From a2890877f10a898fdba4cb00fdc09706906c71c6 Mon Sep 17 00:00:00 2001
From: Max Peintner <max@caos.ch>
Date: Tue, 12 Nov 2024 11:55:01 +0100
Subject: [PATCH 01/31] add logs to login handler

---
 apps/login/src/app/login/route.ts | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/apps/login/src/app/login/route.ts b/apps/login/src/app/login/route.ts
index af8a74f54cf..41e1e87b8d4 100644
--- a/apps/login/src/app/login/route.ts
+++ b/apps/login/src/app/login/route.ts
@@ -102,6 +102,7 @@ export async function GET(request: NextRequest) {
 
         // works not with _rsc request
         try {
+          console.log("create callack for provided session");
           const { callbackUrl } = await createCallback(
             create(CreateCallbackRequestSchema, {
               authRequestId,
@@ -268,6 +269,7 @@ export async function GET(request: NextRequest) {
               sessionId: cookie?.id,
               sessionToken: cookie?.token,
             };
+            console.log("create callack with prompt none");
             const { callbackUrl } = await createCallback(
               create(CreateCallbackRequestSchema, {
                 authRequestId,
@@ -305,6 +307,8 @@ export async function GET(request: NextRequest) {
               sessionToken: cookie?.token,
             };
             try {
+              console.log("create callack - default");
+
               const { callbackUrl } = await createCallback(
                 create(CreateCallbackRequestSchema, {
                   authRequestId,

From 8d969449e2f298f18b085eacec7d7082d1f8f95e Mon Sep 17 00:00:00 2001
From: Max Peintner <max@caos.ch>
Date: Tue, 12 Nov 2024 12:07:31 +0100
Subject: [PATCH 02/31] handle password redirect from browser

---
 apps/login/src/components/change-password-form.tsx | 6 ++++++
 apps/login/src/components/password-form.tsx        | 9 +++++++--
 apps/login/src/components/set-password-form.tsx    | 8 ++++++++
 apps/login/src/lib/server/password.ts              | 3 ++-
 4 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/apps/login/src/components/change-password-form.tsx b/apps/login/src/components/change-password-form.tsx
index b203019a7ab..0ffd79a7a33 100644
--- a/apps/login/src/components/change-password-form.tsx
+++ b/apps/login/src/components/change-password-form.tsx
@@ -12,6 +12,7 @@ import { create } from "@zitadel/client";
 import { ChecksSchema } from "@zitadel/proto/zitadel/session/v2/session_service_pb";
 import { PasswordComplexitySettings } from "@zitadel/proto/zitadel/settings/v2/password_settings_pb";
 import { useTranslations } from "next-intl";
+import { redirect } from "next/navigation";
 import { useState } from "react";
 import { FieldValues, useForm } from "react-hook-form";
 import { Alert } from "./alert";
@@ -103,6 +104,11 @@ export function ChangePasswordForm({
       passwordResponse.error
     ) {
       setError(passwordResponse.error);
+      return;
+    }
+
+    if (passwordResponse && passwordResponse.nextStep) {
+      return redirect(passwordResponse.nextStep);
     }
 
     return;
diff --git a/apps/login/src/components/password-form.tsx b/apps/login/src/components/password-form.tsx
index 1f0e504af33..8621ac8d1cc 100644
--- a/apps/login/src/components/password-form.tsx
+++ b/apps/login/src/components/password-form.tsx
@@ -5,7 +5,7 @@ import { create } from "@zitadel/client";
 import { ChecksSchema } from "@zitadel/proto/zitadel/session/v2/session_service_pb";
 import { LoginSettings } from "@zitadel/proto/zitadel/settings/v2/login_settings_pb";
 import { useTranslations } from "next-intl";
-import { useRouter } from "next/navigation";
+import { redirect, useRouter } from "next/navigation";
 import { useState } from "react";
 import { useForm } from "react-hook-form";
 import { Alert, AlertType } from "./alert";
@@ -71,9 +71,14 @@ export function PasswordForm({
 
     if (response && "error" in response && response.error) {
       setError(response.error);
+      return;
     }
 
-    return response;
+    if (response && response.nextStep) {
+      return redirect(response.nextStep);
+    }
+
+    return;
   }
 
   async function resetPasswordAndContinue() {
diff --git a/apps/login/src/components/set-password-form.tsx b/apps/login/src/components/set-password-form.tsx
index 7bd0b7c488a..e0414b9d580 100644
--- a/apps/login/src/components/set-password-form.tsx
+++ b/apps/login/src/components/set-password-form.tsx
@@ -11,6 +11,7 @@ import { create } from "@zitadel/client";
 import { ChecksSchema } from "@zitadel/proto/zitadel/session/v2/session_service_pb";
 import { PasswordComplexitySettings } from "@zitadel/proto/zitadel/settings/v2/password_settings_pb";
 import { useTranslations } from "next-intl";
+import { redirect } from "next/navigation";
 import { useState } from "react";
 import { FieldValues, useForm } from "react-hook-form";
 import { Alert } from "./alert";
@@ -123,7 +124,14 @@ export function SetPasswordForm({
       passwordResponse.error
     ) {
       setError(passwordResponse.error);
+      return;
     }
+
+    if (passwordResponse && passwordResponse.nextStep) {
+      return redirect(passwordResponse.nextStep);
+    }
+
+    return;
   }
 
   const { errors } = formState;
diff --git a/apps/login/src/lib/server/password.ts b/apps/login/src/lib/server/password.ts
index 2cb512bb971..067517abe23 100644
--- a/apps/login/src/lib/server/password.ts
+++ b/apps/login/src/lib/server/password.ts
@@ -249,7 +249,8 @@ export async function sendPassword(command: UpdateSessionCommand) {
       params.append("organization", command.organization);
     }
 
-    return redirect(`/login?` + params);
+    // move this to browser
+    return { nextStep: `/login?${params}` };
   }
 
   // without OIDC flow

From 9017268e04d747425ac266df4245cf91ed6028e5 Mon Sep 17 00:00:00 2001
From: Max Peintner <max@caos.ch>
Date: Tue, 12 Nov 2024 12:17:16 +0100
Subject: [PATCH 03/31] cleanup password api

---
 apps/login/src/lib/server/password.ts | 35 +++++++++------------------
 1 file changed, 11 insertions(+), 24 deletions(-)

diff --git a/apps/login/src/lib/server/password.ts b/apps/login/src/lib/server/password.ts
index 067517abe23..ce2e4101991 100644
--- a/apps/login/src/lib/server/password.ts
+++ b/apps/login/src/lib/server/password.ts
@@ -124,23 +124,11 @@ export async function sendPassword(command: UpdateSessionCommand) {
     }
   }
 
-  const submitted = {
-    sessionId: session.id,
-    factors: session.factors,
-    challenges: session.challenges,
-    authMethods,
-    userState: user.state,
-  };
-
-  if (
-    !submitted ||
-    !submitted.authMethods ||
-    !submitted.factors?.user?.loginName
-  ) {
+  if (!authMethods || !session.factors?.user?.loginName) {
     return { error: "Could not verify password!" };
   }
 
-  const availableSecondFactors = submitted?.authMethods?.filter(
+  const availableSecondFactors = authMethods?.filter(
     (m: AuthenticationMethodType) =>
       m !== AuthenticationMethodType.PASSWORD &&
       m !== AuthenticationMethodType.PASSKEY,
@@ -148,7 +136,7 @@ export async function sendPassword(command: UpdateSessionCommand) {
 
   if (availableSecondFactors?.length == 1) {
     const params = new URLSearchParams({
-      loginName: submitted.factors?.user.loginName,
+      loginName: session.factors?.user.loginName,
     });
 
     if (command.authRequestId) {
@@ -172,7 +160,7 @@ export async function sendPassword(command: UpdateSessionCommand) {
     }
   } else if (availableSecondFactors?.length >= 1) {
     const params = new URLSearchParams({
-      loginName: submitted.factors.user.loginName,
+      loginName: session.factors.user.loginName,
     });
 
     if (command.authRequestId) {
@@ -184,9 +172,9 @@ export async function sendPassword(command: UpdateSessionCommand) {
     }
 
     return redirect(`/mfa?` + params);
-  } else if (submitted.userState === UserState.INITIAL) {
+  } else if (user.state === UserState.INITIAL) {
     const params = new URLSearchParams({
-      loginName: submitted.factors.user.loginName,
+      loginName: session.factors.user.loginName,
     });
 
     if (command.authRequestId) {
@@ -200,7 +188,7 @@ export async function sendPassword(command: UpdateSessionCommand) {
     return redirect(`/password/change?` + params);
   } else if (command.forceMfa && !availableSecondFactors.length) {
     const params = new URLSearchParams({
-      loginName: submitted.factors.user.loginName,
+      loginName: session.factors.user.loginName,
       force: "true", // this defines if the mfa is forced in the settings
       checkAfter: "true", // this defines if the check is directly made after the setup
     });
@@ -239,9 +227,9 @@ export async function sendPassword(command: UpdateSessionCommand) {
 
   //   return router.push(`/passkey/set?` + params);
   // }
-  else if (command.authRequestId && submitted.sessionId) {
+  else if (command.authRequestId && session.id) {
     const params = new URLSearchParams({
-      sessionId: submitted.sessionId,
+      sessionId: session.id,
       authRequest: command.authRequestId,
     });
 
@@ -249,7 +237,6 @@ export async function sendPassword(command: UpdateSessionCommand) {
       params.append("organization", command.organization);
     }
 
-    // move this to browser
     return { nextStep: `/login?${params}` };
   }
 
@@ -257,11 +244,11 @@ export async function sendPassword(command: UpdateSessionCommand) {
   const params = new URLSearchParams(
     command.authRequestId
       ? {
-          loginName: submitted.factors.user.loginName,
+          loginName: session.factors.user.loginName,
           authRequestId: command.authRequestId,
         }
       : {
-          loginName: submitted.factors.user.loginName,
+          loginName: session.factors.user.loginName,
         },
   );
 

From 096da5e47ba2a2cc8b7598f4a9977129d000234a Mon Sep 17 00:00:00 2001
From: Max Peintner <max@caos.ch>
Date: Tue, 12 Nov 2024 14:16:53 +0100
Subject: [PATCH 04/31] log

---
 apps/login/src/components/password-form.tsx | 2 --
 apps/login/src/lib/server/password.ts       | 2 ++
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/apps/login/src/components/password-form.tsx b/apps/login/src/components/password-form.tsx
index 8621ac8d1cc..27350d5b223 100644
--- a/apps/login/src/components/password-form.tsx
+++ b/apps/login/src/components/password-form.tsx
@@ -77,8 +77,6 @@ export function PasswordForm({
     if (response && response.nextStep) {
       return redirect(response.nextStep);
     }
-
-    return;
   }
 
   async function resetPasswordAndContinue() {
diff --git a/apps/login/src/lib/server/password.ts b/apps/login/src/lib/server/password.ts
index ce2e4101991..085fca450b9 100644
--- a/apps/login/src/lib/server/password.ts
+++ b/apps/login/src/lib/server/password.ts
@@ -237,6 +237,8 @@ export async function sendPassword(command: UpdateSessionCommand) {
       params.append("organization", command.organization);
     }
 
+    console.log("nextStep", `/login?${params}`);
+
     return { nextStep: `/login?${params}` };
   }
 

From 602dbf55eeeae0021e1120ada423e8fe5671b392 Mon Sep 17 00:00:00 2001
From: Max Peintner <max@caos.ch>
Date: Tue, 12 Nov 2024 14:25:33 +0100
Subject: [PATCH 05/31] router push on client

---
 apps/login/src/components/password-form.tsx | 4 ++--
 apps/login/src/lib/server/password.ts       | 2 --
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/apps/login/src/components/password-form.tsx b/apps/login/src/components/password-form.tsx
index 27350d5b223..897cdb80f1a 100644
--- a/apps/login/src/components/password-form.tsx
+++ b/apps/login/src/components/password-form.tsx
@@ -5,7 +5,7 @@ import { create } from "@zitadel/client";
 import { ChecksSchema } from "@zitadel/proto/zitadel/session/v2/session_service_pb";
 import { LoginSettings } from "@zitadel/proto/zitadel/settings/v2/login_settings_pb";
 import { useTranslations } from "next-intl";
-import { redirect, useRouter } from "next/navigation";
+import { useRouter } from "next/navigation";
 import { useState } from "react";
 import { useForm } from "react-hook-form";
 import { Alert, AlertType } from "./alert";
@@ -75,7 +75,7 @@ export function PasswordForm({
     }
 
     if (response && response.nextStep) {
-      return redirect(response.nextStep);
+      return router.push(response.nextStep);
     }
   }
 
diff --git a/apps/login/src/lib/server/password.ts b/apps/login/src/lib/server/password.ts
index 085fca450b9..ce2e4101991 100644
--- a/apps/login/src/lib/server/password.ts
+++ b/apps/login/src/lib/server/password.ts
@@ -237,8 +237,6 @@ export async function sendPassword(command: UpdateSessionCommand) {
       params.append("organization", command.organization);
     }
 
-    console.log("nextStep", `/login?${params}`);
-
     return { nextStep: `/login?${params}` };
   }
 

From 269c8071e2228b45acdaff7fb48a6f3667c18e32 Mon Sep 17 00:00:00 2001
From: Max Peintner <max@caos.ch>
Date: Tue, 12 Nov 2024 14:41:34 +0100
Subject: [PATCH 06/31] load default org on loginname

---
 apps/login/src/app/(login)/loginname/page.tsx | 20 +++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/apps/login/src/app/(login)/loginname/page.tsx b/apps/login/src/app/(login)/loginname/page.tsx
index 928bf1389dd..f0873cf3931 100644
--- a/apps/login/src/app/(login)/loginname/page.tsx
+++ b/apps/login/src/app/(login)/loginname/page.tsx
@@ -3,11 +3,12 @@ import { SignInWithIdp } from "@/components/sign-in-with-idp";
 import { UsernameForm } from "@/components/username-form";
 import {
   getBrandingSettings,
-  getLegalAndSupportSettings,
+  getDefaultOrg,
   getLoginSettings,
   settingsService,
 } from "@/lib/zitadel";
 import { makeReqCtx } from "@zitadel/client/v2";
+import { Organization } from "@zitadel/proto/zitadel/org/v2/org_pb";
 import { getLocale, getTranslations } from "next-intl/server";
 
 function getIdentityProviders(orgId?: string) {
@@ -28,11 +29,22 @@ export default async function Page({
 
   const loginName = searchParams?.loginName;
   const authRequestId = searchParams?.authRequestId;
-  const organization = searchParams?.organization;
+  let organization = searchParams?.organization;
   const submit: boolean = searchParams?.submit === "true";
 
+  if (!organization) {
+    const org: Organization | null = await getDefaultOrg().catch((error) => {
+      console.warn(error);
+      return null;
+    });
+    if (!org) {
+      console.warn("No default organization found");
+    } else {
+      organization = org.id;
+    }
+  }
+
   const loginSettings = await getLoginSettings(organization);
-  const legal = await getLegalAndSupportSettings();
 
   const identityProviders = await getIdentityProviders(organization);
 
@@ -55,7 +67,7 @@ export default async function Page({
           submit={submit}
           allowRegister={!!loginSettings?.allowRegister}
         >
-          {legal && identityProviders && process.env.ZITADEL_API_URL && (
+          {identityProviders && process.env.ZITADEL_API_URL && (
             <SignInWithIdp
               host={host}
               identityProviders={identityProviders}

From a9f51b60ac4958f7ea8d8f12d3827cfc29f8cd94 Mon Sep 17 00:00:00 2001
From: Max Peintner <max@caos.ch>
Date: Tue, 12 Nov 2024 15:30:57 +0100
Subject: [PATCH 07/31] loginname / password page to load default org context
 if no id is provided

---
 apps/login/src/app/(login)/loginname/page.tsx | 25 +++++++----
 apps/login/src/app/(login)/password/page.tsx  | 32 +++++++++++---
 apps/login/src/lib/server/password.ts         | 42 +++++++++++++------
 3 files changed, 73 insertions(+), 26 deletions(-)

diff --git a/apps/login/src/app/(login)/loginname/page.tsx b/apps/login/src/app/(login)/loginname/page.tsx
index f0873cf3931..b6341a523db 100644
--- a/apps/login/src/app/(login)/loginname/page.tsx
+++ b/apps/login/src/app/(login)/loginname/page.tsx
@@ -29,9 +29,10 @@ export default async function Page({
 
   const loginName = searchParams?.loginName;
   const authRequestId = searchParams?.authRequestId;
-  let organization = searchParams?.organization;
+  const organization = searchParams?.organization;
   const submit: boolean = searchParams?.submit === "true";
 
+  let defaultOrganization;
   if (!organization) {
     const org: Organization | null = await getDefaultOrg().catch((error) => {
       console.warn(error);
@@ -40,19 +41,25 @@ export default async function Page({
     if (!org) {
       console.warn("No default organization found");
     } else {
-      organization = org.id;
+      defaultOrganization = org.id;
     }
   }
 
-  const loginSettings = await getLoginSettings(organization);
-
-  const identityProviders = await getIdentityProviders(organization);
-
   const host = process.env.VERCEL_URL
     ? `https://${process.env.VERCEL_URL}`
     : "http://localhost:3000";
 
-  const branding = await getBrandingSettings(organization);
+  const loginSettings = await getLoginSettings(
+    organization ?? defaultOrganization,
+  );
+
+  const identityProviders = await getIdentityProviders(
+    organization ?? defaultOrganization,
+  );
+
+  const branding = await getBrandingSettings(
+    organization ?? defaultOrganization,
+  );
 
   return (
     <DynamicTheme branding={branding}>
@@ -63,7 +70,7 @@ export default async function Page({
         <UsernameForm
           loginName={loginName}
           authRequestId={authRequestId}
-          organization={organization}
+          organization={organization} // stick to "organization" as we still want to do user discovery based on the searchParams not the default organization, later the organization is determined by the found user
           submit={submit}
           allowRegister={!!loginSettings?.allowRegister}
         >
@@ -72,7 +79,7 @@ export default async function Page({
               host={host}
               identityProviders={identityProviders}
               authRequestId={authRequestId}
-              organization={organization}
+              organization={organization ?? defaultOrganization} // use the organization from the searchParams here otherwise fallback to the default organization
             ></SignInWithIdp>
           )}
         </UsernameForm>
diff --git a/apps/login/src/app/(login)/password/page.tsx b/apps/login/src/app/(login)/password/page.tsx
index 1f752850e63..222571854ab 100644
--- a/apps/login/src/app/(login)/password/page.tsx
+++ b/apps/login/src/app/(login)/password/page.tsx
@@ -3,7 +3,12 @@ import { DynamicTheme } from "@/components/dynamic-theme";
 import { PasswordForm } from "@/components/password-form";
 import { UserAvatar } from "@/components/user-avatar";
 import { loadMostRecentSession } from "@/lib/session";
-import { getBrandingSettings, getLoginSettings } from "@/lib/zitadel";
+import {
+  getBrandingSettings,
+  getDefaultOrg,
+  getLoginSettings,
+} from "@/lib/zitadel";
+import { Organization } from "@zitadel/proto/zitadel/org/v2/org_pb";
 import { PasskeysType } from "@zitadel/proto/zitadel/settings/v2/login_settings_pb";
 import { getLocale, getTranslations } from "next-intl/server";
 
@@ -16,7 +21,20 @@ export default async function Page({
   const t = await getTranslations({ locale, namespace: "password" });
   const tError = await getTranslations({ locale, namespace: "error" });
 
-  const { loginName, organization, authRequestId, alt } = searchParams;
+  let { loginName, organization, authRequestId, alt } = searchParams;
+
+  let defaultOrganization;
+  if (!organization) {
+    const org: Organization | null = await getDefaultOrg().catch((error) => {
+      console.warn(error);
+      return null;
+    });
+    if (!org) {
+      console.warn("No default organization found");
+    } else {
+      defaultOrganization = org.id;
+    }
+  }
 
   // also allow no session to be found (ignoreUnkownUsername)
   let sessionFactors;
@@ -30,8 +48,12 @@ export default async function Page({
     console.warn(error);
   }
 
-  const branding = await getBrandingSettings(organization);
-  const loginSettings = await getLoginSettings(organization);
+  const branding = await getBrandingSettings(
+    organization ?? defaultOrganization,
+  );
+  const loginSettings = await getLoginSettings(
+    organization ?? defaultOrganization,
+  );
 
   return (
     <DynamicTheme branding={branding}>
@@ -62,7 +84,7 @@ export default async function Page({
           <PasswordForm
             loginName={loginName}
             authRequestId={authRequestId}
-            organization={organization}
+            organization={organization} // stick to "organization" as we still want to do user discovery based on the searchParams not the default organization, later the organization is determined by the found user
             loginSettings={loginSettings}
             promptPasswordless={
               loginSettings?.passkeysType === PasskeysType.ALLOWED
diff --git a/apps/login/src/lib/server/password.ts b/apps/login/src/lib/server/password.ts
index ce2e4101991..5731229a1c2 100644
--- a/apps/login/src/lib/server/password.ts
+++ b/apps/login/src/lib/server/password.ts
@@ -143,8 +143,11 @@ export async function sendPassword(command: UpdateSessionCommand) {
       params.append("authRequestId", command.authRequestId);
     }
 
-    if (command.organization) {
-      params.append("organization", command.organization);
+    if (command.organization || session.factors?.user?.organizationId) {
+      params.append(
+        "organization",
+        command.organization ?? session.factors?.user?.organizationId,
+      );
     }
 
     const factor = availableSecondFactors[0];
@@ -167,8 +170,11 @@ export async function sendPassword(command: UpdateSessionCommand) {
       params.append("authRequestId", command.authRequestId);
     }
 
-    if (command.organization) {
-      params.append("organization", command.organization);
+    if (command.organization || session.factors?.user?.organizationId) {
+      params.append(
+        "organization",
+        command.organization ?? session.factors?.user?.organizationId,
+      );
     }
 
     return redirect(`/mfa?` + params);
@@ -181,8 +187,11 @@ export async function sendPassword(command: UpdateSessionCommand) {
       params.append("authRequestId", command.authRequestId);
     }
 
-    if (command.organization) {
-      params.append("organization", command.organization);
+    if (command.organization || session.factors?.user?.organizationId) {
+      params.append(
+        "organization",
+        command.organization ?? session.factors?.user?.organizationId,
+      );
     }
 
     return redirect(`/password/change?` + params);
@@ -197,8 +206,11 @@ export async function sendPassword(command: UpdateSessionCommand) {
       params.append("authRequestId", command.authRequestId);
     }
 
-    if (command.organization) {
-      params.append("organization", command.organization);
+    if (command.organization || session.factors?.user?.organizationId) {
+      params.append(
+        "organization",
+        command.organization ?? session.factors?.user?.organizationId,
+      );
     }
 
     // TODO: provide a way to setup passkeys on mfa page?
@@ -233,8 +245,11 @@ export async function sendPassword(command: UpdateSessionCommand) {
       authRequest: command.authRequestId,
     });
 
-    if (command.organization) {
-      params.append("organization", command.organization);
+    if (command.organization || session.factors?.user?.organizationId) {
+      params.append(
+        "organization",
+        command.organization ?? session.factors?.user?.organizationId,
+      );
     }
 
     return { nextStep: `/login?${params}` };
@@ -252,8 +267,11 @@ export async function sendPassword(command: UpdateSessionCommand) {
         },
   );
 
-  if (command.organization) {
-    params.append("organization", command.organization);
+  if (command.organization || session.factors?.user?.organizationId) {
+    params.append(
+      "organization",
+      command.organization ?? session.factors?.user?.organizationId,
+    );
   }
 
   return redirect(`/signedin?` + params);

From 141fa320267f3af2e693b56db160aa509381f741 Mon Sep 17 00:00:00 2001
From: Max Peintner <max@caos.ch>
Date: Tue, 12 Nov 2024 15:35:13 +0100
Subject: [PATCH 08/31] cleanup logs

---
 apps/login/src/app/login/route.ts | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/apps/login/src/app/login/route.ts b/apps/login/src/app/login/route.ts
index 41e1e87b8d4..af8a74f54cf 100644
--- a/apps/login/src/app/login/route.ts
+++ b/apps/login/src/app/login/route.ts
@@ -102,7 +102,6 @@ export async function GET(request: NextRequest) {
 
         // works not with _rsc request
         try {
-          console.log("create callack for provided session");
           const { callbackUrl } = await createCallback(
             create(CreateCallbackRequestSchema, {
               authRequestId,
@@ -269,7 +268,6 @@ export async function GET(request: NextRequest) {
               sessionId: cookie?.id,
               sessionToken: cookie?.token,
             };
-            console.log("create callack with prompt none");
             const { callbackUrl } = await createCallback(
               create(CreateCallbackRequestSchema, {
                 authRequestId,
@@ -307,8 +305,6 @@ export async function GET(request: NextRequest) {
               sessionToken: cookie?.token,
             };
             try {
-              console.log("create callack - default");
-
               const { callbackUrl } = await createCallback(
                 create(CreateCallbackRequestSchema, {
                   authRequestId,

From eef1728a1867f7a98fb6ba12a79e0a44a31103a6 Mon Sep 17 00:00:00 2001
From: Max Peintner <max@caos.ch>
Date: Tue, 12 Nov 2024 16:54:42 +0100
Subject: [PATCH 09/31] cleanup def loading

---
 apps/login/src/app/(login)/loginname/page.tsx | 9 ++-------
 apps/login/src/app/(login)/password/page.tsx  | 9 ++-------
 apps/login/src/app/(login)/register/page.tsx  | 9 ++-------
 3 files changed, 6 insertions(+), 21 deletions(-)

diff --git a/apps/login/src/app/(login)/loginname/page.tsx b/apps/login/src/app/(login)/loginname/page.tsx
index b6341a523db..68928755d33 100644
--- a/apps/login/src/app/(login)/loginname/page.tsx
+++ b/apps/login/src/app/(login)/loginname/page.tsx
@@ -34,13 +34,8 @@ export default async function Page({
 
   let defaultOrganization;
   if (!organization) {
-    const org: Organization | null = await getDefaultOrg().catch((error) => {
-      console.warn(error);
-      return null;
-    });
-    if (!org) {
-      console.warn("No default organization found");
-    } else {
+    const org: Organization | null = await getDefaultOrg();
+    if (org) {
       defaultOrganization = org.id;
     }
   }
diff --git a/apps/login/src/app/(login)/password/page.tsx b/apps/login/src/app/(login)/password/page.tsx
index 222571854ab..659488043bc 100644
--- a/apps/login/src/app/(login)/password/page.tsx
+++ b/apps/login/src/app/(login)/password/page.tsx
@@ -25,13 +25,8 @@ export default async function Page({
 
   let defaultOrganization;
   if (!organization) {
-    const org: Organization | null = await getDefaultOrg().catch((error) => {
-      console.warn(error);
-      return null;
-    });
-    if (!org) {
-      console.warn("No default organization found");
-    } else {
+    const org: Organization | null = await getDefaultOrg();
+    if (org) {
       defaultOrganization = org.id;
     }
   }
diff --git a/apps/login/src/app/(login)/register/page.tsx b/apps/login/src/app/(login)/register/page.tsx
index 931cad0e087..f23582ae3f7 100644
--- a/apps/login/src/app/(login)/register/page.tsx
+++ b/apps/login/src/app/(login)/register/page.tsx
@@ -22,13 +22,8 @@ export default async function Page({
     searchParams;
 
   if (!organization) {
-    const org: Organization | null = await getDefaultOrg().catch((error) => {
-      console.warn(error);
-      return null;
-    });
-    if (!org) {
-      console.warn("No default organization found");
-    } else {
+    const org: Organization | null = await getDefaultOrg();
+    if (org) {
       organization = org.id;
     }
   }

From 657418d51bd6089286bc8e32730b551cd4519e40 Mon Sep 17 00:00:00 2001
From: Max Peintner <max@caos.ch>
Date: Tue, 12 Nov 2024 17:02:47 +0100
Subject: [PATCH 10/31] login integration test

---
 apps/login/cypress/integration/login.cy.ts | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/apps/login/cypress/integration/login.cy.ts b/apps/login/cypress/integration/login.cy.ts
index bb83ca375a2..f293653af1d 100644
--- a/apps/login/cypress/integration/login.cy.ts
+++ b/apps/login/cypress/integration/login.cy.ts
@@ -2,6 +2,14 @@ import { stub } from "../support/mock";
 
 describe("login", () => {
   beforeEach(() => {
+    stub("zitadel.org.v2.OrganizationService", "ListOrganizations", {
+      data: {
+        details: {
+          totalResult: 1,
+        },
+        result: [{ id: "256088834543534543" }],
+      },
+    });
     stub("zitadel.session.v2.SessionService", "CreateSession", {
       data: {
         details: {

From d5a249d7e5d4a48ec45b9f8a7f766b0c4edf0e0b Mon Sep 17 00:00:00 2001
From: Max Peintner <max@caos.ch>
Date: Thu, 14 Nov 2024 09:24:57 +0100
Subject: [PATCH 11/31] catch def org error

---
 apps/login/src/app/(login)/loginname/page.tsx | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/apps/login/src/app/(login)/loginname/page.tsx b/apps/login/src/app/(login)/loginname/page.tsx
index 68928755d33..b71ff468412 100644
--- a/apps/login/src/app/(login)/loginname/page.tsx
+++ b/apps/login/src/app/(login)/loginname/page.tsx
@@ -34,7 +34,10 @@ export default async function Page({
 
   let defaultOrganization;
   if (!organization) {
-    const org: Organization | null = await getDefaultOrg();
+    const org: Organization | null = await getDefaultOrg().catch((error) => {
+      console.warn(error);
+      return null;
+    });
     if (org) {
       defaultOrganization = org.id;
     }

From 258c3c497d6c4821a9e373c16da4702658339716 Mon Sep 17 00:00:00 2001
From: Max Peintner <max@caos.ch>
Date: Thu, 14 Nov 2024 09:25:39 +0100
Subject: [PATCH 12/31] catch def org on pwd page

---
 apps/login/src/app/(login)/password/page.tsx | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/apps/login/src/app/(login)/password/page.tsx b/apps/login/src/app/(login)/password/page.tsx
index 659488043bc..9fe93dcb612 100644
--- a/apps/login/src/app/(login)/password/page.tsx
+++ b/apps/login/src/app/(login)/password/page.tsx
@@ -25,7 +25,10 @@ export default async function Page({
 
   let defaultOrganization;
   if (!organization) {
-    const org: Organization | null = await getDefaultOrg();
+    const org: Organization | null = await getDefaultOrg().catch((error) => {
+      console.warn(error);
+      return null;
+    });
     if (org) {
       defaultOrganization = org.id;
     }

From 3311042195f83e61bda2a58db898ddd02359ddbb Mon Sep 17 00:00:00 2001
From: Max Peintner <max@caos.ch>
Date: Thu, 14 Nov 2024 09:35:40 +0100
Subject: [PATCH 13/31] redirect to /loginname

---
 apps/login/src/app/(login)/loginname/page.tsx | 9 +++++----
 apps/login/src/app/(login)/page.tsx           | 6 +++---
 apps/login/src/app/(login)/password/page.tsx  | 9 +++++----
 3 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/apps/login/src/app/(login)/loginname/page.tsx b/apps/login/src/app/(login)/loginname/page.tsx
index b71ff468412..47e3245cc91 100644
--- a/apps/login/src/app/(login)/loginname/page.tsx
+++ b/apps/login/src/app/(login)/loginname/page.tsx
@@ -34,10 +34,11 @@ export default async function Page({
 
   let defaultOrganization;
   if (!organization) {
-    const org: Organization | null = await getDefaultOrg().catch((error) => {
-      console.warn(error);
-      return null;
-    });
+    const org: Organization | null = await getDefaultOrg();
+    // .catch((error) => {
+    //   console.warn(error);
+    //   return null;
+    // });
     if (org) {
       defaultOrganization = org.id;
     }
diff --git a/apps/login/src/app/(login)/page.tsx b/apps/login/src/app/(login)/page.tsx
index f1fce50f90d..9a530bc59d4 100644
--- a/apps/login/src/app/(login)/page.tsx
+++ b/apps/login/src/app/(login)/page.tsx
@@ -2,7 +2,7 @@ import { redirect } from "next/navigation";
 
 export default function Page() {
   // automatically redirect to loginname
-  if (process.env.DEBUG !== "true") {
-    redirect("/loginname");
-  }
+  //   if (process.env.DEBUG !== "true") {
+  redirect("/loginname");
+  //   }
 }
diff --git a/apps/login/src/app/(login)/password/page.tsx b/apps/login/src/app/(login)/password/page.tsx
index 9fe93dcb612..4fc1e544575 100644
--- a/apps/login/src/app/(login)/password/page.tsx
+++ b/apps/login/src/app/(login)/password/page.tsx
@@ -25,10 +25,11 @@ export default async function Page({
 
   let defaultOrganization;
   if (!organization) {
-    const org: Organization | null = await getDefaultOrg().catch((error) => {
-      console.warn(error);
-      return null;
-    });
+    const org: Organization | null = await getDefaultOrg();
+    // .catch((error) => {
+    //   console.warn(error);
+    //   return null;
+    // });
     if (org) {
       defaultOrganization = org.id;
     }

From 5fa43f02397716a1a2ff1a9c7b17d9d41f1a11b5 Mon Sep 17 00:00:00 2001
From: Max Peintner <max@caos.ch>
Date: Thu, 14 Nov 2024 09:44:19 +0100
Subject: [PATCH 14/31] loginname as starting point

---
 acceptance/tests/username-password.spec.ts    |  2 +-
 .../src/components/mobile-nav-toggle.tsx      | 71 -------------------
 2 files changed, 1 insertion(+), 72 deletions(-)
 delete mode 100644 apps/login/src/components/mobile-nav-toggle.tsx

diff --git a/acceptance/tests/username-password.spec.ts b/acceptance/tests/username-password.spec.ts
index 31d165358e0..071bbd18dc3 100644
--- a/acceptance/tests/username-password.spec.ts
+++ b/acceptance/tests/username-password.spec.ts
@@ -1,7 +1,7 @@
 import { test } from "@playwright/test";
 
 test("username and password", async ({ page }) => {
-  await page.goto("/");
+  await page.goto("/loginname");
   const loginname = page.getByLabel("Loginname");
   await loginname.pressSequentially("zitadel-admin@zitadel.localhost");
   await loginname.press("Enter");
diff --git a/apps/login/src/components/mobile-nav-toggle.tsx b/apps/login/src/components/mobile-nav-toggle.tsx
deleted file mode 100644
index e288237ee15..00000000000
--- a/apps/login/src/components/mobile-nav-toggle.tsx
+++ /dev/null
@@ -1,71 +0,0 @@
-"use client";
-
-import { Bars3Icon, XMarkIcon } from "@heroicons/react/24/solid";
-import { clsx } from "clsx";
-import {
-  createContext,
-  Dispatch,
-  ReactNode,
-  SetStateAction,
-  useContext,
-  useState,
-} from "react";
-
-const MobileNavContext = createContext<
-  [boolean, Dispatch<SetStateAction<boolean>>] | undefined
->(undefined);
-
-export function MobileNavContextProvider({
-  children,
-}: {
-  children: ReactNode;
-}) {
-  const [isOpen, setIsOpen] = useState(false);
-  return (
-    <MobileNavContext.Provider value={[isOpen, setIsOpen]}>
-      {children}
-    </MobileNavContext.Provider>
-  );
-}
-
-export function useMobileNavToggle() {
-  const context = useContext(MobileNavContext);
-  if (context === undefined) {
-    throw new Error(
-      "useMobileNavToggle must be used within a MobileNavContextProvider",
-    );
-  }
-  return context;
-}
-
-export function MobileNavToggle({ children }: { children: ReactNode }) {
-  const [isOpen, setIsOpen] = useMobileNavToggle();
-
-  return (
-    <>
-      <button
-        type="button"
-        className="group absolute right-0 top-0 flex h-14 items-center space-x-2 px-4 lg:hidden"
-        onClick={() => setIsOpen(!isOpen)}
-      >
-        <div className="font-medium text-text-light-secondary-500 dark:text-text-dark-secondary-500 group-hover:text-text-light-500 dark:group-hover:text-text-dark-500">
-          Menu
-        </div>
-        {isOpen ? (
-          <XMarkIcon className="block w-6" />
-        ) : (
-          <Bars3Icon className="block w-6" />
-        )}
-      </button>
-
-      <div
-        className={clsx("overflow-y-auto lg:static lg:block", {
-          "fixed inset-x-0 bottom-0 top-14 bg-gray-900": isOpen,
-          hidden: !isOpen,
-        })}
-      >
-        {children}
-      </div>
-    </>
-  );
-}

From 14eaa51b2839b49a840694c555badb78def31673 Mon Sep 17 00:00:00 2001
From: Max Peintner <max@caos.ch>
Date: Thu, 14 Nov 2024 09:52:17 +0100
Subject: [PATCH 15/31] debug=true

---
 acceptance/setup.sh                 | 4 +++-
 apps/login/src/app/(login)/page.tsx | 6 +++---
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/acceptance/setup.sh b/acceptance/setup.sh
index 5359659efab..aed1f1d8de4 100755
--- a/acceptance/setup.sh
+++ b/acceptance/setup.sh
@@ -29,6 +29,8 @@ echo "Writing environment file to ${WRITE_ENVIRONMENT_FILE} when done."
 
 echo "ZITADEL_API_URL=${ZITADEL_API_URL}
 ZITADEL_SERVICE_USER_ID=${ZITADEL_SERVICE_USER_ID}
-ZITADEL_SERVICE_USER_TOKEN=${PAT}" > ${WRITE_ENVIRONMENT_FILE}
+ZITADEL_SERVICE_USER_TOKEN=${PAT}
+DEBUG=true" > ${WRITE_ENVIRONMENT_FILE}
+
 echo "Wrote environment file ${WRITE_ENVIRONMENT_FILE}"
 cat ${WRITE_ENVIRONMENT_FILE}
diff --git a/apps/login/src/app/(login)/page.tsx b/apps/login/src/app/(login)/page.tsx
index 9a530bc59d4..f1fce50f90d 100644
--- a/apps/login/src/app/(login)/page.tsx
+++ b/apps/login/src/app/(login)/page.tsx
@@ -2,7 +2,7 @@ import { redirect } from "next/navigation";
 
 export default function Page() {
   // automatically redirect to loginname
-  //   if (process.env.DEBUG !== "true") {
-  redirect("/loginname");
-  //   }
+  if (process.env.DEBUG !== "true") {
+    redirect("/loginname");
+  }
 }

From 3ca7d9929fab73e709d94ef164e6e4231b866d88 Mon Sep 17 00:00:00 2001
From: Max Peintner <max@caos.ch>
Date: Thu, 14 Nov 2024 10:04:01 +0100
Subject: [PATCH 16/31] catch error on default org

---
 apps/login/src/app/(login)/loginname/page.tsx | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/apps/login/src/app/(login)/loginname/page.tsx b/apps/login/src/app/(login)/loginname/page.tsx
index 47e3245cc91..b71ff468412 100644
--- a/apps/login/src/app/(login)/loginname/page.tsx
+++ b/apps/login/src/app/(login)/loginname/page.tsx
@@ -34,11 +34,10 @@ export default async function Page({
 
   let defaultOrganization;
   if (!organization) {
-    const org: Organization | null = await getDefaultOrg();
-    // .catch((error) => {
-    //   console.warn(error);
-    //   return null;
-    // });
+    const org: Organization | null = await getDefaultOrg().catch((error) => {
+      console.warn(error);
+      return null;
+    });
     if (org) {
       defaultOrganization = org.id;
     }

From 9b2ed8d200df01b94e2fdffe1753056096f3faff Mon Sep 17 00:00:00 2001
From: Max Peintner <max@caos.ch>
Date: Thu, 14 Nov 2024 10:25:36 +0100
Subject: [PATCH 17/31] script

---
 acceptance/docker-compose.yaml | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/acceptance/docker-compose.yaml b/acceptance/docker-compose.yaml
index 59839e00179..f15cd7524eb 100644
--- a/acceptance/docker-compose.yaml
+++ b/acceptance/docker-compose.yaml
@@ -13,7 +13,7 @@ services:
         condition: "service_healthy"
 
   db:
-    restart: 'always'
+    restart: "always"
     image: "${POSTGRES_IMAGE:-postgres:latest}"
     environment:
       - POSTGRES_USER=zitadel
@@ -23,10 +23,10 @@ services:
     command: postgres -c shared_preload_libraries=pg_stat_statements -c pg_stat_statements.track=all -c shared_buffers=1GB -c work_mem=16MB -c effective_io_concurrency=100 -c wal_level=minimal -c archive_mode=off -c max_wal_senders=0
     healthcheck:
       test: ["CMD-SHELL", "pg_isready"]
-      interval: '10s'
-      timeout: '30s'
+      interval: "10s"
+      timeout: "30s"
       retries: 5
-      start_period: '20s'
+      start_period: "20s"
     ports:
       - 5432:5432
 
@@ -34,10 +34,10 @@ services:
     image: curlimages/curl:8.00.1
     command:
       [
-        "/bin/sh",
-        "-c",
-        "i=0; while ! curl http://zitadel:8080/debug/ready && [ $$i -lt 30 ]; do sleep 1; i=$$((i+1)); done; [ $$i -eq 120 ] && exit 1 || exit 0",
+        "CMD-SHELL",
+        "until curl -s -o /dev/null -w '%{http_code}' http://zitadel:8080/debug/ready | grep -q 200; do sleep 5; done",
       ]
+
     depends_on:
       - zitadel
 

From 17b04dce54e8afb152bbc82b54555c261349899e Mon Sep 17 00:00:00 2001
From: Max Peintner <max@caos.ch>
Date: Thu, 14 Nov 2024 10:30:38 +0100
Subject: [PATCH 18/31] script

---
 acceptance/docker-compose.yaml | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/acceptance/docker-compose.yaml b/acceptance/docker-compose.yaml
index f15cd7524eb..b106e5a89d2 100644
--- a/acceptance/docker-compose.yaml
+++ b/acceptance/docker-compose.yaml
@@ -32,11 +32,7 @@ services:
 
   wait_for_zitadel:
     image: curlimages/curl:8.00.1
-    command:
-      [
-        "CMD-SHELL",
-        "until curl -s -o /dev/null -w '%{http_code}' http://zitadel:8080/debug/ready | grep -q 200; do sleep 5; done",
-      ]
+    command: /bin/sh -c "until curl -s -o /dev/null -w '%{http_code}' http://zitadel:8080/debug/ready | grep -q 200; do sleep 5; done"
 
     depends_on:
       - zitadel

From 8303c492eecee314f862948654a77ecdb495e848 Mon Sep 17 00:00:00 2001
From: Max Peintner <max@caos.ch>
Date: Thu, 14 Nov 2024 10:35:36 +0100
Subject: [PATCH 19/31] escape error catching

---
 apps/login/src/app/(login)/loginname/page.tsx | 5 +----
 apps/login/src/app/(login)/password/page.tsx  | 5 +----
 2 files changed, 2 insertions(+), 8 deletions(-)

diff --git a/apps/login/src/app/(login)/loginname/page.tsx b/apps/login/src/app/(login)/loginname/page.tsx
index b71ff468412..68928755d33 100644
--- a/apps/login/src/app/(login)/loginname/page.tsx
+++ b/apps/login/src/app/(login)/loginname/page.tsx
@@ -34,10 +34,7 @@ export default async function Page({
 
   let defaultOrganization;
   if (!organization) {
-    const org: Organization | null = await getDefaultOrg().catch((error) => {
-      console.warn(error);
-      return null;
-    });
+    const org: Organization | null = await getDefaultOrg();
     if (org) {
       defaultOrganization = org.id;
     }
diff --git a/apps/login/src/app/(login)/password/page.tsx b/apps/login/src/app/(login)/password/page.tsx
index 4fc1e544575..9731e4030e8 100644
--- a/apps/login/src/app/(login)/password/page.tsx
+++ b/apps/login/src/app/(login)/password/page.tsx
@@ -26,10 +26,7 @@ export default async function Page({
   let defaultOrganization;
   if (!organization) {
     const org: Organization | null = await getDefaultOrg();
-    // .catch((error) => {
-    //   console.warn(error);
-    //   return null;
-    // });
+
     if (org) {
       defaultOrganization = org.id;
     }

From 7a40a3c4f4e833a3c99e8777e8933f59dde71ed7 Mon Sep 17 00:00:00 2001
From: Stefan Benz <46600784+stebenz@users.noreply.github.com>
Date: Thu, 14 Nov 2024 12:46:27 +0100
Subject: [PATCH 20/31] chore: correct ready check for acceptance tests

---
 acceptance/docker-compose.yaml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/acceptance/docker-compose.yaml b/acceptance/docker-compose.yaml
index b106e5a89d2..e8448ddb002 100644
--- a/acceptance/docker-compose.yaml
+++ b/acceptance/docker-compose.yaml
@@ -32,8 +32,7 @@ services:
 
   wait_for_zitadel:
     image: curlimages/curl:8.00.1
-    command: /bin/sh -c "until curl -s -o /dev/null -w '%{http_code}' http://zitadel:8080/debug/ready | grep -q 200; do sleep 5; done"
-
+    command: /bin/sh -c "until curl -s -o /dev/null -i -f http://zitadel:8080/debug/ready; do echo 'waiting' && sleep 1; done; echo 'ready' && sleep 5;" || false
     depends_on:
       - zitadel
 

From 0cbde4c74b860e39bd5f81f2deeb51389ee1512c Mon Sep 17 00:00:00 2001
From: Stefan Benz <46600784+stebenz@users.noreply.github.com>
Date: Thu, 14 Nov 2024 15:32:18 +0100
Subject: [PATCH 21/31] chore: add wait for default organization to setup

---
 acceptance/setup.sh | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/acceptance/setup.sh b/acceptance/setup.sh
index aed1f1d8de4..7c8dd2c0111 100755
--- a/acceptance/setup.sh
+++ b/acceptance/setup.sh
@@ -34,3 +34,14 @@ DEBUG=true" > ${WRITE_ENVIRONMENT_FILE}
 
 echo "Wrote environment file ${WRITE_ENVIRONMENT_FILE}"
 cat ${WRITE_ENVIRONMENT_FILE}
+
+# waiting for default organization
+until $(echo "$DEFAULTORG_RESPONSE" | jq -r '.result | length') == 1
+do
+  DEFAULTORG_RESPONSE=$(curl -s --request POST \
+      --url "${ZITADEL_API_INTERNAL_URL}/v2/organizations/_search" \
+      --header "Authorization: Bearer ${PAT}" \
+      --header "Host: ${ZITADEL_API_DOMAIN}" \
+      -d '{"queries": [{"defaultQuery": {}}]}'  )
+  echo "Received default organization response: ${DEFAULTORG_RESPONSE}"
+done

From b43db1ff2bd2ec1c736e3a7c160ad77516e98943 Mon Sep 17 00:00:00 2001
From: Max Peintner <max@caos.ch>
Date: Thu, 14 Nov 2024 15:43:29 +0100
Subject: [PATCH 22/31] change setup script

---
 acceptance/setup.sh | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/acceptance/setup.sh b/acceptance/setup.sh
index 7c8dd2c0111..1756cf428ed 100755
--- a/acceptance/setup.sh
+++ b/acceptance/setup.sh
@@ -36,12 +36,18 @@ echo "Wrote environment file ${WRITE_ENVIRONMENT_FILE}"
 cat ${WRITE_ENVIRONMENT_FILE}
 
 # waiting for default organization
-until $(echo "$DEFAULTORG_RESPONSE" | jq -r '.result | length') == 1
-do
+until [ "$(echo "$DEFAULTORG_RESPONSE" | jq -r '.result | length')" -eq 1 ]; do
   DEFAULTORG_RESPONSE=$(curl -s --request POST \
       --url "${ZITADEL_API_INTERNAL_URL}/v2/organizations/_search" \
       --header "Authorization: Bearer ${PAT}" \
       --header "Host: ${ZITADEL_API_DOMAIN}" \
-      -d '{"queries": [{"defaultQuery": {}}]}'  )
+      -d '{"queries": [{"defaultQuery": {}}]}' )
+
+  if [ $? -ne 0 ]; then
+    echo "Error: Failed to fetch default organization response"
+    exit 1
+  fi
+
   echo "Received default organization response: ${DEFAULTORG_RESPONSE}"
-done
+  sleep 5
+done
\ No newline at end of file

From 414be0343cab4e5595ff0766cd0653f520eb36f6 Mon Sep 17 00:00:00 2001
From: Max Peintner <max@caos.ch>
Date: Thu, 14 Nov 2024 15:54:39 +0100
Subject: [PATCH 23/31] revert :D and set value

---
 acceptance/setup.sh | 14 ++++----------
 1 file changed, 4 insertions(+), 10 deletions(-)

diff --git a/acceptance/setup.sh b/acceptance/setup.sh
index 1756cf428ed..90f40191dec 100755
--- a/acceptance/setup.sh
+++ b/acceptance/setup.sh
@@ -36,18 +36,12 @@ echo "Wrote environment file ${WRITE_ENVIRONMENT_FILE}"
 cat ${WRITE_ENVIRONMENT_FILE}
 
 # waiting for default organization
-until [ "$(echo "$DEFAULTORG_RESPONSE" | jq -r '.result | length')" -eq 1 ]; do
+until $(echo "$DEFAULTORG_RESPONSE" | jq -r '.result | length') == 1
+do
   DEFAULTORG_RESPONSE=$(curl -s --request POST \
       --url "${ZITADEL_API_INTERNAL_URL}/v2/organizations/_search" \
       --header "Authorization: Bearer ${PAT}" \
       --header "Host: ${ZITADEL_API_DOMAIN}" \
-      -d '{"queries": [{"defaultQuery": {}}]}' )
-
-  if [ $? -ne 0 ]; then
-    echo "Error: Failed to fetch default organization response"
-    exit 1
-  fi
-
+      -d '{"queries": [{"defaultQuery": {"value": true}}]}'  )
   echo "Received default organization response: ${DEFAULTORG_RESPONSE}"
-  sleep 5
-done
\ No newline at end of file
+done

From 882b3c59a278e233ef7e1f81b2325be7f87ad906 Mon Sep 17 00:00:00 2001
From: Stefan Benz <46600784+stebenz@users.noreply.github.com>
Date: Thu, 14 Nov 2024 16:33:58 +0100
Subject: [PATCH 24/31] chore: add wait for default organization to setup

---
 acceptance/setup.sh | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/acceptance/setup.sh b/acceptance/setup.sh
index 7c8dd2c0111..525819f4179 100755
--- a/acceptance/setup.sh
+++ b/acceptance/setup.sh
@@ -35,13 +35,14 @@ DEBUG=true" > ${WRITE_ENVIRONMENT_FILE}
 echo "Wrote environment file ${WRITE_ENVIRONMENT_FILE}"
 cat ${WRITE_ENVIRONMENT_FILE}
 
+DEFAULTORG_RESPONSE_RESULTS=0
 # waiting for default organization
-until $(echo "$DEFAULTORG_RESPONSE" | jq -r '.result | length') == 1
+until [ ${DEFAULTORG_RESPONSE_RESULTS} -eq 1 ]
 do
-  DEFAULTORG_RESPONSE=$(curl -s --request POST \
+  DEFAULTORG_RESPONSE_RESULTS=$(curl -s --request POST \
       --url "${ZITADEL_API_INTERNAL_URL}/v2/organizations/_search" \
       --header "Authorization: Bearer ${PAT}" \
       --header "Host: ${ZITADEL_API_DOMAIN}" \
-      -d '{"queries": [{"defaultQuery": {}}]}'  )
-  echo "Received default organization response: ${DEFAULTORG_RESPONSE}"
+      -d '{"queries": [{"defaultQuery": {}}]}' | jq -r '.result | length')
+  echo "Received default organization response results: ${DEFAULTORG_RESPONSE_RESULTS}"
 done

From e44ef268aa8108e61e08d3f2bfab0afb3f6c5e3d Mon Sep 17 00:00:00 2001
From: Stefan Benz <46600784+stebenz@users.noreply.github.com>
Date: Thu, 14 Nov 2024 16:42:41 +0100
Subject: [PATCH 25/31] chore: add wait for default organization to setup

---
 acceptance/setup.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/acceptance/setup.sh b/acceptance/setup.sh
index a9b3cf6d31b..2f770db88d3 100755
--- a/acceptance/setup.sh
+++ b/acceptance/setup.sh
@@ -35,10 +35,13 @@ DEBUG=true" > ${WRITE_ENVIRONMENT_FILE}
 echo "Wrote environment file ${WRITE_ENVIRONMENT_FILE}"
 cat ${WRITE_ENVIRONMENT_FILE}
 
+sleep 10s
+
 DEFAULTORG_RESPONSE_RESULTS=0
 # waiting for default organization
 until [ ${DEFAULTORG_RESPONSE_RESULTS} -eq 1 ]
 do
+  sleep 1s
   DEFAULTORG_RESPONSE_RESULTS=$(curl -s --request POST \
       --url "${ZITADEL_API_INTERNAL_URL}/v2/organizations/_search" \
       --header "Authorization: Bearer ${PAT}" \

From 83db788995f55be95f03fe5e041f5a8c5473812f Mon Sep 17 00:00:00 2001
From: Stefan Benz <46600784+stebenz@users.noreply.github.com>
Date: Thu, 14 Nov 2024 17:02:36 +0100
Subject: [PATCH 26/31] chore: add wait for default organization to setup

---
 acceptance/setup.sh | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/acceptance/setup.sh b/acceptance/setup.sh
index 2f770db88d3..e010785e6e4 100755
--- a/acceptance/setup.sh
+++ b/acceptance/setup.sh
@@ -42,10 +42,12 @@ DEFAULTORG_RESPONSE_RESULTS=0
 until [ ${DEFAULTORG_RESPONSE_RESULTS} -eq 1 ]
 do
   sleep 1s
-  DEFAULTORG_RESPONSE_RESULTS=$(curl -s --request POST \
+  DEFAULTORG_RESPONSE=$(curl -s --request POST \
       --url "${ZITADEL_API_INTERNAL_URL}/v2/organizations/_search" \
       --header "Authorization: Bearer ${PAT}" \
       --header "Host: ${ZITADEL_API_DOMAIN}" \
-      -d '{"queries": [{"defaultQuery": {"value": true}}]}' | jq -r '.result | length')
-  echo "Received default organization response results: ${DEFAULTORG_RESPONSE_RESULTS}"
+      -d '{"queries": [{"defaultQuery": {"value": true}}]}')
+  echo "Received default organization response: ${DEFAULTORG_RESPONSE}"
+  DEFAULTORG_RESPONSE_RESULTS=$(echo $DEFAULTORG_RESPONSE | jq -r '.result | length')
+  echo "Received default organization response result: ${DEFAULTORG_RESPONSE_RESULTS}"
 done

From c01209ed2e9904cd92f0138cff3800f029ca29a1 Mon Sep 17 00:00:00 2001
From: Stefan Benz <46600784+stebenz@users.noreply.github.com>
Date: Thu, 14 Nov 2024 17:25:43 +0100
Subject: [PATCH 27/31] chore: add wait for default organization to setup

---
 acceptance/setup.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acceptance/setup.sh b/acceptance/setup.sh
index e010785e6e4..9ac85627c2e 100755
--- a/acceptance/setup.sh
+++ b/acceptance/setup.sh
@@ -46,7 +46,7 @@ do
       --url "${ZITADEL_API_INTERNAL_URL}/v2/organizations/_search" \
       --header "Authorization: Bearer ${PAT}" \
       --header "Host: ${ZITADEL_API_DOMAIN}" \
-      -d '{"queries": [{"defaultQuery": {"value": true}}]}')
+      -d '{"queries": [{"default_query": {}}]}' )
   echo "Received default organization response: ${DEFAULTORG_RESPONSE}"
   DEFAULTORG_RESPONSE_RESULTS=$(echo $DEFAULTORG_RESPONSE | jq -r '.result | length')
   echo "Received default organization response result: ${DEFAULTORG_RESPONSE_RESULTS}"

From 97a02a671d7e67cd1474be420c1ea253ac64b156 Mon Sep 17 00:00:00 2001
From: Stefan Benz <46600784+stebenz@users.noreply.github.com>
Date: Thu, 14 Nov 2024 17:31:54 +0100
Subject: [PATCH 28/31] chore: add wait for default organization to setup

---
 acceptance/setup.sh | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/acceptance/setup.sh b/acceptance/setup.sh
index 9ac85627c2e..689ff098233 100755
--- a/acceptance/setup.sh
+++ b/acceptance/setup.sh
@@ -35,18 +35,15 @@ DEBUG=true" > ${WRITE_ENVIRONMENT_FILE}
 echo "Wrote environment file ${WRITE_ENVIRONMENT_FILE}"
 cat ${WRITE_ENVIRONMENT_FILE}
 
-sleep 10s
-
 DEFAULTORG_RESPONSE_RESULTS=0
 # waiting for default organization
 until [ ${DEFAULTORG_RESPONSE_RESULTS} -eq 1 ]
 do
-  sleep 1s
   DEFAULTORG_RESPONSE=$(curl -s --request POST \
       --url "${ZITADEL_API_INTERNAL_URL}/v2/organizations/_search" \
       --header "Authorization: Bearer ${PAT}" \
       --header "Host: ${ZITADEL_API_DOMAIN}" \
-      -d '{"queries": [{"default_query": {}}]}' )
+      -d "{\"queries\": [{\"defaultQuery\":{}}]}" )
   echo "Received default organization response: ${DEFAULTORG_RESPONSE}"
   DEFAULTORG_RESPONSE_RESULTS=$(echo $DEFAULTORG_RESPONSE | jq -r '.result | length')
   echo "Received default organization response result: ${DEFAULTORG_RESPONSE_RESULTS}"

From ff355f64ab2f631b2b015487f32502f461848a95 Mon Sep 17 00:00:00 2001
From: Stefan Benz <46600784+stebenz@users.noreply.github.com>
Date: Thu, 14 Nov 2024 17:43:08 +0100
Subject: [PATCH 29/31] chore: add wait for default organization to setup

---
 acceptance/docker-compose.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acceptance/docker-compose.yaml b/acceptance/docker-compose.yaml
index e8448ddb002..25fe770dba2 100644
--- a/acceptance/docker-compose.yaml
+++ b/acceptance/docker-compose.yaml
@@ -1,7 +1,7 @@
 services:
   zitadel:
     user: "${ZITADEL_DEV_UID}"
-    image: "${ZITADEL_IMAGE:-ghcr.io/zitadel/zitadel:latest}"
+    image: "${ZITADEL_IMAGE:-ghcr.io/zitadel/zitadel:v2.65.0}"
     command: 'start-from-init --masterkey "MasterkeyNeedsToHave32Characters" --tlsMode disabled --config /zitadel.yaml --steps /zitadel.yaml'
     ports:
       - "8080:8080"

From 2bf1e09f688416f1c6e5d12962927f47d13ace02 Mon Sep 17 00:00:00 2001
From: Stefan Benz <46600784+stebenz@users.noreply.github.com>
Date: Thu, 14 Nov 2024 18:01:04 +0100
Subject: [PATCH 30/31] chore: add wait for default organization to setup

---
 acceptance/docker-compose.yaml | 2 +-
 acceptance/setup.sh            | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/acceptance/docker-compose.yaml b/acceptance/docker-compose.yaml
index 25fe770dba2..e8448ddb002 100644
--- a/acceptance/docker-compose.yaml
+++ b/acceptance/docker-compose.yaml
@@ -1,7 +1,7 @@
 services:
   zitadel:
     user: "${ZITADEL_DEV_UID}"
-    image: "${ZITADEL_IMAGE:-ghcr.io/zitadel/zitadel:v2.65.0}"
+    image: "${ZITADEL_IMAGE:-ghcr.io/zitadel/zitadel:latest}"
     command: 'start-from-init --masterkey "MasterkeyNeedsToHave32Characters" --tlsMode disabled --config /zitadel.yaml --steps /zitadel.yaml'
     ports:
       - "8080:8080"
diff --git a/acceptance/setup.sh b/acceptance/setup.sh
index 689ff098233..01b6bd826ec 100755
--- a/acceptance/setup.sh
+++ b/acceptance/setup.sh
@@ -43,6 +43,7 @@ do
       --url "${ZITADEL_API_INTERNAL_URL}/v2/organizations/_search" \
       --header "Authorization: Bearer ${PAT}" \
       --header "Host: ${ZITADEL_API_DOMAIN}" \
+      --header "Content-Type: application/json" \
       -d "{\"queries\": [{\"defaultQuery\":{}}]}" )
   echo "Received default organization response: ${DEFAULTORG_RESPONSE}"
   DEFAULTORG_RESPONSE_RESULTS=$(echo $DEFAULTORG_RESPONSE | jq -r '.result | length')

From 6a6284caa7c6f5a8076aec65a642e7272d19a055 Mon Sep 17 00:00:00 2001
From: Stefan Benz <46600784+stebenz@users.noreply.github.com>
Date: Thu, 14 Nov 2024 18:28:43 +0100
Subject: [PATCH 31/31] chore: add wait for default organization to setup

---
 .github/workflows/test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 3dd3cca3415..6bd2abcf7cc 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -5,7 +5,7 @@ on: pull_request
 jobs:
   quality:
     env:
-      ZITADEL_IMAGE: ghcr.io/zitadel/zitadel:v2.63.4
+      ZITADEL_IMAGE: ghcr.io/zitadel/zitadel:v2.65.0
       POSTGRES_IMAGE: postgres:17.0-alpine3.19
 
     name: Ensure Quality