fix(setup): member role synchronization execution check (#11180)

The change was introduced in
https://github.com/zitadel/zitadel/pull/11178.
The fix is to prevent wiping the memberships because the projection did
not init yet.

### Changes
- Introduces a check to determine if the member role synchronization
should be executed based on the existence of a specific database table
(`projections.instance_members4`).
- Ensures that the synchronization process only runs if the required
table is present in the database.

cmd/setup/67.go

@@ -2,6 +2,7 @@ package setup
 
 import (
 	"context"
+	"database/sql"
 	_ "embed"
 
 	"github.com/zitadel/zitadel/internal/database"
@@ -18,7 +19,17 @@ type SyncMemberRoleFields struct {
 }
 
 func (mig *SyncMemberRoleFields) Execute(ctx context.Context, _ eventstore.Event) error {
-	_, err := mig.dbClient.ExecContext(ctx, syncMemberRoleFields)
+	var exists bool
+	err := mig.dbClient.QueryRowContext(
+		ctx,
+		func(row *sql.Row) error {
+			return row.Scan(&exists)
+		},
+		"SELECT EXISTS(SELECT FROM pg_catalog.pg_tables WHERE schemaname = 'projections' and tablename = 'instance_members4')")
+	if err != nil || !exists {
+		return err
+	}
+	_, err = mig.dbClient.ExecContext(ctx, syncMemberRoleFields)
 	return err
 }
 

cmd/setup/setup.go

@@ -278,6 +278,7 @@ func Setup(ctx context.Context, config *Config, steps *Steps, masterKey string)
 		steps.s63AlterResourceCounts,
 		steps.s64ChangePushPosition,
 		steps.s65FixUserMetadata5Index,
+		steps.s67SyncMemberRoleFields,
 	} {
 		setupErr = executeMigration(ctx, eventstoreClient, step, "migration failed")
 		if setupErr != nil {
@@ -341,7 +342,6 @@ func Setup(ctx context.Context, config *Config, steps *Steps, masterKey string)
 		steps.s48Apps7SAMLConfigsLoginVersion,
 		steps.s59SetupWebkeys, // this step needs commands.
 		steps.s66SessionRecoveryCodeCheckedAt,
-		steps.s67SyncMemberRoleFields,
 	} {
 		setupErr = executeMigration(ctx, eventstoreClient, step, "migration failed")
 		if setupErr != nil {