fix(benchmark): set proper audience to introspect token (#11586)

# Which Problems Are Solved

Benchmark appears to run correctly, however the token used isn't valid.
The backend (Zitadel 4.11-pre) prints a constant stream of info logs
that the token isn't valid for the client.

# How the Problems Are Solved

Pass the generated project IDs as a scope for a new login.

# Additional Changes

- ensure keys for introspection and add session recipes.

# Additional Context

- Closes #11585

---------

Co-authored-by: Silvan <[email protected]>

benchmark/.gitignore

@@ -1,2 +1,5 @@
 .env
+dist/**
+.keys/**
+output/**
 

benchmark/Makefile

@@ -28,7 +28,7 @@ manipulate_user: bundle
 	${K6} run --summary-trend-stats "min,avg,max,p(50),p(95),p(99)" dist/manipulate_user.js --vus ${VUS} --duration ${DURATION} --out csv=output/manipulate_user_${DATE}.csv
 
 .PHONY: introspect
-introspect: ensure_modules bundle
+introspect: ensure_key_pair ensure_modules bundle
 	go install go.k6.io/xk6/cmd/xk6@latest
 	cd ../../xk6-modules && xk6 build --with xk6-zitadel=.
 	${K6} run --summary-trend-stats "min,avg,max,p(50),p(95),p(99)" dist/introspection.js --vus ${VUS} --duration ${DURATION} --out csv=output/introspect_${DATE}.csv
@@ -46,7 +46,7 @@ password_session: ensure_key_pair ensure_modules bundle
 	${K6} run --summary-trend-stats "min,avg,max,p(50),p(95),p(99)" dist/password_session.js --vus ${VUS} --duration ${DURATION} --out csv=output/otp_session_${DATE}.csv
 
 .PHONY: add_session
-add_session: ensure_modules bundle
+add_session: ensure_key_pair ensure_modules bundle
 	${K6} run --summary-trend-stats "min,avg,max,p(50),p(95),p(99)" dist/add_session.js --vus ${VUS} --duration ${DURATION} --out csv=output/add_session_${DATE}.csv
 
 .PHONY: machine_jwt_profile_grant

benchmark/package-lock.json

@@ -1,12 +1,11 @@
 {
-    "name": "typescript",
+    "name": "@zitadel/benchmark",
     "version": "1.0.0",
     "lockfileVersion": 3,
     "requires": true,
     "packages": {
         "": {
-            "name": "typescript",
-            "version": "1.0.0",
+            "name": "@zitadel/benchmark",
             "license": "Apache-2.0",
             "devDependencies": {
                 "@babel/core": "7.23.7",

benchmark/src/login_ui.ts

@@ -9,25 +9,25 @@ import url from './url';
 import { User } from './user';
 import { Tokens } from './oidc';
 
-export function loginByUsernamePassword(user: User) {
+export function loginByUsernamePassword(user: User, client = Client()) {
   check(user, {
     'user defined': (u) => u !== undefined || fail(`user is undefined`),
   });
 
-  const loginUI = initLogin();
+  const loginUI = initLogin(undefined, client);
   const loginNameResponse = enterLoginName(loginUI, user);
   const passwordResponse = enterPassword(loginNameResponse, user);
   return token(new URL(passwordResponse.url).searchParams.get('code'));
 }
 
 const initLoginTrend = new Trend('login_ui_init_login_duration', true);
-export function initLogin(clientId?: string): Response {
+export function initLogin(loginClientId?: string, client = Client()): Response {
   let params = {};
   let expectedStatus = 200;
-  if (clientId) {
+  if (loginClientId) {
     params = {
       headers: {
-        'x-zitadel-login-client': clientId,
+        'x-zitadel-login-client': loginClientId,
       },
       redirects: 0,
     };
@@ -36,7 +36,7 @@ export function initLogin(clientId?: string): Response {
 
   const response = http.get(
     url('/oauth/v2/authorize', {
-      searchParams: Client(),
+      searchParams: client,
     }),
     params,
   );

benchmark/src/oidc.ts

@@ -71,6 +71,7 @@ export function introspect(jwt: string, token: string) {
   );
   check(res, {
     'introspect status ok': (r) => r.status >= 200 && r.status < 300,
+    'introspect active': (r) => r.json('active') === true,
   });
 
   introspectTrend.add(res.timings.duration);

benchmark/src/use_cases/introspection.ts

@@ -3,7 +3,7 @@ import { createAPI, createAppKey } from '../app';
 import { createProject } from '../project';
 import { createOrg, removeOrg } from '../org';
 import { introspect } from '../oidc';
-import { Config, MaxVUs } from '../config';
+import { Config, MaxVUs, Client } from '../config';
 import { b64decode } from 'k6/encoding';
 // @ts-ignore Import module
 import zitadel from 'k6/x/zitadel';
@@ -41,11 +41,18 @@ export async function setup() {
   });
   console.info(`setup: ${tokens.length} tokens generated`);
 
-  return { adminTokens, tokens, org };
+  const client = { ...Client() };
+  client.scope = [client.scope, ...projects.map((p) => `urn:zitadel:iam:org:project:id:${p.id}:aud`)].join(' ');
+  console.info('setup: login user with scope %s', client.scope);
+
+  const userTokens = loginByUsernamePassword(Config.admin as User, client);
+  console.info('setup: user signed in');
+
+  return { adminTokens, userTokens, tokens, org };
 }
 
 export default function (data: any) {
-  introspect(data.tokens[__VU - 1], data.adminTokens.accessToken);
+  introspect(data.tokens[__VU - 1], data.userTokens.accessToken);
 }
 
 export function teardown(data: any) {