fix: propagate non-NotFound errors from instance interceptor (#12019)

internal/api/grpc/server/middleware/instance_interceptor_test.go

@@ -2,6 +2,7 @@ package middleware
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"reflect"
 	"testing"
@@ -9,11 +10,15 @@ import (
 
 	"golang.org/x/text/language"
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
 
 	"github.com/zitadel/zitadel/internal/api/authz"
 	http_util "github.com/zitadel/zitadel/internal/api/http"
 	"github.com/zitadel/zitadel/internal/execution/target"
 	"github.com/zitadel/zitadel/internal/feature"
+	"github.com/zitadel/zitadel/internal/i18n"
+	"github.com/zitadel/zitadel/internal/zerrors"
 	object_v3 "github.com/zitadel/zitadel/pkg/grpc/object/v3alpha"
 )
 
@@ -229,9 +234,13 @@ type mockInstanceVerifier struct {
 	id           string
 	instanceHost string
 	publicHost   string
+	err          error
 }
 
 func (m *mockInstanceVerifier) InstanceByHost(_ context.Context, instanceHost, publicHost string) (authz.Instance, error) {
+	if m.err != nil {
+		return nil, m.err
+	}
 	if instanceHost != m.instanceHost {
 		return nil, fmt.Errorf("invalid host")
 	}
@@ -245,6 +254,9 @@ func (m *mockInstanceVerifier) InstanceByHost(_ context.Context, instanceHost, p
 }
 
 func (m *mockInstanceVerifier) InstanceByID(_ context.Context, id string) (authz.Instance, error) {
+	if m.err != nil {
+		return nil, m.err
+	}
 	if id != m.id {
 		return nil, fmt.Errorf("not found")
 	}
@@ -304,3 +316,75 @@ func (m *mockInstance) Features() feature.Features {
 func (m *mockInstance) ExecutionRouter() target.Router {
 	return target.NewRouter(nil)
 }
+
+func Test_setInstance_errorCodes(t *testing.T) {
+	i18n.SupportLanguages(language.English)
+	translator := i18n.NewZitadelTranslator(language.English)
+
+	cases := []struct {
+		name     string
+		err      error
+		wantCode codes.Code
+	}{
+		{
+			name:     "not found from verifier propagates as NotFound",
+			err:      zerrors.ThrowNotFound(nil, "TEST-001", "Errors.Instance.NotFound"),
+			wantCode: codes.NotFound,
+		},
+		{
+			name:     "internal error from verifier propagates as Internal",
+			err:      zerrors.ThrowInternal(errors.New("FATAL: the database system is shutting down (SQLSTATE 57P03)"), "TEST-002", "Errors.Internal"),
+			wantCode: codes.Internal,
+		},
+		{
+			name:     "unavailable error from verifier propagates as Unavailable",
+			err:      zerrors.ThrowUnavailable(nil, "TEST-003", "Errors.Unavailable"),
+			wantCode: codes.Unavailable,
+		},
+	}
+
+	for _, tc := range cases {
+		verifier := &mockInstanceVerifier{err: tc.err}
+
+		t.Run("byRequestedHost/"+tc.name, func(t *testing.T) {
+			ctx := http_util.WithDomainContext(context.Background(), &http_util.DomainCtx{InstanceHost: "host"})
+			_, err := setInstance(ctx, &mockRequest{}, &grpc.UnaryServerInfo{}, nil, verifier, "", translator)
+			if err == nil {
+				t.Fatal("expected error, got nil")
+			}
+			if got := status.Code(err); got != tc.wantCode {
+				t.Errorf("got code %v, want %v", got, tc.wantCode)
+			}
+		})
+
+		t.Run("byID/"+tc.name, func(t *testing.T) {
+			req := &mockRequestWithExplicitInstance{
+				instance: object_v3.Instance{
+					Property: &object_v3.Instance_Id{Id: "any"},
+				},
+			}
+			_, err := setInstance(context.Background(), req, &grpc.UnaryServerInfo{}, nil, verifier, "", translator)
+			if err == nil {
+				t.Fatal("expected error, got nil")
+			}
+			if got := status.Code(err); got != tc.wantCode {
+				t.Errorf("got code %v, want %v", got, tc.wantCode)
+			}
+		})
+
+		t.Run("byDomain/"+tc.name, func(t *testing.T) {
+			req := &mockRequestWithExplicitInstance{
+				instance: object_v3.Instance{
+					Property: &object_v3.Instance_Domain{Domain: "any"},
+				},
+			}
+			_, err := setInstance(context.Background(), req, &grpc.UnaryServerInfo{}, nil, verifier, "", translator)
+			if err == nil {
+				t.Fatal("expected error, got nil")
+			}
+			if got := status.Code(err); got != tc.wantCode {
+				t.Errorf("got code %v, want %v", got, tc.wantCode)
+			}
+		})
+	}
+}