bryan@probo.com>
---
 pkg/accessreview/access_source_service.go | 22 +++++++++++++++++++---
 pkg/coredata/connector.go                 |  6 ++++++
 2 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/pkg/accessreview/access_source_service.go b/pkg/accessreview/access_source_service.go
index 6bfe48a52..b46d9650d 100644
--- a/pkg/accessreview/access_source_service.go
+++ b/pkg/accessreview/access_source_service.go
@@ -261,9 +261,25 @@ func (s AccessSourceService) Delete(
 				return nil
 			}
 
-			cnnctr := &coredata.Connector{ID: *source.ConnectorID}
-			if err := cnnctr.Delete(ctx, conn, s.scope); err != nil {
-				return fmt.Errorf("cannot delete connector: %w", err)
+			// Garbage-collecting the connector is best-effort. A
+			// concurrent transaction may insert a new access source or
+			// SCIM bridge referencing this connector between the counts
+			// above and the DELETE, producing a foreign-key violation.
+			// Run the delete inside a savepoint so such a failure rolls
+			// back only the GC attempt and still commits the access
+			// source deletion instead of aborting the whole transaction.
+			if err := conn.Savepoint(
+				ctx,
+				func(ctx context.Context, conn pg.Tx) error {
+					cnnctr := &coredata.Connector{ID: *source.ConnectorID}
+					if err := cnnctr.Delete(ctx, conn, s.scope); err != nil {
+						return fmt.Errorf("cannot delete connector: %w", err)
+					}
+
+					return nil
+				},
+			); err != nil {
+				return err
 			}
 
 			return nil
diff --git a/pkg/coredata/connector.go b/pkg/coredata/connector.go
index 4e89f5da7..403577f68 100644
--- a/pkg/coredata/connector.go
+++ b/pkg/coredata/connector.go
@@ -322,6 +322,12 @@ WHERE %s AND id = @id
 
 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
+		if pgErr, ok := errors.AsType[*pgconn.PgError](err); ok {
+			if pgErr.Code == "23503" {
+				return ErrResourceInUse
+			}
+		}
+
 		return fmt.Errorf("cannot delete connector: %w", err)
 	}