WithTransportCredentials

[bfivelson0101]

This pr adds an option to inject custom grpc transport credentials into the connection. The primary reason for this is to provide a way to trust certificates that were issued by a custom ca. The current implementation allowed for the SystemCertPool or insecureSkipVerify as the only transport options.

Definition of Ready

• I am happy with the code
• Short description of the feature/issue is added in the pr description
• PR is linked to the corresponding user story
• Acceptance criteria are met
• All open todos and follow ups are defined in a new ticket and justified
• Deviations from the acceptance criteria and design are agreed with the PO and documented.
• No debug or dead code
• My code has no repetitions
• Critical parts are tested automatically
• Where possible E2E tests are implemented
• Documentation/examples are up-to-date
• All non-functional requirements are met
• Functionality of the acceptance criteria is checked manually on the dev system.

[Copilot]

Pull request overview

This PR adds support for injecting custom gRPC transport credentials to enable connections with certificates issued by custom certificate authorities. Previously, only the system certificate pool or insecure skip verify were supported as transport options.

Changes:

• Added WithTransportCredentials option to both pkg/client/zitadel and pkg/client packages
• Modified transport option logic to prioritize custom credentials over default options
• Added example implementations demonstrating custom CA usage with both admin and management APIs

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
pkg/client/zitadel/client.go	Added transportCredentials field to Connection struct and WithTransportCredentials option function; modified transportOption to check for custom credentials first
pkg/client/client.go	Added transportCredentials field to clientOptions, WithTransportCredentials option function, and modified newConnection to accept and use custom credentials
example/customCA/middleware/tokenTools.go	Helper functions for creating JWT profile token sources with custom HTTP clients for CA trust
example/customCA/admin/admin.go	Example demonstrating admin API usage with custom CA certificate
example/customCA/Management/management.go	Example demonstrating management API usage with custom CA certificate

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The tls.Config is initialized with default values, which may not enforce minimum TLS version requirements. For production use, consider explicitly setting MinVersion (e.g., tls.VersionTLS12 or tls.VersionTLS13) to ensure secure TLS connections. While this is example code, it sets a pattern that users might follow.

Suggested change

	var tlsConfig = &tls.Config{}
	var tlsConfig = &tls.Config{
	MinVersion: tls.VersionTLS12,
	}