feat: allow managing invite code in secret generators (#12109)

# Which Problems Are Solved

Zitadel exposes the secrets generator configuration through its admin
api. This allows instance admins to manage them on their own and they
can create overwrite the system / runtime defaults (incl. expiration).
This very much needed in multi-instance scenarios such as zitadel.cloud.
Currently the invite code configuration was not manageable through the
API, but only runtime config.

# How the Problems Are Solved

- added the `invite_code` type to the API allowing it to be set and
retrieved.
- added the type to console's management list
- added the type to be stored on instance setup
- change the `GetSecretGenerator` endpoint to fall back to the runtime
config if no config is stored on the instance itself
- ensure the `length` and at least one charset is enabled, return an
error otherwise
- expiry is not enforced, so 0 allows codes with no expiry (current
state)

# Additional Changes

None

# Additional Context

- closes https://github.com/zitadel/zitadel/issues/10474

TERMINOLOGY.md

@@ -73,6 +73,7 @@ All user-facing wording in docs, UI, and API descriptions must follow this table
 | Password changed | Past-tense wording for password change notification | Password change | Password changed | replace | UI notifications |
 | Object descriptions | All resource descriptions must use end-user language | internal / technical wording | clear end-user language | replace | UI + Docs |
 | Complement Token | Flow type for actions executed during token creation. In UI use "Complement Token"; in API use `flowType = 2` (CustomiseToken). Docs must not show PreUserinfoCreation=3 for this type. | Compliment Token, CustomiseToken, CustomizeToken | Complement Token | replace | Everywhere |
+| Invite Code | One-time code used to invite a user to set up authentication (secret generator and user-invite flows) | Invitation Code, Invitation code | Invite Code | replace | UI + Docs |
 
 ## Governance
 

apps/docs/content/guides/manage/console/default-settings.mdx

@@ -387,6 +387,7 @@ The following secrets can be specified:
 - Application secrets
 - One Time Password (OTP) - SMS
 - One Time Password (OTP) - Email
+- Invite Code
 
 <img
   src="/docs/img/guides/console/secretappearance.png"

backend/v3/domain/settings.go

@@ -476,6 +476,7 @@ type SecretGeneratorSettingsAttributes struct {
 	DomainVerification       *DomainVerificationAttributes       `json:"domainVerification,omitempty"`
 	OTPSMS                   *OTPSMSAttributes                   `json:"otpSms,omitempty"`
 	OTPEmail                 *OTPEmailAttributes                 `json:"otpEmail,omitempty"`
+	InviteCode               *InviteCodeAttributes               `json:"inviteCode,omitempty"`
 }
 
 type ClientSecretAttributes struct {
@@ -514,6 +515,10 @@ type OTPEmailAttributes struct {
 	SecretGeneratorAttrsWithExpiry
 }
 
+type InviteCodeAttributes struct {
+	SecretGeneratorAttrsWithExpiry
+}
+
 type SecretGeneratorAttrs struct {
 	Length              *uint `json:"length,omitempty"`
 	IncludeLowerLetters *bool `json:"includeLowerLetters,omitempty"`

backend/v3/storage/database/events_testing/settings_instance_test.go

@@ -1477,6 +1477,14 @@ func TestServer_TestInstanceSecretGeneratorSettingsReduces(t *testing.T) {
 			assert.Equal(collect, false, *setting.OTPEmail.IncludeUpperLetters)
 			assert.Equal(collect, true, *setting.OTPEmail.IncludeDigits)
 			assert.Equal(collect, false, *setting.OTPEmail.IncludeSymbols)
+
+			// InviteCode
+			assert.Equal(collect, uint(6), *setting.InviteCode.Length)
+			assert.Equal(collect, 72*time.Hour, *setting.InviteCode.Expiry)
+			assert.Equal(collect, false, *setting.InviteCode.IncludeLowerLetters)
+			assert.Equal(collect, true, *setting.InviteCode.IncludeUpperLetters)
+			assert.Equal(collect, true, *setting.InviteCode.IncludeDigits)
+			assert.Equal(collect, false, *setting.InviteCode.IncludeSymbols)
 		}, retryDuration, tick)
 	})
 

backend/v3/storage/database/repository/settings.go

@@ -1456,6 +1456,9 @@ func (s secretGeneratorSettings) SetSettingFields(value domain.SecretGeneratorSe
 	if value.OTPEmail != nil {
 		changes = append(changes, s.SetOTPEmail(*value.OTPEmail))
 	}
+	if value.InviteCode != nil {
+		changes = append(changes, s.SetInviteCode(*value.InviteCode))
+	}
 	return db_json.NewJsonChanges(s.SettingsColumn(), changes...)
 }
 
@@ -1495,6 +1498,10 @@ func (s secretGeneratorSettings) SetOTPEmail(value domain.OTPEmailAttributes) db
 	return db_json.NewFieldChange([]string{"otpEmail"}, value)
 }
 
+func (s secretGeneratorSettings) SetInviteCode(value domain.InviteCodeAttributes) db_json.JsonUpdate {
+	return db_json.NewFieldChange([]string{"inviteCode"}, value)
+}
+
 func SecretGeneratorSettingsRepository() domain.SecretGeneratorSettingsRepository {
 	return &secretGeneratorSettings{
 		settings{},

backend/v3/storage/database/repository/settings_test.go

@@ -5134,6 +5134,9 @@ func createDefaultSecretGeneratorSettingsAttributes() domain.SecretGeneratorSett
 		OTPEmail: &domain.OTPEmailAttributes{
 			SecretGeneratorAttrsWithExpiry: createDefaultSecretGeneratorAttrsWithExpiry(thirtyMinutes),
 		},
+		InviteCode: &domain.InviteCodeAttributes{
+			SecretGeneratorAttrsWithExpiry: createDefaultSecretGeneratorAttrsWithExpiry(oneDay * 3),
+		},
 	}
 }
 
@@ -5146,3 +5149,32 @@ func createSecretGeneratorSettings(instanceID string, organizationID *string) *d
 		SecretGeneratorSettingsAttributes: createDefaultSecretGeneratorSettingsAttributes(),
 	}
 }
+
+func TestSecretGeneratorSettingsInviteCodeRoundTrip(t *testing.T) {
+	tx, rollback := transactionForRollback(t)
+	defer rollback()
+
+	instanceID := createInstance(t, tx)
+	repo := repository.SecretGeneratorSettingsRepository()
+
+	want := createSecretGeneratorSettings(instanceID, nil)
+	require.NotNil(t, want.InviteCode)
+
+	err := repo.Set(t.Context(), tx, want)
+	require.NoError(t, err)
+
+	got, err := repo.Get(t.Context(), tx, database.WithCondition(
+		repo.UniqueCondition(instanceID, nil, domain.SettingTypeSecretGenerator, domain.SettingStateActive),
+	))
+	require.NoError(t, err)
+	require.NotNil(t, got.InviteCode)
+	assert.EqualExportedValues(t, want.InviteCode, got.InviteCode)
+
+	list, err := repo.List(t.Context(), tx, database.WithCondition(
+		repo.InstanceIDCondition(instanceID),
+	))
+	require.NoError(t, err)
+	require.Len(t, list, 1)
+	require.NotNil(t, list[0].InviteCode)
+	assert.EqualExportedValues(t, want.InviteCode, list[0].InviteCode)
+}

cmd/defaults.yaml

@@ -1212,12 +1212,12 @@ DefaultInstance:
       IncludeDigits: true # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_OTPEMAIL_INCLUDEDIGITS
       IncludeSymbols: false # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_OTPEMAIL_INCLUDESYMBOLS
     InviteCode:
-      Length: 6 # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INITIALIZEUSERCODE_LENGTH
+      Length: 6 # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INVITECODE_LENGTH
-      Expiry: "72h" # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INITIALIZEUSERCODE_EXPIRY
+      Expiry: "72h" # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INVITECODE_EXPIRY
-      IncludeLowerLetters: false # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INITIALIZEUSERCODE_INCLUDELOWERLETTERS
+      IncludeLowerLetters: false # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INVITECODE_INCLUDELOWERLETTERS
-      IncludeUpperLetters: true # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INITIALIZEUSERCODE_INCLUDEUPPERLETTERS
+      IncludeUpperLetters: true # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INVITECODE_INCLUDEUPPERLETTERS
-      IncludeDigits: true # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INITIALIZEUSERCODE_INCLUDEDIGITS
+      IncludeDigits: true # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INVITECODE_INCLUDEDIGITS
-      IncludeSymbols: false # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INITIALIZEUSERCODE_INCLUDESYMBOLS
+      IncludeSymbols: false # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INVITECODE_INCLUDESYMBOLS
     SigningKey:
       Length: 36 # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_SIGNINGKEY_LENGTH
       IncludeLowerLetters: true # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_SIGNINGKEY_INCLUDELOWERLETTERS

cmd/mirror/projections.go

@@ -177,6 +177,7 @@ func projections(
 		0,
 		config.SystemAPIUsers,
 		false,
+		config.DefaultInstance.SecretGenerators.ToMap(),
 	)
 	logging.OnError(ctx, err).Fatal("unable to start queries")
 

cmd/setup/setup.go

@@ -535,6 +535,7 @@ func startCommandsQueries(
 		0,   // not needed for projections
 		nil, // not needed for projections
 		false,
+		config.DefaultInstance.SecretGenerators.ToMap(),
 	)
 	logging.OnError(ctx, err).Fatal("unable to start queries")
 

cmd/start/start.go

@@ -248,6 +248,7 @@ func startZitadel(ctx context.Context, config *Config, masterKey string, server
 		config.AuditLogRetention,
 		config.SystemAPIUsers,
 		true,
+		config.DefaultInstance.SecretGenerators.ToMap(),
 	)
 	if err != nil {
 		return fmt.Errorf("cannot start queries: %w", err)

console/src/app/modules/policies/secret-generator/secret-generator.component.ts

@@ -19,6 +19,7 @@ export class SecretGeneratorComponent {
     SecretGeneratorType.SECRET_GENERATOR_TYPE_APP_SECRET,
     SecretGeneratorType.SECRET_GENERATOR_TYPE_OTP_SMS,
     SecretGeneratorType.SECRET_GENERATOR_TYPE_OTP_EMAIL,
+    SecretGeneratorType.SECRET_GENERATOR_TYPE_INVITE_CODE,
   ];
 
   constructor() {}

console/src/assets/i18n/ar.json

@@ -1608,7 +1608,8 @@
         "5": "تهيئة بدون كلمة مرور",
         "6": "سر التطبيق",
         "7": "OTP - SMS",
-        "8": "OTP - بريد إلكتروني"
+        "8": "OTP - بريد إلكتروني",
+        "9": "رمز الدعوة"
       },
       "EXPIRY": "انتهاء الصلاحية (بالدقائق)",
       "INCLUDEDIGITS": "تضمين أرقام",

console/src/assets/i18n/bg.json

@@ -1615,7 +1615,8 @@
         "5": "Инициализация на ключ за достъп",
         "6": "Тайна на приложението",
         "7": "OTP - SMS",
-        "8": "OTP – имейл"
+        "8": "OTP – имейл",
+        "9": "Код за покана"
       },
       "EXPIRY": "Изтичане (в минути)",
       "INCLUDEDIGITS": "Включете числа",

console/src/assets/i18n/cs.json

@@ -1613,7 +1613,8 @@
         "5": "Inicializace Passkey",
         "6": "Tajemství pomocí aplikace",
         "7": "OTP - SMS",
-        "8": "OTP - E-mail"
+        "8": "OTP - E-mail",
+        "9": "Kód pozvánky"
       },
       "EXPIRY": "Expirace (v minutách)",
       "INCLUDEDIGITS": "Zahrnout čísla",

console/src/assets/i18n/de.json

@@ -1613,7 +1613,8 @@
         "5": "Passkey Initialisierungscode",
         "6": "Anwendungsgeheimnis",
         "7": "OTP - SMS",
-        "8": "OTP - Email"
+        "8": "OTP - Email",
+        "9": "Einladungscode"
       },
       "EXPIRY": "Ablauf (in Minuten)",
       "INCLUDEDIGITS": "Enthält Zahlen",

console/src/assets/i18n/en.json

@@ -1618,7 +1618,8 @@
         "5": "Passkey Initialization",
         "6": "Application Secret",
         "7": "OTP - SMS",
-        "8": "OTP - Email"
+        "8": "OTP - Email",
+        "9": "Invite Code"
       },
       "EXPIRY": "Expiration (in minutes)",
       "INCLUDEDIGITS": "Include Numbers",

console/src/assets/i18n/es.json

@@ -1614,7 +1614,8 @@
         "5": "Inicialización de llave de acceso",
         "6": "Secreto de aplicación",
         "7": "One Time Password (OTP) - SMS",
-        "8": "One Time Password (OTP) - email"
+        "8": "One Time Password (OTP) - email",
+        "9": "Código de invitación"
       },
       "EXPIRY": "Caducidad (en minutos)",
       "INCLUDEDIGITS": "Incluir números",

console/src/assets/i18n/fr.json

@@ -1613,7 +1613,8 @@
         "5": "Initialisation de clé d'accès",
         "6": "Secret de l'application",
         "7": "OTP - SMS",
-        "8": "OTP - e-mail"
+        "8": "OTP - e-mail",
+        "9": "Code d'invitation"
       },
       "EXPIRY": "Expiration (en minutes)",
       "INCLUDEDIGITS": "Inclure les chiffres",

console/src/assets/i18n/hu.json

@@ -1611,7 +1611,8 @@
         "5": "Passkey inicializálás",
         "6": "Alkalmazás titok",
         "7": "OTP - SMS",
-        "8": "OTP - Email"
+        "8": "OTP - Email",
+        "9": "Meghívókód"
       },
       "EXPIRY": "Lejárat (percben)",
       "INCLUDEDIGITS": "Számok bevonása",

console/src/assets/i18n/id.json

@@ -1613,7 +1613,8 @@
         "5": "Inisialisasi Passkey",
         "6": "Rahasia Aplikasi",
         "7": "OTP - SMS",
-        "8": "OTP - Email"
+        "8": "OTP - Email",
+        "9": "Kode Undangan"
       },
       "EXPIRY": "Kedaluwarsa (dalam menit)",
       "INCLUDEDIGITS": "Sertakan Angka",

console/src/assets/i18n/it.json

@@ -1613,7 +1613,8 @@
         "5": "Inizializzazione passkey",
         "6": "Segreto dell'applicazione",
         "7": "OTP - SMS",
-        "8": "OTP - Email"
+        "8": "OTP - Email",
+        "9": "Codice di invito"
       },
       "EXPIRY": "Scadenza (in minuti)",
       "INCLUDEDIGITS": "Contiene numeri",

console/src/assets/i18n/ja.json

@@ -1613,7 +1613,8 @@
         "5": "パスキーの初期設定",
         "6": "アプリケーションのシークレット",
         "7": "OTP - SMS",
-        "8": "OTP - 電子メール"
+        "8": "OTP - 電子メール",
+        "9": "招待コード"
       },
       "EXPIRY": "有効期限 (分単位)",
       "INCLUDEDIGITS": "数字を含める",

console/src/assets/i18n/ko.json

@@ -1613,7 +1613,8 @@
         "5": "패스키 초기화",
         "6": "애플리케이션 시크릿",
         "7": "OTP - SMS",
-        "8": "OTP - 이메일"
+        "8": "OTP - 이메일",
+        "9": "초대 코드"
       },
       "EXPIRY": "만료 시간 (분)",
       "INCLUDEDIGITS": "숫자 포함",

console/src/assets/i18n/mk.json

@@ -1614,7 +1614,8 @@
         "5": "Иницијализација на Passkey",
         "6": "Апликациска тајна",
         "7": "OTP - СМС",
-        "8": "OTP - е-пошта"
+        "8": "OTP - е-пошта",
+        "9": "Код за покана"
       },
       "EXPIRY": "Истекување (во минути)",
       "INCLUDEDIGITS": "Вклучи цифри",

console/src/assets/i18n/nl.json

@@ -1613,7 +1613,8 @@
         "5": "Passkey Initialisatie",
         "6": "Applicatie Secret",
         "7": "OTP - SMS",
-        "8": "OTP - Email"
+        "8": "OTP - Email",
+        "9": "Uitnodigingscode"
       },
       "EXPIRY": "Vervaldatum (in minuten)",
       "INCLUDEDIGITS": "Inclusief Nummers",

console/src/assets/i18n/pl.json

@@ -1612,7 +1612,8 @@
         "5": "Inicjalizacja passkey",
         "6": "Sekret aplikacji",
         "7": "OTP - SMS",
-        "8": "OTP — e-mail"
+        "8": "OTP — e-mail",
+        "9": "Kod zaproszenia"
       },
       "EXPIRY": "Wygaśnięcie (w minutach)",
       "INCLUDEDIGITS": "Dołącz cyfry",

console/src/assets/i18n/pt.json

@@ -1614,7 +1614,8 @@
         "5": "Inicialização passkey",
         "6": "Segredo do aplicativo",
         "7": "OTP - SMS",
-        "8": "OTP - e-mail"
+        "8": "OTP - e-mail",
+        "9": "Código de convite"
       },
       "EXPIRY": "Expiração (em minutos)",
       "INCLUDEDIGITS": "Incluir números",

console/src/assets/i18n/ro.json

@@ -1611,7 +1611,8 @@
         "5": "Inițializarea Passkey",
         "6": "Secretul aplicației",
         "7": "OTP - SMS",
-        "8": "OTP - E-mail"
+        "8": "OTP - E-mail",
+        "9": "Cod de invitație"
       },
       "EXPIRY": "Expirare (în minute)",
       "INCLUDEDIGITS": "Includeți numere",

console/src/assets/i18n/ru.json

@@ -1672,7 +1672,8 @@
         "5": "Инициализация ключа доступа",
         "6": "Ключ приложения",
         "7": "OTP — SMS",
-        "8": "OTP – электронная почта"
+        "8": "OTP – электронная почта",
+        "9": "Код приглашения"
       },
       "EXPIRY": "Срок действия (в минутах)",
       "INCLUDEDIGITS": "Содержит цифры",

console/src/assets/i18n/sv.json

@@ -1617,7 +1617,8 @@
         "5": "Passkey-initiering",
         "6": "Applikations-hemlighet",
         "7": "OTP - SMS",
-        "8": "OTP - E-post"
+        "8": "OTP - E-post",
+        "9": "Inbjudningskod"
       },
       "EXPIRY": "Utgång (på minuter)",
       "INCLUDEDIGITS": "Inkludera siffror",

console/src/assets/i18n/tr.json

@@ -1616,7 +1616,8 @@
         "5": "Passkey Başlatma",
         "6": "Uygulama Gizli Anahtarı",
         "7": "OTP - SMS",
-        "8": "OTP - E-posta"
+        "8": "OTP - E-posta",
+        "9": "Davet Kodu"
       },
       "EXPIRY": "Son kullanma (dakika cinsinden)",
       "INCLUDEDIGITS": "Sayıları Dahil Et",

console/src/assets/i18n/uk.json

@@ -1617,7 +1617,8 @@
         "5": "Ініціалізація ключа доступу",
         "6": "Секрет додатка",
         "7": "OTP - SMS",
-        "8": "OTP - Email"
+        "8": "OTP - Email",
+        "9": "Код запрошення"
       },
       "EXPIRY": "Термін дії (у хвилинах)",
       "INCLUDEDIGITS": "Включити цифри",

console/src/assets/i18n/zh.json

@@ -1616,7 +1616,8 @@
         "5": "Passkey 初始化",
         "6": "应用密钥",
         "7": "OTP - SMS",
-        "8": "OTP - 电子邮件"
+        "8": "OTP - 电子邮件",
+        "9": "邀请码"
       },
       "EXPIRY": "过期时间 (以分钟为单位)",
       "INCLUDEDIGITS": "包含数字",

internal/api/grpc/admin/iam_settings_converter.go

@@ -105,6 +105,8 @@ func SecretGeneratorTypeToPb(generatorType domain.SecretGeneratorType) settings_
 		return settings_pb.SecretGeneratorType_SECRET_GENERATOR_TYPE_OTP_SMS
 	case domain.SecretGeneratorTypeOTPEmail:
 		return settings_pb.SecretGeneratorType_SECRET_GENERATOR_TYPE_OTP_EMAIL
+	case domain.SecretGeneratorTypeInviteCode:
+		return settings_pb.SecretGeneratorType_SECRET_GENERATOR_TYPE_INVITE_CODE
 	default:
 		return settings_pb.SecretGeneratorType_SECRET_GENERATOR_TYPE_UNSPECIFIED
 	}
@@ -128,6 +130,8 @@ func SecretGeneratorTypeToDomain(generatorType settings_pb.SecretGeneratorType)
 		return domain.SecretGeneratorTypeOTPSMS
 	case settings_pb.SecretGeneratorType_SECRET_GENERATOR_TYPE_OTP_EMAIL:
 		return domain.SecretGeneratorTypeOTPEmail
+	case settings_pb.SecretGeneratorType_SECRET_GENERATOR_TYPE_INVITE_CODE:
+		return domain.SecretGeneratorTypeInviteCode
 	default:
 		return domain.SecretGeneratorTypeUnspecified
 	}

internal/command/instance.go

@@ -163,6 +163,22 @@ type SecretGenerators struct {
 	SigningKey               *crypto.GeneratorConfig
 }
 
+func (s *SecretGenerators) ToMap() map[domain.SecretGeneratorType]*crypto.GeneratorConfig {
+	return map[domain.SecretGeneratorType]*crypto.GeneratorConfig{
+		domain.SecretGeneratorTypeInitCode:             s.InitializeUserCode,
+		domain.SecretGeneratorTypeVerifyEmailCode:      s.EmailVerificationCode,
+		domain.SecretGeneratorTypeVerifyPhoneCode:      s.PhoneVerificationCode,
+		domain.SecretGeneratorTypeVerifyDomain:         s.DomainVerification,
+		domain.SecretGeneratorTypePasswordResetCode:    s.PasswordVerificationCode,
+		domain.SecretGeneratorTypePasswordlessInitCode: s.PasswordlessInitCode,
+		domain.SecretGeneratorTypeAppSecret:            s.ClientSecret,
+		domain.SecretGeneratorTypeOTPSMS:               s.OTPSMS,
+		domain.SecretGeneratorTypeOTPEmail:             s.OTPEmail,
+		domain.SecretGeneratorTypeInviteCode:           s.InviteCode,
+		domain.SecretGeneratorTypeSigningKey:           s.SigningKey,
+	}
+}
+
 type ZitadelConfig struct {
 	instanceID             string
 	orgID                  string
@@ -326,6 +342,7 @@ func setupInstanceElements(instanceAgg *instance.Aggregate, setup *InstanceSetup
 		prepareAddSecretGeneratorConfig(instanceAgg, domain.SecretGeneratorTypeVerifyDomain, setup.SecretGenerators.DomainVerification),
 		prepareAddSecretGeneratorConfig(instanceAgg, domain.SecretGeneratorTypeOTPSMS, setup.SecretGenerators.OTPSMS),
 		prepareAddSecretGeneratorConfig(instanceAgg, domain.SecretGeneratorTypeOTPEmail, setup.SecretGenerators.OTPEmail),
+		prepareAddSecretGeneratorConfig(instanceAgg, domain.SecretGeneratorTypeInviteCode, setup.SecretGenerators.InviteCode),
 
 		prepareAddDefaultPasswordComplexityPolicy(
 			instanceAgg,

internal/command/instance_settings.go

@@ -35,8 +35,8 @@ func prepareAddSecretGeneratorConfig(a *instance.Aggregate, typ domain.SecretGen
 		if !typ.Valid() {
 			return nil, zerrors.ThrowInvalidArgument(nil, "V2-FGqVj", "Errors.InvalidArgument")
 		}
-		if config.Length < 1 {
+		if err := config.Valid(); err != nil {
-			return nil, zerrors.ThrowInvalidArgument(nil, "V2-jEqCt", "Errors.InvalidArgument")
+			return nil, err
 		}
 		return func(ctx context.Context, filter preparation.FilterToQueryReducer) ([]eventstore.Command, error) {
 			writeModel := NewInstanceSecretGeneratorConfigWriteModel(ctx, typ)
@@ -71,9 +71,12 @@ func prepareAddSecretGeneratorConfig(a *instance.Aggregate, typ domain.SecretGen
 }
 
 func (c *Commands) ChangeSecretGeneratorConfig(ctx context.Context, generatorType domain.SecretGeneratorType, config *crypto.GeneratorConfig) (*domain.ObjectDetails, error) {
-	if generatorType == domain.SecretGeneratorTypeUnspecified {
+	if !generatorType.Valid() {
 		return nil, zerrors.ThrowInvalidArgument(nil, "COMMAND-33k9f", "Errors.SecretGenerator.TypeMissing")
 	}
+	if err := config.Valid(); err != nil {
+		return nil, err
+	}
 
 	generatorWriteModel, err := c.getSecretConfig(ctx, generatorType)
 	if err != nil {

internal/command/instance_settings_test.go

@@ -2,6 +2,7 @@ package command
 
 import (
 	"context"
+	"errors"
 	"testing"
 	"time"
 
@@ -218,6 +219,52 @@ func TestCommandSide_ChangeSecretGenerator(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "secret generator config invalid (length), invalid error",
+			fields: fields{
+				eventstore: expectEventstore(),
+			},
+			args: args{
+				ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
+				generator: &crypto.GeneratorConfig{
+					Length:              0,
+					Expiry:              2 * time.Hour,
+					IncludeLowerLetters: true,
+					IncludeUpperLetters: true,
+					IncludeDigits:       true,
+					IncludeSymbols:      true,
+				},
+				generatorType: domain.SecretGeneratorTypeInitCode,
+			},
+			res: res{
+				err: func(err error) bool {
+					return errors.Is(err, zerrors.ThrowInvalidArgument(nil, "CRYPTO-FVJ2x", "Errors.InvalidArgument"))
+				},
+			},
+		},
+		{
+			name: "secret generator config invalid (charset), invalid error",
+			fields: fields{
+				eventstore: expectEventstore(),
+			},
+			args: args{
+				ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
+				generator: &crypto.GeneratorConfig{
+					Length:              8,
+					Expiry:              2 * time.Hour,
+					IncludeLowerLetters: false,
+					IncludeUpperLetters: false,
+					IncludeDigits:       false,
+					IncludeSymbols:      false,
+				},
+				generatorType: domain.SecretGeneratorTypeInitCode,
+			},
+			res: res{
+				err: func(err error) bool {
+					return errors.Is(err, zerrors.ThrowInvalidArgument(nil, "CRYPTO-Ckl2s", "Errors.InvalidArgument"))
+				},
+			},
+		},
 		{
 			name: "generator removed, new added ok",
 			fields: fields{
@@ -332,15 +379,21 @@ func TestCommandSide_ChangeSecretGenerator(t *testing.T) {
 						),
 					),
 					expectPush(
-						newSecretGeneratorChangedEvent(context.Background(),
+						func() *instance.SecretGeneratorChangedEvent {
-							domain.SecretGeneratorTypeInitCode,
+							changes := []instance.SecretGeneratorChanges{
-							8,
+								instance.ChangeSecretGeneratorLength(8),
-							time.Hour*2,
+								instance.ChangeSecretGeneratorExpiry(2 * time.Hour),
-							false,
+								instance.ChangeSecretGeneratorIncludeUpperLetters(false),
-							false,
+								instance.ChangeSecretGeneratorIncludeDigits(false),
-							false,
+								instance.ChangeSecretGeneratorIncludeSymbols(false),
-							false,
+							}
-						),
+							event, _ := instance.NewSecretGeneratorChangeEvent(context.Background(),
+								&instance.NewAggregate("INSTANCE").Aggregate,
+								domain.SecretGeneratorTypeInitCode,
+								changes,
+							)
+							return event
+						}(),
 					),
 				),
 			},
@@ -349,7 +402,7 @@ func TestCommandSide_ChangeSecretGenerator(t *testing.T) {
 				generator: &crypto.GeneratorConfig{
 					Length:              8,
 					Expiry:              2 * time.Hour,
-					IncludeLowerLetters: false,
+					IncludeLowerLetters: true,
 					IncludeUpperLetters: false,
 					IncludeDigits:       false,
 					IncludeSymbols:      false,
@@ -523,20 +576,3 @@ func TestCommandSide_RemoveSecretGenerator(t *testing.T) {
 		})
 	}
 }
-
-func newSecretGeneratorChangedEvent(ctx context.Context, generatorType domain.SecretGeneratorType, length uint, expiry time.Duration, lowerCase, upperCase, digits, symbols bool) *instance.SecretGeneratorChangedEvent {
-	changes := []instance.SecretGeneratorChanges{
-		instance.ChangeSecretGeneratorLength(length),
-		instance.ChangeSecretGeneratorExpiry(expiry),
-		instance.ChangeSecretGeneratorIncludeLowerLetters(lowerCase),
-		instance.ChangeSecretGeneratorIncludeUpperLetters(upperCase),
-		instance.ChangeSecretGeneratorIncludeDigits(digits),
-		instance.ChangeSecretGeneratorIncludeSymbols(symbols),
-	}
-	event, _ := instance.NewSecretGeneratorChangeEvent(ctx,
-		&instance.NewAggregate("INSTANCE").Aggregate,
-		generatorType,
-		changes,
-	)
-	return event
-}

internal/command/instance_test.go

@@ -331,6 +331,7 @@ func instanceElementsFilters() []expect {
 		expectFilter(),
 		expectFilter(),
 		expectFilter(),
+		expectFilter(),
 	}
 }
 
@@ -348,6 +349,7 @@ func instanceElementsEvents(ctx context.Context, instanceID, instanceName string
 		instance.NewSecretGeneratorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecretGeneratorTypeVerifyDomain, 32, 0, true, true, true, false),
 		instance.NewSecretGeneratorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecretGeneratorTypeOTPSMS, 8, 5*time.Minute, false, false, true, false),
 		instance.NewSecretGeneratorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecretGeneratorTypeOTPEmail, 8, 5*time.Minute, false, false, true, false),
+		instance.NewSecretGeneratorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecretGeneratorTypeInviteCode, 6, 72*time.Hour, false, true, true, false),
 	}
 }
 
@@ -362,6 +364,7 @@ func instanceElementsConfig() *SecretGenerators {
 		DomainVerification:       &crypto.GeneratorConfig{Length: 32, IncludeLowerLetters: true, IncludeUpperLetters: true, IncludeDigits: true},
 		OTPSMS:                   &crypto.GeneratorConfig{Length: 8, Expiry: 5 * time.Minute, IncludeDigits: true},
 		OTPEmail:                 &crypto.GeneratorConfig{Length: 8, Expiry: 5 * time.Minute, IncludeDigits: true},
+		InviteCode:               &crypto.GeneratorConfig{Length: 6, Expiry: 72 * time.Hour, IncludeUpperLetters: true, IncludeDigits: true},
 	}
 }
 

internal/crypto/code.go

@@ -23,6 +23,16 @@ type GeneratorConfig struct {
 	IncludeSymbols      bool
 }
 
+func (c *GeneratorConfig) Valid() error {
+	if c.Length < 1 {
+		return zerrors.ThrowInvalidArgument(nil, "CRYPTO-FVJ2x", "Errors.InvalidArgument")
+	}
+	if !c.IncludeLowerLetters && !c.IncludeUpperLetters && !c.IncludeDigits && !c.IncludeSymbols {
+		return zerrors.ThrowInvalidArgument(nil, "CRYPTO-Ckl2s", "Errors.InvalidArgument")
+	}
+	return nil
+}
+
 //go:generate mockgen -source code.go -destination ./code_mock.go -package crypto
 
 type Generator interface {

internal/query/projection/settings_relational.go

@@ -1584,8 +1584,12 @@ func setSecretGeneratorSettingsAttrs(generatorType legacy_domain.SecretGenerator
 		secretGeneratorSettingsAttrs.OTPEmail = &domain.OTPEmailAttributes{
 			SecretGeneratorAttrsWithExpiry: attrsWithExpiry,
 		}
-	case legacy_domain.SecretGeneratorTypeInviteCode, legacy_domain.SecretGeneratorTypeSigningKey:
+	case legacy_domain.SecretGeneratorTypeInviteCode:
-		// do nothing as these secret generators are not persisted in the settings
+		secretGeneratorSettingsAttrs.InviteCode = &domain.InviteCodeAttributes{
+			SecretGeneratorAttrsWithExpiry: attrsWithExpiry,
+		}
+	case legacy_domain.SecretGeneratorTypeSigningKey:
+		// do nothing as this secret generator is not persisted in the settings
 	case legacy_domain.SecretGeneratorTypeUnspecified:
 		return domain.SecretGeneratorSettingsAttributes{}, zerrors.ThrowInvalidArgumentf(nil, "HANDL-2n3fK", "unspecified secret generator type")
 	default:

internal/query/query.go

@@ -45,6 +45,7 @@ type Queries struct {
 	zitadelRoles                        []authz.RoleMapping
 	multifactors                        domain.MultifactorConfigs
 	defaultAuditLogRetention            time.Duration
+	defaultSecretGenerators             map[domain.SecretGeneratorType]*crypto.GeneratorConfig
 }
 
 func StartQueries(
@@ -62,6 +63,7 @@ func StartQueries(
 	defaultAuditLogRetention time.Duration,
 	systemAPIUsers map[string]*authz.SystemAPIUser,
 	startProjections bool,
+	secretGeneratorDefaults map[domain.SecretGeneratorType]*crypto.GeneratorConfig,
 ) (repo *Queries, err error) {
 	repo = &Queries{
 		eventstore:                          es,
@@ -84,6 +86,7 @@ func StartQueries(
 			},
 		},
 		defaultAuditLogRetention: defaultAuditLogRetention,
+		defaultSecretGenerators:  secretGeneratorDefaults,
 	}
 
 	repo.checkPermission = permissionCheck(repo)

internal/query/secret_generator_test.go

@@ -9,6 +9,12 @@ import (
 	"testing"
 	"time"
 
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/zitadel/zitadel/internal/api/authz"
+	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/database"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/zerrors"
 )
@@ -70,6 +76,9 @@ var (
 		"include_symbols",
 		"count",
 	}
+	expectedSecretGeneratorByTypeQuery = regexp.QuoteMeta(prepareSecretGeneratorStmt +
+		` WHERE projections.secret_generators2.generator_type = $1 AND projections.secret_generators2.instance_id = $2`)
+	secretGeneratorByTypeInstanceID = "instanceID"
 )
 
 func Test_SecretGeneratorsPrepares(t *testing.T) {
@@ -314,3 +323,101 @@ func Test_SecretGeneratorsPrepares(t *testing.T) {
 		})
 	}
 }
+
+func TestQueries_SecretGeneratorByType(t *testing.T) {
+	ctx := authz.NewMockContext(secretGeneratorByTypeInstanceID, "orgID", "loginClient")
+	generatorType := domain.SecretGeneratorTypeInviteCode
+	queryArgs := []driver.Value{generatorType, secretGeneratorByTypeInstanceID}
+	inviteCodeDefault := &crypto.GeneratorConfig{
+		Length:              6,
+		Expiry:              72 * time.Hour,
+		IncludeUpperLetters: true,
+		IncludeDigits:       true,
+	}
+
+	tests := []struct {
+		name                    string
+		mock                    sqlExpectation
+		defaultSecretGenerators map[domain.SecretGeneratorType]*crypto.GeneratorConfig
+		want                    *SecretGenerator
+		wantErr                 error
+	}{
+		{
+			name: "found in DB",
+			mock: mockQuery(expectedSecretGeneratorByTypeQuery, prepareSecretGeneratorCols, []driver.Value{
+				"agg-id",
+				domain.SecretGeneratorTypeInviteCode,
+				testNow,
+				testNow,
+				"ro",
+				uint64(20211108),
+				6,
+				72 * time.Hour,
+				false,
+				true,
+				true,
+				false,
+			}, queryArgs...),
+			want: &SecretGenerator{
+				AggregateID:         "agg-id",
+				GeneratorType:       domain.SecretGeneratorTypeInviteCode,
+				CreationDate:        testNow,
+				ChangeDate:          testNow,
+				ResourceOwner:       "ro",
+				Sequence:            20211108,
+				Length:              6,
+				Expiry:              72 * time.Hour,
+				IncludeLowerLetters: false,
+				IncludeUpperLetters: true,
+				IncludeDigits:       true,
+				IncludeSymbols:      false,
+			},
+		},
+		{
+			name: "not found, default exists",
+			mock: mockQueryErr(expectedSecretGeneratorByTypeQuery, sql.ErrNoRows, queryArgs...),
+			defaultSecretGenerators: map[domain.SecretGeneratorType]*crypto.GeneratorConfig{
+				domain.SecretGeneratorTypeInviteCode: inviteCodeDefault,
+			},
+			want: &SecretGenerator{
+				AggregateID:         secretGeneratorByTypeInstanceID,
+				ResourceOwner:       secretGeneratorByTypeInstanceID,
+				GeneratorType:       domain.SecretGeneratorTypeInviteCode,
+				Length:              6,
+				Expiry:              72 * time.Hour,
+				IncludeUpperLetters: true,
+				IncludeDigits:       true,
+			},
+		},
+		{
+			name:                    "not found, no default",
+			mock:                    mockQueryErr(expectedSecretGeneratorByTypeQuery, sql.ErrNoRows, queryArgs...),
+			defaultSecretGenerators: map[domain.SecretGeneratorType]*crypto.GeneratorConfig{},
+			wantErr:                 sql.ErrNoRows,
+		},
+		{
+			name:    "DB internal error",
+			mock:    mockQueryErr(expectedSecretGeneratorByTypeQuery, sql.ErrConnDone, queryArgs...),
+			wantErr: sql.ErrConnDone,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			execMock(t, tt.mock, func(db *sql.DB) {
+				q := &Queries{
+					client: &database.DB{
+						DB: db,
+					},
+					defaultSecretGenerators: tt.defaultSecretGenerators,
+				}
+				got, err := q.SecretGeneratorByType(ctx, generatorType)
+				if tt.wantErr != nil {
+					require.ErrorIs(t, err, tt.wantErr)
+				} else {
+					require.NoError(t, err)
+				}
+				assert.Equal(t, tt.want, got)
+			})
+		})
+	}
+}

internal/query/secret_generators.go

@@ -139,8 +139,29 @@ func (q *Queries) SecretGeneratorByType(ctx context.Context, generatorType domai
 		generator, err = scan(row)
 		return err
 	}, query, args...)
-	logging.OnError(err).WithField("type", generatorType).WithField("instance_id", instanceID).Error("secret generator by type")
+	if err == nil {
-	return generator, err
+		return generator, nil
+	}
+	if !errors.Is(err, sql.ErrNoRows) {
+		logging.OnError(err).WithField("type", generatorType).WithField("instance_id", instanceID).Error("secret generator by type")
+		return nil, err
+	}
+	// if the config was not (yet) stored on the database, fall back to the system / runtime config
+	defaultConfig, ok := q.defaultSecretGenerators[generatorType]
+	if !ok {
+		return nil, err // return the initial not found error
+	}
+	return &SecretGenerator{
+		AggregateID:         instanceID,
+		ResourceOwner:       instanceID,
+		GeneratorType:       generatorType,
+		Length:              defaultConfig.Length,
+		Expiry:              defaultConfig.Expiry,
+		IncludeLowerLetters: defaultConfig.IncludeLowerLetters,
+		IncludeUpperLetters: defaultConfig.IncludeUpperLetters,
+		IncludeDigits:       defaultConfig.IncludeDigits,
+		IncludeSymbols:      defaultConfig.IncludeSymbols,
+	}, nil
 }
 
 func (q *Queries) SearchSecretGenerators(ctx context.Context, queries *SecretGeneratorSearchQueries) (secretGenerators *SecretGenerators, err error) {

proto/zitadel/settings.proto

@@ -56,6 +56,7 @@ enum SecretGeneratorType {
   SECRET_GENERATOR_TYPE_APP_SECRET = 6;
   SECRET_GENERATOR_TYPE_OTP_SMS = 7;
   SECRET_GENERATOR_TYPE_OTP_EMAIL = 8;
+  SECRET_GENERATOR_TYPE_INVITE_CODE = 9;
 }
 
 message SMTPConfig {