chore: rename IAM to instance (#11351)

# Which Problems Are Solved

In many cases IAM was used where instance was meant. 

# How the Problems Are Solved

- Rename wrong usage of IAM to instance all over the code base.
- Add an agents.md which explains the terms used in Zitadel's
architecture.

# Additional Context

- closes #11280

---------

Co-authored-by: Copilot <[email protected]>
Co-authored-by: muhlemmer <[email protected]>
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Marco A. <[email protected]>

internal/api/grpc/instance/v2/integration_test/query_test.go

@@ -105,7 +105,7 @@ func TestGetInstance(t *testing.T) {
 				inputContext:      ctxWithSysAuthZ,
 				inputInstanceID:   "invalid",
 				expectedErrorCode: codes.NotFound,
-				expectedErrorMsg:  "Errors.IAM.NotFound (QUERY-n0wng)",
+				expectedErrorMsg:  "Errors.Instance.NotFound (QUERY-n0wng)",
 			},
 		}
 

internal/api/grpc/management/integration_test/org_test.go

@@ -168,7 +168,7 @@ func TestServer_AddOrgMember(t *testing.T) {
 			wantErr: true,
 		},
 		{
-			name: "iam role error",
+			name: "instance role error",
 			args: args{
 				ctx: OrgCTX,
 				req: &mgmt_pb.AddOrgMemberRequest{
@@ -249,7 +249,7 @@ func TestServer_UpdateOrgMember(t *testing.T) {
 			wantErr: true,
 		},
 		{
-			name: "iam role error",
+			name: "instance role error",
 			args: args{
 				ctx: OrgCTX,
 				req: &mgmt_pb.UpdateOrgMemberRequest{

internal/api/http/middleware/instance_interceptor.go

@@ -89,7 +89,7 @@ func setInstance(ctx context.Context, verifier authz.InstanceVerifier) (_ contex
 
 	requestContext := zitadel_http.DomainContext(ctx)
 	if requestContext.InstanceDomain() == "" {
-		return nil, zerrors.ThrowNotFound(err, "INST-zWq7X", "Errors.IAM.NotFound")
+		return nil, zerrors.ThrowNotFound(err, "INST-zWq7X", "Errors.Instance.NotFound")
 	}
 	instance, err := verifier.InstanceByHost(authCtx, requestContext.InstanceDomain(), requestContext.RequestedDomain())
 	if err != nil {

internal/api/oidc/integration_test/token_exchange_test.go

@@ -399,7 +399,7 @@ func TestServer_TokenExchangeImpersonation(t *testing.T) {
 			wantErr: true,
 		},
 		{
-			name: "IAM IMPERSONATION: subject: userID, actor: access token, success",
+			name: "Instance IMPERSONATION: subject: userID, actor: access token, success",
 			args: args{
 				SubjectToken:       userResp.GetUserId(),
 				SubjectTokenType:   oidc_api.UserIDTokenType,
@@ -564,7 +564,7 @@ func TestImpersonation_API_Call(t *testing.T) {
 	iamUserID, iamImpersonatorPAT := createMachineUserPATWithMembership(ctx, t, instance, "IAM_ADMIN_IMPERSONATOR")
 	iamOwner := instance.Users.Get(integration.UserTypeIAMOwner)
 
-	// impersonating the IAM owner!
+	// impersonating the instance owner!
 	resp, err := tokenexchange.ExchangeToken(ctx, exchanger, iamOwner.Token, oidc.AccessTokenType, iamImpersonatorPAT, oidc.AccessTokenType, nil, nil, nil, oidc.AccessTokenType)
 	require.NoError(t, err)
 	accessTokenVerifier(ctx, resourceServer, iamOwner.ID, iamUserID)

internal/api/scim/integration_test/users_replace_test.go

@@ -229,7 +229,7 @@ func TestReplaceUser(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			// use iam owner => we don't want to test permissions of the create endpoint.
+			// use instance owner => we don't want to test permissions of the create endpoint.
 			createdUser, err := Instance.Client.SCIM.Users.Create(Instance.WithAuthorization(CTX, integration.UserTypeIAMOwner), Instance.DefaultOrg.Id, withUsername(fullUserJson, integration.Username()))
 			require.NoError(t, err)