Expose User Last Login in Users List API

[gaghan430]

As per discussion with @JoseSzycho regarding this datum-cloud/staff-portal#282,
We need backend support to expose each user’s most recent login date-time in the users list API response.

API Endpoint:
GET apis/iam.miloapis.com/v1alpha1/users

[JoseSzycho]

@OscarLlamas6 can you tackle this?

You can use our idpIntentSucceededHandler for doing so.

This handler captures the zitadel idpintent.succeeded webhook event.

{
  "aggregateID": "354795392467997738",
  "aggregateType": "idpintent",
  "resourceOwner": "325848471661714009",
  "instanceID": "325848471661714009",
  "version": "v1",
  "sequence": 2,
  "event_type": "idpintent.succeeded",
  "created_at": "2026-01-09T14:55:38.926735Z",
  "event_payload": {
    "idpUser": "eyJVc2VyIjp7ImVtYWlsIjoianN6eWNob3dza2lAZGF0dW0ubmV0IiwiZW1haWxfdmVyaWZpZWQiOnRydWUsImZhbWlseV9uYW1lIjoiU3p5Y2hvd3NraSIsImdpdmVuX25hbWUiOiJKb3NlIiwiaGQiOiJkYXR1bS5uZXQiLCJuYW1lIjoiSm9zZSBTenljaG93c2tpIiwicGljdHVyZSI6Imh0dHBzOi8vbGgzLmdvb2dsZXVzZXJjb250ZW50LmNvbS9hL0FDZzhvY0wyVHBuTDhxU0Z1Sk1aSXZBYXhRa3V0ZzlBQk9ISThUd3Jzb0drN2U3UWNvd1JiNFU9czk2LWMiLCJzdWIiOiIxMTcwOTc3MzQyNTA4ODc4ODc2NTUifX0=",
    "idpUserId": "117097734250887887655",
    "idpUserName": "jszychowski@datum.net",
    "userId": "341931253005553172",
    "idpAccessToken": {
      "CryptoType": 0,
      "Algorithm": "aes",
      "KeyID": "idpConfigKey",
      "Crypted": "BocSRrgZN2gFQ1A0kHkEKFe4TNbsKoufBqgYLKexmNum7U8QY4EE3cnKcFrVBQPzPKRqBIv0VVRn2e8mFnkZw4gC3jQwxJo3Cs3DVYDDj6AGDq1946Ll80dEx6wRia52WGBWQyRbdvWI0CDGjHx31URtHgDTBuHwI8hwHHKxHr86GJRZhPCfkAlxmy8PWGbmWNKyINR0VUPSjW7S7xVIE6LXUWGO0yi3PeNZAZUU9bi3aWYWJCnssp2HRfQQm5PkmtyTKwFsnharfwDF036yXQUXmVx8wbEXxCqnBJyshlnRHd9aMeX6QPJa4lcuOEm81t4OnxJtTxlCPW1DkStsqsmpzPX8QFe/7sisdfie8R8QemG+cBJcrrgC3gR9pOH5hrt3uN1GyMK3R3j/taUH+1PAew9M/VlL3qolmIRbG4qUObn5Qpqi8roRtas6d2D8AXKJhoitVDdN9K9Z+8JUOZMbJc/oBA=="
    },
    "idpIdToken": "eyJhbGciOiJSUzI1NiIsImtpZCI6IjRiYTZlZmVmNWUxNzIxNDk5NzFhMmQzYWJiNWYzMzJlMGY3ODcxNjUiLCJ0eXAiOiJKV1QifQ.eyJpc3MiOiJodHRwczovL2FjY291bnRzLmdvb2dsZS5jb20iLCJhenAiOiI4NjQzOTU0MjEyNDAtYmt2ODlldGQ0ZTV1dHFxcmhmMXI0b2FoaGRiYWFwOTIuYXBwcy5nb29nbGV1c2VyY29udGVudC5jb20iLCJhdWQiOiI4NjQzOTU0MjEyNDAtYmt2ODlldGQ0ZTV1dHFxcmhmMXI0b2FoaGRiYWFwOTIuYXBwcy5nb29nbGV1c2VyY29udGVudC5jb20iLCJzdWIiOiIxMTcwOTc3MzQyNTA4ODc4ODc2NTUiLCJoZCI6ImRhdHVtLm5ldCIsImVtYWlsIjoianN6eWNob3dza2lAZGF0dW0ubmV0IiwiZW1haWxfdmVyaWZpZWQiOnRydWUsImF0X2hhc2giOiJRTEtXNFcyYlV5azdlOVB4OEpQclBnIiwibmFtZSI6Ikpvc2UgU3p5Y2hvd3NraSIsInBpY3R1cmUiOiJodHRwczovL2xoMy5nb29nbGV1c2VyY29udGVudC5jb20vYS9BQ2c4b2NMMlRwbkw4cVNGdUpNWkl2QWF4UWt1dGc5QUJPSEk4VHdyc29HazdlN1Fjb3dSYjRVPXM5Ni1jIiwiZ2l2ZW5fbmFtZSI6Ikpvc2UiLCJmYW1pbHlfbmFtZSI6IlN6eWNob3dza2kiLCJpYXQiOjE3Njc5NzA1MzgsImV4cCI6MTc2Nzk3NDEzOH0.ZiDR1OM2VDnrVMkVnzBx9PBnPf-sh1kPRaxg9MQyA69xvE_PsFTTxgqP3UwX--Rtaod1LT7b-zH-19BsjfrjKvII21sVE-cRvimtLfG8GNOh924beX22VOTqQ69lFJ8bUOtuo7SGM4qkFh3Wol2fZmdWpq5aw62XrOUwqjGqq9REyMb6s69k2BhJoJKLr2gtcjvu66WayV1MufRHopcSMZTO8DKKebk5x_RdxxFfTClKh8ros1HZUeMm2k0ELdpdeQnqfdmkb6UF00e8YZAgRxDThRfg50K8AVbGgfbG9DaUtn_iCNhOkJ6hALjjmrDA2M2ng-Ph3VKkMilJZREyCw",
    "expiresAt": "2026-01-09T15:55:37.791449766Z"
  }
}

As you see, the handler already identifies the current provider using for the authentication, and updates the Status.LastLoginProvider field.

We should update the User CR status to include a map that register the last use of each provider.

Please be aware that this event is only triggered when a user login from the idp, on each token refresh, this event won't be executed.

So maybe, you could also create another user status field that only indicates the date of the last token instropection, you should evaluate wether to make this, as it might be more convenient to do on Milo side.