feat: report side-effect principal deletion from revoke

[alan-lee-12]

What

Some downstream apps delete the user record when their last role is revoked. Today ConductorOne doesn't learn the account is gone until the next full sync (~1h), so an immediate role change (revoke old → request new) fails downstream because the account no longer exists.

This adds an optional provisioning.revoke.principal_deleted_check probe. After the revoke queries run (same transaction), the probe checks whether the principal still exists; if it's gone, the connector attaches a ResourceDeleted annotation to the revoke response so ConductorOne can mark the account deleted immediately.

Changes

• config (pkg/bsql/config.go, pkg/bsql/validate.go): PrincipalDeletedCheck { query } under provisioning.revoke, plus validation (non-empty query + var check)
• pkg/bsql/query.go: RunRevokeProvisioning + runPrincipalDeletedCheck — runs the probe on the same executor/tx after the revoke queries; no rows ⇒ principal deleted. Tolerates the all-zero-rows (already-revoked) case so retried revokes still report the deletion.
• pkg/bsql/provisioning.go: Revoke() attaches ResourceDeleted{principal.Id}, combined with GrantAlreadyRevoked on the already-revoked retry path.
• examples/mssql-revoke-deletes-user.yml: worked example (delete-user-on-last-role revoke + probe + re-provisioning)
• tests: pkg/bsql/provisioning_revoke_deleted_test.go (9 cases) + config round-trip in config_test.go

Dependency / merge order

Depends on the ResourceDeleted annotation in ConductorOne/baton-sdk#1010. This branch is intentionally source-only — go.mod / go.sum / vendor/ are not included, so it won't build standalone until the SDK PR is released and the dependency is bumped here (dropping the local replace directive used during development).

Test plan (built against the local SDK via replace)

• go build ./... && go test ./... -count=1 — pass
• gofmt clean; golangci-lint run ./pkg/bsql/... — clean aside from the dev-only replace directive

Refs FDE-296

🤖 Generated with Claude Code

[linear-code]

FDE-296

[github-actions]

Connector PR Review: feat: report side-effect principal deletion from revoke

Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base 88650be8ea0c.
Review mode: full
View review run: https://github.com/ConductorOne/baton-sql/actions/runs/29459482247

Review Summary

Scanned the full PR diff for security and correctness. The change adds an optional revoke_options.principal_deleted_check probe that runs on the same transaction after the revoke queries and attaches a ResourceDeleted annotation when the principal is gone. The config struct change (Revoke *RevokeEntitlementProvisioningQueries with inline-embedded EntitlementProvisioningQueries) is backward compatible and mirrors the existing GrantEntitlementProvisioningQueries pattern, so existing YAML and .Revoke.Queries / .NoTransaction access still work. Transaction and probe atomicity, the all-zero-rows (already-revoked) retry path, and the probe-error rollback path are all correct and covered by the 9 new test cases plus the config round-trip test. No new issues found.

The previously-noted merge-order dependency still stands and remains non-blocking only because this is a draft: pkg/bsql/provisioning.go uses sdkResource.NewResourceDeleted and v2.ResourceDeleted, neither of which exists in the pinned baton-sdk v0.18.2 (confirmed against vendor/); go.mod / go.sum / vendor/ are intentionally not bumped, so the branch will not compile until the SDK PR lands and the dependency is updated. Must not merge before that bump.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

None.

[github-actions]

No blocking issues found.

[github-actions]

No blocking issues found.