Block delete for in-progress access review campaigns

Reject deletion while a campaign is fetching sources so workers are
not racing a removed record. All other statuses remain deletable.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>

pkg/accessreview/campaign_service.go

@@ -205,6 +205,10 @@ func (s *Service) DeleteCampaign(
 				return fmt.Errorf("cannot load campaign: %w", err)
 			}
 
+			if campaign.Status == coredata.AccessReviewCampaignStatusInProgress {
+				return NewCampaignNotDeletableError(campaign.ID)
+			}
+
 			if err := campaign.Delete(ctx, conn, scope); err != nil {
 				return fmt.Errorf("cannot delete campaign: %w", err)
 			}

pkg/accessreview/errors.go

@@ -30,6 +30,7 @@ import (
 var (
 	ErrCampaignMissingSources    = errors.New("access review campaign missing scope sources")
 	ErrCampaignNotDraft          = errors.New("access review campaign not draft")
+	ErrCampaignNotDeletable      = errors.New("access review campaign not deletable")
 	ErrCampaignNotPendingActions = errors.New("access review campaign not pending actions")
 	ErrCampaignCompleted         = errors.New("access review campaign completed")
 	ErrCampaignCancelled         = errors.New("access review campaign cancelled")
@@ -44,6 +45,10 @@ type (
 		CampaignID gid.GID
 	}
 
+	CampaignNotDeletableError struct {
+		CampaignID gid.GID
+	}
+
 	CampaignNotPendingActionsError struct {
 		CampaignID gid.GID
 	}
@@ -84,6 +89,21 @@ func (e *CampaignNotDraftError) Is(target error) bool {
 	return target == ErrCampaignNotDraft
 }
 
+func NewCampaignNotDeletableError(campaignID gid.GID) error {
+	return &CampaignNotDeletableError{CampaignID: campaignID}
+}
+
+func (e *CampaignNotDeletableError) Error() string {
+	return fmt.Sprintf(
+		"access review campaign %q cannot be deleted while it is in progress",
+		e.CampaignID,
+	)
+}
+
+func (e *CampaignNotDeletableError) Is(target error) bool {
+	return target == ErrCampaignNotDeletable
+}
+
 func NewCampaignNotPendingActionsError(campaignID gid.GID) error {
 	return &CampaignNotPendingActionsError{CampaignID: campaignID}
 }

pkg/accessreview/errors_test.go

@@ -57,6 +57,15 @@ func TestCampaignClientErrors(t *testing.T) {
 			wantText: fmt.Sprintf("access review campaign %q is not in draft", campaignID),
 			sentinel: accessreview.ErrCampaignNotDraft,
 		},
+		{
+			name: "not deletable",
+			err:  accessreview.NewCampaignNotDeletableError(campaignID),
+			wantText: fmt.Sprintf(
+				"access review campaign %q cannot be deleted while it is in progress",
+				campaignID,
+			),
+			sentinel: accessreview.ErrCampaignNotDeletable,
+		},
 		{
 			name: "not pending actions",
 			err:  accessreview.NewCampaignNotPendingActionsError(campaignID),