feat(oauth/oidc): move token exchange from beta to GA (#11475)

# Which Problems Are Solved

This PR marks the OAuth2 Token Exchange as general available (GA).

# How the Problems Are Solved

- API:
- deprecated the feature toggle (to prevent breaking changes) in v2beta
and v2 API
- removed all related event logic and updated the projection interation
  - removed the toggle usage for token exchange
  - removed related translations
- Management Console:
  - removed the feature toggle and its translations
- Docs:
  - removed all beta labels and feature toggle notes

# Additional Changes

- removed unused `Errors.WebKey.FeatureDisabled` translations

# Additional Context

- closes #11114

---------

Co-authored-by: Marco A. <[email protected]>

internal/api/grpc/feature/v2/converter.go

@@ -20,7 +20,6 @@ func systemFeaturesToCommand(req *feature_pb.SetSystemFeaturesRequest) (*command
 	return &command.SystemFeatures{
 		LoginDefaultOrg:                req.LoginDefaultOrg,
 		UserSchema:                     req.UserSchema,
-		TokenExchange:                  req.OidcTokenExchange,
 		ImprovedPerformance:            improvedPerformanceListToDomain(req.ImprovedPerformance),
 		OIDCSingleV1SessionTermination: req.OidcSingleV1SessionTermination,
 		EnableBackChannelLogout:        req.EnableBackChannelLogout,
@@ -32,10 +31,13 @@ func systemFeaturesToCommand(req *feature_pb.SetSystemFeaturesRequest) (*command
 
 func systemFeaturesToPb(f *query.SystemFeatures) *feature_pb.GetSystemFeaturesResponse {
 	return &feature_pb.GetSystemFeaturesResponse{
-		Details:                        object.DomainToDetailsPb(f.Details),
-		LoginDefaultOrg:                featureSourceToFlagPb(&f.LoginDefaultOrg),
-		UserSchema:                     featureSourceToFlagPb(&f.UserSchema),
-		OidcTokenExchange:              featureSourceToFlagPb(&f.TokenExchange),
+		Details:         object.DomainToDetailsPb(f.Details),
+		LoginDefaultOrg: featureSourceToFlagPb(&f.LoginDefaultOrg),
+		UserSchema:      featureSourceToFlagPb(&f.UserSchema),
+		OidcTokenExchange: &feature_pb.FeatureFlag{ // TODO: remove in next major version
+			Enabled: true,
+			Source:  feature_pb.Source_SOURCE_SYSTEM,
+		},
 		ImprovedPerformance:            featureSourceToImprovedPerformanceFlagPb(&f.ImprovedPerformance),
 		OidcSingleV1SessionTermination: featureSourceToFlagPb(&f.OIDCSingleV1SessionTermination),
 		EnableBackChannelLogout:        featureSourceToFlagPb(&f.EnableBackChannelLogout),
@@ -53,7 +55,6 @@ func instanceFeaturesToCommand(req *feature_pb.SetInstanceFeaturesRequest) (*com
 	return &command.InstanceFeatures{
 		LoginDefaultOrg:                req.LoginDefaultOrg,
 		UserSchema:                     req.UserSchema,
-		TokenExchange:                  req.OidcTokenExchange,
 		ImprovedPerformance:            improvedPerformanceListToDomain(req.ImprovedPerformance),
 		DebugOIDCParentError:           req.DebugOidcParentError,
 		OIDCSingleV1SessionTermination: req.OidcSingleV1SessionTermination,
@@ -67,10 +68,13 @@ func instanceFeaturesToCommand(req *feature_pb.SetInstanceFeaturesRequest) (*com
 
 func instanceFeaturesToPb(f *query.InstanceFeatures) *feature_pb.GetInstanceFeaturesResponse {
 	return &feature_pb.GetInstanceFeaturesResponse{
-		Details:                        object.DomainToDetailsPb(f.Details),
-		LoginDefaultOrg:                featureSourceToFlagPb(&f.LoginDefaultOrg),
-		UserSchema:                     featureSourceToFlagPb(&f.UserSchema),
-		OidcTokenExchange:              featureSourceToFlagPb(&f.TokenExchange),
+		Details:         object.DomainToDetailsPb(f.Details),
+		LoginDefaultOrg: featureSourceToFlagPb(&f.LoginDefaultOrg),
+		UserSchema:      featureSourceToFlagPb(&f.UserSchema),
+		OidcTokenExchange: &feature_pb.FeatureFlag{ // TODO: remove in next major version
+			Enabled: true,
+			Source:  feature_pb.Source_SOURCE_SYSTEM,
+		},
 		ImprovedPerformance:            featureSourceToImprovedPerformanceFlagPb(&f.ImprovedPerformance),
 		DebugOidcParentError:           featureSourceToFlagPb(&f.DebugOIDCParentError),
 		OidcSingleV1SessionTermination: featureSourceToFlagPb(&f.OIDCSingleV1SessionTermination),

internal/api/grpc/feature/v2/converter_test.go

@@ -23,7 +23,6 @@ func Test_systemFeaturesToCommand(t *testing.T) {
 	arg := &feature_pb.SetSystemFeaturesRequest{
 		LoginDefaultOrg:                gu.Ptr(true),
 		UserSchema:                     gu.Ptr(true),
-		OidcTokenExchange:              gu.Ptr(true),
 		ImprovedPerformance:            nil,
 		OidcSingleV1SessionTermination: gu.Ptr(true),
 		LoginV2: &feature_pb.LoginV2{
@@ -37,7 +36,6 @@ func Test_systemFeaturesToCommand(t *testing.T) {
 	want := &command.SystemFeatures{
 		LoginDefaultOrg:                gu.Ptr(true),
 		UserSchema:                     gu.Ptr(true),
-		TokenExchange:                  gu.Ptr(true),
 		ImprovedPerformance:            nil,
 		OIDCSingleV1SessionTermination: gu.Ptr(true),
 		LoginV2: &feature.LoginV2{
@@ -75,10 +73,6 @@ func Test_systemFeaturesToPb(t *testing.T) {
 			Level: feature.LevelSystem,
 			Value: true,
 		},
-		TokenExchange: query.FeatureSource[bool]{
-			Level: feature.LevelSystem,
-			Value: false,
-		},
 		ImprovedPerformance: query.FeatureSource[[]feature.ImprovedPerformanceType]{
 			Level: feature.LevelSystem,
 			Value: []feature.ImprovedPerformanceType{feature.ImprovedPerformanceTypeOrgDomainVerified},
@@ -122,7 +116,7 @@ func Test_systemFeaturesToPb(t *testing.T) {
 			Source:  feature_pb.Source_SOURCE_SYSTEM,
 		},
 		OidcTokenExchange: &feature_pb.FeatureFlag{
-			Enabled: false,
+			Enabled: true,
 			Source:  feature_pb.Source_SOURCE_SYSTEM,
 		},
 		ImprovedPerformance: &feature_pb.ImprovedPerformanceFeatureFlag{
@@ -165,7 +159,6 @@ func Test_instanceFeaturesToCommand(t *testing.T) {
 	arg := &feature_pb.SetInstanceFeaturesRequest{
 		LoginDefaultOrg:                gu.Ptr(true),
 		UserSchema:                     gu.Ptr(true),
-		OidcTokenExchange:              gu.Ptr(true),
 		ImprovedPerformance:            nil,
 		DebugOidcParentError:           gu.Ptr(true),
 		OidcSingleV1SessionTermination: gu.Ptr(true),
@@ -181,7 +174,6 @@ func Test_instanceFeaturesToCommand(t *testing.T) {
 	want := &command.InstanceFeatures{
 		LoginDefaultOrg:                gu.Ptr(true),
 		UserSchema:                     gu.Ptr(true),
-		TokenExchange:                  gu.Ptr(true),
 		ImprovedPerformance:            nil,
 		DebugOIDCParentError:           gu.Ptr(true),
 		OIDCSingleV1SessionTermination: gu.Ptr(true),
@@ -220,10 +212,6 @@ func Test_instanceFeaturesToPb(t *testing.T) {
 			Level: feature.LevelInstance,
 			Value: true,
 		},
-		TokenExchange: query.FeatureSource[bool]{
-			Level: feature.LevelSystem,
-			Value: false,
-		},
 		ImprovedPerformance: query.FeatureSource[[]feature.ImprovedPerformanceType]{
 			Level: feature.LevelSystem,
 			Value: []feature.ImprovedPerformanceType{feature.ImprovedPerformanceTypeOrgDomainVerified},
@@ -271,7 +259,7 @@ func Test_instanceFeaturesToPb(t *testing.T) {
 			Source:  feature_pb.Source_SOURCE_INSTANCE,
 		},
 		OidcTokenExchange: &feature_pb.FeatureFlag{
-			Enabled: false,
+			Enabled: true,
 			Source:  feature_pb.Source_SOURCE_SYSTEM,
 		},
 		ImprovedPerformance: &feature_pb.ImprovedPerformanceFeatureFlag{

internal/api/grpc/feature/v2beta/converter.go

@@ -12,7 +12,6 @@ func systemFeaturesToCommand(req *feature_pb.SetSystemFeaturesRequest) *command.
 	return &command.SystemFeatures{
 		LoginDefaultOrg:                req.LoginDefaultOrg,
 		UserSchema:                     req.UserSchema,
-		TokenExchange:                  req.OidcTokenExchange,
 		ImprovedPerformance:            improvedPerformanceListToDomain(req.ImprovedPerformance),
 		OIDCSingleV1SessionTermination: req.OidcSingleV1SessionTermination,
 	}
@@ -20,10 +19,13 @@ func systemFeaturesToCommand(req *feature_pb.SetSystemFeaturesRequest) *command.
 
 func systemFeaturesToPb(f *query.SystemFeatures) *feature_pb.GetSystemFeaturesResponse {
 	return &feature_pb.GetSystemFeaturesResponse{
-		Details:                        object.DomainToDetailsPb(f.Details),
-		LoginDefaultOrg:                featureSourceToFlagPb(&f.LoginDefaultOrg),
-		UserSchema:                     featureSourceToFlagPb(&f.UserSchema),
-		OidcTokenExchange:              featureSourceToFlagPb(&f.TokenExchange),
+		Details:         object.DomainToDetailsPb(f.Details),
+		LoginDefaultOrg: featureSourceToFlagPb(&f.LoginDefaultOrg),
+		UserSchema:      featureSourceToFlagPb(&f.UserSchema),
+		OidcTokenExchange: &feature_pb.FeatureFlag{ // TODO: remove in next major version
+			Enabled: true,
+			Source:  feature_pb.Source_SOURCE_SYSTEM,
+		},
 		ImprovedPerformance:            featureSourceToImprovedPerformanceFlagPb(&f.ImprovedPerformance),
 		OidcSingleV1SessionTermination: featureSourceToFlagPb(&f.OIDCSingleV1SessionTermination),
 	}
@@ -33,7 +35,6 @@ func instanceFeaturesToCommand(req *feature_pb.SetInstanceFeaturesRequest) *comm
 	return &command.InstanceFeatures{
 		LoginDefaultOrg:                req.LoginDefaultOrg,
 		UserSchema:                     req.UserSchema,
-		TokenExchange:                  req.OidcTokenExchange,
 		ImprovedPerformance:            improvedPerformanceListToDomain(req.ImprovedPerformance),
 		DebugOIDCParentError:           req.DebugOidcParentError,
 		OIDCSingleV1SessionTermination: req.OidcSingleV1SessionTermination,
@@ -42,10 +43,13 @@ func instanceFeaturesToCommand(req *feature_pb.SetInstanceFeaturesRequest) *comm
 
 func instanceFeaturesToPb(f *query.InstanceFeatures) *feature_pb.GetInstanceFeaturesResponse {
 	return &feature_pb.GetInstanceFeaturesResponse{
-		Details:                        object.DomainToDetailsPb(f.Details),
-		LoginDefaultOrg:                featureSourceToFlagPb(&f.LoginDefaultOrg),
-		UserSchema:                     featureSourceToFlagPb(&f.UserSchema),
-		OidcTokenExchange:              featureSourceToFlagPb(&f.TokenExchange),
+		Details:         object.DomainToDetailsPb(f.Details),
+		LoginDefaultOrg: featureSourceToFlagPb(&f.LoginDefaultOrg),
+		UserSchema:      featureSourceToFlagPb(&f.UserSchema),
+		OidcTokenExchange: &feature_pb.FeatureFlag{ // TODO: remove in next major version
+			Enabled: true,
+			Source:  feature_pb.Source_SOURCE_SYSTEM,
+		},
 		ImprovedPerformance:            featureSourceToImprovedPerformanceFlagPb(&f.ImprovedPerformance),
 		DebugOidcParentError:           featureSourceToFlagPb(&f.DebugOIDCParentError),
 		OidcSingleV1SessionTermination: featureSourceToFlagPb(&f.OIDCSingleV1SessionTermination),

internal/api/grpc/feature/v2beta/converter_test.go

@@ -20,14 +20,12 @@ func Test_systemFeaturesToCommand(t *testing.T) {
 	arg := &feature_pb.SetSystemFeaturesRequest{
 		LoginDefaultOrg:                gu.Ptr(true),
 		UserSchema:                     gu.Ptr(true),
-		OidcTokenExchange:              gu.Ptr(true),
 		ImprovedPerformance:            nil,
 		OidcSingleV1SessionTermination: gu.Ptr(true),
 	}
 	want := &command.SystemFeatures{
 		LoginDefaultOrg:                gu.Ptr(true),
 		UserSchema:                     gu.Ptr(true),
-		TokenExchange:                  gu.Ptr(true),
 		ImprovedPerformance:            nil,
 		OIDCSingleV1SessionTermination: gu.Ptr(true),
 	}
@@ -50,10 +48,6 @@ func Test_systemFeaturesToPb(t *testing.T) {
 			Level: feature.LevelSystem,
 			Value: true,
 		},
-		TokenExchange: query.FeatureSource[bool]{
-			Level: feature.LevelSystem,
-			Value: false,
-		},
 		ImprovedPerformance: query.FeatureSource[[]feature.ImprovedPerformanceType]{
 			Level: feature.LevelSystem,
 			Value: []feature.ImprovedPerformanceType{feature.ImprovedPerformanceTypeOrgDomainVerified},
@@ -78,7 +72,7 @@ func Test_systemFeaturesToPb(t *testing.T) {
 			Source:  feature_pb.Source_SOURCE_SYSTEM,
 		},
 		OidcTokenExchange: &feature_pb.FeatureFlag{
-			Enabled: false,
+			Enabled: true,
 			Source:  feature_pb.Source_SOURCE_SYSTEM,
 		},
 		ImprovedPerformance: &feature_pb.ImprovedPerformanceFeatureFlag{
@@ -98,14 +92,12 @@ func Test_instanceFeaturesToCommand(t *testing.T) {
 	arg := &feature_pb.SetInstanceFeaturesRequest{
 		LoginDefaultOrg:                gu.Ptr(true),
 		UserSchema:                     gu.Ptr(true),
-		OidcTokenExchange:              gu.Ptr(true),
 		ImprovedPerformance:            nil,
 		OidcSingleV1SessionTermination: gu.Ptr(true),
 	}
 	want := &command.InstanceFeatures{
 		LoginDefaultOrg:                gu.Ptr(true),
 		UserSchema:                     gu.Ptr(true),
-		TokenExchange:                  gu.Ptr(true),
 		ImprovedPerformance:            nil,
 		OIDCSingleV1SessionTermination: gu.Ptr(true),
 	}
@@ -128,10 +120,6 @@ func Test_instanceFeaturesToPb(t *testing.T) {
 			Level: feature.LevelInstance,
 			Value: true,
 		},
-		TokenExchange: query.FeatureSource[bool]{
-			Level: feature.LevelSystem,
-			Value: false,
-		},
 		ImprovedPerformance: query.FeatureSource[[]feature.ImprovedPerformanceType]{
 			Level: feature.LevelSystem,
 			Value: []feature.ImprovedPerformanceType{feature.ImprovedPerformanceTypeOrgDomainVerified},
@@ -156,7 +144,7 @@ func Test_instanceFeaturesToPb(t *testing.T) {
 			Source:  feature_pb.Source_SOURCE_INSTANCE,
 		},
 		OidcTokenExchange: &feature_pb.FeatureFlag{
-			Enabled: false,
+			Enabled: true,
 			Source:  feature_pb.Source_SOURCE_SYSTEM,
 		},
 		ImprovedPerformance: &feature_pb.ImprovedPerformanceFeatureFlag{

internal/api/oidc/integration_test/token_exchange_test.go

@@ -17,41 +17,12 @@ import (
 	"github.com/zitadel/oidc/v3/pkg/oidc"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
-	"google.golang.org/protobuf/proto"
 
 	oidc_api "github.com/zitadel/zitadel/internal/api/oidc"
 	"github.com/zitadel/zitadel/internal/integration"
 	"github.com/zitadel/zitadel/pkg/grpc/admin"
-	"github.com/zitadel/zitadel/pkg/grpc/feature/v2"
 )
 
-func setTokenExchangeFeature(t *testing.T, instance *integration.Instance, value bool) {
-	iamCTX := instance.WithAuthorization(CTX, integration.UserTypeIAMOwner)
-
-	_, err := instance.Client.FeatureV2.SetInstanceFeatures(iamCTX, &feature.SetInstanceFeaturesRequest{
-		OidcTokenExchange: proto.Bool(value),
-	})
-	require.NoError(t, err)
-	retryDuration := time.Minute
-	if ctxDeadline, ok := iamCTX.Deadline(); ok {
-		retryDuration = time.Until(ctxDeadline)
-	}
-	require.EventuallyWithT(t,
-		func(ttt *assert.CollectT) {
-			f, err := instance.Client.FeatureV2.GetInstanceFeatures(iamCTX, &feature.GetInstanceFeaturesRequest{
-				Inheritance: true,
-			})
-			assert.NoError(ttt, err)
-			if f.OidcTokenExchange.GetEnabled() {
-				return
-			}
-		},
-		retryDuration,
-		time.Second,
-		"timed out waiting for ensuring instance feature")
-	time.Sleep(time.Second)
-}
-
 func setImpersonationPolicy(t *testing.T, instance *integration.Instance, value bool) {
 	iamCTX := instance.WithAuthorization(CTX, integration.UserTypeIAMOwner)
 
@@ -150,11 +121,7 @@ func TestServer_TokenExchange(t *testing.T) {
 	_, orgImpersonatorPAT := createMachineUserPATWithMembership(ctx, t, instance, "ORG_ADMIN_IMPERSONATOR")
 	serviceUserID, noPermPAT := createMachineUserPATWithMembership(ctx, t, instance)
 
-	// test that feature is disabled per default
 	teResp, err := tokenexchange.ExchangeToken(ctx, exchanger, noPermPAT, oidc.AccessTokenType, "", "", nil, nil, nil, oidc.AccessTokenType)
-	require.Error(t, err)
-	setTokenExchangeFeature(t, instance, true)
-	teResp, err = tokenexchange.ExchangeToken(ctx, exchanger, noPermPAT, oidc.AccessTokenType, "", "", nil, nil, nil, oidc.AccessTokenType)
 	require.NoError(t, err)
 
 	patScopes := oidc.SpaceDelimitedArray{"openid", "profile", "urn:zitadel:iam:user:metadata", "urn:zitadel:iam:user:resourceowner"}
@@ -361,7 +328,6 @@ func TestServer_TokenExchangeImpersonation(t *testing.T) {
 	userResp := instance.CreateHumanUser(ctx)
 
 	// exchange some tokens for later use
-	setTokenExchangeFeature(t, instance, true)
 	setImpersonationPolicy(t, instance, true)
 
 	client, keyData, err := instance.CreateOIDCTokenExchangeClient(ctx, t)
@@ -593,7 +559,6 @@ func TestImpersonation_API_Call(t *testing.T) {
 	resourceServer, err := instance.CreateResourceServerJWTProfile(ctx, keyData)
 	require.NoError(t, err)
 
-	setTokenExchangeFeature(t, instance, true)
 	setImpersonationPolicy(t, instance, true)
 
 	iamUserID, iamImpersonatorPAT := createMachineUserPATWithMembership(ctx, t, instance, "IAM_ADMIN_IMPERSONATOR")

internal/api/oidc/token_exchange.go

@@ -41,9 +41,6 @@ func (s *Server) tokenExchange(ctx context.Context, r *op.ClientRequest[oidc.Tok
 	ctx, span := tracing.NewSpan(ctx)
 	defer func() { span.EndWithError(err) }()
 
-	if !authz.GetFeatures(ctx).TokenExchange {
-		return nil, zerrors.ThrowPreconditionFailed(nil, "OIDC-oan4I", "Errors.TokenExchange.FeatureDisabled")
-	}
 	if len(r.Data.Resource) > 0 {
 		return nil, oidc.ErrInvalidTarget().WithDescription("resource parameter not supported")
 	}

internal/command/instance.go

@@ -133,7 +133,6 @@ type InstanceSetup struct {
 type InstanceSetupFeatures struct {
 	LoginDefaultOrg                *bool
 	UserSchema                     *bool
-	TokenExchange                  *bool
 	ImprovedPerformance            []feature.ImprovedPerformanceType
 	DebugOIDCParentError           *bool
 	OIDCSingleV1SessionTermination *bool
@@ -167,7 +166,6 @@ func (f *InstanceSetupFeatures) ToInstanceFeatures() (_ *InstanceFeatures, err e
 	return &InstanceFeatures{
 		LoginDefaultOrg:                f.LoginDefaultOrg,
 		UserSchema:                     f.UserSchema,
-		TokenExchange:                  f.TokenExchange,
 		ImprovedPerformance:            f.ImprovedPerformance,
 		DebugOIDCParentError:           f.DebugOIDCParentError,
 		OIDCSingleV1SessionTermination: f.OIDCSingleV1SessionTermination,

internal/command/instance_features.go

@@ -15,7 +15,6 @@ import (
 type InstanceFeatures struct {
 	LoginDefaultOrg                *bool
 	UserSchema                     *bool
-	TokenExchange                  *bool
 	ImprovedPerformance            []feature.ImprovedPerformanceType
 	DebugOIDCParentError           *bool
 	OIDCSingleV1SessionTermination *bool
@@ -29,7 +28,6 @@ type InstanceFeatures struct {
 func (m *InstanceFeatures) isEmpty() bool {
 	return m == nil || (m.LoginDefaultOrg == nil &&
 		m.UserSchema == nil &&
-		m.TokenExchange == nil &&
 		// nil check to allow unset improvements
 		m.ImprovedPerformance == nil &&
 		m.DebugOIDCParentError == nil &&

internal/command/instance_features_model.go

@@ -68,7 +68,6 @@ func (m *InstanceFeaturesWriteModel) Query() *eventstore.SearchQueryBuilder {
 			feature_v2.InstanceResetEventType,
 			feature_v2.InstanceLoginDefaultOrgEventType,
 			feature_v2.InstanceUserSchemaEventType,
-			feature_v2.InstanceTokenExchangeEventType,
 			feature_v2.InstanceImprovedPerformanceEventType,
 			feature_v2.InstanceDebugOIDCParentErrorEventType,
 			feature_v2.InstanceOIDCSingleV1SessionTerminationEventType,
@@ -92,9 +91,6 @@ func reduceInstanceFeature(features *InstanceFeatures, key feature.Key, value an
 	case feature.KeyLoginDefaultOrg:
 		v := value.(bool)
 		features.LoginDefaultOrg = &v
-	case feature.KeyTokenExchange:
-		v := value.(bool)
-		features.TokenExchange = &v
 	case feature.KeyUserSchema:
 		v := value.(bool)
 		features.UserSchema = &v
@@ -128,7 +124,6 @@ func (wm *InstanceFeaturesWriteModel) setCommands(ctx context.Context, f *Instan
 	aggregate := feature_v2.NewAggregate(wm.AggregateID, wm.ResourceOwner)
 	cmds := make([]eventstore.Command, 0, len(feature.KeyValues())-1)
 	cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.LoginDefaultOrg, f.LoginDefaultOrg, feature_v2.InstanceLoginDefaultOrgEventType)
-	cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.TokenExchange, f.TokenExchange, feature_v2.InstanceTokenExchangeEventType)
 	cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.UserSchema, f.UserSchema, feature_v2.InstanceUserSchemaEventType)
 	cmds = appendFeatureSliceUpdate(ctx, cmds, aggregate, wm.ImprovedPerformance, f.ImprovedPerformance, feature_v2.InstanceImprovedPerformanceEventType)
 	cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.DebugOIDCParentError, f.DebugOIDCParentError, feature_v2.InstanceDebugOIDCParentErrorEventType)

internal/command/instance_features_model_test.go

@@ -38,15 +38,6 @@ func Test_reduceInstanceFeature(t *testing.T) {
 			},
 			expected: &InstanceFeatures{LoginDefaultOrg: gu.Ptr(true)},
 		},
-		{
-			name: "token exchange",
-			args: args{
-				features: &InstanceFeatures{},
-				key:      feature.KeyTokenExchange,
-				value:    true,
-			},
-			expected: &InstanceFeatures{TokenExchange: gu.Ptr(true)},
-		},
 		{
 			name: "user schema",
 			args: args{

internal/command/instance_features_test.go

@@ -335,13 +335,6 @@ func TestInstanceFeatures_isEmpty(t *testing.T) {
 			},
 			want: false,
 		},
-		{
-			name: "TokenExchange set",
-			features: &InstanceFeatures{
-				TokenExchange: gu.Ptr(true),
-			},
-			want: false,
-		},
 		{
 			name: "ImprovedPerformance set",
 			features: &InstanceFeatures{

internal/command/instance_test.go

@@ -1776,7 +1776,6 @@ func TestInstanceSetupFeatures_ToInstanceFeatures(t *testing.T) {
 	type fields struct {
 		LoginDefaultOrg                *bool
 		UserSchema                     *bool
-		TokenExchange                  *bool
 		ImprovedPerformance            []feature.ImprovedPerformanceType
 		DebugOIDCParentError           *bool
 		OIDCSingleV1SessionTermination *bool
@@ -1806,7 +1805,6 @@ func TestInstanceSetupFeatures_ToInstanceFeatures(t *testing.T) {
 			fields: fields{
 				LoginDefaultOrg:                gu.Ptr(true),
 				UserSchema:                     gu.Ptr(false),
-				TokenExchange:                  gu.Ptr(true),
 				ImprovedPerformance:            []feature.ImprovedPerformanceType{feature.ImprovedPerformanceTypeOrgDomainVerified},
 				DebugOIDCParentError:           gu.Ptr(true),
 				OIDCSingleV1SessionTermination: gu.Ptr(false),
@@ -1818,7 +1816,6 @@ func TestInstanceSetupFeatures_ToInstanceFeatures(t *testing.T) {
 			want: &InstanceFeatures{
 				LoginDefaultOrg:                gu.Ptr(true),
 				UserSchema:                     gu.Ptr(false),
-				TokenExchange:                  gu.Ptr(true),
 				ImprovedPerformance:            []feature.ImprovedPerformanceType{feature.ImprovedPerformanceTypeOrgDomainVerified},
 				DebugOIDCParentError:           gu.Ptr(true),
 				OIDCSingleV1SessionTermination: gu.Ptr(false),
@@ -1875,7 +1872,6 @@ func TestInstanceSetupFeatures_ToInstanceFeatures(t *testing.T) {
 			f := &InstanceSetupFeatures{
 				LoginDefaultOrg:                tc.fields.LoginDefaultOrg,
 				UserSchema:                     tc.fields.UserSchema,
-				TokenExchange:                  tc.fields.TokenExchange,
 				ImprovedPerformance:            tc.fields.ImprovedPerformance,
 				DebugOIDCParentError:           tc.fields.DebugOIDCParentError,
 				OIDCSingleV1SessionTermination: tc.fields.OIDCSingleV1SessionTermination,

internal/command/system_features.go

@@ -11,7 +11,6 @@ import (
 
 type SystemFeatures struct {
 	LoginDefaultOrg                *bool
-	TokenExchange                  *bool
 	UserSchema                     *bool
 	ImprovedPerformance            []feature.ImprovedPerformanceType
 	OIDCSingleV1SessionTermination *bool
@@ -24,7 +23,6 @@ type SystemFeatures struct {
 func (m *SystemFeatures) isEmpty() bool {
 	return m == nil || (m.LoginDefaultOrg == nil &&
 		m.UserSchema == nil &&
-		m.TokenExchange == nil &&
 		// nil check to allow unset improvements
 		m.ImprovedPerformance == nil &&
 		m.OIDCSingleV1SessionTermination == nil &&

internal/command/system_features_model.go

@@ -61,7 +61,6 @@ func (m *SystemFeaturesWriteModel) Query() *eventstore.SearchQueryBuilder {
 			feature_v2.SystemResetEventType,
 			feature_v2.SystemLoginDefaultOrgEventType,
 			feature_v2.SystemUserSchemaEventType,
-			feature_v2.SystemTokenExchangeEventType,
 			feature_v2.SystemImprovedPerformanceEventType,
 			feature_v2.SystemOIDCSingleV1SessionTerminationEventType,
 			feature_v2.SystemEnableBackChannelLogout,
@@ -86,9 +85,6 @@ func reduceSystemFeature(features *SystemFeatures, key feature.Key, value any) {
 	case feature.KeyUserSchema:
 		v := value.(bool)
 		features.UserSchema = &v
-	case feature.KeyTokenExchange:
-		v := value.(bool)
-		features.TokenExchange = &v
 	case feature.KeyImprovedPerformance:
 		features.ImprovedPerformance = value.([]feature.ImprovedPerformanceType)
 	case feature.KeyOIDCSingleV1SessionTermination:
@@ -113,7 +109,6 @@ func (wm *SystemFeaturesWriteModel) setCommands(ctx context.Context, f *SystemFe
 	cmds := make([]eventstore.Command, 0, len(feature.KeyValues())-1)
 	cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.LoginDefaultOrg, f.LoginDefaultOrg, feature_v2.SystemLoginDefaultOrgEventType)
 	cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.UserSchema, f.UserSchema, feature_v2.SystemUserSchemaEventType)
-	cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.TokenExchange, f.TokenExchange, feature_v2.SystemTokenExchangeEventType)
 	cmds = appendFeatureSliceUpdate(ctx, cmds, aggregate, wm.ImprovedPerformance, f.ImprovedPerformance, feature_v2.SystemImprovedPerformanceEventType)
 	cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.OIDCSingleV1SessionTermination, f.OIDCSingleV1SessionTermination, feature_v2.SystemOIDCSingleV1SessionTerminationEventType)
 	cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.EnableBackChannelLogout, f.EnableBackChannelLogout, feature_v2.SystemEnableBackChannelLogout)

internal/command/system_features_test.go

@@ -289,7 +289,6 @@ func TestSystemFeatures_isEmpty(t *testing.T) {
 		{name: "empty features", sysFeatures: &SystemFeatures{}, want: true},
 		{name: "LoginDefaultOrg set", sysFeatures: &SystemFeatures{LoginDefaultOrg: gu.Ptr(true)}, want: false},
 		{name: "UserSchema set", sysFeatures: &SystemFeatures{UserSchema: gu.Ptr(true)}, want: false},
-		{name: "TokenExchange set", sysFeatures: &SystemFeatures{TokenExchange: gu.Ptr(true)}, want: false},
 		{name: "ImprovedPerformance set", sysFeatures: &SystemFeatures{ImprovedPerformance: []feature.ImprovedPerformanceType{}}, want: false},
 		{name: "OIDCSingleV1SessionTermination set", sysFeatures: &SystemFeatures{OIDCSingleV1SessionTermination: gu.Ptr(true)}, want: false},
 		{name: "EnableBackChannelLogout set", sysFeatures: &SystemFeatures{EnableBackChannelLogout: gu.Ptr(true)}, want: false},

internal/feature/feature.go

@@ -9,12 +9,11 @@ import (
 type Key int
 
 const (
-	// Reserved: 2, 3, 6, 8, 11
+	// Reserved: 2, 3, 5, 6, 8, 11
 
 	KeyUnspecified                    Key = 0
 	KeyLoginDefaultOrg                Key = 1
 	KeyUserSchema                     Key = 4
-	KeyTokenExchange                  Key = 5
 	KeyImprovedPerformance            Key = 7
 	KeyDebugOIDCParentError           Key = 9
 	KeyOIDCSingleV1SessionTermination Key = 10
@@ -41,7 +40,6 @@ const (
 type Features struct {
 	LoginDefaultOrg                bool                      `json:"login_default_org,omitempty"`
 	UserSchema                     bool                      `json:"user_schema,omitempty"`
-	TokenExchange                  bool                      `json:"token_exchange,omitempty"`
 	ImprovedPerformance            []ImprovedPerformanceType `json:"improved_performance,omitempty"`
 	DebugOIDCParentError           bool                      `json:"debug_oidc_parent_error,omitempty"`
 	OIDCSingleV1SessionTermination bool                      `json:"oidc_single_v1_session_termination,omitempty"`

internal/feature/key_enumer.go

@@ -10,8 +10,8 @@ import (
 const (
 	_KeyName_0      = "unspecifiedlogin_default_org"
 	_KeyLowerName_0 = "unspecifiedlogin_default_org"
-	_KeyName_1      = "user_schematoken_exchange"
-	_KeyLowerName_1 = "user_schematoken_exchange"
+	_KeyName_1      = "user_schema"
+	_KeyLowerName_1 = "user_schema"
 	_KeyName_2      = "improved_performance"
 	_KeyLowerName_2 = "improved_performance"
 	_KeyName_3      = "debug_oidc_parent_erroroidc_single_v1_session_termination"
@@ -22,7 +22,7 @@ const (
 
 var (
 	_KeyIndex_0 = [...]uint8{0, 11, 28}
-	_KeyIndex_1 = [...]uint8{0, 11, 25}
+	_KeyIndex_1 = [...]uint8{0, 11}
 	_KeyIndex_2 = [...]uint8{0, 20}
 	_KeyIndex_3 = [...]uint8{0, 23, 57}
 	_KeyIndex_4 = [...]uint8{0, 26, 34, 53, 87, 111}
@@ -32,9 +32,8 @@ func (i Key) String() string {
 	switch {
 	case 0 <= i && i <= 1:
 		return _KeyName_0[_KeyIndex_0[i]:_KeyIndex_0[i+1]]
-	case 4 <= i && i <= 5:
-		i -= 4
-		return _KeyName_1[_KeyIndex_1[i]:_KeyIndex_1[i+1]]
+	case i == 4:
+		return _KeyName_1
 	case i == 7:
 		return _KeyName_2
 	case 9 <= i && i <= 10:
@@ -55,7 +54,6 @@ func _KeyNoOp() {
 	_ = x[KeyUnspecified-(0)]
 	_ = x[KeyLoginDefaultOrg-(1)]
 	_ = x[KeyUserSchema-(4)]
-	_ = x[KeyTokenExchange-(5)]
 	_ = x[KeyImprovedPerformance-(7)]
 	_ = x[KeyDebugOIDCParentError-(9)]
 	_ = x[KeyOIDCSingleV1SessionTermination-(10)]
@@ -66,7 +64,7 @@ func _KeyNoOp() {
 	_ = x[KeyEnableRelationalTables-(16)]
 }
 
-var _KeyValues = []Key{KeyUnspecified, KeyLoginDefaultOrg, KeyUserSchema, KeyTokenExchange, KeyImprovedPerformance, KeyDebugOIDCParentError, KeyOIDCSingleV1SessionTermination, KeyEnableBackChannelLogout, KeyLoginV2, KeyPermissionCheckV2, KeyManagementConsoleUseV2UserApi, KeyEnableRelationalTables}
+var _KeyValues = []Key{KeyUnspecified, KeyLoginDefaultOrg, KeyUserSchema, KeyImprovedPerformance, KeyDebugOIDCParentError, KeyOIDCSingleV1SessionTermination, KeyEnableBackChannelLogout, KeyLoginV2, KeyPermissionCheckV2, KeyManagementConsoleUseV2UserApi, KeyEnableRelationalTables}
 
 var _KeyNameToValueMap = map[string]Key{
 	_KeyName_0[0:11]:        KeyUnspecified,
@@ -75,8 +73,6 @@ var _KeyNameToValueMap = map[string]Key{
 	_KeyLowerName_0[11:28]:  KeyLoginDefaultOrg,
 	_KeyName_1[0:11]:        KeyUserSchema,
 	_KeyLowerName_1[0:11]:   KeyUserSchema,
-	_KeyName_1[11:25]:       KeyTokenExchange,
-	_KeyLowerName_1[11:25]:  KeyTokenExchange,
 	_KeyName_2[0:20]:        KeyImprovedPerformance,
 	_KeyLowerName_2[0:20]:   KeyImprovedPerformance,
 	_KeyName_3[0:23]:        KeyDebugOIDCParentError,
@@ -99,7 +95,6 @@ var _KeyNames = []string{
 	_KeyName_0[0:11],
 	_KeyName_0[11:28],
 	_KeyName_1[0:11],
-	_KeyName_1[11:25],
 	_KeyName_2[0:20],
 	_KeyName_3[0:23],
 	_KeyName_3[23:57],

internal/query/instance_by_domain.sql

@@ -6,14 +6,14 @@ with domain as (
 ), instance_features as (
 	select i.*
 	from domain d
-	join projections.instance_features3 i on d.instance_id = i.instance_id
+	join projections.instance_features4 i on d.instance_id = i.instance_id
 ), features as (
 	select instance_id, json_object_agg(
 		coalesce(i.key, s.key),
 		coalesce(i.value, s.value)
 	) features
 	from domain d
-	cross join projections.system_features2 s
+	cross join projections.system_features3 s
 	full outer join instance_features i using (instance_id, key)
 	group by instance_id
 ), external_domains as (

internal/query/instance_by_id.sql

@@ -4,8 +4,8 @@ with features as (
 		coalesce(i.value, s.value)
 	) features
 	from (select $1::text instance_id) x
-	cross join projections.system_features2 s
-	full outer join projections.instance_features3 i using (key, instance_id)
+	cross join projections.system_features3 s
+	full outer join projections.instance_features4 i using (key, instance_id)
 	group by instance_id
 ), external_domains as (
 	select instance_id, array_agg(domain) as domains

internal/query/instance_features.go

@@ -11,7 +11,6 @@ type InstanceFeatures struct {
 	Details                        *domain.ObjectDetails
 	LoginDefaultOrg                FeatureSource[bool]
 	UserSchema                     FeatureSource[bool]
-	TokenExchange                  FeatureSource[bool]
 	ImprovedPerformance            FeatureSource[[]feature.ImprovedPerformanceType]
 	DebugOIDCParentError           FeatureSource[bool]
 	OIDCSingleV1SessionTermination FeatureSource[bool]

internal/query/instance_features_model.go

@@ -64,7 +64,6 @@ func (m *InstanceFeaturesReadModel) Query() *eventstore.SearchQueryBuilder {
 			feature_v2.InstanceResetEventType,
 			feature_v2.InstanceLoginDefaultOrgEventType,
 			feature_v2.InstanceUserSchemaEventType,
-			feature_v2.InstanceTokenExchangeEventType,
 			feature_v2.InstanceImprovedPerformanceEventType,
 			feature_v2.InstanceDebugOIDCParentErrorEventType,
 			feature_v2.InstanceOIDCSingleV1SessionTerminationEventType,
@@ -92,7 +91,6 @@ func (m *InstanceFeaturesReadModel) populateFromSystem() bool {
 	}
 	m.instance.LoginDefaultOrg = m.system.LoginDefaultOrg
 	m.instance.UserSchema = m.system.UserSchema
-	m.instance.TokenExchange = m.system.TokenExchange
 	m.instance.ImprovedPerformance = m.system.ImprovedPerformance
 	m.instance.OIDCSingleV1SessionTermination = m.system.OIDCSingleV1SessionTermination
 	m.instance.EnableBackChannelLogout = m.system.EnableBackChannelLogout
@@ -112,8 +110,6 @@ func reduceInstanceFeatureSet[T any](features *InstanceFeatures, event *feature_
 		features.LoginDefaultOrg.set(level, event.Value)
 	case feature.KeyUserSchema:
 		features.UserSchema.set(level, event.Value)
-	case feature.KeyTokenExchange:
-		features.TokenExchange.set(level, event.Value)
 	case feature.KeyImprovedPerformance:
 		features.ImprovedPerformance.set(level, event.Value)
 	case feature.KeyDebugOIDCParentError:

internal/query/projection/instance_features.go

@@ -14,7 +14,7 @@ import (
 )
 
 const (
-	InstanceFeatureTable = "projections.instance_features3"
+	InstanceFeatureTable = "projections.instance_features4"
 
 	InstanceFeatureInstanceIDCol   = "instance_id"
 	InstanceFeatureKeyCol          = "key"
@@ -68,10 +68,6 @@ func (*instanceFeatureProjection) Reducers() []handler.AggregateReducer {
 				Event:  feature_v2.InstanceUserSchemaEventType,
 				Reduce: reduceInstanceSetFeature[bool],
 			},
-			{
-				Event:  feature_v2.InstanceTokenExchangeEventType,
-				Reduce: reduceInstanceSetFeature[bool],
-			},
 			{
 				Event:  feature_v2.InstanceImprovedPerformanceEventType,
 				Reduce: reduceInstanceSetFeature[[]feature.ImprovedPerformanceType],

internal/query/projection/instance_features_test.go

@@ -38,7 +38,7 @@ func TestInstanceFeaturesProjection_reduces(t *testing.T) {
 				executer: &testExecuter{
 					executions: []execution{
 						{
-							expectedStmt: "INSERT INTO projections.instance_features3 (instance_id, key, creation_date, change_date, sequence, value) VALUES ($1, $2, $3, $4, $5, $6) ON CONFLICT (instance_id, key) DO UPDATE SET (creation_date, change_date, sequence, value) = (projections.instance_features3.creation_date, EXCLUDED.change_date, EXCLUDED.sequence, EXCLUDED.value)",
+							expectedStmt: "INSERT INTO projections.instance_features4 (instance_id, key, creation_date, change_date, sequence, value) VALUES ($1, $2, $3, $4, $5, $6) ON CONFLICT (instance_id, key) DO UPDATE SET (creation_date, change_date, sequence, value) = (projections.instance_features4.creation_date, EXCLUDED.change_date, EXCLUDED.sequence, EXCLUDED.value)",
 							expectedArgs: []interface{}{
 								"agg-id",
 								"user_schema",
@@ -69,7 +69,7 @@ func TestInstanceFeaturesProjection_reduces(t *testing.T) {
 				executer: &testExecuter{
 					executions: []execution{
 						{
-							expectedStmt: "INSERT INTO projections.instance_features3 (instance_id, key, creation_date, change_date, sequence, value) VALUES ($1, $2, $3, $4, $5, $6) ON CONFLICT (instance_id, key) DO UPDATE SET (creation_date, change_date, sequence, value) = (projections.instance_features3.creation_date, EXCLUDED.change_date, EXCLUDED.sequence, EXCLUDED.value)",
+							expectedStmt: "INSERT INTO projections.instance_features4 (instance_id, key, creation_date, change_date, sequence, value) VALUES ($1, $2, $3, $4, $5, $6) ON CONFLICT (instance_id, key) DO UPDATE SET (creation_date, change_date, sequence, value) = (projections.instance_features4.creation_date, EXCLUDED.change_date, EXCLUDED.sequence, EXCLUDED.value)",
 							expectedArgs: []interface{}{
 								"instance-id",
 								"login_default_org",
@@ -100,7 +100,7 @@ func TestInstanceFeaturesProjection_reduces(t *testing.T) {
 				executer: &testExecuter{
 					executions: []execution{
 						{
-							expectedStmt: "DELETE FROM projections.instance_features3 WHERE (instance_id = $1)",
+							expectedStmt: "DELETE FROM projections.instance_features4 WHERE (instance_id = $1)",
 							expectedArgs: []interface{}{
 								"agg-id",
 							},
@@ -126,7 +126,7 @@ func TestInstanceFeaturesProjection_reduces(t *testing.T) {
 				executer: &testExecuter{
 					executions: []execution{
 						{
-							expectedStmt: "DELETE FROM projections.instance_features3 WHERE (instance_id = $1)",
+							expectedStmt: "DELETE FROM projections.instance_features4 WHERE (instance_id = $1)",
 							expectedArgs: []interface{}{
 								"agg-id",
 							},

internal/query/projection/system_features.go

@@ -12,7 +12,7 @@ import (
 )
 
 const (
-	SystemFeatureTable = "projections.system_features2"
+	SystemFeatureTable = "projections.system_features3"
 
 	SystemFeatureKeyCol          = "key"
 	SystemFeatureCreationDateCol = "creation_date"
@@ -60,10 +60,6 @@ func (*systemFeatureProjection) Reducers() []handler.AggregateReducer {
 				Event:  feature_v2.SystemUserSchemaEventType,
 				Reduce: reduceSystemSetFeature[bool],
 			},
-			{
-				Event:  feature_v2.SystemTokenExchangeEventType,
-				Reduce: reduceSystemSetFeature[bool],
-			},
 			{
 				Event:  feature_v2.SystemImprovedPerformanceEventType,
 				Reduce: reduceSystemSetFeature[[]feature.ImprovedPerformanceType],

internal/query/projection/system_features_test.go

@@ -36,7 +36,7 @@ func TestSystemFeaturesProjection_reduces(t *testing.T) {
 				executer: &testExecuter{
 					executions: []execution{
 						{
-							expectedStmt: "INSERT INTO projections.system_features2 (key, creation_date, change_date, sequence, value) VALUES ($1, $2, $3, $4, $5) ON CONFLICT (key) DO UPDATE SET (creation_date, change_date, sequence, value) = (projections.system_features2.creation_date, EXCLUDED.change_date, EXCLUDED.sequence, EXCLUDED.value)",
+							expectedStmt: "INSERT INTO projections.system_features3 (key, creation_date, change_date, sequence, value) VALUES ($1, $2, $3, $4, $5) ON CONFLICT (key) DO UPDATE SET (creation_date, change_date, sequence, value) = (projections.system_features3.creation_date, EXCLUDED.change_date, EXCLUDED.sequence, EXCLUDED.value)",
 							expectedArgs: []interface{}{
 								"user_schema",
 								anyArg{},
@@ -66,7 +66,7 @@ func TestSystemFeaturesProjection_reduces(t *testing.T) {
 				executer: &testExecuter{
 					executions: []execution{
 						{
-							expectedStmt: "DELETE FROM projections.system_features2 WHERE (key IS NOT NULL)",
+							expectedStmt: "DELETE FROM projections.system_features3 WHERE (key IS NOT NULL)",
 							expectedArgs: []interface{}{},
 						},
 					},

internal/query/system_features.go

@@ -22,7 +22,6 @@ type SystemFeatures struct {
 
 	LoginDefaultOrg                FeatureSource[bool]
 	UserSchema                     FeatureSource[bool]
-	TokenExchange                  FeatureSource[bool]
 	ImprovedPerformance            FeatureSource[[]feature.ImprovedPerformanceType]
 	OIDCSingleV1SessionTermination FeatureSource[bool]
 	EnableBackChannelLogout        FeatureSource[bool]

internal/query/system_features_model.go

@@ -57,7 +57,6 @@ func (m *SystemFeaturesReadModel) Query() *eventstore.SearchQueryBuilder {
 			feature_v2.SystemResetEventType,
 			feature_v2.SystemLoginDefaultOrgEventType,
 			feature_v2.SystemUserSchemaEventType,
-			feature_v2.SystemTokenExchangeEventType,
 			feature_v2.SystemImprovedPerformanceEventType,
 			feature_v2.SystemOIDCSingleV1SessionTerminationEventType,
 			feature_v2.SystemEnableBackChannelLogout,
@@ -85,8 +84,6 @@ func reduceSystemFeatureSet[T any](features *SystemFeatures, event *feature_v2.S
 		features.LoginDefaultOrg.set(level, event.Value)
 	case feature.KeyUserSchema:
 		features.UserSchema.set(level, event.Value)
-	case feature.KeyTokenExchange:
-		features.TokenExchange.set(level, event.Value)
 	case feature.KeyImprovedPerformance:
 		features.ImprovedPerformance.set(level, event.Value)
 	case feature.KeyOIDCSingleV1SessionTermination:

internal/repository/feature/feature_v2/eventstore.go

@@ -9,7 +9,6 @@ func init() {
 	eventstore.RegisterFilterEventMapper(AggregateType, SystemResetEventType, eventstore.GenericEventMapper[ResetEvent])
 	eventstore.RegisterFilterEventMapper(AggregateType, SystemLoginDefaultOrgEventType, eventstore.GenericEventMapper[SetEvent[bool]])
 	eventstore.RegisterFilterEventMapper(AggregateType, SystemUserSchemaEventType, eventstore.GenericEventMapper[SetEvent[bool]])
-	eventstore.RegisterFilterEventMapper(AggregateType, SystemTokenExchangeEventType, eventstore.GenericEventMapper[SetEvent[bool]])
 	eventstore.RegisterFilterEventMapper(AggregateType, SystemImprovedPerformanceEventType, eventstore.GenericEventMapper[SetEvent[[]feature.ImprovedPerformanceType]])
 	eventstore.RegisterFilterEventMapper(AggregateType, SystemOIDCSingleV1SessionTerminationEventType, eventstore.GenericEventMapper[SetEvent[bool]])
 	eventstore.RegisterFilterEventMapper(AggregateType, SystemEnableBackChannelLogout, eventstore.GenericEventMapper[SetEvent[bool]])
@@ -20,7 +19,6 @@ func init() {
 	eventstore.RegisterFilterEventMapper(AggregateType, InstanceResetEventType, eventstore.GenericEventMapper[ResetEvent])
 	eventstore.RegisterFilterEventMapper(AggregateType, InstanceLoginDefaultOrgEventType, eventstore.GenericEventMapper[SetEvent[bool]])
 	eventstore.RegisterFilterEventMapper(AggregateType, InstanceUserSchemaEventType, eventstore.GenericEventMapper[SetEvent[bool]])
-	eventstore.RegisterFilterEventMapper(AggregateType, InstanceTokenExchangeEventType, eventstore.GenericEventMapper[SetEvent[bool]])
 	eventstore.RegisterFilterEventMapper(AggregateType, InstanceImprovedPerformanceEventType, eventstore.GenericEventMapper[SetEvent[[]feature.ImprovedPerformanceType]])
 	eventstore.RegisterFilterEventMapper(AggregateType, InstanceDebugOIDCParentErrorEventType, eventstore.GenericEventMapper[SetEvent[bool]])
 	eventstore.RegisterFilterEventMapper(AggregateType, InstanceOIDCSingleV1SessionTerminationEventType, eventstore.GenericEventMapper[SetEvent[bool]])

internal/repository/feature/feature_v2/feature.go

@@ -14,7 +14,6 @@ var (
 	SystemResetEventType                          = resetEventTypeFromFeature(feature.LevelSystem)
 	SystemLoginDefaultOrgEventType                = setEventTypeFromFeature(feature.LevelSystem, feature.KeyLoginDefaultOrg)
 	SystemUserSchemaEventType                     = setEventTypeFromFeature(feature.LevelSystem, feature.KeyUserSchema)
-	SystemTokenExchangeEventType                  = setEventTypeFromFeature(feature.LevelSystem, feature.KeyTokenExchange)
 	SystemImprovedPerformanceEventType            = setEventTypeFromFeature(feature.LevelSystem, feature.KeyImprovedPerformance)
 	SystemOIDCSingleV1SessionTerminationEventType = setEventTypeFromFeature(feature.LevelSystem, feature.KeyOIDCSingleV1SessionTermination)
 	SystemEnableBackChannelLogout                 = setEventTypeFromFeature(feature.LevelSystem, feature.KeyEnableBackChannelLogout)
@@ -25,7 +24,6 @@ var (
 	InstanceResetEventType                          = resetEventTypeFromFeature(feature.LevelInstance)
 	InstanceLoginDefaultOrgEventType                = setEventTypeFromFeature(feature.LevelInstance, feature.KeyLoginDefaultOrg)
 	InstanceUserSchemaEventType                     = setEventTypeFromFeature(feature.LevelInstance, feature.KeyUserSchema)
-	InstanceTokenExchangeEventType                  = setEventTypeFromFeature(feature.LevelInstance, feature.KeyTokenExchange)
 	InstanceImprovedPerformanceEventType            = setEventTypeFromFeature(feature.LevelInstance, feature.KeyImprovedPerformance)
 	InstanceDebugOIDCParentErrorEventType           = setEventTypeFromFeature(feature.LevelInstance, feature.KeyDebugOIDCParentError)
 	InstanceOIDCSingleV1SessionTerminationEventType = setEventTypeFromFeature(feature.LevelInstance, feature.KeyOIDCSingleV1SessionTermination)

internal/static/i18n/ar.yaml

@@ -600,7 +600,6 @@ Errors:
     Data:
       Invalid: البيانات غير صالحة لمخطط المستخدم
   TokenExchange:
-    FeatureDisabled: ميزة تبادل الرموز معطلة للمثيل الخاص بك. https://zitadel.com/docs/apis/resources/feature_service_v2/feature-service-set-instance-features
     Token:
       Missing: الرمز مفقود
       Invalid: الرمز غير صالح
@@ -614,7 +613,6 @@ Errors:
     ActiveDelete: لا يمكن حذف مفتاح ويب نشط
     Config: تكوين مفتاح الويب غير صالح
     Duplicate: معرف مفتاح الويب ليس فريداً
-    FeatureDisabled: ميزة مفتاح الويب معطلة
     NoActive: لم يتم العثور على مفتاح ويب نشط
     NotFound: مفتاح الويب غير موجود
 

internal/static/i18n/bg.yaml

@@ -622,7 +622,6 @@ Errors:
     Data:
       Invalid: Невалидни данни за потребителска схема
   TokenExchange:
-    FeatureDisabled: Функцията Token Exchange е деактивирана за вашето копие. https://zitadel.com/docs/apis/resources/feature_service_v2/feature-service-set-instance-features
     Token:
       Missing: Токенът липсва
       Invalid: Токенът е невалиден
@@ -636,7 +635,6 @@ Errors:
     ActiveDelete: Не може да се изтрие активен уеб ключ
     Config: Невалидна конфигурация на уеб ключ
     Duplicate: ID на уеб ключ не е уникален
-    FeatureDisabled: Ключовата уеб функция е деактивирана
     NoActive: Не е намерен активен уеб ключ
     NotFound: Уеб ключът не е намерен
 

internal/static/i18n/cs.yaml

@@ -602,7 +602,6 @@ Errors:
     Data:
       Invalid: Data neplatná pro uživatelské schéma
   TokenExchange:
-    FeatureDisabled: Funkce Token Exchange je pro vaši instanci zakázána. https://zitadel.com/docs/apis/resources/feature_service_v2/feature-service-set-instance-features
     Token:
       Missing: Token chybí
       Invalid: Token je neplatný
@@ -616,7 +615,6 @@ Errors:
     ActiveDelete: Aktivní webový klíč nelze smazat
     Config: Neplatná konfigurace webového klíče
     Duplicate: ID webového klíče není jedinečné
-    FeatureDisabled: Funkce webového klíče je zakázána
     NoActive: Nebyl nalezen žádný aktivní webový klíč
     NotFound: Webový klíč nebyl nalezen
 

internal/static/i18n/de.yaml

@@ -604,7 +604,6 @@ Errors:
     Data:
       Invalid: Daten für Benutzerschema ungültig
   TokenExchange:
-    FeatureDisabled: Die Token-Austauschfunktion ist für Ihre Instanz deaktiviert. https://zitadel.com/docs/apis/resources/feature_service_v2/feature-service-set-instance-features
     Token:
       Missing: Token fehlt
       Invalid: Token ist ungültig
@@ -618,7 +617,6 @@ Errors:
     ActiveDelete: Aktiver Webschlüssel kann nicht gelöscht werden
     Config: Ungültige Webschlüsselkonfiguration
     Duplicate: Webschlüssel-ID nicht eindeutig
-    FeatureDisabled: Webschlüsselfunktion deaktiviert
     NoActive: Kein aktiver Webschlüssel gefunden
     NotFound: Webschlüssel nicht gefunden
 

internal/static/i18n/en.yaml

@@ -605,7 +605,6 @@ Errors:
     Data:
       Invalid: Data invalid for User Schema
   TokenExchange:
-    FeatureDisabled: Token Exchange feature is disabled for your instance. https://zitadel.com/docs/apis/resources/feature_service_v2/feature-service-set-instance-features
     Token:
       Missing: Token is missing
       Invalid: Token is invalid
@@ -619,7 +618,6 @@ Errors:
     ActiveDelete: Cannot delete active web key
     Config: Invalid web key config
     Duplicate: Web key ID not unique
-    FeatureDisabled: Web key feature disabled
     NoActive: No active web key found
     NotFound: Web key not found
 

internal/static/i18n/es.yaml

@@ -604,7 +604,6 @@ Errors:
     Data:
       Invalid: Datos no válidos para el esquema de usuario
   TokenExchange:
-    FeatureDisabled: La función de intercambio de tokens está deshabilitada para su instancia. https://zitadel.com/docs/apis/resources/feature_service_v2/feature-service-set-instance-features
     Token:
       Missing: Falta la ficha
       Invalid: El token no es válido
@@ -618,7 +617,6 @@ Errors:
     ActiveDelete: No se puede eliminar la clave web activa
     Config: Configuración de clave web no válida
     Duplicate: ID de clave web no único
-    FeatureDisabled: Función de clave web deshabilitada
     NoActive: No se encontró ninguna clave web activa
     NotFound: Clave web no encontrada
 

internal/static/i18n/fr.yaml

@@ -604,7 +604,6 @@ Errors:
     Data:
       Invalid: Données non valides pour le schéma utilisateur
   TokenExchange:
-    FeatureDisabled: La fonctionnalité Token Exchange est désactivée pour votre instance. https://zitadel.com/docs/apis/resources/feature_service_v2/feature-service-set-instance-features
     Token:
       Missing: Le jeton est manquant
       Invalid: Le jeton n'est pas valide
@@ -618,7 +617,6 @@ Errors:
     ActiveDelete: Impossible de supprimer la clé Web active
     Config: Configuration de clé Web non valide
     Duplicate: L'ID de clé Web n'est pas unique
-    FeatureDisabled: Fonctionnalité de clé Web désactivée
     NoActive: Aucune clé Web active trouvée
     NotFound: Clé Web introuvable
 

internal/static/i18n/hu.yaml

@@ -604,7 +604,6 @@ Errors:
     Data:
       Invalid: Érvénytelen adat a User Schema-hoz
   TokenExchange:
-    FeatureDisabled: A Token Exchange funkció le van tiltva az példányod esetében. https://zitadel.com/docs/apis/resources/feature_service_v2/feature-service-set-instance-features
     Token:
       Missing: A token hiányzik
       Invalid: A token érvénytelen
@@ -618,7 +617,6 @@ Errors:
     ActiveDelete: Az aktív webkulcs nem törölhető
     Config: Érvénytelen webkulcs konfiguráció
     Duplicate: A webkulcs azonosító nem egyedi
-    FeatureDisabled: A webkulcs funkció le van tiltva
     NoActive: Aktív web kulcs nem található
     NotFound: Web kulcs nem található
 

internal/static/i18n/id.yaml

@@ -599,7 +599,6 @@ Errors:
     NotInactive: Skema Pengguna tidak aktif
     NotExists: Skema Pengguna tidak ada
   TokenExchange:
-    FeatureDisabled: 'Fitur Token Exchange dinonaktifkan untuk instance Anda. '
     Token:
       Missing: Tokennya hilang
       Invalid: Token tidak valid
@@ -613,7 +612,6 @@ Errors:
     ActiveDelete: Tidak dapat menghapus kunci web yang aktif
     Config: Konfigurasi kunci web tidak valid
     Duplicate: ID kunci web tidak unik
-    FeatureDisabled: Fitur kunci web dinonaktifkan
     NoActive: Tidak ditemukan kunci web aktif
     NotFound: Kunci web tidak ditemukan
 

internal/static/i18n/it.yaml

@@ -604,7 +604,6 @@ Errors:
     Data:
       Invalid: Dati non validi per lo schema utente
   TokenExchange:
-    FeatureDisabled: La funzionalità di scambio token è disabilitata per la tua istanza. https://zitadel.com/docs/apis/resources/feature_service_v2/feature-service-set-instance-features
     Token:
       Missing: Manca il gettone
       Invalid: Il token non è valido
@@ -618,7 +617,6 @@ Errors:
     ActiveDelete: Impossibile eliminare la chiave Web attiva
     Config: Configurazione chiave Web non valida
     Duplicate: ID chiave Web non univoco
-    FeatureDisabled: Funzione chiave Web disabilitata
     NoActive: Nessuna chiave Web attiva trovata
     NotFound: Chiave Web non trovata
 

internal/static/i18n/ja.yaml

@@ -605,7 +605,6 @@ Errors:
     Data:
       Invalid: ユーザー スキーマのデータが無効です
   TokenExchange:
-    FeatureDisabled: インスタンスではトークン交換機能が無効になっています。 https://zitadel.com/docs/apis/resources/feature_service_v2/feature-service-set-instance-features
     Token:
       Missing: トークンがありません
       Invalid: トークンが無効です
@@ -619,7 +618,6 @@ Errors:
     ActiveDelete: アクティブな Web キーを削除できません
     Config: 無効な Web キー設定
     Duplicate: Web キー ID が一意ではありません
-    FeatureDisabled: Web キー機能が無効です
     NoActive: アクティブな Web キーが見つかりません
     NotFound: Web キーが見つかりません
 

internal/static/i18n/ko.yaml

@@ -605,7 +605,6 @@ Errors:
     Data:
       Invalid: 사용자 스키마에 대한 데이터가 유효하지 않습니다
   TokenExchange:
-    FeatureDisabled: 토큰 교환 기능이 인스턴스에서 비활성화되어 있습니다. https://zitadel.com/docs/apis/resources/feature_service_v2/feature-service-set-instance-features
     Token:
       Missing: 토큰이 누락되었습니다
       Invalid: 토큰이 유효하지 않습니다
@@ -619,7 +618,6 @@ Errors:
     ActiveDelete: 활성 웹 키를 삭제할 수 없습니다
     Config: 웹 키 설정이 유효하지 않습니다
     Duplicate: 웹 키 ID가 고유하지 않습니다
-    FeatureDisabled: 웹 키 기능이 비활성화되었습니다
     NoActive: 활성 웹 키가 없습니다
     NotFound: 웹 키를 찾을 수 없습니다
 

internal/static/i18n/mk.yaml

@@ -603,7 +603,6 @@ Errors:
     Data:
       Invalid: Податоците не се валидни за корисничка шема
   TokenExchange:
-    FeatureDisabled: Функцијата за размена на токени е оневозможена на вашиот пример. https://zitadel.com/docs/apis/resources/feature_service_v2/feature-service-set-instance-features
     Token:
       Missing: Недостасува токен
       Invalid: Токенот е неважечки
@@ -617,7 +616,6 @@ Errors:
     ActiveDelete: Не може да се избрише активниот веб-клуч
     Config: Неважечка конфигурација на веб-клуч
     Duplicate: ID на веб-клучот не е единствен
-    FeatureDisabled: Функцијата за веб-клуч е оневозможена
     NoActive: Не е пронајден активен веб-клуч
     NotFound: Веб-клучот не е пронајден
 

internal/static/i18n/nl.yaml

@@ -604,7 +604,6 @@ Errors:
     Data:
       Invalid: Податоците не се валидни за корисничка шема
   TokenExchange:
-    FeatureDisabled: De Token Exchange-functie is uitgeschakeld voor uw instantie. https://zitadel.com/docs/apis/resources/feature_service_v2/feature-service-set-instance-features
     Token:
       Missing: Token ontbreekt
       Invalid: Token is ongeldig
@@ -618,7 +617,6 @@ Errors:
     ActiveDelete: Kan actieve websleutel niet verwijderen
     Config: Ongeldige websleutelconfiguratie
     Duplicate: Websleutel-ID niet uniek
-    FeatureDisabled: Websleutelfunctie uitgeschakeld
     NoActive: Geen actieve websleutel gevonden
     NotFound: Websleutel niet gevonden
 

internal/static/i18n/pl.yaml

@@ -604,7 +604,6 @@ Errors:
     Data:
       Invalid: Nieprawidłowe dane dla schematu użytkownika
   TokenExchange:
-    FeatureDisabled: Funkcja wymiany tokenów jest wyłączona dla Twojej instancji. https://zitadel.com/docs/apis/resources/feature_service_v2/feature-service-set-instance-features
     Token:
       Missing: Brak tokena
       Invalid: Token jest nieprawidłowy
@@ -618,7 +617,6 @@ Errors:
     ActiveDelete: Nie można usunąć aktywnego klucza internetowego
     Config: Nieprawidłowa konfiguracja klucza internetowego
     Duplicate: Identyfikator klucza internetowego nie jest unikalny
-    FeatureDisabled: Funkcja klucza internetowego jest wyłączona
     NoActive: Nie znaleziono aktywnego klucza internetowego
     NotFound: Nie znaleziono klucza internetowego
 

internal/static/i18n/pt.yaml

@@ -603,7 +603,6 @@ Errors:
     Data:
       Invalid: Dados inválidos para o esquema do utilizador
   TokenExchange:
-    FeatureDisabled: O recurso Token Exchange está desabilitado para sua instância. https://zitadel.com/docs/apis/resources/feature_service_v2/feature-service-set-instance-features
     Token:
       Missing: O token está faltando
       Invalid: O token é inválido
@@ -617,7 +616,6 @@ Errors:
     ActiveDelete: Não é possível eliminar a chave web ativa
     Config: Configuração de chave web inválida
     Duplicate: ID da chave Web não exclusivo
-    FeatureDisabled: Recurso chave da Web desativado
     NoActive: Nenhuma chave web ativa encontrada
     NotFound: Chave Web não encontrada
 

internal/static/i18n/ro.yaml

@@ -600,7 +600,6 @@ Errors:
         Data:
           Invalid: Datele sunt invalide pentru schema de utilizator
       TokenExchange:
-        FeatureDisabled: Caracteristica Token Exchange este dezactivată pentru instanța dvs. https://zitadel.com/docs/apis/resources/feature_service_v2/feature-service-set-instance-features
         Token:
           Missing: Token-ul lipsește
           Invalid: Token-ul este invalid
@@ -614,7 +613,6 @@ Errors:
         ActiveDelete: Nu se poate șterge o cheie web activă
         Config: Configurație cheie web invalidă
         Duplicate: ID-ul cheii web nu este unic
-        FeatureDisabled: Caracteristica cheie web este dezactivată
         NoActive: Nu a fost găsită nicio cheie web activă
         NotFound: Cheia web nu a fost găsită
 

internal/static/i18n/ru.yaml

@@ -593,7 +593,6 @@ Errors:
     Data:
       Invalid: Данные недействительны для схемы пользователя
   TokenExchange:
-    FeatureDisabled: Функция обмена токенами отключена для вашего экземпляра. https://zitadel.com/docs/apis/resources/feature_service_v2/feature-service-set-instance-features
     Token:
       Missing: Токен отсутствует
       Invalid: Токен недействителен
@@ -607,7 +606,6 @@ Errors:
     ActiveDelete: Невозможно удалить активный веб-ключ
     Config: Неверная конфигурация веб-ключа
     Duplicate: Идентификатор веб-ключа не уникален
-    FeatureDisabled: Функция веб-ключа отключена
     NoActive: Активный веб-ключ не найден
     NotFound: Веб-ключ не найден
 

internal/static/i18n/sv.yaml

@@ -604,7 +604,6 @@ Errors:
     Data:
       Invalid: Data ogiltig för användarschema
   TokenExchange:
-    FeatureDisabled: Token Exchange-funktionen är inaktiverad för din instans. https://zitadel.com/docs/apis/resources/feature_service_v2/feature-service-set-instance-features
     Token:
       Missing: Token saknas
       Invalid: Token är ogiltig
@@ -618,7 +617,6 @@ Errors:
     ActiveDelete: Det går inte att ta bort aktiv webbnyckel
     Config: Ogiltig webbnyckelkonfiguration
     Duplicate: Webnyckel-ID är inte unikt
-    FeatureDisabled: Webnyckelfunktion inaktiverad
     NoActive: Ingen aktiv webbnyckel hittades
     NotFound: Webnyckel hittades inte
 

internal/static/i18n/tr.yaml

@@ -605,7 +605,6 @@ Errors:
     Data:
       Invalid: Kullanıcı Şeması için veri geçersiz
   TokenExchange:
-    FeatureDisabled: Token Exchange özelliği instance'ınız için devre dışı. https://zitadel.com/docs/apis/resources/feature_service_v2/feature-service-set-instance-features
     Token:
       Missing: Token eksik
       Invalid: Token geçersiz
@@ -619,7 +618,6 @@ Errors:
     ActiveDelete: Aktif web anahtarı silinemez
     Config: Geçersiz web anahtarı yapılandırması
     Duplicate: Web anahtarı ID benzersiz değil
-    FeatureDisabled: Web anahtarı özelliği devre dışı
     NoActive: Aktif web anahtarı bulunamadı
     NotFound: Web anahtarı bulunamadı
 

internal/static/i18n/uk.yaml

@@ -599,7 +599,6 @@ Errors:
     Data:
       Invalid: Дані недійсні для схеми користувача
   TokenExchange:
-    FeatureDisabled: Функція обміну токенів вимкнена для вашого інстансу. https://zitadel.com/docs/apis/resources/feature_service_v2/feature-service-set-instance-features
     Token:
       Missing: Токен відсутній
       Invalid: Токен недійсний
@@ -613,7 +612,6 @@ Errors:
     ActiveDelete: Неможливо видалити активний веб-ключ
     Config: Недійсна конфігурація веб-ключа
     Duplicate: Ідентифікатор веб-ключа не унікальний
-    FeatureDisabled: Функція веб-ключа вимкнена
     NoActive: Активний веб-ключ не знайдено
     NotFound: Веб-ключ не знайдено
 

internal/static/i18n/zh.yaml

@@ -605,7 +605,6 @@ Errors:
     Data:
       Invalid: 用户架构的数据无效
   TokenExchange:
-    FeatureDisabled: 您的实例已禁用令牌交换功能。 https://zitadel.com/docs/apis/resources/feature_service_v2/feature-service-set-instance-features
     Token:
       Missing: 令牌丢失
       Invalid: 令牌无效
@@ -619,7 +618,6 @@ Errors:
     ActiveDelete: 无法删除活动 Web 密钥
     Config: 无效的 Web 密钥配置
     Duplicate: Web 密钥 ID 不唯一
-    FeatureDisabled: Web 密钥功能已禁用
     NoActive: 未找到活动 Web 密钥
     NotFound: 未找到 Web 密钥