chore: rehaul DevX (#10571)

# Which Problems Are Solved

Replaces Turbo by Nx and lays the foundation for the next CI
improvements. It enables using Nx Cloud to speed the up the pipelines
that affect any node package.
It streamlines the dev experience for frontend and backend developers by
providing the following commands:

| Task | Command | Notes |
|------|---------|--------|
| **Production** | `nx run PROJECT:prod` | Production server |
| **Develop** | `nx run PROJECT:dev` | Hot reloading development server
|
| **Test** | `nx run PROJECT:test` | Run all tests |
| **Lint** | `nx run PROJECT:lint` | Check code style |
| **Lint Fix** | `nx run PROJECT:lint-fix` | Auto-fix style issues |

The following values can be used for PROJECT:

- @zitadel/zitadel (root commands)
- @zitadel/api,
- @zitadel/login,
- @zitadel/console,
- @zitadel/docs,
- @zitadel/client
- @zitadel/proto

The project names and folders are streamlined:

| Old Folder | New Folder |
| --- | --- |
| ./e2e | ./tests/functional-ui |
| ./load-test | ./benchmark |
| ./build/zitadel | ./apps/api |
| ./console | ./apps/console (postponed so the PR is reviewable) |  

Also, all references to the TypeScript repo are removed so we can
archive it.

# How the Problems Are Solved

- Ran `npx nx@latest init`
- Replaced all turbo.json by project.json and fixed the target configs
- Removed Turbo dependency
- All JavaScript related code affected by a PRs changes is
quality-checked using the `nx affected` command
- We move PR checks that are runnable using Nx into the `check`
workflow. For workflows where we don't use Nx, yet, we restore
previously built dependency artifacts from Nx.
- We only use a single and easy to understand dev container
- The CONTRIBUTING.md is streamlined
- The setup with a generated client pat is orchestrated with Nx
- Everything related to the TypeScript repo is updated or removed. A
**Deploy with Vercel** button is added to the docs and the
CONTRIBUTING.md.

# Additional Changes

- NPM package names have a consistent pattern.
- Docker bake is removed. The login container is built and released like
the core container.
- The integration tests build the login container before running, so
they don't rely on the login container action anymore. This fixes
consistently failing checks on PRs from forks.
- The docs build in GitHub actions is removed, as we already build on
Vercel.

# Additional Context

- Internal discussion:
https://zitadel.slack.com/archives/C087ADF8LRX/p1756277884928169
- Workflow dispatch test:
https://github.com/zitadel/zitadel/actions/runs/17760122959

---------

Co-authored-by: Florian Forster <[email protected]>
Co-authored-by: Tim Möhlmann <[email protected]>
Co-authored-by: Copilot <[email protected]>

benchmark/src/use_cases/human_password_login.ts

@@ -0,0 +1,37 @@
+import { loginByUsernamePassword } from '../login_ui';
+import { createOrg, removeOrg } from '../org';
+import { User, createHuman } from '../user';
+import { userinfo } from '../oidc';
+import { Trend } from 'k6/metrics';
+import { Config, MaxVUs } from '../config';
+
+export async function setup() {
+  const tokens = loginByUsernamePassword(Config.admin as User);
+  console.log('setup: admin signed in');
+
+  const org = await createOrg(tokens.accessToken!);
+  console.log(`setup: org (${org.organizationId}) created`);
+
+  const humanPromises = Array.from({ length: MaxVUs() }, (_, i) => {
+    return createHuman(`zitizen-${i}`, org, tokens.accessToken!);
+  });
+
+  const humans = (await Promise.all(humanPromises)).map((user) => {
+    return { userId: user.userId, loginName: user.loginNames[0], password: 'Password1!' };
+  });
+  console.log(`setup: ${humans.length} users created`);
+  return { tokens, users: humans, org };
+}
+
+const humanPasswordLoginTrend = new Trend('human_password_login_duration', true);
+export default function (data: any) {
+  const start = new Date();
+  const token = loginByUsernamePassword(data.users[__VU - 1]);
+  userinfo(token.accessToken!);
+
+  humanPasswordLoginTrend.add(new Date().getTime() - start.getTime());
+}
+
+export function teardown(data: any) {
+  removeOrg(data.org, data.tokens.accessToken);
+}

benchmark/src/use_cases/introspection.ts

@@ -0,0 +1,54 @@
+import { loginByUsernamePassword } from '../login_ui';
+import { createAPI, createAppKey } from '../app';
+import { createProject } from '../project';
+import { createOrg, removeOrg } from '../org';
+import { introspect } from '../oidc';
+import { Config, MaxVUs } from '../config';
+import { b64decode } from 'k6/encoding';
+// @ts-ignore Import module
+import zitadel from 'k6/x/zitadel';
+import { User } from '../user';
+
+export async function setup() {
+  const adminTokens = loginByUsernamePassword(Config.admin as User);
+  console.info('setup: admin signed in');
+
+  const org = await createOrg(adminTokens.accessToken!);
+  console.info(`setup: org (${org.organizationId}) created`);
+
+  const projectPromises = Array.from({ length: MaxVUs() }, (_, i) => {
+    return createProject(`project-${i}`, org, adminTokens.accessToken!);
+  });
+  const projects = await Promise.all(projectPromises);
+  console.log(`setup: ${projects.length} projects created`);
+
+  const apis = await Promise.all(
+    projects.map((project, i) => {
+      return createAPI(`api-${i}`, project.id, org, adminTokens.accessToken!);
+    }),
+  );
+  console.info(`setup: ${apis.length} apis created`);
+
+  const keys = await Promise.all(
+    apis.map((api, i) => {
+      return createAppKey(api.appId, projects[i].id, org, adminTokens.accessToken!);
+    }),
+  );
+  console.info(`setup: ${keys.length} keys created`);
+
+  const tokens = keys.map((key) => {
+    return zitadel.jwtFromKey(b64decode(key.keyDetails, 'url', 's'), Config.host);
+  });
+  console.info(`setup: ${tokens.length} tokens generated`);
+
+  return { adminTokens, tokens, org };
+}
+
+export default function (data: any) {
+  introspect(data.tokens[__VU - 1], data.adminTokens.accessToken);
+}
+
+export function teardown(data: any) {
+  removeOrg(data.org, data.adminTokens.accessToken);
+  console.info('teardown: org removed');
+}

benchmark/src/use_cases/machine_client_credentials_login.ts

@@ -0,0 +1,48 @@
+import { loginByUsernamePassword } from '../login_ui';
+import { createOrg, removeOrg } from '../org';
+import { createMachine, User, addMachineSecret } from '../user';
+import { clientCredentials, userinfo } from '../oidc';
+import { Config, MaxVUs } from '../config';
+
+export async function setup() {
+  const tokens = loginByUsernamePassword(Config.admin as User);
+  console.info('setup: admin signed in');
+
+  const org = await createOrg(tokens.accessToken!);
+  console.info(`setup: org (${org.organizationId}) created`);
+
+  let machines = (
+    await Promise.all(
+      Array.from({ length: MaxVUs() }, (_, i) => {
+        return createMachine(`zitachine-${i}`, org, tokens.accessToken!);
+      }),
+    )
+  ).map((machine) => {
+    return { userId: machine.userId, loginName: machine.loginNames[0] };
+  });
+  console.info(`setup: ${machines.length} machines created`);
+
+  let credentials = (
+    await Promise.all(
+      machines.map((machine) => {
+        return addMachineSecret(machine.userId, org, tokens.accessToken!);
+      }),
+    )
+  ).map((credentials, i) => {
+    return { userId: machines[i].userId, loginName: machines[i].loginName, password: credentials.clientSecret };
+  });
+  console.info(`setup: secrets added`);
+
+  return { tokens, machines: credentials, org };
+}
+
+export default function (data: any) {
+  clientCredentials(data.machines[__VU - 1].loginName, data.machines[__VU - 1].password).then((token) => {
+    userinfo(token.accessToken!);
+  });
+}
+
+export function teardown(data: any) {
+  removeOrg(data.org, data.tokens.accessToken);
+  console.info('teardown: org removed');
+}

benchmark/src/use_cases/machine_jwt_profile_grant.ts

@@ -0,0 +1,49 @@
+import { loginByUsernamePassword } from '../login_ui';
+import { createOrg, removeOrg } from '../org';
+import { createMachine, User, addMachineKey } from '../user';
+import { JWTProfileRequest, token, userinfo } from '../oidc';
+import { Config, MaxVUs } from '../config';
+import encoding from 'k6/encoding';
+
+const publicKey = encoding.b64encode(open('../.keys/key.pem.pub'));
+
+export async function setup() {
+  const tokens = loginByUsernamePassword(Config.admin as User);
+  console.info('setup: admin signed in');
+
+  const org = await createOrg(tokens.accessToken!);
+  console.info(`setup: org (${org.organizationId}) created`);
+
+  let machines = (
+    await Promise.all(
+      Array.from({ length: MaxVUs() }, (_, i) => {
+        return createMachine(`zitachine-${i}`, org, tokens.accessToken!);
+      }),
+    )
+  ).map((machine) => {
+    return { userId: machine.userId, loginName: machine.loginNames[0] };
+  });
+  console.info(`setup: ${machines.length} machines created`);
+
+  let keys = (
+    await Promise.all(
+      machines.map((machine) => {
+        return addMachineKey(machine.userId, org, tokens.accessToken!, publicKey);
+      }),
+    )
+  ).map((key, i) => {
+    return { userId: machines[i].userId, keyId: key.keyId };
+  });
+  console.info(`setup: ${keys.length} keys added`);
+
+  return { tokens, machines: keys, org };
+}
+
+export default function (data: any) {
+  token(new JWTProfileRequest(data.machines[__VU - 1].userId, data.machines[__VU - 1].keyId));
+}
+
+export function teardown(data: any) {
+  removeOrg(data.org, data.tokens.accessToken);
+  console.info('teardown: org removed');
+}

benchmark/src/use_cases/machine_jwt_profile_grant_single_user.ts

@@ -0,0 +1,32 @@
+import { loginByUsernamePassword } from '../login_ui';
+import { createOrg, removeOrg } from '../org';
+import { createMachine, User, addMachineKey } from '../user';
+import { JWTProfileRequest, token, userinfo } from '../oidc';
+import { Config } from '../config';
+import encoding from 'k6/encoding';
+
+const publicKey = encoding.b64encode(open('../.keys/key.pem.pub'));
+
+export async function setup() {
+  const tokens = loginByUsernamePassword(Config.admin as User);
+  console.info('setup: admin signed in');
+
+  const org = await createOrg(tokens.accessToken!);
+  console.info(`setup: org (${org.organizationId}) created`);
+
+  const machine = await createMachine(`zitachine`, org, tokens.accessToken!);
+  console.info(`setup: machine ${machine.userId} created`);
+  const key = await addMachineKey(machine.userId, org, tokens.accessToken!, publicKey);
+  console.info(`setup: key ${key.keyId} added`);
+
+  return { tokens, machine: { userId: machine.userId, keyId: key.keyId }, org };
+}
+
+export default function (data: any) {
+  token(new JWTProfileRequest(data.machine.userId, data.machine.keyId));
+}
+
+export function teardown(data: any) {
+  removeOrg(data.org, data.tokens.accessToken);
+  console.info('teardown: org removed');
+}

benchmark/src/use_cases/machine_pat_login.ts

@@ -0,0 +1,46 @@
+import { loginByUsernamePassword } from '../login_ui';
+import { createOrg, removeOrg } from '../org';
+import { createMachine, addMachinePat, User } from '../user';
+import { userinfo } from '../oidc';
+import { Config, MaxVUs } from '../config';
+
+export async function setup() {
+  const tokens = loginByUsernamePassword(Config.admin as User);
+  console.info('setup: admin signed in');
+
+  const org = await createOrg(tokens.accessToken!);
+  console.info(`setup: org (${org.organizationId}) created`);
+
+  let machines = (
+    await Promise.all(
+      Array.from({ length: MaxVUs() }, (_, i) => {
+        return createMachine(`zitachine-${i}`, org, tokens.accessToken!);
+      }),
+    )
+  ).map((machine) => {
+    return { userId: machine.userId, loginName: machine.loginNames[0] };
+  });
+  console.info(`setup: ${machines.length} machines created`);
+
+  let pats = (
+    await Promise.all(
+      machines.map((machine) => {
+        return addMachinePat(machine.userId, org, tokens.accessToken!);
+      }),
+    )
+  ).map((pat, i) => {
+    return { userId: machines[i].userId, loginName: machines[i].loginName, pat: pat.token };
+  });
+  console.info(`setup: Pats added`);
+
+  return { tokens, machines: pats, org };
+}
+
+export default function (data: any) {
+  userinfo(data.machines[__VU - 1].pat);
+}
+
+export function teardown(data: any) {
+  removeOrg(data.org, data.tokens.accessToken);
+  console.info('teardown: org removed');
+}

benchmark/src/use_cases/manipulate_user.ts

@@ -0,0 +1,47 @@
+import { loginByUsernamePassword } from '../login_ui';
+import { createOrg, removeOrg } from '../org';
+import { createHuman, updateHuman, lockUser, deleteUser, User } from '../user';
+import { Config } from '../config';
+import { check } from 'k6';
+
+export async function setup() {
+  const tokens = loginByUsernamePassword(Config.admin as User);
+  console.info('setup: admin signed in');
+
+  const org = await createOrg(tokens.accessToken!);
+  console.info(`setup: org (${org.organizationId}) created`);
+
+  return { tokens, org };
+}
+
+export default async function (data: any) {
+  const human = await createHuman(`vu-${__VU}-${new Date(Date.now()).getTime()}`, data.org, data.tokens.accessToken);
+  const updateRes = await updateHuman(
+    {
+      profile: {
+        nickName: `${new Date(Date.now()).toISOString()}`,
+      },
+    },
+    human.userId,
+    data.org,
+    data.tokens.accessToken,
+  );
+  check(updateRes, {
+    'update user is status ok': (r) => r.status >= 200 && r.status < 300,
+  });
+
+  const lockRes = await lockUser(human.userId, data.org, data.tokens.accessToken);
+  check(lockRes, {
+    'lock user is status ok': (r) => r.status >= 200 && r.status < 300,
+  });
+
+  const deleteRes = await deleteUser(human.userId, data.org, data.tokens.accessToken);
+  check(deleteRes, {
+    'delete user is status ok': (r) => r.status >= 200 && r.status < 300,
+  });
+}
+
+export function teardown(data: any) {
+  removeOrg(data.org, data.tokens.accessToken);
+  console.info('teardown: org removed');
+}

benchmark/src/use_cases/session/add_session.ts

@@ -0,0 +1,45 @@
+import { loginByUsernamePassword } from '../../login_ui';
+import { createOrg, removeOrg } from '../../org';
+import { User, createHuman, createMachine } from '../../user';
+import { Trend } from 'k6/metrics';
+import { Config, MaxVUs } from '../../config';
+import { createSession } from '../../session';
+import { check } from 'k6';
+
+export async function setup() {
+  const tokens = loginByUsernamePassword(Config.admin as User);
+  console.log('setup: admin signed in');
+
+  const org = await createOrg(tokens.accessToken!);
+  console.log(`setup: org (${org.organizationId}) created`);
+
+  const humanPromises = Array.from({ length: MaxVUs() }, (_, i) => {
+    return createHuman(`zitizen-${i}`, org, tokens.accessToken!);
+  });
+
+  const humans = (await Promise.all(humanPromises)).map((user) => {
+    return { userId: user.userId, loginName: user.loginNames[0], password: 'Password1!' };
+  });
+  console.log(`setup: ${humans.length} users created`);
+  return { tokens, users: humans, org };
+}
+
+const addSessionTrend = new Trend('add_session_duration', true);
+export default async function (data: any) {
+  const start = new Date();
+  const session = await createSession(data.org, data.tokens.accessToken, {
+    user: {
+      userId: data.users[__VU - 1].userId,
+    },
+  });
+
+  check(session, {
+    'add session is status ok': (s) => s.id !== '',
+  });
+
+  addSessionTrend.add(new Date().getTime() - start.getTime());
+}
+
+export function teardown(data: any) {
+  removeOrg(data.org, data.tokens.accessToken);
+}

benchmark/src/use_cases/session/oidc_session.ts

@@ -0,0 +1,53 @@
+import { loginByUsernamePassword, initLogin } from '../../login_ui';
+import { createOrg, removeOrg } from '../../org';
+import { User, addMachineKey, createMachine } from '../../user';
+import { Trend } from 'k6/metrics';
+import { Config } from '../../config';
+import { check } from 'k6';
+import { finalizeAuthRequest, JWTProfileRequest, token } from '../../oidc';
+import { createSession } from '../../session';
+import encoding from 'k6/encoding';
+import { addIAMMember } from '../../membership';
+
+const publicKey = encoding.b64encode(open('../.keys/key.pem.pub'));
+
+export async function setup() {
+  const adminTokens = loginByUsernamePassword(Config.admin as User);
+  console.log('setup: admin signed in');
+
+  const org = await createOrg(adminTokens.accessToken!);
+  console.log(`setup: org (${org.organizationId}) created`);
+
+  const loginUser = await createMachine('load-test', org, adminTokens.accessToken!);
+  const loginUserKey = await addMachineKey(loginUser.userId, org, adminTokens.accessToken!, publicKey);
+  await addIAMMember(loginUser.userId, ['IAM_LOGIN_CLIENT'], adminTokens.accessToken!);
+  const tokens = await token(new JWTProfileRequest(loginUser.userId, loginUserKey.keyId));
+
+  return { tokens, user: loginUser, key: loginUserKey, org, adminTokens };
+}
+
+// implements the flow described in
+// https://zitadel.com/docs/guides/integrate/login-ui/oidc-standard
+const addSessionTrend = new Trend('oidc_session_duration', true);
+export default async function (data: any) {
+  const start = new Date();
+  const authorizeResponse = initLogin(data.tokens.info.client_id);
+
+  const authRequestId = new URLSearchParams(authorizeResponse.headers['Location']).values().next().value;
+  check(authRequestId, {
+    'auth request id returned': (s) => s !== '',
+  });
+
+  const session = await createSession(data.org, data.tokens.accessToken, {
+    user: {
+      userId: data.user.userId,
+    },
+  });
+  await finalizeAuthRequest(authRequestId!, session, data.tokens!);
+
+  addSessionTrend.add(new Date().getTime() - start.getTime());
+}
+
+export function teardown(data: any) {
+  removeOrg(data.org, data.adminTokens.accessToken);
+}

benchmark/src/use_cases/session/otp_session.ts

@@ -0,0 +1,57 @@
+import { loginByUsernamePassword } from '../../login_ui';
+import { createOrg, removeOrg } from '../../org';
+import { createHuman, setEmailOTPOnHuman, User } from '../../user';
+import { Trend } from 'k6/metrics';
+import { Config, MaxVUs } from '../../config';
+import { createSession, setSession } from '../../session';
+
+export async function setup() {
+  const tokens = loginByUsernamePassword(Config.admin as User);
+  console.log('setup: admin signed in');
+
+  const org = await createOrg(tokens.accessToken!);
+  console.log(`setup: org (${org.organizationId}) created`);
+
+  const humanPromises = Array.from({ length: MaxVUs() }, (_, i) => {
+    return createHuman(`zitizen-${i}`, org, tokens.accessToken!);
+  });
+
+  const humans = (await Promise.all(humanPromises)).map((user) => {
+    setEmailOTPOnHuman(user, org, tokens.accessToken!);
+    return { userId: user.userId, loginName: user.loginNames[0], password: 'Password1!' };
+  });
+  console.log(`setup: ${humans.length} users created`);
+
+  return { tokens, org, users: humans };
+}
+
+// implements the flow described in
+// https://zitadel.com/docs/guides/integrate/login-ui/oidc-standard
+const otpSessionTrend = new Trend('otp_session_duration', true);
+export default async function (data: any) {
+  const start = new Date();
+  let session = await createSession(data.org, data.tokens.accessToken, {
+    user: {
+      loginName: data.users[__VU - 1].loginName,
+    },
+  });
+  const sessionId = (session as any).sessionId;
+
+  session = await setSession(sessionId, session, data.tokens.accessToken, {
+    otpEmail: {
+      return_code: {},
+    },
+  });
+
+  session = await setSession(sessionId, session, data.tokens.accessToken, null, {
+    otpEmail: {
+      code: session.challenges.otpEmail,
+    },
+  });
+
+  otpSessionTrend.add(new Date().getTime() - start.getTime());
+}
+
+export function teardown(data: any) {
+  removeOrg(data.org, data.tokens.accessToken);
+}

benchmark/src/use_cases/session/password_session.ts

@@ -0,0 +1,49 @@
+import { loginByUsernamePassword } from '../../login_ui';
+import { createOrg, removeOrg } from '../../org';
+import { createHuman, setEmailOTPOnHuman, User } from '../../user';
+import { Trend } from 'k6/metrics';
+import { Config, MaxVUs } from '../../config';
+import { createSession, setSession } from '../../session';
+
+export async function setup() {
+  const tokens = loginByUsernamePassword(Config.admin as User);
+  console.log('setup: admin signed in');
+
+  const org = await createOrg(tokens.accessToken!);
+  console.log(`setup: org (${org.organizationId}) created`);
+
+  const humanPromises = Array.from({ length: MaxVUs() }, (_, i) => {
+    return createHuman(`zitizen-${i}`, org, tokens.accessToken!);
+  });
+
+  const humans = (await Promise.all(humanPromises)).map((user) => {
+    setEmailOTPOnHuman(user, org, tokens.accessToken!);
+    return { userId: user.userId, loginName: user.loginNames[0], password: 'Password1!' };
+  });
+  console.log(`setup: ${humans.length} users created`);
+
+  return { tokens, org, users: humans };
+}
+
+const passwordSessionTrend = new Trend('password_session_duration', true);
+export default async function (data: any) {
+  const start = new Date();
+  let session = await createSession(data.org, data.tokens.accessToken, {
+    user: {
+      loginName: data.users[__VU - 1].loginName,
+    },
+  });
+  const sessionId = (session as any).sessionId;
+
+  session = await setSession(sessionId, session, data.tokens.accessToken, null, {
+    password: {
+      password: data.users[__VU - 1].password,
+    },
+  });
+
+  passwordSessionTrend.add(new Date().getTime() - start.getTime());
+}
+
+export function teardown(data: any) {
+  removeOrg(data.org, data.tokens.accessToken);
+}

benchmark/src/use_cases/user_info.ts

@@ -0,0 +1,27 @@
+import { loginByUsernamePassword } from '../login_ui';
+import { userinfo } from '../oidc';
+import { Config } from '../config';
+import { User, createHuman } from '../user';
+import { createOrg, removeOrg } from '../org';
+
+export async function setup() {
+  const adminTokens = loginByUsernamePassword(Config.admin as User);
+  console.info('setup: admin signed in');
+
+  const org = await createOrg(adminTokens.accessToken!);
+  console.info(`setup: org (${org.organizationId}) created`);
+
+  const user = await createHuman('gigi', org, adminTokens.accessToken!);
+  console.info(`setup: user (${user.userId}) created`);
+
+  return { org, tokens: loginByUsernamePassword({ loginName: user.loginNames[0], password: 'Password1!' } as User) };
+}
+
+export default function (data: any) {
+  userinfo(data.tokens.accessToken);
+}
+
+export function teardown(data: any) {
+  removeOrg(data.org, data.tokens.accessToken);
+  console.info('teardown: org removed');
+}

benchmark/src/use_cases/users_by_metadata_key.ts

@@ -0,0 +1,65 @@
+import { loginByUsernamePassword } from '../login_ui';
+import { createOrg, removeOrg } from '../org';
+import { createHuman, User, createMachine, setUserMetadata, listUsers } from '../user';
+import { Config } from '../config';
+import { check } from 'k6';
+import encoding from 'k6/encoding';
+
+const userAmount = parseInt(__ENV.USER_AMOUNT) || 2500;
+
+export async function setup() {
+  const tokens = loginByUsernamePassword(Config.admin as User);
+  console.info('setup: admin signed in');
+
+  const org = await createOrg(tokens.accessToken!);
+  console.info(`setup: org (${org.organizationId}) created`);
+
+  const users: User[] = [];
+
+  await Promise.all(
+    Array.from({ length: userAmount }, async (_, i) => {
+      let user: User;
+      let type: 'human' | 'machine';
+      if (i % 2 === 0) {
+        user = await createHuman(`zitizen-${i}`, org, tokens.accessToken!);
+        type = 'human';
+      } else {
+        user = await createMachine(`zitachine-${i}`, org, tokens.accessToken!);
+        type = 'machine';
+      }
+      users.push(user);
+      await setUserMetadata(
+        [
+          { key: 'type', value: encoding.b64encode(type, 'rawurl') },
+          { key: 'org', value: encoding.b64encode(org.organizationId, 'rawurl') },
+          { key: 'id', value: encoding.b64encode(user.userId, 'rawurl') },
+        ],
+        user.userId,
+        tokens.accessToken!,
+      );
+      if (i % 10 === 0) {
+        console.log(`setup: ${i} of ${userAmount} users setup`);
+      }
+    }),
+  );
+  console.info(`setup: ${users.length} users created`);
+
+  return { tokens, org, users };
+}
+
+export default async function (data: any) {
+  const result = await listUsers(
+    {
+      queries: [{ metadataKeyFilter: { key: 'org', method: 'TEXT_FILTER_METHOD_EQUALS' } }],
+    },
+    data.tokens.accessToken!,
+  );
+  check(result, {
+    'total result length': (res) => res.details.totalResult == userAmount,
+  }) || console.log(`unexpected amount of users. expected ${userAmount} but got ${result.details.totalResult}`);
+}
+
+export function teardown(data: any) {
+  removeOrg(data.org, data.tokens.accessToken);
+  console.info('teardown: org removed');
+}

benchmark/src/use_cases/users_by_metadata_value.ts

@@ -0,0 +1,67 @@
+import { loginByUsernamePassword } from '../login_ui';
+import { createOrg, removeOrg } from '../org';
+import { createHuman, User, createMachine, setUserMetadata, listUsers } from '../user';
+import { Config } from '../config';
+import { check } from 'k6';
+import encoding from 'k6/encoding';
+
+const userAmount = parseInt(__ENV.USER_AMOUNT) || 2500;
+
+export async function setup() {
+  const tokens = loginByUsernamePassword(Config.admin as User);
+  console.info('setup: admin signed in');
+
+  const org = await createOrg(tokens.accessToken!);
+  console.info(`setup: org (${org.organizationId}) created`);
+
+  const users: User[] = [];
+
+  await Promise.all(
+    Array.from({ length: userAmount }, async (_, i) => {
+      let user: User;
+      let type: 'human' | 'machine';
+      if (i % 2 === 0) {
+        user = await createHuman(`zitizen-${i}`, org, tokens.accessToken!);
+        type = 'human';
+      } else {
+        user = await createMachine(`zitachine-${i}`, org, tokens.accessToken!);
+        type = 'machine';
+      }
+      users.push(user);
+      await setUserMetadata(
+        [
+          { key: 'type', value: encoding.b64encode(type, 'rawurl') },
+          { key: 'org', value: encoding.b64encode(org.organizationId, 'rawurl') },
+          { key: 'id', value: encoding.b64encode(user.userId, 'rawurl') },
+        ],
+        user.userId,
+        tokens.accessToken!,
+      );
+      if (i % 10 === 0) {
+        console.log(`setup: ${i} of ${userAmount} users setup`);
+      }
+    }),
+  );
+  console.info(`setup: ${users.length} users created`);
+
+  return { tokens, org, users };
+}
+
+export default async function (data: any) {
+  const result = await listUsers(
+    {
+      queries: [
+        { metadataValueFilter: { value: encoding.b64encode('human', 'rawurl'), method: 'BYTE_FILTER_METHOD_EQUALS' } },
+      ],
+    },
+    data.tokens.accessToken!,
+  );
+  check(result, {
+    'total result length': (res) => res.details.totalResult == userAmount / 2,
+  }) || console.log(`unexpected amount of users. expected ${userAmount / 2} but got ${result.details.totalResult}`);
+}
+
+export function teardown(data: any) {
+  removeOrg(data.org, data.tokens.accessToken);
+  console.info('teardown: org removed');
+}

benchmark/src/use_cases/verify_all_user_grants_exist.ts

@@ -0,0 +1,77 @@
+import { loginByUsernamePassword } from '../login_ui';
+import { createOrg } from '../org';
+import { User, createMachine } from '../user';
+import { Config, MaxVUs } from '../config';
+import { createProject, Project } from '../project';
+import { addUserGrant } from '../user_grant';
+
+export async function setup() {
+  const tokens = loginByUsernamePassword(Config.admin as User);
+  console.info('setup: admin signed in');
+
+  const org = await createOrg(tokens.accessToken!);
+  console.info(`setup: org (${org.organizationId}) created`);
+
+  const projects = await Promise.all(
+    Array.from({ length: 50 }, (_, i) => {
+      return createProject(`project-${i}`, org, tokens.accessToken!);
+    }),
+  );
+  console.log(`setup: ${projects.length} projects created`);
+
+  let machines = (
+    await Promise.all(
+      Array.from({ length: MaxVUs() }, async (_, i) => {
+        return await createMachine(`zitachine-${i}`, org, tokens.accessToken!);
+      }),
+    )
+  ).map((machine) => {
+    return { userId: machine.userId, loginName: machine.loginNames[0] };
+  });
+  console.log(`setup: ${machines.length} machines created`);
+
+  return { tokens, org, machines, projects };
+}
+
+export default async function (data: any) {
+  const machine = await createMachine(`zitachine-${__VU}-${__ITER}`, data.org, data.tokens.accessToken!);
+  let userGrants = await Promise.all(
+    data.projects.map((project: Project) => {
+      return addUserGrant(data.org, machine.userId, project, [], data.tokens.accessToken!);
+    }),
+  );
+
+  return { userGrants };
+}
+
+export function teardown(data: any) {
+  // removeOrg(data.org, data.tokens.accessToken);
+  console.info('teardown: org is not removed to verify correctness of projections, do not forget to remove the org afterwards');
+}
+
+/** 
+ * To verify the correctness of the projections you can use the following statements:
+ * 
+ * set the owner of the events:
+ * 
+ * set my.owner = '<org id of the created org>';
+ * 
+ * check if the amount of events is the same as amount of objects
+ * 
+ *  select * from (
+    select 'projections.user_grants5', count(*) from projections.user_grants5 where resource_owner = (select current_setting('my.owner'))
+    union all
+    select 'projections.users14', count(*) from projections.users14 where resource_owner = (select current_setting('my.owner'))
+    union all
+    select 'projections.sessions8', count(*) from projections.sessions8 where user_resource_owner = (select current_setting('my.owner'))
+    union all
+    select aggregate_type, count(*) from eventstore.events2
+    where
+        aggregate_type in ('user', 'usergrant', 'session')
+        and event_type in ('user.machine.added', 'user.human.added', 'user.grant.added', 'session.user.checked')
+        and (owner = (select current_setting('my.owner'))
+            OR payload->>'userResourceOwner' = (select current_setting('my.owner'))
+        )
+        group by aggregate_type
+) order by 2;
+ */