feat(v3alpha): read actions (#8357)

# Which Problems Are Solved

The current v3alpha actions APIs don't exactly adhere to the [new
resources API
design](https://zitadel.com/docs/apis/v3#standard-resources).

# How the Problems Are Solved

- **Improved ID access**: The aggregate ID is added to the resource
details object, so accessing resource IDs and constructing proto
messages for resources is easier
- **Explicit Instances**: Optionally, the instance can be explicitly
given in each request
- **Pagination**: A default search limit and a max search limit are
added to the defaults.yaml. They apply to the new v3 APIs (currently
only actions). The search query defaults are changed to ascending by
creation date, because this makes the pagination results the most
deterministic. The creation date is also added to the object details.
The bug with updated creation dates is fixed for executions and targets.
- **Removed Sequences**: Removed Sequence from object details and
ProcessedSequence from search details

# Additional Changes

Object details IDs are checked in unit test only if an empty ID is
expected. Centralizing the details check also makes this internal object
more flexible for future evolutions.

# Additional Context

- Closes #8169 
- Depends on https://github.com/zitadel/zitadel/pull/8225

---------

Co-authored-by: Silvan <silvan.reusser@gmail.com>
Co-authored-by: Stefan Benz <46600784+stebenz@users.noreply.github.com>

internal/api/grpc/server/middleware/instance_interceptor.go

@@ -17,6 +17,7 @@ import (
 	"github.com/zitadel/zitadel/internal/i18n"
 	"github.com/zitadel/zitadel/internal/telemetry/tracing"
 	"github.com/zitadel/zitadel/internal/zerrors"
+	object_v3 "github.com/zitadel/zitadel/pkg/grpc/object/v3alpha"
 )
 
 const (
@@ -34,33 +35,67 @@ func InstanceInterceptor(verifier authz.InstanceVerifier, externalDomain string,
 func setInstance(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler, verifier authz.InstanceVerifier, externalDomain string, translator *i18n.Translator, idFromRequestsServices ...string) (_ interface{}, err error) {
 	interceptorCtx, span := tracing.NewServerInterceptorSpan(ctx)
 	defer func() { span.EndWithError(err) }()
+
 	for _, service := range idFromRequestsServices {
 		if !strings.HasPrefix(service, "/") {
 			service = "/" + service
 		}
 		if strings.HasPrefix(info.FullMethod, service) {
-			withInstanceIDProperty, ok := req.(interface{ GetInstanceId() string })
+			withInstanceIDProperty, ok := req.(interface {
+				GetInstanceId() string
+			})
 			if !ok {
 				return handler(ctx, req)
 			}
-			ctx = authz.WithInstanceID(ctx, withInstanceIDProperty.GetInstanceId())
-			instance, err := verifier.InstanceByID(ctx)
-			if err != nil {
-				notFoundErr := new(zerrors.NotFoundError)
-				if errors.As(err, &notFoundErr) {
-					notFoundErr.Message = translator.LocalizeFromCtx(ctx, notFoundErr.GetMessage(), nil)
-				}
-				return nil, status.Error(codes.NotFound, err.Error())
-			}
-			return handler(authz.WithInstance(ctx, instance), req)
+			return addInstanceByID(interceptorCtx, req, handler, verifier, translator, withInstanceIDProperty.GetInstanceId())
 		}
 	}
+	explicitInstanceRequest, ok := req.(interface {
+		GetInstance() *object_v3.Instance
+	})
+	if ok {
+		instance := explicitInstanceRequest.GetInstance()
+		if id := instance.GetId(); id != "" {
+			return addInstanceByID(interceptorCtx, req, handler, verifier, translator, id)
+		}
+		if domain := instance.GetDomain(); domain != "" {
+			return addInstanceByDomain(interceptorCtx, req, handler, verifier, translator, domain)
+		}
+	}
+	return addInstanceByRequestedHost(interceptorCtx, req, handler, verifier, translator, externalDomain)
+}
+
+func addInstanceByID(ctx context.Context, req interface{}, handler grpc.UnaryHandler, verifier authz.InstanceVerifier, translator *i18n.Translator, id string) (interface{}, error) {
+	instance, err := verifier.InstanceByID(ctx, id)
+	if err != nil {
+		notFoundErr := new(zerrors.ZitadelError)
+		if errors.As(err, &notFoundErr) {
+			notFoundErr.Message = translator.LocalizeFromCtx(ctx, notFoundErr.GetMessage(), nil)
+		}
+		return nil, status.Error(codes.NotFound, fmt.Errorf("unable to set instance using id %s: %w", id, notFoundErr).Error())
+	}
+	return handler(authz.WithInstance(ctx, instance), req)
+}
+
+func addInstanceByDomain(ctx context.Context, req interface{}, handler grpc.UnaryHandler, verifier authz.InstanceVerifier, translator *i18n.Translator, domain string) (interface{}, error) {
+	instance, err := verifier.InstanceByHost(ctx, domain, "")
+	if err != nil {
+		notFoundErr := new(zerrors.NotFoundError)
+		if errors.As(err, &notFoundErr) {
+			notFoundErr.Message = translator.LocalizeFromCtx(ctx, notFoundErr.GetMessage(), nil)
+		}
+		return nil, status.Error(codes.NotFound, fmt.Errorf("unable to set instance using domain %s: %w", domain, notFoundErr).Error())
+	}
+	return handler(authz.WithInstance(ctx, instance), req)
+}
+
+func addInstanceByRequestedHost(ctx context.Context, req interface{}, handler grpc.UnaryHandler, verifier authz.InstanceVerifier, translator *i18n.Translator, externalDomain string) (interface{}, error) {
 	requestContext := zitadel_http.DomainContext(ctx)
 	if requestContext.InstanceHost == "" {
-		logging.WithFields("origin", requestContext.Origin(), "externalDomain", externalDomain).WithError(err).Error("unable to set instance")
+		logging.WithFields("origin", requestContext.Origin(), "externalDomain", externalDomain).Error("unable to set instance")
 		return nil, status.Error(codes.NotFound, "no instanceHost specified")
 	}
-	instance, err := verifier.InstanceByHost(interceptorCtx, requestContext.InstanceHost, requestContext.PublicHost)
+	instance, err := verifier.InstanceByHost(ctx, requestContext.InstanceHost, requestContext.PublicHost)
 	if err != nil {
 		origin := zitadel_http.DomainContext(ctx)
 		logging.WithFields("origin", requestContext.Origin(), "externalDomain", externalDomain).WithError(err).Error("unable to set instance")
@@ -72,6 +107,5 @@ func setInstance(ctx context.Context, req interface{}, info *grpc.UnaryServerInf
 		}
 		return nil, status.Error(codes.NotFound, fmt.Sprintf("unable to set instance using origin %s (ExternalDomain is %s)", origin, externalDomain))
 	}
-	span.End()
 	return handler(authz.WithInstance(ctx, instance), req)
 }

internal/api/grpc/server/middleware/instance_interceptor_test.go

@@ -13,6 +13,7 @@ import (
 	"github.com/zitadel/zitadel/internal/api/authz"
 	http_util "github.com/zitadel/zitadel/internal/api/http"
 	"github.com/zitadel/zitadel/internal/feature"
+	object_v3 "github.com/zitadel/zitadel/pkg/grpc/object/v3alpha"
 )
 
 func Test_setInstance(t *testing.T) {
@@ -69,6 +70,135 @@ func Test_setInstance(t *testing.T) {
 				err:  false,
 			},
 		},
+		{
+			"explicit instance unset, hostname not found, error",
+			args{
+				ctx:      http_util.WithDomainContext(context.Background(), &http_util.DomainCtx{InstanceHost: "host2"}),
+				req:      &mockRequestWithExplicitInstance{},
+				verifier: &mockInstanceVerifier{instanceHost: "host"},
+			},
+			res{
+				want: nil,
+				err:  true,
+			},
+		},
+		{
+			"explicit instance unset, invalid host, error",
+			args{
+				ctx:      http_util.WithDomainContext(context.Background(), &http_util.DomainCtx{InstanceHost: "host2"}),
+				req:      &mockRequestWithExplicitInstance{},
+				verifier: &mockInstanceVerifier{instanceHost: "host"},
+			},
+			res{
+				want: nil,
+				err:  true,
+			},
+		},
+		{
+			"explicit instance unset, valid host",
+			args{
+				ctx:      http_util.WithDomainContext(context.Background(), &http_util.DomainCtx{InstanceHost: "host"}),
+				req:      &mockRequestWithExplicitInstance{},
+				verifier: &mockInstanceVerifier{instanceHost: "host"},
+				handler: func(ctx context.Context, req interface{}) (interface{}, error) {
+					return req, nil
+				},
+			},
+			res{
+				want: &mockRequestWithExplicitInstance{},
+				err:  false,
+			},
+		},
+		{
+			name: "explicit instance set, id not found, error",
+			args: args{
+				ctx: context.Background(),
+				req: &mockRequestWithExplicitInstance{
+					instance: object_v3.Instance{
+						Property: &object_v3.Instance_Id{
+							Id: "not existing instance id",
+						},
+					},
+				},
+				verifier: &mockInstanceVerifier{id: "existing instance id"},
+			},
+			res: res{
+				want: nil,
+				err:  true,
+			},
+		},
+		{
+			name: "explicit instance set, id found, ok",
+			args: args{
+				ctx: context.Background(),
+				req: &mockRequestWithExplicitInstance{
+					instance: object_v3.Instance{
+						Property: &object_v3.Instance_Id{
+							Id: "existing instance id",
+						},
+					},
+				},
+				verifier: &mockInstanceVerifier{id: "existing instance id"},
+				handler: func(ctx context.Context, req interface{}) (interface{}, error) {
+					return req, nil
+				},
+			},
+			res: res{
+				want: &mockRequestWithExplicitInstance{
+					instance: object_v3.Instance{
+						Property: &object_v3.Instance_Id{
+							Id: "existing instance id",
+						},
+					},
+				},
+				err: false,
+			},
+		},
+		{
+			name: "explicit instance set, domain not found, error",
+			args: args{
+				ctx: context.Background(),
+				req: &mockRequestWithExplicitInstance{
+					instance: object_v3.Instance{
+						Property: &object_v3.Instance_Domain{
+							Domain: "not existing instance domain",
+						},
+					},
+				},
+				verifier: &mockInstanceVerifier{instanceHost: "existing instance domain"},
+			},
+			res: res{
+				want: nil,
+				err:  true,
+			},
+		},
+		{
+			name: "explicit instance set, domain found, ok",
+			args: args{
+				ctx: context.Background(),
+				req: &mockRequestWithExplicitInstance{
+					instance: object_v3.Instance{
+						Property: &object_v3.Instance_Domain{
+							Domain: "existing instance domain",
+						},
+					},
+				},
+				verifier: &mockInstanceVerifier{instanceHost: "existing instance domain"},
+				handler: func(ctx context.Context, req interface{}) (interface{}, error) {
+					return req, nil
+				},
+			},
+			res: res{
+				want: &mockRequestWithExplicitInstance{
+					instance: object_v3.Instance{
+						Property: &object_v3.Instance_Domain{
+							Domain: "existing instance domain",
+						},
+					},
+				},
+				err: false,
+			},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -86,7 +216,16 @@ func Test_setInstance(t *testing.T) {
 
 type mockRequest struct{}
 
+type mockRequestWithExplicitInstance struct {
+	instance object_v3.Instance
+}
+
+func (m *mockRequestWithExplicitInstance) GetInstance() *object_v3.Instance {
+	return &m.instance
+}
+
 type mockInstanceVerifier struct {
+	id           string
 	instanceHost string
 	publicHost   string
 }
@@ -104,7 +243,12 @@ func (m *mockInstanceVerifier) InstanceByHost(_ context.Context, instanceHost, p
 	return &mockInstance{}, nil
 }
 
-func (m *mockInstanceVerifier) InstanceByID(context.Context) (authz.Instance, error) { return nil, nil }
+func (m *mockInstanceVerifier) InstanceByID(_ context.Context, id string) (authz.Instance, error) {
+	if id != m.id {
+		return nil, fmt.Errorf("not found")
+	}
+	return &mockInstance{}, nil
+}
 
 type mockInstance struct{}
 

internal/api/grpc/server/server.go

@@ -2,7 +2,6 @@ package server
 
 import (
 	"crypto/tls"
-
 	grpc_middleware "github.com/grpc-ecosystem/go-grpc-middleware"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"