feat(session/v2): user password lockout error response (#9233)

# Which Problems Are Solved

Adds `failed attempts` field to the grpc response when a user enters
wrong password when logging in

FYI:

this only covers the senario above; other senarios where this is not
applied are:
SetPasswordWithVerifyCode
setPassword
ChangPassword
setPasswordWithPermission

# How the Problems Are Solved 

Created new grpc message `CredentialsCheckError` -
`proto/zitadel/message.proto` to include `failed_attempts` field.

Had to create a new package -
`github.com/zitadel/zitadel/internal/command/errors` to resolve cycle
dependency between `github.com/zitadel/zitadel/internal/command` and
`github.com/zitadel/zitadel/internal/command`.

# Additional Changes

- none

# Additional Context

- Closes https://github.com/zitadel/zitadel/issues/9198

---------

Co-authored-by: Iraq Jaber <IraqJaber@gmail.com>

internal/api/grpc/gerrors/zitadel_errors.go

@@ -7,7 +7,9 @@ import (
 	"github.com/zitadel/logging"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/protoadapt"
 
+	commandErrors "github.com/zitadel/zitadel/internal/command/errors"
 	"github.com/zitadel/zitadel/internal/zerrors"
 	"github.com/zitadel/zitadel/pkg/grpc/message"
 )
@@ -23,7 +25,9 @@ func ZITADELToGRPCError(err error) error {
 	msg := key
 	msg += " (" + id + ")"
 
-	s, err := status.New(code, msg).WithDetails(&message.ErrorDetail{Id: id, Message: key})
+	errorInfo := getErrorInfo(id, key, err)
+
+	s, err := status.New(code, msg).WithDetails(errorInfo)
 	if err != nil {
 		logging.WithError(err).WithField("logID", "GRPC-gIeRw").Debug("unable to add detail")
 		return status.New(code, msg).Err()
@@ -71,3 +75,16 @@ func ExtractZITADELError(err error) (c codes.Code, msg, id string, ok bool) {
 		return codes.Unknown, err.Error(), "", false
 	}
 }
+
+func getErrorInfo(id, key string, err error) protoadapt.MessageV1 {
+	var errorInfo protoadapt.MessageV1
+
+	var wpe *commandErrors.WrongPasswordError
+	if err != nil && errors.As(err, &wpe) {
+		errorInfo = &message.CredentialsCheckError{Id: id, Message: key, FailedAttempts: wpe.FailedAttempts}
+	} else {
+		errorInfo = &message.ErrorDetail{Id: id, Message: key}
+	}
+
+	return errorInfo
+}

internal/api/grpc/gerrors/zitadel_errors_test.go

@@ -2,11 +2,16 @@ package gerrors
 
 import (
 	"errors"
+	"fmt"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
 	"google.golang.org/grpc/codes"
+	"google.golang.org/protobuf/protoadapt"
 
+	commandErrors "github.com/zitadel/zitadel/internal/command/errors"
 	"github.com/zitadel/zitadel/internal/zerrors"
+	"github.com/zitadel/zitadel/pkg/grpc/message"
 )
 
 func TestCaosToGRPCError(t *testing.T) {
@@ -43,6 +48,54 @@ func TestCaosToGRPCError(t *testing.T) {
 	}
 }
 
+func Test_getErrorInfo(t *testing.T) {
+	tests := []struct {
+		name   string
+		id     string
+		key    string
+		err    error
+		result protoadapt.MessageV1
+	}{
+		{
+			name:   "parent error nil, return message.ErrorDetail{}",
+			id:     "id",
+			key:    "key",
+			result: &message.ErrorDetail{Id: "id", Message: "key"},
+		},
+		{
+			name:   "parent error nil not commandErrors.WrongPasswordError{}, return message.ErrorDetail{}",
+			id:     "id",
+			key:    "key",
+			err:    fmt.Errorf("normal error not commandErrors.WrongPasswordError{}"),
+			result: &message.ErrorDetail{Id: "id", Message: "key"},
+		},
+		{
+			name:   "parent error not nil type commandErrors.WrongPasswordError{}, return message.CredentialsCheckError{}",
+			id:     "id",
+			key:    "key",
+			err:    &commandErrors.WrongPasswordError{FailedAttempts: 22},
+			result: &message.CredentialsCheckError{Id: "id", Message: "key", FailedAttempts: 22},
+		},
+		{
+			name: "parent error not nil wrapped commandErrors.WrongPasswordError{}, return message.CredentialsCheckError{}",
+			id:   "id",
+			key:  "key",
+			err: func() error {
+				err := fmt.Errorf("normal error")
+				wpa := &commandErrors.WrongPasswordError{FailedAttempts: 26}
+				return fmt.Errorf("%w: %w", err, wpa)
+			}(),
+			result: &message.CredentialsCheckError{Id: "id", Message: "key", FailedAttempts: 26},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			errorInfo := getErrorInfo(tt.id, tt.key, tt.err)
+			assert.Equal(t, tt.result, errorInfo)
+		})
+	}
+}
+
 func Test_Extract(t *testing.T) {
 	type args struct {
 		err error