Add tailscale driver

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/accessreview/access_source_service.go

@@ -218,12 +218,55 @@ func (s AccessSourceService) Delete(
 	ctx context.Context,
 	accessSourceID gid.GID,
 ) error {
-	source := &coredata.AccessSource{ID: accessSourceID}
+	source := &coredata.AccessSource{}
 
 	return s.pg.WithTx(
 		ctx,
 		func(ctx context.Context, conn pg.Tx) error {
-			return source.Delete(ctx, conn, s.scope)
+			if err := source.LoadByID(ctx, conn, s.scope, accessSourceID); err != nil {
+				return fmt.Errorf("cannot load access source: %w", err)
+			}
+
+			if err := source.Delete(ctx, conn, s.scope); err != nil {
+				return fmt.Errorf("cannot delete access source: %w", err)
+			}
+
+			// Garbage-collect the underlying connector once nothing else
+			// references it. The connectors table is unique per
+			// (organization_id, provider), so leaving an orphaned connector
+			// behind would block re-adding a source for the same provider.
+			if source.ConnectorID == nil {
+				return nil
+			}
+
+			accessSources := &coredata.AccessSources{}
+
+			sourceCount, err := accessSources.CountByConnectorID(ctx, conn, s.scope, *source.ConnectorID)
+			if err != nil {
+				return fmt.Errorf("cannot count access sources for connector: %w", err)
+			}
+
+			if sourceCount > 0 {
+				return nil
+			}
+
+			bridges := &coredata.SCIMBridges{}
+
+			bridgeCount, err := bridges.CountByConnectorID(ctx, conn, s.scope, *source.ConnectorID)
+			if err != nil {
+				return fmt.Errorf("cannot count scim bridges for connector: %w", err)
+			}
+
+			if bridgeCount > 0 {
+				return nil
+			}
+
+			cnnctr := &coredata.Connector{ID: *source.ConnectorID}
+			if err := cnnctr.Delete(ctx, conn, s.scope); err != nil {
+				return fmt.Errorf("cannot delete connector: %w", err)
+			}
+
+			return nil
 		},
 	)
 }