fix(benchmark): set proper audience to introspect token (#11586)

# Which Problems Are Solved

Benchmark appears to run correctly, however the token used isn't valid.
The backend (Zitadel 4.11-pre) prints a constant stream of info logs
that the token isn't valid for the client.

# How the Problems Are Solved

Pass the generated project IDs as a scope for a new login.

# Additional Changes

- ensure keys for introspection and add session recipes.

# Additional Context

- Closes #11585

---------

Co-authored-by: Silvan <[email protected]>

benchmark/src/login_ui.ts

@@ -9,25 +9,25 @@ import url from './url';
 import { User } from './user';
 import { Tokens } from './oidc';
 
-export function loginByUsernamePassword(user: User) {
+export function loginByUsernamePassword(user: User, client = Client()) {
   check(user, {
     'user defined': (u) => u !== undefined || fail(`user is undefined`),
   });
 
-  const loginUI = initLogin();
+  const loginUI = initLogin(undefined, client);
   const loginNameResponse = enterLoginName(loginUI, user);
   const passwordResponse = enterPassword(loginNameResponse, user);
   return token(new URL(passwordResponse.url).searchParams.get('code'));
 }
 
 const initLoginTrend = new Trend('login_ui_init_login_duration', true);
-export function initLogin(clientId?: string): Response {
+export function initLogin(loginClientId?: string, client = Client()): Response {
   let params = {};
   let expectedStatus = 200;
-  if (clientId) {
+  if (loginClientId) {
     params = {
       headers: {
-        'x-zitadel-login-client': clientId,
+        'x-zitadel-login-client': loginClientId,
       },
       redirects: 0,
     };
@@ -36,7 +36,7 @@ export function initLogin(clientId?: string): Response {
 
   const response = http.get(
     url('/oauth/v2/authorize', {
-      searchParams: Client(),
+      searchParams: client,
     }),
     params,
   );

benchmark/src/oidc.ts

@@ -71,6 +71,7 @@ export function introspect(jwt: string, token: string) {
   );
   check(res, {
     'introspect status ok': (r) => r.status >= 200 && r.status < 300,
+    'introspect active': (r) => r.json('active') === true,
   });
 
   introspectTrend.add(res.timings.duration);

benchmark/src/use_cases/introspection.ts

@@ -3,7 +3,7 @@ import { createAPI, createAppKey } from '../app';
 import { createProject } from '../project';
 import { createOrg, removeOrg } from '../org';
 import { introspect } from '../oidc';
-import { Config, MaxVUs } from '../config';
+import { Config, MaxVUs, Client } from '../config';
 import { b64decode } from 'k6/encoding';
 // @ts-ignore Import module
 import zitadel from 'k6/x/zitadel';
@@ -41,11 +41,18 @@ export async function setup() {
   });
   console.info(`setup: ${tokens.length} tokens generated`);
 
-  return { adminTokens, tokens, org };
+  const client = { ...Client() };
+  client.scope = [client.scope, ...projects.map((p) => `urn:zitadel:iam:org:project:id:${p.id}:aud`)].join(' ');
+  console.info('setup: login user with scope %s', client.scope);
+
+  const userTokens = loginByUsernamePassword(Config.admin as User, client);
+  console.info('setup: user signed in');
+
+  return { adminTokens, userTokens, tokens, org };
 }
 
 export default function (data: any) {
-  introspect(data.tokens[__VU - 1], data.adminTokens.accessToken);
+  introspect(data.tokens[__VU - 1], data.userTokens.accessToken);
 }
 
 export function teardown(data: any) {