feat: allow managing invite code in secret generators (#12109)

# Which Problems Are Solved

Zitadel exposes the secrets generator configuration through its admin
api. This allows instance admins to manage them on their own and they
can create overwrite the system / runtime defaults (incl. expiration).
This very much needed in multi-instance scenarios such as zitadel.cloud.
Currently the invite code configuration was not manageable through the
API, but only runtime config.

# How the Problems Are Solved

- added the `invite_code` type to the API allowing it to be set and
retrieved.
- added the type to console's management list
- added the type to be stored on instance setup
- change the `GetSecretGenerator` endpoint to fall back to the runtime
config if no config is stored on the instance itself
- ensure the `length` and at least one charset is enabled, return an
error otherwise
- expiry is not enforced, so 0 allows codes with no expiry (current
state)

# Additional Changes

None

# Additional Context

- closes https://github.com/zitadel/zitadel/issues/10474

backend/v3/domain/settings.go

@@ -476,6 +476,7 @@ type SecretGeneratorSettingsAttributes struct {
 	DomainVerification       *DomainVerificationAttributes       `json:"domainVerification,omitempty"`
 	OTPSMS                   *OTPSMSAttributes                   `json:"otpSms,omitempty"`
 	OTPEmail                 *OTPEmailAttributes                 `json:"otpEmail,omitempty"`
+	InviteCode               *InviteCodeAttributes               `json:"inviteCode,omitempty"`
 }
 
 type ClientSecretAttributes struct {
@@ -514,6 +515,10 @@ type OTPEmailAttributes struct {
 	SecretGeneratorAttrsWithExpiry
 }
 
+type InviteCodeAttributes struct {
+	SecretGeneratorAttrsWithExpiry
+}
+
 type SecretGeneratorAttrs struct {
 	Length              *uint `json:"length,omitempty"`
 	IncludeLowerLetters *bool `json:"includeLowerLetters,omitempty"`

backend/v3/storage/database/events_testing/settings_instance_test.go

@@ -1477,6 +1477,14 @@ func TestServer_TestInstanceSecretGeneratorSettingsReduces(t *testing.T) {
 			assert.Equal(collect, false, *setting.OTPEmail.IncludeUpperLetters)
 			assert.Equal(collect, true, *setting.OTPEmail.IncludeDigits)
 			assert.Equal(collect, false, *setting.OTPEmail.IncludeSymbols)
+
+			// InviteCode
+			assert.Equal(collect, uint(6), *setting.InviteCode.Length)
+			assert.Equal(collect, 72*time.Hour, *setting.InviteCode.Expiry)
+			assert.Equal(collect, false, *setting.InviteCode.IncludeLowerLetters)
+			assert.Equal(collect, true, *setting.InviteCode.IncludeUpperLetters)
+			assert.Equal(collect, true, *setting.InviteCode.IncludeDigits)
+			assert.Equal(collect, false, *setting.InviteCode.IncludeSymbols)
 		}, retryDuration, tick)
 	})
 

backend/v3/storage/database/repository/settings.go

@@ -1456,6 +1456,9 @@ func (s secretGeneratorSettings) SetSettingFields(value domain.SecretGeneratorSe
 	if value.OTPEmail != nil {
 		changes = append(changes, s.SetOTPEmail(*value.OTPEmail))
 	}
+	if value.InviteCode != nil {
+		changes = append(changes, s.SetInviteCode(*value.InviteCode))
+	}
 	return db_json.NewJsonChanges(s.SettingsColumn(), changes...)
 }
 
@@ -1495,6 +1498,10 @@ func (s secretGeneratorSettings) SetOTPEmail(value domain.OTPEmailAttributes) db
 	return db_json.NewFieldChange([]string{"otpEmail"}, value)
 }
 
+func (s secretGeneratorSettings) SetInviteCode(value domain.InviteCodeAttributes) db_json.JsonUpdate {
+	return db_json.NewFieldChange([]string{"inviteCode"}, value)
+}
+
 func SecretGeneratorSettingsRepository() domain.SecretGeneratorSettingsRepository {
 	return &secretGeneratorSettings{
 		settings{},

backend/v3/storage/database/repository/settings_test.go

@@ -5134,6 +5134,9 @@ func createDefaultSecretGeneratorSettingsAttributes() domain.SecretGeneratorSett
 		OTPEmail: &domain.OTPEmailAttributes{
 			SecretGeneratorAttrsWithExpiry: createDefaultSecretGeneratorAttrsWithExpiry(thirtyMinutes),
 		},
+		InviteCode: &domain.InviteCodeAttributes{
+			SecretGeneratorAttrsWithExpiry: createDefaultSecretGeneratorAttrsWithExpiry(oneDay * 3),
+		},
 	}
 }
 
@@ -5146,3 +5149,32 @@ func createSecretGeneratorSettings(instanceID string, organizationID *string) *d
 		SecretGeneratorSettingsAttributes: createDefaultSecretGeneratorSettingsAttributes(),
 	}
 }
+
+func TestSecretGeneratorSettingsInviteCodeRoundTrip(t *testing.T) {
+	tx, rollback := transactionForRollback(t)
+	defer rollback()
+
+	instanceID := createInstance(t, tx)
+	repo := repository.SecretGeneratorSettingsRepository()
+
+	want := createSecretGeneratorSettings(instanceID, nil)
+	require.NotNil(t, want.InviteCode)
+
+	err := repo.Set(t.Context(), tx, want)
+	require.NoError(t, err)
+
+	got, err := repo.Get(t.Context(), tx, database.WithCondition(
+		repo.UniqueCondition(instanceID, nil, domain.SettingTypeSecretGenerator, domain.SettingStateActive),
+	))
+	require.NoError(t, err)
+	require.NotNil(t, got.InviteCode)
+	assert.EqualExportedValues(t, want.InviteCode, got.InviteCode)
+
+	list, err := repo.List(t.Context(), tx, database.WithCondition(
+		repo.InstanceIDCondition(instanceID),
+	))
+	require.NoError(t, err)
+	require.Len(t, list, 1)
+	require.NotNil(t, list[0].InviteCode)
+	assert.EqualExportedValues(t, want.InviteCode, list[0].InviteCode)
+}