From b58292847b252d3547d4d131a81eb9135ee52fa3 Mon Sep 17 00:00:00 2001
From: Silvan <27845747+adlerhurst@users.noreply.github.com>
Date: Fri, 12 Dec 2025 11:09:03 +0100
Subject: [PATCH] fix(setup): member role synchronization execution check
 (#11180)

The change was introduced in
https://github.com/zitadel/zitadel/pull/11178.
The fix is to prevent wiping the memberships because the projection did
not init yet.

### Changes
- Introduces a check to determine if the member role synchronization
should be executed based on the existence of a specific database table
(`projections.instance_members4`).
- Ensures that the synchronization process only runs if the required
table is present in the database.

(cherry picked from commit 1b54a9eb057c65596671a456d612dd30ecba43b5)
---
 cmd/setup/67.go    | 13 ++++++++++++-
 cmd/setup/setup.go |  2 +-
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/cmd/setup/67.go b/cmd/setup/67.go
index 9859a6db105..101254c3885 100644
--- a/cmd/setup/67.go
+++ b/cmd/setup/67.go
@@ -2,6 +2,7 @@ package setup
 
 import (
 	"context"
+	"database/sql"
 	_ "embed"
 
 	"github.com/zitadel/zitadel/internal/database"
@@ -18,7 +19,17 @@ type SyncMemberRoleFields struct {
 }
 
 func (mig *SyncMemberRoleFields) Execute(ctx context.Context, _ eventstore.Event) error {
-	_, err := mig.dbClient.ExecContext(ctx, syncMemberRoleFields)
+	var exists bool
+	err := mig.dbClient.QueryRowContext(
+		ctx,
+		func(row *sql.Row) error {
+			return row.Scan(&exists)
+		},
+		"SELECT EXISTS(SELECT FROM pg_catalog.pg_tables WHERE schemaname = 'projections' and tablename = 'instance_members4')")
+	if err != nil || !exists {
+		return err
+	}
+	_, err = mig.dbClient.ExecContext(ctx, syncMemberRoleFields)
 	return err
 }
 
diff --git a/cmd/setup/setup.go b/cmd/setup/setup.go
index ccf2abf72b5..b4fd1d02143 100644
--- a/cmd/setup/setup.go
+++ b/cmd/setup/setup.go
@@ -277,6 +277,7 @@ func Setup(ctx context.Context, config *Config, steps *Steps, masterKey string)
 		steps.s63AlterResourceCounts,
 		steps.s64ChangePushPosition,
 		steps.s65FixUserMetadata5Index,
+		steps.s67SyncMemberRoleFields,
 	} {
 		setupErr = executeMigration(ctx, eventstoreClient, step, "migration failed")
 		if setupErr != nil {
@@ -336,7 +337,6 @@ func Setup(ctx context.Context, config *Config, steps *Steps, masterKey string)
 		steps.s43CreateFieldsDomainIndex,
 		steps.s48Apps7SAMLConfigsLoginVersion,
 		steps.s59SetupWebkeys, // this step needs commands.
-		steps.s67SyncMemberRoleFields,
 	} {
 		setupErr = executeMigration(ctx, eventstoreClient, step, "migration failed")
 		if setupErr != nil {