fix: forward field selector to sessions backend

[zachsmith1]

Summary

milo's local Sessions REST handler at internal/apiserver/identity/sessions/rest.go:43 was building a fresh empty ListOptions{} and discarding the caller's FieldSelector before delegating to the DynamicProvider backend that proxies to auth-provider-zitadel. The comment said "ignore selectors; self-scoped list delegated to provider" — written before the cross-user lookup pattern landed (#588 / datum-cloud/auth-provider-zitadel#69).

Symptom (observed live in staging)

After #588 merged, the field-selector validation 400 went away — but the request still returned no sessions for the targeted user. Tracing showed:

• fraud-operator → milo: LIST sessions?fieldSelector=status.userUID=<uid> ✓
• milo local REST handler → backend: ListOptions{} (selector dropped)
• backend → auth-provider-zitadel: LIST sessions?timeout=3s (no selector)
• auth-provider-zitadel REST handler: opts.FieldSelector == nil → falls back to u.GetUID() → caller is system:control@fraud.miloapis.com (service account, no UID) → uid="" → 0 sessions

apiserver logs confirmed the empty UID:

"Listing sessions" uid=""
"ListSessions: found 0 session(s) for userID=""
URI="/apis/identity.miloapis.com/v1alpha1/sessions?timeout=3s"

Fix

Forward opts.FieldSelector (and opts.LabelSelector for completeness) into the metav1.ListOptions passed to Backend.ListSessions. The DynamicProvider backend already preserves the caller identity via X-Remote-* headers (internal/apiserver/identity/sessions/dynamic.go:108-119), so auth-provider-zitadel's REST handler still runs its own SAR check against milo and rejects unauthorized cross-user reads.

Test plan

• go build ./... clean
• go test ./internal/apiserver/identity/sessions/... clean
• Once merged + rolled to staging milo, fraud-operator's Sessions list returns the user's actual sessions instead of 0 session(s) for userID="". Verify via kubectl -n datum-iam-system logs deploy/auth-provider-zitadel-apiserver | grep "Listing sessions" showing uid=<actual-target-uid>.

Related

• fix: register status.userUID field selector for Session #588 — fixed the field-selector 400 at the conversion layer (necessary precondition; this PR is the missing piece)
• fix(apiserver): register status.userUID field selector for Session/UserIdentity auth-provider-zitadel#105 — same field-selector registration on the auth-provider-zitadel scheme
• feat(apiserver): authorize cross-user session/identity lookups via SAR to milo auth-provider-zitadel#69 — added the Session REST handler with the status.userUID selector consumer + SAR enforcement
• feat: source IP and User-Agent from identity Sessions API fraud#32 — fraud-operator caller that surfaced the issue

🤖 Generated with Claude Code

[joggrbot]

📝 Documentation Analysis

All docs are up to date! 🎉

---

✅ Latest commit analyzed: bc9a875 | Powered by Joggr