feat(api): allow specifying access_token type (opaque/JWT) for service users (#5150)

Add functionality to configure the access token type on the service accounts to provide the oidc library with the necessary information to create the right type of access token.

internal/command/user_machine_model.go

@@ -15,9 +15,10 @@ type MachineWriteModel struct {
 
 	UserName string
 
-	Name        string
-	Description string
-	UserState   domain.UserState
+	Name            string
+	Description     string
+	UserState       domain.UserState
+	AccessTokenType domain.OIDCTokenType
 
 	ClientSecret *crypto.CryptoValue
 }
@@ -38,6 +39,7 @@ func (wm *MachineWriteModel) Reduce() error {
 			wm.UserName = e.UserName
 			wm.Name = e.Name
 			wm.Description = e.Description
+			wm.AccessTokenType = e.AccessTokenType
 			wm.UserState = domain.UserStateActive
 		case *user.UsernameChangedEvent:
 			wm.UserName = e.UserName
@@ -48,6 +50,9 @@ func (wm *MachineWriteModel) Reduce() error {
 			if e.Description != nil {
 				wm.Description = *e.Description
 			}
+			if e.AccessTokenType != nil {
+				wm.AccessTokenType = *e.AccessTokenType
+			}
 		case *user.UserLockedEvent:
 			if wm.UserState != domain.UserStateDeleted {
 				wm.UserState = domain.UserStateLocked
@@ -99,6 +104,7 @@ func (wm *MachineWriteModel) NewChangedEvent(
 	aggregate *eventstore.Aggregate,
 	name,
 	description string,
+	accessTokenType domain.OIDCTokenType,
 ) (*user.MachineChangedEvent, bool, error) {
 	changes := make([]user.MachineChanges, 0)
 	var err error
@@ -109,6 +115,9 @@ func (wm *MachineWriteModel) NewChangedEvent(
 	if wm.Description != description {
 		changes = append(changes, user.ChangeDescription(description))
 	}
+	if wm.AccessTokenType != accessTokenType {
+		changes = append(changes, user.ChangeAccessTokenType(accessTokenType))
+	}
 	if len(changes) == 0 {
 		return nil, false, nil
 	}