Merge commit from fork

* fix: Improve host header handling and deployment mode detection

* ZITADEL_CLOUD env

* refactor service config

* service config

* cleanup

* cleanup

* util for original and public host

* instanceHost, publicHost

* cleanup constructUrl

* cleanup middleware

* add x-zitadel-forward-host as fallback for current cloud setup

* fix build

* fix: lint

* fix: update test mocks

* fix: provide basepath to unit tests

* host handling

* unit tests

* imports

* fix: getPublicHost instead of getInstanceHost

* unit tests

* update nextjs, implement jwt verify for logout_token

* pass logout information in jwt to login v2

* handle hosts in jwks url

* point idp callbacks to the api and not the login UI

* logout_hint out of logout token, typecheck

* rm unused imports

* fix oidc integration test

---------

Co-authored-by: Livio Spring <[email protected]>

apps/login/src/lib/deployment.ts

@@ -0,0 +1,24 @@
+/**
+ * Checks if system user credentials are available for JWT authentication.
+ *
+ * System user authentication requires:
+ * - AUDIENCE: The API audience for JWT authentication
+ * - SYSTEM_USER_ID: The system user's ID
+ * - SYSTEM_USER_PRIVATE_KEY: The private key for JWT signing
+ *
+ * Both multi-tenant and self-hosted deployments can use system user authentication.
+ *
+ * @returns true if system user credentials are present, false otherwise
+ */
+export function hasSystemUserCredentials(): boolean {
+  return !!process.env.AUDIENCE && !!process.env.SYSTEM_USER_ID && !!process.env.SYSTEM_USER_PRIVATE_KEY;
+}
+
+/**
+ * Checks if service user token is available for authentication.
+ *
+ * @returns true if ZITADEL_SERVICE_USER_TOKEN is present, false otherwise
+ */
+export function hasServiceUserToken(): boolean {
+  return !!process.env.ZITADEL_SERVICE_USER_TOKEN;
+}