feat: add AdditionalGrantsRevoked annotation for revoke responses

[mstanbCO]

Summary

• Adds a new AdditionalGrantsRevoked annotation (proto/c1/connector/v2/annotation_additional_grants_revoked.proto) that a connector can attach to a GrantManagerServiceRevokeResponse.
• It carries a repeated list of revoked_grant_ids — additional grants the connector had to revoke in order to service a single Revoke request (e.g. flipping a "has access" flag before removing a principal's last role).
• ConductorOne can use this to mark those grants revoked without dispatching redundant Revoke RPCs.
• Includes generated pb code and Go helpers grant.NewAdditionalGrantsRevoked(...) / grant.AppendAdditionalGrantsRevoked(...), mirroring the existing GrantReplaced pattern.

Usage

annos := annotations.Annotations{}
annos.Append(grant.NewAdditionalGrantsRevoked(hasAccessGrant.GetId()))
return annos, nil

Test plan

• buf generate produces the pb files
• go build ./...
• go test ./pkg/types/grant/ passes (new helper tests included)

Made with Cursor

[github-actions]

General PR Review: feat: add AdditionalGrantsRevoked annotation for revoke responses

Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0
Review mode: full
View review run

Review Summary

This PR adds a new AdditionalGrantsRevoked protobuf annotation and corresponding Go helper functions (NewAdditionalGrantsRevoked, AppendAdditionalGrantsRevoked) for connectors to signal that extra grants were revoked as a side effect of a single Revoke RPC. The implementation cleanly mirrors the existing GrantReplaced pattern in structure, naming, and test coverage. No issues found.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

None.

[github-actions]

No blocking issues found.