feat: handle Zitadel provider IdP login via login v1 (#12469)

# Which Problems Are Solved

This PR adds support for using a ZITADEL IdP provider in the login v1 UI
flow and conditionally grants a support-user instance membership based
on a ZITADEL-specific project-roles token claim.

# How the Problems Are Solved

- Introduced ZITADEL IdP handling in the login v1 handler, including
extracting the `urn:zitadel:iam:org:project:roles` claim and granting
`IAM_OWNER_VIEWER` instance membership when configured orgs match.
- Added a new `AddInstanceMemberFromLogin` to assign an instance
membership during the login v1 ZITADEL-IdP flow without permission
checks (as the authorization is established based on the project roles
in the token claim)
- Added unit tests

# Additional Changes

N/A

# Additional Context
- Closes https://github.com/zitadel/zitadel/issues/12446

internal/command/org_idp_test.go

@@ -6167,66 +6167,6 @@ func TestCommandSide_AddOrgZitadelIDP(t *testing.T) {
 				want: &domain.ObjectDetails{ResourceOwner: "org1"},
 			},
 		},
-		{
-			name: "ok",
-			fields: fields{
-				eventstore: expectEventstore(
-					expectFilter(),
-					expectPush(
-						org.NewZitadelIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate,
-							"id1",
-							"name",
-							"issuer",
-							"clientID",
-							&crypto.CryptoValue{
-								CryptoType: crypto.TypeEncryption,
-								Algorithm:  "enc",
-								KeyID:      "id",
-								Crypted:    []byte("clientSecret"),
-							},
-							nil,
-							idp.Options{},
-							[]idp.RolesInfo{
-								{
-									OrganizationID:     "org1",
-									OrganizationDomain: "example-org1.com",
-								},
-								{
-									OrganizationID:     "org2",
-									OrganizationDomain: "example-org2.com",
-								},
-							},
-						),
-					),
-				),
-				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
-			},
-			args: args{
-				ctx:           context.Background(),
-				resourceOwner: "org1",
-				provider: ZitadelProvider{
-					Name:         "name",
-					Issuer:       "issuer",
-					ClientID:     "clientID",
-					ClientSecret: "clientSecret",
-					InstanceRolesInfo: []idp.RolesInfo{
-						{
-							OrganizationID:     "org1",
-							OrganizationDomain: "example-org1.com",
-						},
-						{
-							OrganizationID:     "org2",
-							OrganizationDomain: "example-org2.com",
-						},
-					},
-				},
-			},
-			res: res{
-				id:   "id1",
-				want: &domain.ObjectDetails{ResourceOwner: "org1"},
-			},
-		},
 		{
 			name: "ok all set",
 			fields: fields{
@@ -6251,16 +6191,7 @@ func TestCommandSide_AddOrgZitadelIDP(t *testing.T) {
 								IsAutoCreation:    true,
 								IsAutoUpdate:      true,
 							},
-							[]idp.RolesInfo{
-								{
-									OrganizationID:     "org1",
-									OrganizationDomain: "example-org1.com",
-								},
-								{
-									OrganizationID:     "org2",
-									OrganizationDomain: "example-org2.com",
-								},
-							},
+							nil,
 						),
 					),
 				),
@@ -6282,16 +6213,6 @@ func TestCommandSide_AddOrgZitadelIDP(t *testing.T) {
 						IsAutoCreation:    true,
 						IsAutoUpdate:      true,
 					},
-					InstanceRolesInfo: []idp.RolesInfo{
-						{
-							OrganizationID:     "org1",
-							OrganizationDomain: "example-org1.com",
-						},
-						{
-							OrganizationID:     "org2",
-							OrganizationDomain: "example-org2.com",
-						},
-					},
 				},
 			},
 			res: res{
@@ -6299,6 +6220,34 @@ func TestCommandSide_AddOrgZitadelIDP(t *testing.T) {
 				want: &domain.ObjectDetails{ResourceOwner: "org1"},
 			},
 		},
+		{
+			name: "instance roles info not allowed",
+			fields: fields{
+				eventstore:  expectEventstore(),
+				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"),
+			},
+			args: args{
+				ctx:           context.Background(),
+				resourceOwner: "org1",
+				provider: ZitadelProvider{
+					Name:         "name",
+					Issuer:       "issuer",
+					ClientID:     "clientID",
+					ClientSecret: "clientSecret",
+					InstanceRolesInfo: []idp.RolesInfo{
+						{
+							OrganizationID:     "org1",
+							OrganizationDomain: "example-org1.com",
+						},
+					},
+				},
+			},
+			res: res{
+				err: func(err error) bool {
+					return errors.Is(err, zerrors.ThrowInvalidArgument(nil, "ORG-ImOVF3", "Errors.Invalid.Argument"))
+				},
+			},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -6504,16 +6453,7 @@ func TestCommands_UpdateOrgZitadelIDP(t *testing.T) {
 								},
 								[]string{openid.ScopeOpenID, openid.ScopeEmail},
 								idp.Options{},
-								[]idp.RolesInfo{
-									{
-										OrganizationID:     "org1",
-										OrganizationDomain: "example-org1.com",
-									},
-									{
-										OrganizationID:     "org2",
-										OrganizationDomain: "example-org2.com",
-									},
-								},
+								nil,
 							),
 						),
 					),
@@ -6527,20 +6467,36 @@ func TestCommands_UpdateOrgZitadelIDP(t *testing.T) {
 					Issuer:   "issuer",
 					ClientID: "clientID",
 					Scopes:   []string{openid.ScopeOpenID, openid.ScopeEmail},
+				},
+			},
+			res: res{
+				want: &domain.ObjectDetails{ResourceOwner: "org1"},
+			},
+		},
+		{
+			name: "instance roles info not allowed",
+			fields: fields{
+				eventstore: expectEventstore(),
+			},
+			args: args{
+				id:            "idp-id",
+				resourceOwner: "org1",
+				provider: ZitadelProvider{
+					Name:     "name",
+					Issuer:   "issuer",
+					ClientID: "clientID",
 					InstanceRolesInfo: []idp.RolesInfo{
 						{
 							OrganizationID:     "org1",
 							OrganizationDomain: "example-org1.com",
 						},
-						{
-							OrganizationID:     "org2",
-							OrganizationDomain: "example-org2.com",
-						},
 					},
 				},
 			},
 			res: res{
-				want: &domain.ObjectDetails{ResourceOwner: "org1"},
+				err: func(err error) bool {
+					return errors.Is(err, zerrors.ThrowInvalidArgument(nil, "ORG-ImOVF3", "Errors.Invalid.Argument"))
+				},
 			},
 		},
 		{
@@ -6562,12 +6518,7 @@ func TestCommands_UpdateOrgZitadelIDP(t *testing.T) {
 								},
 								[]string{openid.ScopeOpenID, openid.ScopeEmail},
 								idp.Options{},
-								[]idp.RolesInfo{
-									{
-										OrganizationID:     "org1",
-										OrganizationDomain: "example-org1.com",
-									},
-								},
+								nil,
 							)),
 					),
 					expectPush(
@@ -6592,16 +6543,6 @@ func TestCommands_UpdateOrgZitadelIDP(t *testing.T) {
 										IsAutoCreation:    &t,
 										IsAutoUpdate:      &t,
 									}),
-									idp.ChangeZitadelIDPInstanceRolesInfo([]idp.RolesInfo{
-										{
-											OrganizationID:     "org1",
-											OrganizationDomain: "example-org1.com",
-										},
-										{
-											OrganizationID:     "org2",
-											OrganizationDomain: "example-org2.com",
-										},
-									}),
 								},
 							)
 							return event
@@ -6625,16 +6566,6 @@ func TestCommands_UpdateOrgZitadelIDP(t *testing.T) {
 						IsAutoCreation:    true,
 						IsAutoUpdate:      true,
 					},
-					InstanceRolesInfo: []idp.RolesInfo{
-						{
-							OrganizationID:     "org1",
-							OrganizationDomain: "example-org1.com",
-						},
-						{
-							OrganizationID:     "org2",
-							OrganizationDomain: "example-org2.com",
-						},
-					},
 				},
 			},
 			res: res{
@@ -6660,12 +6591,7 @@ func TestCommands_UpdateOrgZitadelIDP(t *testing.T) {
 								},
 								[]string{openid.ScopeOpenID, openid.ScopeEmail},
 								idp.Options{},
-								[]idp.RolesInfo{
-									{
-										OrganizationID:     "org1",
-										OrganizationDomain: "example-org1.com",
-									},
-								},
+								nil,
 							)),
 					),
 					expectPush(
@@ -6690,16 +6616,6 @@ func TestCommands_UpdateOrgZitadelIDP(t *testing.T) {
 										IsAutoCreation:    &t,
 										IsAutoUpdate:      &t,
 									}),
-									idp.ChangeZitadelIDPInstanceRolesInfo([]idp.RolesInfo{
-										{
-											OrganizationID:     "org1",
-											OrganizationDomain: "example-org1.com",
-										},
-										{
-											OrganizationID:     "org2",
-											OrganizationDomain: "example-org2.com",
-										},
-									}),
 								},
 							)
 							return event
@@ -6723,16 +6639,6 @@ func TestCommands_UpdateOrgZitadelIDP(t *testing.T) {
 						IsAutoCreation:    true,
 						IsAutoUpdate:      true,
 					},
-					InstanceRolesInfo: []idp.RolesInfo{
-						{
-							OrganizationID:     "org1",
-							OrganizationDomain: "example-org1.com",
-						},
-						{
-							OrganizationID:     "org2",
-							OrganizationDomain: "example-org2.com",
-						},
-					},
 				},
 			},
 			res: res{