feat: handle instanceID in projections (#3442)

* feat: handle instanceID in projections

* rename functions

* fix key lock

* fix import

internal/auth/repository/eventsourcing/eventstore/auth_request.go

@@ -61,12 +61,12 @@ type privacyPolicyProvider interface {
 }
 
 type userSessionViewProvider interface {
-	UserSessionByIDs(string, string) (*user_view_model.UserSessionView, error)
-	UserSessionsByAgentID(string) ([]*user_view_model.UserSessionView, error)
+	UserSessionByIDs(string, string, string) (*user_view_model.UserSessionView, error)
+	UserSessionsByAgentID(string, string) ([]*user_view_model.UserSessionView, error)
 	PrefixAvatarURL() string
 }
 type userViewProvider interface {
-	UserByID(string) (*user_view_model.UserView, error)
+	UserByID(string, string) (*user_view_model.UserView, error)
 	PrefixAvatarURL() string
 }
 
@@ -79,7 +79,7 @@ type lockoutPolicyViewProvider interface {
 }
 
 type idpProviderViewProvider interface {
-	IDPProvidersByAggregateIDAndState(string, iam_model.IDPConfigState) ([]*iam_view_model.IDPProviderView, error)
+	IDPProvidersByAggregateIDAndState(string, string, iam_model.IDPConfigState) ([]*iam_view_model.IDPProviderView, error)
 }
 
 type userEventProvider interface {
@@ -102,7 +102,7 @@ type userGrantProvider interface {
 
 type projectProvider interface {
 	ProjectByOIDCClientID(context.Context, string) (*query.Project, error)
-	OrgProjectMappingByIDs(orgID, projectID string) (*project_view_model.OrgProjectMapping, error)
+	OrgProjectMappingByIDs(orgID, projectID, instanceID string) (*project_view_model.OrgProjectMapping, error)
 }
 
 type applicationProvider interface {
@@ -596,7 +596,7 @@ func (repo *AuthRequestRepo) fillPolicies(ctx context.Context, request *domain.A
 }
 
 func (repo *AuthRequestRepo) tryUsingOnlyUserSession(request *domain.AuthRequest) error {
-	userSessions, err := userSessionsByUserAgentID(repo.UserSessionViewProvider, request.AgentID)
+	userSessions, err := userSessionsByUserAgentID(repo.UserSessionViewProvider, request.AgentID, request.InstanceID)
 	if err != nil {
 		return err
 	}
@@ -618,9 +618,9 @@ func (repo *AuthRequestRepo) checkLoginName(ctx context.Context, request *domain
 		if request.RequestedOrgID != "" {
 			preferredLoginName += "@" + request.RequestedPrimaryDomain
 		}
-		user, err = repo.View.UserByLoginNameAndResourceOwner(preferredLoginName, request.RequestedOrgID)
+		user, err = repo.View.UserByLoginNameAndResourceOwner(preferredLoginName, request.RequestedOrgID, request.InstanceID)
 	} else {
-		user, err = repo.View.UserByLoginName(loginName)
+		user, err = repo.View.UserByLoginName(loginName, request.InstanceID)
 		if err == nil {
 			err = repo.checkLoginPolicyWithResourceOwner(ctx, request, user)
 			if err != nil {
@@ -696,9 +696,9 @@ func (repo *AuthRequestRepo) checkSelectedExternalIDP(request *domain.AuthReques
 func (repo *AuthRequestRepo) checkExternalUserLogin(ctx context.Context, request *domain.AuthRequest, idpConfigID, externalUserID string) (err error) {
 	externalIDP := new(user_view_model.ExternalIDPView)
 	if request.RequestedOrgID != "" {
-		externalIDP, err = repo.View.ExternalIDPByExternalUserIDAndIDPConfigIDAndResourceOwner(externalUserID, idpConfigID, request.RequestedOrgID)
+		externalIDP, err = repo.View.ExternalIDPByExternalUserIDAndIDPConfigIDAndResourceOwner(externalUserID, idpConfigID, request.RequestedOrgID, request.InstanceID)
 	} else {
-		externalIDP, err = repo.View.ExternalIDPByExternalUserIDAndIDPConfigID(externalUserID, idpConfigID)
+		externalIDP, err = repo.View.ExternalIDPByExternalUserIDAndIDPConfigID(externalUserID, idpConfigID, request.InstanceID)
 	}
 	if err != nil {
 		return err
@@ -828,7 +828,7 @@ func (repo *AuthRequestRepo) nextSteps(ctx context.Context, request *domain.Auth
 }
 
 func (repo *AuthRequestRepo) usersForUserSelection(request *domain.AuthRequest) ([]domain.UserSelection, error) {
-	userSessions, err := userSessionsByUserAgentID(repo.UserSessionViewProvider, request.AgentID)
+	userSessions, err := userSessionsByUserAgentID(repo.UserSessionViewProvider, request.AgentID, request.InstanceID)
 	if err != nil {
 		return nil, err
 	}
@@ -1044,13 +1044,13 @@ func setOrgID(orgViewProvider orgViewProvider, request *domain.AuthRequest) erro
 
 func getLoginPolicyIDPProviders(provider idpProviderViewProvider, iamID, orgID string, defaultPolicy bool) ([]*iam_model.IDPProviderView, error) {
 	if defaultPolicy {
-		idpProviders, err := provider.IDPProvidersByAggregateIDAndState(iamID, iam_model.IDPConfigStateActive)
+		idpProviders, err := provider.IDPProvidersByAggregateIDAndState(iamID, iamID, iam_model.IDPConfigStateActive)
 		if err != nil {
 			return nil, err
 		}
 		return iam_view_model.IDPProviderViewsToModel(idpProviders), nil
 	}
-	idpProviders, err := provider.IDPProvidersByAggregateIDAndState(orgID, iam_model.IDPConfigStateActive)
+	idpProviders, err := provider.IDPProvidersByAggregateIDAndState(orgID, iamID, iam_model.IDPConfigStateActive)
 	if err != nil {
 		return nil, err
 	}
@@ -1071,8 +1071,8 @@ func checkVerificationTime(verificationTime time.Time, lifetime time.Duration) b
 	return verificationTime.Add(lifetime).After(time.Now().UTC())
 }
 
-func userSessionsByUserAgentID(provider userSessionViewProvider, agentID string) ([]*user_model.UserSessionView, error) {
-	session, err := provider.UserSessionsByAgentID(agentID)
+func userSessionsByUserAgentID(provider userSessionViewProvider, agentID, instanceID string) ([]*user_model.UserSessionView, error) {
+	session, err := provider.UserSessionsByAgentID(agentID, instanceID)
 	if err != nil {
 		return nil, err
 	}
@@ -1080,7 +1080,7 @@ func userSessionsByUserAgentID(provider userSessionViewProvider, agentID string)
 }
 
 func userSessionByIDs(ctx context.Context, provider userSessionViewProvider, eventProvider userEventProvider, agentID string, user *user_model.UserView) (*user_model.UserSessionView, error) {
-	session, err := provider.UserSessionByIDs(agentID, user.ID)
+	session, err := provider.UserSessionByIDs(agentID, user.ID, authz.GetInstance(ctx).InstanceID())
 	if err != nil {
 		if !errors.IsNotFound(err) {
 			return nil, err
@@ -1156,7 +1156,7 @@ func activeUserByID(ctx context.Context, userViewProvider userViewProvider, user
 }
 
 func userByID(ctx context.Context, viewProvider userViewProvider, eventProvider userEventProvider, userID string) (*user_model.UserView, error) {
-	user, viewErr := viewProvider.UserByID(userID)
+	user, viewErr := viewProvider.UserByID(userID, authz.GetInstance(ctx).InstanceID())
 	if viewErr != nil && !errors.IsNotFound(viewErr) {
 		return nil, viewErr
 	} else if user == nil {
@@ -1254,7 +1254,7 @@ func projectRequired(ctx context.Context, request *domain.AuthRequest, projectPr
 	if !project.HasProjectCheck {
 		return false, nil
 	}
-	_, err = projectProvider.OrgProjectMappingByIDs(request.UserOrgID, project.ID)
+	_, err = projectProvider.OrgProjectMappingByIDs(request.UserOrgID, project.ID, request.InstanceID)
 	if errors.IsNotFound(err) {
 		return true, nil
 	}

internal/auth/repository/eventsourcing/eventstore/auth_request_test.go

@@ -24,11 +24,11 @@ import (
 
 type mockViewNoUserSession struct{}
 
-func (m *mockViewNoUserSession) UserSessionByIDs(string, string) (*user_view_model.UserSessionView, error) {
+func (m *mockViewNoUserSession) UserSessionByIDs(string, string, string) (*user_view_model.UserSessionView, error) {
 	return nil, errors.ThrowNotFound(nil, "id", "user session not found")
 }
 
-func (m *mockViewNoUserSession) UserSessionsByAgentID(string) ([]*user_view_model.UserSessionView, error) {
+func (m *mockViewNoUserSession) UserSessionsByAgentID(string, string) ([]*user_view_model.UserSessionView, error) {
 	return nil, nil
 }
 
@@ -38,11 +38,11 @@ func (m *mockViewNoUserSession) PrefixAvatarURL() string {
 
 type mockViewErrUserSession struct{}
 
-func (m *mockViewErrUserSession) UserSessionByIDs(string, string) (*user_view_model.UserSessionView, error) {
+func (m *mockViewErrUserSession) UserSessionByIDs(string, string, string) (*user_view_model.UserSessionView, error) {
 	return nil, errors.ThrowInternal(nil, "id", "internal error")
 }
 
-func (m *mockViewErrUserSession) UserSessionsByAgentID(string) ([]*user_view_model.UserSessionView, error) {
+func (m *mockViewErrUserSession) UserSessionsByAgentID(string, string) ([]*user_view_model.UserSessionView, error) {
 	return nil, errors.ThrowInternal(nil, "id", "internal error")
 }
 
@@ -65,7 +65,7 @@ type mockUser struct {
 	ResourceOwner string
 }
 
-func (m *mockViewUserSession) UserSessionByIDs(string, string) (*user_view_model.UserSessionView, error) {
+func (m *mockViewUserSession) UserSessionByIDs(string, string, string) (*user_view_model.UserSessionView, error) {
 	return &user_view_model.UserSessionView{
 		ExternalLoginVerification: m.ExternalLoginVerification,
 		PasswordlessVerification:  m.PasswordlessVerification,
@@ -75,7 +75,7 @@ func (m *mockViewUserSession) UserSessionByIDs(string, string) (*user_view_model
 	}, nil
 }
 
-func (m *mockViewUserSession) UserSessionsByAgentID(string) ([]*user_view_model.UserSessionView, error) {
+func (m *mockViewUserSession) UserSessionsByAgentID(string, string) ([]*user_view_model.UserSessionView, error) {
 	sessions := make([]*user_view_model.UserSessionView, len(m.Users))
 	for i, user := range m.Users {
 		sessions[i] = &user_view_model.UserSessionView{
@@ -93,7 +93,7 @@ func (m *mockViewUserSession) PrefixAvatarURL() string {
 
 type mockViewNoUser struct{}
 
-func (m *mockViewNoUser) UserByID(string) (*user_view_model.UserView, error) {
+func (m *mockViewNoUser) UserByID(string, string) (*user_view_model.UserView, error) {
 	return nil, errors.ThrowNotFound(nil, "id", "user not found")
 }
 
@@ -156,7 +156,7 @@ func (m *mockLockoutPolicy) LockoutPolicyByOrg(context.Context, string) (*query.
 	return m.policy, nil
 }
 
-func (m *mockViewUser) UserByID(string) (*user_view_model.UserView, error) {
+func (m *mockViewUser) UserByID(string, string) (*user_view_model.UserView, error) {
 	return &user_view_model.UserView{
 		State:    int32(user_model.UserStateActive),
 		UserName: "UserName",
@@ -232,7 +232,7 @@ func (m *mockProject) ProjectByOIDCClientID(ctx context.Context, s string) (*que
 	return &query.Project{HasProjectCheck: m.projectCheck}, nil
 }
 
-func (m *mockProject) OrgProjectMappingByIDs(orgID, projectID string) (*proj_view_model.OrgProjectMapping, error) {
+func (m *mockProject) OrgProjectMappingByIDs(orgID, projectID, instanceID string) (*proj_view_model.OrgProjectMapping, error) {
 	if m.hasProject {
 		return &proj_view_model.OrgProjectMapping{OrgID: orgID, ProjectID: projectID}, nil
 	}

internal/auth/repository/eventsourcing/eventstore/org.go

@@ -23,7 +23,7 @@ type OrgRepository struct {
 }
 
 func (repo *OrgRepository) GetIDPConfigByID(ctx context.Context, idpConfigID string) (*iam_model.IDPConfigView, error) {
-	idpConfig, err := repo.View.IDPConfigByID(idpConfigID)
+	idpConfig, err := repo.View.IDPConfigByID(idpConfigID, authz.GetInstance(ctx).InstanceID())
 	if err != nil {
 		return nil, err
 	}

internal/auth/repository/eventsourcing/eventstore/refresh_token.go

@@ -6,16 +6,16 @@ import (
 
 	"github.com/caos/logging"
 
+	"github.com/caos/zitadel/internal/api/authz"
+	"github.com/caos/zitadel/internal/auth/repository/eventsourcing/view"
 	"github.com/caos/zitadel/internal/crypto"
 	"github.com/caos/zitadel/internal/domain"
+	"github.com/caos/zitadel/internal/errors"
 	v1 "github.com/caos/zitadel/internal/eventstore/v1"
 	"github.com/caos/zitadel/internal/eventstore/v1/models"
-	usr_view "github.com/caos/zitadel/internal/user/repository/view"
-
-	"github.com/caos/zitadel/internal/auth/repository/eventsourcing/view"
-	"github.com/caos/zitadel/internal/errors"
 	"github.com/caos/zitadel/internal/telemetry/tracing"
 	usr_model "github.com/caos/zitadel/internal/user/model"
+	usr_view "github.com/caos/zitadel/internal/user/repository/view"
 	"github.com/caos/zitadel/internal/user/repository/view/model"
 )
 
@@ -31,7 +31,7 @@ func (r *RefreshTokenRepo) RefreshTokenByID(ctx context.Context, refreshToken st
 	if err != nil {
 		return nil, err
 	}
-	tokenView, viewErr := r.View.RefreshTokenByID(tokenID)
+	tokenView, viewErr := r.View.RefreshTokenByID(tokenID, authz.GetInstance(ctx).InstanceID())
 	if viewErr != nil && !errors.IsNotFound(viewErr) {
 		return nil, viewErr
 	}
@@ -41,7 +41,7 @@ func (r *RefreshTokenRepo) RefreshTokenByID(ctx context.Context, refreshToken st
 		tokenView.UserID = userID
 	}
 
-	events, esErr := r.getUserEvents(ctx, userID, tokenView.Sequence)
+	events, esErr := r.getUserEvents(ctx, userID, tokenView.InstanceID, tokenView.Sequence)
 	if errors.IsNotFound(viewErr) && len(events) == 0 {
 		return nil, errors.ThrowNotFound(nil, "EVENT-BHB52", "Errors.User.RefreshToken.Invalid")
 	}
@@ -68,7 +68,7 @@ func (r *RefreshTokenRepo) SearchMyRefreshTokens(ctx context.Context, userID str
 	if err != nil {
 		return nil, err
 	}
-	sequence, err := r.View.GetLatestRefreshTokenSequence()
+	sequence, err := r.View.GetLatestRefreshTokenSequence(authz.GetInstance(ctx).InstanceID())
 	logging.Log("EVENT-GBdn4").OnError(err).WithField("traceID", tracing.TraceIDFromCtx(ctx)).Warn("could not read latest refresh token sequence")
 	request.Queries = append(request.Queries, &usr_model.RefreshTokenSearchQuery{Key: usr_model.RefreshTokenSearchKeyUserID, Method: domain.SearchMethodEquals, Value: userID})
 	tokens, count, err := r.View.SearchRefreshTokens(request)
@@ -85,8 +85,8 @@ func (r *RefreshTokenRepo) SearchMyRefreshTokens(ctx context.Context, userID str
 	}, nil
 }
 
-func (r *RefreshTokenRepo) getUserEvents(ctx context.Context, userID string, sequence uint64) ([]*models.Event, error) {
-	query, err := usr_view.UserByIDQuery(userID, sequence)
+func (r *RefreshTokenRepo) getUserEvents(ctx context.Context, userID, instanceID string, sequence uint64) ([]*models.Event, error) {
+	query, err := usr_view.UserByIDQuery(userID, instanceID, sequence)
 	if err != nil {
 		return nil, err
 	}

internal/auth/repository/eventsourcing/eventstore/token.go

@@ -2,18 +2,18 @@ package eventstore
 
 import (
 	"context"
-	"github.com/caos/zitadel/internal/eventstore/v1"
 	"time"
 
-	"github.com/caos/zitadel/internal/eventstore/v1/models"
-	usr_view "github.com/caos/zitadel/internal/user/repository/view"
-
 	"github.com/caos/logging"
 
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/auth/repository/eventsourcing/view"
 	"github.com/caos/zitadel/internal/errors"
+	v1 "github.com/caos/zitadel/internal/eventstore/v1"
+	"github.com/caos/zitadel/internal/eventstore/v1/models"
 	"github.com/caos/zitadel/internal/telemetry/tracing"
 	usr_model "github.com/caos/zitadel/internal/user/model"
+	usr_view "github.com/caos/zitadel/internal/user/repository/view"
 	"github.com/caos/zitadel/internal/user/repository/view/model"
 )
 
@@ -34,7 +34,7 @@ func (repo *TokenRepo) IsTokenValid(ctx context.Context, userID, tokenID string)
 }
 
 func (repo *TokenRepo) TokenByID(ctx context.Context, userID, tokenID string) (*usr_model.TokenView, error) {
-	token, viewErr := repo.View.TokenByID(tokenID)
+	token, viewErr := repo.View.TokenByID(tokenID, authz.GetInstance(ctx).InstanceID())
 	if viewErr != nil && !errors.IsNotFound(viewErr) {
 		return nil, viewErr
 	}
@@ -44,7 +44,7 @@ func (repo *TokenRepo) TokenByID(ctx context.Context, userID, tokenID string) (*
 		token.UserID = userID
 	}
 
-	events, esErr := repo.getUserEvents(ctx, userID, token.Sequence)
+	events, esErr := repo.getUserEvents(ctx, userID, token.InstanceID, token.Sequence)
 	if errors.IsNotFound(viewErr) && len(events) == 0 {
 		return nil, errors.ThrowNotFound(nil, "EVENT-4T90g", "Errors.Token.NotFound")
 	}
@@ -66,8 +66,8 @@ func (repo *TokenRepo) TokenByID(ctx context.Context, userID, tokenID string) (*
 	return model.TokenViewToModel(token), nil
 }
 
-func (r *TokenRepo) getUserEvents(ctx context.Context, userID string, sequence uint64) ([]*models.Event, error) {
-	query, err := usr_view.UserByIDQuery(userID, sequence)
+func (r *TokenRepo) getUserEvents(ctx context.Context, userID, instanceID string, sequence uint64) ([]*models.Event, error) {
+	query, err := usr_view.UserByIDQuery(userID, instanceID, sequence)
 	if err != nil {
 		return nil, err
 	}

internal/auth/repository/eventsourcing/eventstore/user.go

@@ -3,6 +3,7 @@ package eventstore
 import (
 	"context"
 
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/auth/repository/eventsourcing/view"
 	"github.com/caos/zitadel/internal/config/systemdefaults"
 	"github.com/caos/zitadel/internal/domain"
@@ -26,7 +27,7 @@ func (repo *UserRepo) Health(ctx context.Context) error {
 }
 
 func (repo *UserRepo) UserSessionUserIDsByAgentID(ctx context.Context, agentID string) ([]string, error) {
-	userSessions, err := repo.View.UserSessionsByAgentID(agentID)
+	userSessions, err := repo.View.UserSessionsByAgentID(agentID, authz.GetInstance(ctx).InstanceID())
 	if err != nil {
 		return nil, err
 	}
@@ -44,7 +45,7 @@ func (repo *UserRepo) UserEventsByID(ctx context.Context, id string, sequence ui
 }
 
 func (r *UserRepo) getUserEvents(ctx context.Context, userID string, sequence uint64) ([]*models.Event, error) {
-	query, err := usr_view.UserByIDQuery(userID, sequence)
+	query, err := usr_view.UserByIDQuery(userID, authz.GetInstance(ctx).InstanceID(), sequence)
 	if err != nil {
 		return nil, err
 	}

internal/auth/repository/eventsourcing/eventstore/user_session.go

@@ -14,7 +14,7 @@ type UserSessionRepo struct {
 }
 
 func (repo *UserSessionRepo) GetMyUserSessions(ctx context.Context) ([]*usr_model.UserSessionView, error) {
-	userSessions, err := repo.View.UserSessionsByAgentID(authz.GetCtxData(ctx).AgentID)
+	userSessions, err := repo.View.UserSessionsByAgentID(authz.GetCtxData(ctx).AgentID, authz.GetInstance(ctx).InstanceID())
 	if err != nil {
 		return nil, err
 	}

internal/auth/repository/eventsourcing/handler/idp_config.go

@@ -54,8 +54,8 @@ func (_ *IDPConfig) AggregateTypes() []models.AggregateType {
 	return []models.AggregateType{org.AggregateType, instance.AggregateType}
 }
 
-func (i *IDPConfig) CurrentSequence() (uint64, error) {
-	sequence, err := i.view.GetLatestIDPConfigSequence()
+func (i *IDPConfig) CurrentSequence(instanceID string) (uint64, error) {
+	sequence, err := i.view.GetLatestIDPConfigSequence(instanceID)
 	if err != nil {
 		return 0, err
 	}
@@ -63,13 +63,30 @@ func (i *IDPConfig) CurrentSequence() (uint64, error) {
 }
 
 func (i *IDPConfig) EventQuery() (*models.SearchQuery, error) {
-	sequence, err := i.view.GetLatestIDPConfigSequence()
+	sequences, err := i.view.GetLatestIDPConfigSequences()
 	if err != nil {
 		return nil, err
 	}
-	return models.NewSearchQuery().
+
+	query := models.NewSearchQuery()
+	instances := make([]string, 0)
+	for _, sequence := range sequences {
+		for _, instance := range instances {
+			if sequence.InstanceID == instance {
+				break
+			}
+		}
+		instances = append(instances, sequence.InstanceID)
+		query.AddQuery().
+			AggregateTypeFilter(i.AggregateTypes()...).
+			LatestSequenceFilter(sequence.CurrentSequence).
+			InstanceIDFilter(sequence.InstanceID)
+	}
+	return query.AddQuery().
 		AggregateTypeFilter(i.AggregateTypes()...).
-		LatestSequenceFilter(sequence.CurrentSequence), nil
+		LatestSequenceFilter(0).
+		ExcludedInstanceIDsFilter(instances...).
+		SearchQuery(), nil
 }
 
 func (i *IDPConfig) Reduce(event *models.Event) (err error) {
@@ -97,7 +114,7 @@ func (i *IDPConfig) processIdpConfig(providerType iam_model.IDPProviderType, eve
 		if err != nil {
 			return err
 		}
-		idp, err = i.view.IDPConfigByID(idp.IDPConfigID)
+		idp, err = i.view.IDPConfigByID(idp.IDPConfigID, idp.InstanceID)
 		if err != nil {
 			return err
 		}
@@ -108,7 +125,7 @@ func (i *IDPConfig) processIdpConfig(providerType iam_model.IDPProviderType, eve
 		if err != nil {
 			return err
 		}
-		idp, err = i.view.IDPConfigByID(idp.IDPConfigID)
+		idp, err = i.view.IDPConfigByID(idp.IDPConfigID, idp.InstanceID)
 		if err != nil {
 			return err
 		}

internal/auth/repository/eventsourcing/handler/idp_providers.go

@@ -4,6 +4,7 @@ import (
 	"context"
 
 	"github.com/caos/logging"
+
 	"github.com/caos/zitadel/internal/config/systemdefaults"
 	"github.com/caos/zitadel/internal/domain"
 	"github.com/caos/zitadel/internal/eventstore"
@@ -67,8 +68,8 @@ func (_ *IDPProvider) AggregateTypes() []models.AggregateType {
 	return []es_models.AggregateType{instance.AggregateType, org.AggregateType}
 }
 
-func (i *IDPProvider) CurrentSequence() (uint64, error) {
-	sequence, err := i.view.GetLatestIDPProviderSequence()
+func (i *IDPProvider) CurrentSequence(instanceID string) (uint64, error) {
+	sequence, err := i.view.GetLatestIDPProviderSequence(instanceID)
 	if err != nil {
 		return 0, err
 	}
@@ -76,13 +77,29 @@ func (i *IDPProvider) CurrentSequence() (uint64, error) {
 }
 
 func (i *IDPProvider) EventQuery() (*models.SearchQuery, error) {
-	sequence, err := i.view.GetLatestIDPProviderSequence()
+	sequences, err := i.view.GetLatestIDPProviderSequences()
 	if err != nil {
 		return nil, err
 	}
-	return es_models.NewSearchQuery().
+	query := es_models.NewSearchQuery()
+	instances := make([]string, 0)
+	for _, sequence := range sequences {
+		for _, instance := range instances {
+			if sequence.InstanceID == instance {
+				break
+			}
+		}
+		instances = append(instances, sequence.InstanceID)
+		query.AddQuery().
+			AggregateTypeFilter(i.AggregateTypes()...).
+			LatestSequenceFilter(sequence.CurrentSequence).
+			InstanceIDFilter(sequence.InstanceID)
+	}
+	return query.AddQuery().
 		AggregateTypeFilter(i.AggregateTypes()...).
-		LatestSequenceFilter(sequence.CurrentSequence), nil
+		LatestSequenceFilter(0).
+		ExcludedInstanceIDsFilter(instances...).
+		SearchQuery(), nil
 }
 
 func (i *IDPProvider) Reduce(event *models.Event) (err error) {
@@ -108,7 +125,7 @@ func (i *IDPProvider) processIdpProvider(event *models.Event) (err error) {
 		if err != nil {
 			return err
 		}
-		return i.view.DeleteIDPProvider(event.AggregateID, provider.IDPConfigID, event)
+		return i.view.DeleteIDPProvider(event.AggregateID, provider.IDPConfigID, event.InstanceID, event)
 	case instance.IDPConfigChangedEventType, org.IDPConfigChangedEventType:
 		esConfig := new(iam_view_model.IDPConfigView)
 		providerType := iam_model.IDPProviderTypeSystem
@@ -116,7 +133,7 @@ func (i *IDPProvider) processIdpProvider(event *models.Event) (err error) {
 			providerType = iam_model.IDPProviderTypeOrg
 		}
 		esConfig.AppendEvent(providerType, event)
-		providers, err := i.view.IDPProvidersByIDPConfigID(esConfig.IDPConfigID)
+		providers, err := i.view.IDPProvidersByIDPConfigID(esConfig.IDPConfigID, esConfig.InstanceID)
 		if err != nil {
 			return err
 		}
@@ -134,7 +151,7 @@ func (i *IDPProvider) processIdpProvider(event *models.Event) (err error) {
 		}
 		return i.view.PutIDPProviders(event, providers...)
 	case org.LoginPolicyRemovedEventType:
-		return i.view.DeleteIDPProvidersByAggregateID(event.AggregateID, event)
+		return i.view.DeleteIDPProvidersByAggregateID(event.AggregateID, event.InstanceID, event)
 	default:
 		return i.view.ProcessedIDPProviderSequence(event)
 	}

internal/auth/repository/eventsourcing/handler/org_project_mapping.go

@@ -8,7 +8,6 @@ import (
 	es_models "github.com/caos/zitadel/internal/eventstore/v1/models"
 	"github.com/caos/zitadel/internal/eventstore/v1/query"
 	"github.com/caos/zitadel/internal/eventstore/v1/spooler"
-	proj_view "github.com/caos/zitadel/internal/project/repository/view"
 	view_model "github.com/caos/zitadel/internal/project/repository/view/model"
 	"github.com/caos/zitadel/internal/repository/project"
 )
@@ -55,8 +54,8 @@ func (_ *OrgProjectMapping) AggregateTypes() []es_models.AggregateType {
 	return []es_models.AggregateType{project.AggregateType}
 }
 
-func (p *OrgProjectMapping) CurrentSequence() (uint64, error) {
-	sequence, err := p.view.GetLatestOrgProjectMappingSequence()
+func (p *OrgProjectMapping) CurrentSequence(instanceID string) (uint64, error) {
+	sequence, err := p.view.GetLatestOrgProjectMappingSequence(instanceID)
 	if err != nil {
 		return 0, err
 	}
@@ -64,11 +63,29 @@ func (p *OrgProjectMapping) CurrentSequence() (uint64, error) {
 }
 
 func (p *OrgProjectMapping) EventQuery() (*es_models.SearchQuery, error) {
-	sequence, err := p.view.GetLatestOrgProjectMappingSequence()
+	sequences, err := p.view.GetLatestOrgProjectMappingSequences()
 	if err != nil {
 		return nil, err
 	}
-	return proj_view.ProjectQuery(sequence.CurrentSequence), nil
+	query := es_models.NewSearchQuery()
+	instances := make([]string, 0)
+	for _, sequence := range sequences {
+		for _, instance := range instances {
+			if sequence.InstanceID == instance {
+				break
+			}
+		}
+		instances = append(instances, sequence.InstanceID)
+		query.AddQuery().
+			AggregateTypeFilter(p.AggregateTypes()...).
+			LatestSequenceFilter(sequence.CurrentSequence).
+			InstanceIDFilter(sequence.InstanceID)
+	}
+	return query.AddQuery().
+		AggregateTypeFilter(p.AggregateTypes()...).
+		LatestSequenceFilter(0).
+		ExcludedInstanceIDsFilter(instances...).
+		SearchQuery(), nil
 }
 
 func (p *OrgProjectMapping) Reduce(event *es_models.Event) (err error) {
@@ -79,7 +96,7 @@ func (p *OrgProjectMapping) Reduce(event *es_models.Event) (err error) {
 		mapping.ProjectID = event.AggregateID
 		mapping.InstanceID = event.InstanceID
 	case project.ProjectRemovedType:
-		err := p.view.DeleteOrgProjectMappingsByProjectID(event.AggregateID)
+		err := p.view.DeleteOrgProjectMappingsByProjectID(event.AggregateID, event.InstanceID)
 		if err == nil {
 			return p.view.ProcessedOrgProjectMappingSequence(event)
 		}
@@ -93,7 +110,7 @@ func (p *OrgProjectMapping) Reduce(event *es_models.Event) (err error) {
 	case project.GrantRemovedType:
 		projectGrant := new(view_model.ProjectGrant)
 		projectGrant.SetData(event)
-		err := p.view.DeleteOrgProjectMappingsByProjectGrantID(event.AggregateID)
+		err := p.view.DeleteOrgProjectMappingsByProjectGrantID(event.AggregateID, event.InstanceID)
 		if err == nil {
 			return p.view.ProcessedOrgProjectMappingSequence(event)
 		}

internal/auth/repository/eventsourcing/handler/refresh_token.go

@@ -58,8 +58,8 @@ func (t *RefreshToken) AggregateTypes() []es_models.AggregateType {
 	return []es_models.AggregateType{user.AggregateType, project.AggregateType}
 }
 
-func (t *RefreshToken) CurrentSequence() (uint64, error) {
-	sequence, err := t.view.GetLatestRefreshTokenSequence()
+func (t *RefreshToken) CurrentSequence(instanceID string) (uint64, error) {
+	sequence, err := t.view.GetLatestRefreshTokenSequence(instanceID)
 	if err != nil {
 		return 0, err
 	}
@@ -67,13 +67,29 @@ func (t *RefreshToken) CurrentSequence() (uint64, error) {
 }
 
 func (t *RefreshToken) EventQuery() (*es_models.SearchQuery, error) {
-	sequence, err := t.view.GetLatestRefreshTokenSequence()
+	sequences, err := t.view.GetLatestRefreshTokenSequences()
 	if err != nil {
 		return nil, err
 	}
-	return es_models.NewSearchQuery().
-		AggregateTypeFilter(user.AggregateType, project.AggregateType).
-		LatestSequenceFilter(sequence.CurrentSequence), nil
+	query := es_models.NewSearchQuery()
+	instances := make([]string, 0)
+	for _, sequence := range sequences {
+		for _, instance := range instances {
+			if sequence.InstanceID == instance {
+				break
+			}
+		}
+		instances = append(instances, sequence.InstanceID)
+		query.AddQuery().
+			AggregateTypeFilter(t.AggregateTypes()...).
+			LatestSequenceFilter(sequence.CurrentSequence).
+			InstanceIDFilter(sequence.InstanceID)
+	}
+	return query.AddQuery().
+		AggregateTypeFilter(t.AggregateTypes()...).
+		LatestSequenceFilter(0).
+		ExcludedInstanceIDsFilter(instances...).
+		SearchQuery(), nil
 }
 
 func (t *RefreshToken) Reduce(event *es_models.Event) (err error) {
@@ -91,7 +107,7 @@ func (t *RefreshToken) Reduce(event *es_models.Event) (err error) {
 			logging.Log("EVEN-DBbn4").WithError(err).Error("could not unmarshal event data")
 			return caos_errs.ThrowInternal(nil, "MODEL-BHn75", "could not unmarshal data")
 		}
-		token, err := t.view.RefreshTokenByID(e.TokenID)
+		token, err := t.view.RefreshTokenByID(e.TokenID, event.InstanceID)
 		if err != nil {
 			return err
 		}
@@ -106,11 +122,11 @@ func (t *RefreshToken) Reduce(event *es_models.Event) (err error) {
 			logging.Log("EVEN-BDbh3").WithError(err).Error("could not unmarshal event data")
 			return caos_errs.ThrowInternal(nil, "MODEL-Bz653", "could not unmarshal data")
 		}
-		return t.view.DeleteRefreshToken(e.TokenID, event)
+		return t.view.DeleteRefreshToken(e.TokenID, event.InstanceID, event)
 	case user.UserLockedType,
 		user.UserDeactivatedType,
 		user.UserRemovedType:
-		return t.view.DeleteUserRefreshTokens(event.AggregateID, event)
+		return t.view.DeleteUserRefreshTokens(event.AggregateID, event.InstanceID, event)
 	default:
 		return t.view.ProcessedRefreshTokenSequence(event)
 	}

internal/auth/repository/eventsourcing/handler/token.go

@@ -64,8 +64,8 @@ func (_ *Token) AggregateTypes() []es_models.AggregateType {
 	return []es_models.AggregateType{user.AggregateType, project.AggregateType}
 }
 
-func (p *Token) CurrentSequence() (uint64, error) {
-	sequence, err := p.view.GetLatestTokenSequence()
+func (p *Token) CurrentSequence(instanceID string) (uint64, error) {
+	sequence, err := p.view.GetLatestTokenSequence(instanceID)
 	if err != nil {
 		return 0, err
 	}
@@ -73,13 +73,29 @@ func (p *Token) CurrentSequence() (uint64, error) {
 }
 
 func (t *Token) EventQuery() (*es_models.SearchQuery, error) {
-	sequence, err := t.view.GetLatestTokenSequence()
+	sequences, err := t.view.GetLatestTokenSequences()
 	if err != nil {
 		return nil, err
 	}
-	return es_models.NewSearchQuery().
-		AggregateTypeFilter(user.AggregateType, project.AggregateType).
-		LatestSequenceFilter(sequence.CurrentSequence), nil
+	query := es_models.NewSearchQuery()
+	instances := make([]string, 0)
+	for _, sequence := range sequences {
+		for _, instance := range instances {
+			if sequence.InstanceID == instance {
+				break
+			}
+		}
+		instances = append(instances, sequence.InstanceID)
+		query.AddQuery().
+			AggregateTypeFilter(t.AggregateTypes()...).
+			LatestSequenceFilter(sequence.CurrentSequence).
+			InstanceIDFilter(sequence.InstanceID)
+	}
+	return query.AddQuery().
+		AggregateTypeFilter(t.AggregateTypes()...).
+		LatestSequenceFilter(0).
+		ExcludedInstanceIDsFilter(instances...).
+		SearchQuery(), nil
 }
 
 func (t *Token) Reduce(event *es_models.Event) (err error) {
@@ -96,7 +112,7 @@ func (t *Token) Reduce(event *es_models.Event) (err error) {
 		user.HumanProfileChangedType:
 		user := new(view_model.UserView)
 		user.AppendEvent(event)
-		tokens, err := t.view.TokensByUserID(event.AggregateID)
+		tokens, err := t.view.TokensByUserID(event.AggregateID, event.InstanceID)
 		if err != nil {
 			return err
 		}
@@ -110,24 +126,24 @@ func (t *Token) Reduce(event *es_models.Event) (err error) {
 		if err != nil {
 			return err
 		}
-		return t.view.DeleteSessionTokens(id, event.AggregateID, event)
+		return t.view.DeleteSessionTokens(id, event.AggregateID, event.InstanceID, event)
 	case user.UserLockedType,
 		user.UserDeactivatedType,
 		user.UserRemovedType:
-		return t.view.DeleteUserTokens(event.AggregateID, event)
+		return t.view.DeleteUserTokens(event.AggregateID, event.InstanceID, event)
 	case user_repo.UserTokenRemovedType,
 		user_repo.PersonalAccessTokenRemovedType:
 		id, err := tokenIDFromRemovedEvent(event)
 		if err != nil {
 			return err
 		}
-		return t.view.DeleteToken(id, event)
+		return t.view.DeleteToken(id, event.InstanceID, event)
 	case user_repo.HumanRefreshTokenRemovedType:
 		id, err := refreshTokenIDFromRemovedEvent(event)
 		if err != nil {
 			return err
 		}
-		return t.view.DeleteTokensFromRefreshToken(id, event)
+		return t.view.DeleteTokensFromRefreshToken(id, event.InstanceID, event)
 	case project.ApplicationDeactivatedType,
 		project.ApplicationRemovedType:
 		application, err := applicationFromSession(event)
@@ -137,7 +153,7 @@ func (t *Token) Reduce(event *es_models.Event) (err error) {
 		return t.view.DeleteApplicationTokens(event, application.AppID)
 	case project.ProjectDeactivatedType,
 		project.ProjectRemovedType:
-		project, err := t.getProjectByID(context.Background(), event.AggregateID)
+		project, err := t.getProjectByID(context.Background(), event.AggregateID, event.InstanceID)
 		if err != nil {
 			return err
 		}
@@ -196,8 +212,8 @@ func (t *Token) OnSuccess() error {
 	return spooler.HandleSuccess(t.view.UpdateTokenSpoolerRunTimestamp)
 }
 
-func (t *Token) getProjectByID(ctx context.Context, projID string) (*proj_model.Project, error) {
-	query, err := proj_view.ProjectByIDQuery(projID, 0)
+func (t *Token) getProjectByID(ctx context.Context, projID, instanceID string) (*proj_model.Project, error) {
+	query, err := proj_view.ProjectByIDQuery(projID, instanceID, 0)
 	if err != nil {
 		return nil, err
 	}

internal/auth/repository/eventsourcing/handler/user.go

@@ -65,8 +65,8 @@ func (_ *User) AggregateTypes() []es_models.AggregateType {
 	return []es_models.AggregateType{user_repo.AggregateType, org.AggregateType}
 }
 
-func (u *User) CurrentSequence() (uint64, error) {
-	sequence, err := u.view.GetLatestUserSequence()
+func (u *User) CurrentSequence(instanceID string) (uint64, error) {
+	sequence, err := u.view.GetLatestUserSequence(instanceID)
 	if err != nil {
 		return 0, err
 	}
@@ -74,13 +74,29 @@ func (u *User) CurrentSequence() (uint64, error) {
 }
 
 func (u *User) EventQuery() (*es_models.SearchQuery, error) {
-	sequence, err := u.view.GetLatestUserSequence()
+	sequences, err := u.view.GetLatestUserSequences()
 	if err != nil {
 		return nil, err
 	}
-	return es_models.NewSearchQuery().
+	query := es_models.NewSearchQuery()
+	instances := make([]string, 0)
+	for _, sequence := range sequences {
+		for _, instance := range instances {
+			if sequence.InstanceID == instance {
+				break
+			}
+		}
+		instances = append(instances, sequence.InstanceID)
+		query.AddQuery().
+			AggregateTypeFilter(u.AggregateTypes()...).
+			LatestSequenceFilter(sequence.CurrentSequence).
+			InstanceIDFilter(sequence.InstanceID)
+	}
+	return query.AddQuery().
 		AggregateTypeFilter(u.AggregateTypes()...).
-		LatestSequenceFilter(sequence.CurrentSequence), nil
+		LatestSequenceFilter(0).
+		ExcludedInstanceIDsFilter(instances...).
+		SearchQuery(), nil
 }
 
 func (u *User) Reduce(event *es_models.Event) (err error) {
@@ -146,14 +162,14 @@ func (u *User) ProcessUser(event *es_models.Event) (err error) {
 		user_repo.HumanPasswordChangedType,
 		user_repo.HumanPasswordlessInitCodeAddedType,
 		user_repo.HumanPasswordlessInitCodeRequestedType:
-		user, err = u.view.UserByID(event.AggregateID)
+		user, err = u.view.UserByID(event.AggregateID, event.InstanceID)
 		if err != nil {
 			return err
 		}
 		err = user.AppendEvent(event)
 	case user_repo.UserDomainClaimedType,
 		user_repo.UserUserNameChangedType:
-		user, err = u.view.UserByID(event.AggregateID)
+		user, err = u.view.UserByID(event.AggregateID, event.InstanceID)
 		if err != nil {
 			return err
 		}
@@ -163,7 +179,7 @@ func (u *User) ProcessUser(event *es_models.Event) (err error) {
 		}
 		err = u.fillLoginNames(user)
 	case user_repo.UserRemovedType:
-		return u.view.DeleteUser(event.AggregateID, event)
+		return u.view.DeleteUser(event.AggregateID, event.InstanceID, event)
 	default:
 		return u.view.ProcessedUserSequence(event)
 	}
@@ -203,7 +219,7 @@ func (u *User) fillLoginNamesOnOrgUsers(event *es_models.Event) error {
 	if err != nil {
 		return err
 	}
-	users, err := u.view.UsersByOrgID(event.AggregateID)
+	users, err := u.view.UsersByOrgID(event.AggregateID, event.InstanceID)
 	if err != nil {
 		return err
 	}
@@ -221,7 +237,7 @@ func (u *User) fillPreferredLoginNamesOnOrgUsers(event *es_models.Event) error {
 	if !userLoginMustBeDomain {
 		return nil
 	}
-	users, err := u.view.UsersByOrgID(event.AggregateID)
+	users, err := u.view.UsersByOrgID(event.AggregateID, event.InstanceID)
 	if err != nil {
 		return err
 	}

internal/auth/repository/eventsourcing/handler/user_external_idps.go

@@ -69,8 +69,8 @@ func (_ *ExternalIDP) AggregateTypes() []es_models.AggregateType {
 	return []es_models.AggregateType{user.AggregateType, instance.AggregateType, org.AggregateType}
 }
 
-func (i *ExternalIDP) CurrentSequence() (uint64, error) {
-	sequence, err := i.view.GetLatestExternalIDPSequence()
+func (i *ExternalIDP) CurrentSequence(instanceID string) (uint64, error) {
+	sequence, err := i.view.GetLatestExternalIDPSequence(instanceID)
 	if err != nil {
 		return 0, err
 	}
@@ -78,13 +78,29 @@ func (i *ExternalIDP) CurrentSequence() (uint64, error) {
 }
 
 func (i *ExternalIDP) EventQuery() (*es_models.SearchQuery, error) {
-	sequence, err := i.view.GetLatestExternalIDPSequence()
+	sequences, err := i.view.GetLatestExternalIDPSequences()
 	if err != nil {
 		return nil, err
 	}
-	return es_models.NewSearchQuery().
+	query := es_models.NewSearchQuery()
+	instances := make([]string, 0)
+	for _, sequence := range sequences {
+		for _, instance := range instances {
+			if sequence.InstanceID == instance {
+				break
+			}
+		}
+		instances = append(instances, sequence.InstanceID)
+		query.AddQuery().
+			AggregateTypeFilter(i.AggregateTypes()...).
+			LatestSequenceFilter(sequence.CurrentSequence).
+			InstanceIDFilter(sequence.InstanceID)
+	}
+	return query.AddQuery().
 		AggregateTypeFilter(i.AggregateTypes()...).
-		LatestSequenceFilter(sequence.CurrentSequence), nil
+		LatestSequenceFilter(0).
+		ExcludedInstanceIDsFilter(instances...).
+		SearchQuery(), nil
 }
 
 func (i *ExternalIDP) Reduce(event *es_models.Event) (err error) {
@@ -111,9 +127,9 @@ func (i *ExternalIDP) processUser(event *es_models.Event) (err error) {
 		if err != nil {
 			return err
 		}
-		return i.view.DeleteExternalIDP(externalIDP.ExternalUserID, externalIDP.IDPConfigID, event)
+		return i.view.DeleteExternalIDP(externalIDP.ExternalUserID, externalIDP.IDPConfigID, externalIDP.InstanceID, event)
 	case user.UserRemovedType:
-		return i.view.DeleteExternalIDPsByUserID(event.AggregateID, event)
+		return i.view.DeleteExternalIDPsByUserID(event.AggregateID, event.InstanceID, event)
 	default:
 		return i.view.ProcessedExternalIDPSequence(event)
 	}
@@ -133,7 +149,7 @@ func (i *ExternalIDP) processIdpConfig(event *es_models.Event) (err error) {
 		} else {
 			configView.AppendEvent(iam_model.IDPProviderTypeOrg, event)
 		}
-		exterinalIDPs, err := i.view.ExternalIDPsByIDPConfigID(configView.IDPConfigID)
+		exterinalIDPs, err := i.view.ExternalIDPsByIDPConfigID(configView.IDPConfigID, configView.InstanceID)
 		if err != nil {
 			return err
 		}

internal/auth/repository/eventsourcing/handler/user_session.go

@@ -11,7 +11,6 @@ import (
 	"github.com/caos/zitadel/internal/eventstore/v1/query"
 	"github.com/caos/zitadel/internal/eventstore/v1/spooler"
 	"github.com/caos/zitadel/internal/repository/user"
-	"github.com/caos/zitadel/internal/user/repository/view"
 	view_model "github.com/caos/zitadel/internal/user/repository/view/model"
 )
 
@@ -57,8 +56,8 @@ func (_ *UserSession) AggregateTypes() []models.AggregateType {
 	return []models.AggregateType{user.AggregateType}
 }
 
-func (u *UserSession) CurrentSequence() (uint64, error) {
-	sequence, err := u.view.GetLatestUserSessionSequence()
+func (u *UserSession) CurrentSequence(instanceID string) (uint64, error) {
+	sequence, err := u.view.GetLatestUserSessionSequence(instanceID)
 	if err != nil {
 		return 0, err
 	}
@@ -66,11 +65,29 @@ func (u *UserSession) CurrentSequence() (uint64, error) {
 }
 
 func (u *UserSession) EventQuery() (*models.SearchQuery, error) {
-	sequence, err := u.view.GetLatestUserSessionSequence()
+	sequences, err := u.view.GetLatestUserSessionSequences()
 	if err != nil {
 		return nil, err
 	}
-	return view.UserQuery(sequence.CurrentSequence), nil
+	query := models.NewSearchQuery()
+	instances := make([]string, 0)
+	for _, sequence := range sequences {
+		for _, instance := range instances {
+			if sequence.InstanceID == instance {
+				break
+			}
+		}
+		instances = append(instances, sequence.InstanceID)
+		query.AddQuery().
+			AggregateTypeFilter(u.AggregateTypes()...).
+			LatestSequenceFilter(sequence.CurrentSequence).
+			InstanceIDFilter(sequence.InstanceID)
+	}
+	return query.AddQuery().
+		AggregateTypeFilter(u.AggregateTypes()...).
+		LatestSequenceFilter(0).
+		ExcludedInstanceIDsFilter(instances...).
+		SearchQuery(), nil
 }
 
 func (u *UserSession) Reduce(event *models.Event) (err error) {
@@ -95,7 +112,7 @@ func (u *UserSession) Reduce(event *models.Event) (err error) {
 		if err != nil {
 			return err
 		}
-		session, err = u.view.UserSessionByIDs(eventData.UserAgentID, event.AggregateID)
+		session, err = u.view.UserSessionByIDs(eventData.UserAgentID, event.AggregateID, event.InstanceID)
 		if err != nil {
 			if !errors.IsNotFound(err) {
 				return err
@@ -126,7 +143,7 @@ func (u *UserSession) Reduce(event *models.Event) (err error) {
 		user.UserIDPLinkCascadeRemovedType,
 		user.HumanPasswordlessTokenRemovedType,
 		user.HumanU2FTokenRemovedType:
-		sessions, err := u.view.UserSessionsByUserID(event.AggregateID)
+		sessions, err := u.view.UserSessionsByUserID(event.AggregateID, event.InstanceID)
 		if err != nil {
 			return err
 		}
@@ -143,7 +160,7 @@ func (u *UserSession) Reduce(event *models.Event) (err error) {
 		}
 		return u.view.PutUserSessions(sessions, event)
 	case user.UserRemovedType:
-		return u.view.DeleteUserSessions(event.AggregateID, event)
+		return u.view.DeleteUserSessions(event.AggregateID, event.InstanceID, event)
 	default:
 		return u.view.ProcessedUserSessionSequence(event)
 	}
@@ -169,7 +186,7 @@ func (u *UserSession) updateSession(session *view_model.UserSessionView, event *
 }
 
 func (u *UserSession) fillUserInfo(session *view_model.UserSessionView, id string) error {
-	user, err := u.view.UserByID(id)
+	user, err := u.view.UserByID(id, session.InstanceID)
 	if err != nil {
 		return err
 	}

internal/auth/repository/eventsourcing/spooler/lock.go

@@ -19,6 +19,6 @@ func NewLocker(client *sql.DB) *locker {
 	return &locker{dbClient: client}
 }
 
-func (l *locker) Renew(lockerID, viewModel string, waitTime time.Duration) error {
-	return es_locker.Renew(l.dbClient, lockTable, lockerID, viewModel, waitTime)
+func (l *locker) Renew(lockerID, viewModel, instanceID string, waitTime time.Duration) error {
+	return es_locker.Renew(l.dbClient, lockTable, lockerID, viewModel, instanceID, waitTime)
 }

internal/auth/repository/eventsourcing/view/error_event.go

@@ -12,6 +12,6 @@ func (v *View) saveFailedEvent(failedEvent *repository.FailedEvent) error {
 	return repository.SaveFailedEvent(v.Db, errTable, failedEvent)
 }
 
-func (v *View) latestFailedEvent(viewName string, sequence uint64) (*repository.FailedEvent, error) {
-	return repository.LatestFailedEvent(v.Db, errTable, viewName, sequence)
+func (v *View) latestFailedEvent(viewName, instanceID string, sequence uint64) (*repository.FailedEvent, error) {
+	return repository.LatestFailedEvent(v.Db, errTable, viewName, instanceID, sequence)
 }

internal/auth/repository/eventsourcing/view/external_idps.go

@@ -12,16 +12,16 @@ const (
 	externalIDPTable = "auth.user_external_idps"
 )
 
-func (v *View) ExternalIDPByExternalUserIDAndIDPConfigID(externalUserID, idpConfigID string) (*model.ExternalIDPView, error) {
-	return view.ExternalIDPByExternalUserIDAndIDPConfigID(v.Db, externalIDPTable, externalUserID, idpConfigID)
+func (v *View) ExternalIDPByExternalUserIDAndIDPConfigID(externalUserID, idpConfigID, instanceID string) (*model.ExternalIDPView, error) {
+	return view.ExternalIDPByExternalUserIDAndIDPConfigID(v.Db, externalIDPTable, externalUserID, idpConfigID, instanceID)
 }
 
-func (v *View) ExternalIDPByExternalUserIDAndIDPConfigIDAndResourceOwner(externalUserID, idpConfigID, resourceOwner string) (*model.ExternalIDPView, error) {
-	return view.ExternalIDPByExternalUserIDAndIDPConfigIDAndResourceOwner(v.Db, externalIDPTable, externalUserID, idpConfigID, resourceOwner)
+func (v *View) ExternalIDPByExternalUserIDAndIDPConfigIDAndResourceOwner(externalUserID, idpConfigID, resourceOwner, instanceID string) (*model.ExternalIDPView, error) {
+	return view.ExternalIDPByExternalUserIDAndIDPConfigIDAndResourceOwner(v.Db, externalIDPTable, externalUserID, idpConfigID, resourceOwner, instanceID)
 }
 
-func (v *View) ExternalIDPsByIDPConfigID(idpConfigID string) ([]*model.ExternalIDPView, error) {
-	return view.ExternalIDPsByIDPConfigID(v.Db, externalIDPTable, idpConfigID)
+func (v *View) ExternalIDPsByIDPConfigID(idpConfigID, instanceID string) ([]*model.ExternalIDPView, error) {
+	return view.ExternalIDPsByIDPConfigID(v.Db, externalIDPTable, idpConfigID, instanceID)
 }
 
 func (v *View) PutExternalIDP(externalIDP *model.ExternalIDPView, event *models.Event) error {
@@ -40,24 +40,28 @@ func (v *View) PutExternalIDPs(event *models.Event, externalIDPs ...*model.Exter
 	return v.ProcessedExternalIDPSequence(event)
 }
 
-func (v *View) DeleteExternalIDP(externalUserID, idpConfigID string, event *models.Event) error {
-	err := view.DeleteExternalIDP(v.Db, externalIDPTable, externalUserID, idpConfigID)
+func (v *View) DeleteExternalIDP(externalUserID, idpConfigID, instanceID string, event *models.Event) error {
+	err := view.DeleteExternalIDP(v.Db, externalIDPTable, externalUserID, idpConfigID, instanceID)
 	if err != nil && !errors.IsNotFound(err) {
 		return err
 	}
 	return v.ProcessedExternalIDPSequence(event)
 }
 
-func (v *View) DeleteExternalIDPsByUserID(userID string, event *models.Event) error {
-	err := view.DeleteExternalIDPsByUserID(v.Db, externalIDPTable, userID)
+func (v *View) DeleteExternalIDPsByUserID(userID, instanceID string, event *models.Event) error {
+	err := view.DeleteExternalIDPsByUserID(v.Db, externalIDPTable, userID, instanceID)
 	if err != nil {
 		return err
 	}
 	return v.ProcessedExternalIDPSequence(event)
 }
 
-func (v *View) GetLatestExternalIDPSequence() (*global_view.CurrentSequence, error) {
-	return v.latestSequence(externalIDPTable)
+func (v *View) GetLatestExternalIDPSequence(instanceID string) (*global_view.CurrentSequence, error) {
+	return v.latestSequence(externalIDPTable, instanceID)
+}
+
+func (v *View) GetLatestExternalIDPSequences() ([]*global_view.CurrentSequence, error) {
+	return v.latestSequences(externalIDPTable)
 }
 
 func (v *View) ProcessedExternalIDPSequence(event *models.Event) error {
@@ -68,8 +72,8 @@ func (v *View) UpdateExternalIDPSpoolerRunTimestamp() error {
 	return v.updateSpoolerRunSequence(externalIDPTable)
 }
 
-func (v *View) GetLatestExternalIDPFailedEvent(sequence uint64) (*global_view.FailedEvent, error) {
-	return v.latestFailedEvent(externalIDPTable, sequence)
+func (v *View) GetLatestExternalIDPFailedEvent(sequence uint64, instanceID string) (*global_view.FailedEvent, error) {
+	return v.latestFailedEvent(externalIDPTable, instanceID, sequence)
 }
 
 func (v *View) ProcessedExternalIDPFailedEvent(failedEvent *global_view.FailedEvent) error {

internal/auth/repository/eventsourcing/view/idp_configs.go

@@ -13,12 +13,12 @@ const (
 	idpConfigTable = "auth.idp_configs"
 )
 
-func (v *View) IDPConfigByID(idpID string) (*iam_es_model.IDPConfigView, error) {
-	return view.IDPByID(v.Db, idpConfigTable, idpID)
+func (v *View) IDPConfigByID(idpID, instanceID string) (*iam_es_model.IDPConfigView, error) {
+	return view.IDPByID(v.Db, idpConfigTable, idpID, instanceID)
 }
 
-func (v *View) GetIDPConfigsByAggregateID(aggregateID string) ([]*iam_es_model.IDPConfigView, error) {
-	return view.GetIDPConfigsByAggregateID(v.Db, idpConfigTable, aggregateID)
+func (v *View) GetIDPConfigsByAggregateID(aggregateID, instanceID string) ([]*iam_es_model.IDPConfigView, error) {
+	return view.GetIDPConfigsByAggregateID(v.Db, idpConfigTable, aggregateID, instanceID)
 }
 
 func (v *View) SearchIDPConfigs(request *iam_model.IDPConfigSearchRequest) ([]*iam_es_model.IDPConfigView, uint64, error) {
@@ -34,15 +34,19 @@ func (v *View) PutIDPConfig(idp *iam_es_model.IDPConfigView, event *models.Event
 }
 
 func (v *View) DeleteIDPConfig(idpID string, event *models.Event) error {
-	err := view.DeleteIDP(v.Db, idpConfigTable, idpID)
+	err := view.DeleteIDP(v.Db, idpConfigTable, idpID, event.InstanceID)
 	if err != nil && !errors.IsNotFound(err) {
 		return err
 	}
 	return v.ProcessedIDPConfigSequence(event)
 }
 
-func (v *View) GetLatestIDPConfigSequence() (*global_view.CurrentSequence, error) {
-	return v.latestSequence(idpConfigTable)
+func (v *View) GetLatestIDPConfigSequence(instanceID string) (*global_view.CurrentSequence, error) {
+	return v.latestSequence(idpConfigTable, instanceID)
+}
+
+func (v *View) GetLatestIDPConfigSequences() ([]*global_view.CurrentSequence, error) {
+	return v.latestSequences(idpConfigTable)
 }
 
 func (v *View) ProcessedIDPConfigSequence(event *models.Event) error {
@@ -53,8 +57,8 @@ func (v *View) UpdateIDPConfigSpoolerRunTimestamp() error {
 	return v.updateSpoolerRunSequence(idpConfigTable)
 }
 
-func (v *View) GetLatestIDPConfigFailedEvent(sequence uint64) (*global_view.FailedEvent, error) {
-	return v.latestFailedEvent(idpConfigTable, sequence)
+func (v *View) GetLatestIDPConfigFailedEvent(sequence uint64, instanceID string) (*global_view.FailedEvent, error) {
+	return v.latestFailedEvent(idpConfigTable, instanceID, sequence)
 }
 
 func (v *View) ProcessedIDPConfigFailedEvent(failedEvent *global_view.FailedEvent) error {

internal/auth/repository/eventsourcing/view/idp_providers.go

@@ -13,16 +13,16 @@ const (
 	idpProviderTable = "auth.idp_providers"
 )
 
-func (v *View) IDPProviderByAggregateAndIDPConfigID(aggregateID, idpConfigID string) (*model.IDPProviderView, error) {
-	return view.GetIDPProviderByAggregateIDAndConfigID(v.Db, idpProviderTable, aggregateID, idpConfigID)
+func (v *View) IDPProviderByAggregateAndIDPConfigID(aggregateID, idpConfigID, instanceID string) (*model.IDPProviderView, error) {
+	return view.GetIDPProviderByAggregateIDAndConfigID(v.Db, idpProviderTable, aggregateID, idpConfigID, instanceID)
 }
 
-func (v *View) IDPProvidersByIDPConfigID(idpConfigID string) ([]*model.IDPProviderView, error) {
-	return view.IDPProvidersByIdpConfigID(v.Db, idpProviderTable, idpConfigID)
+func (v *View) IDPProvidersByIDPConfigID(idpConfigID, instanceID string) ([]*model.IDPProviderView, error) {
+	return view.IDPProvidersByIdpConfigID(v.Db, idpProviderTable, idpConfigID, instanceID)
 }
 
-func (v *View) IDPProvidersByAggregateIDAndState(aggregateID string, idpConfigState iam_model.IDPConfigState) ([]*model.IDPProviderView, error) {
-	return view.IDPProvidersByAggregateIDAndState(v.Db, idpProviderTable, aggregateID, idpConfigState)
+func (v *View) IDPProvidersByAggregateIDAndState(aggregateID, instanceID string, idpConfigState iam_model.IDPConfigState) ([]*model.IDPProviderView, error) {
+	return view.IDPProvidersByAggregateIDAndState(v.Db, idpProviderTable, aggregateID, instanceID, idpConfigState)
 }
 
 func (v *View) SearchIDPProviders(request *iam_model.IDPProviderSearchRequest) ([]*model.IDPProviderView, uint64, error) {
@@ -45,24 +45,28 @@ func (v *View) PutIDPProviders(event *models.Event, providers ...*model.IDPProvi
 	return v.ProcessedIDPProviderSequence(event)
 }
 
-func (v *View) DeleteIDPProvider(aggregateID, idpConfigID string, event *models.Event) error {
-	err := view.DeleteIDPProvider(v.Db, idpProviderTable, aggregateID, idpConfigID)
+func (v *View) DeleteIDPProvider(aggregateID, idpConfigID, instanceID string, event *models.Event) error {
+	err := view.DeleteIDPProvider(v.Db, idpProviderTable, aggregateID, idpConfigID, instanceID)
 	if err != nil && !errors.IsNotFound(err) {
 		return err
 	}
 	return v.ProcessedIDPProviderSequence(event)
 }
 
-func (v *View) DeleteIDPProvidersByAggregateID(aggregateID string, event *models.Event) error {
-	err := view.DeleteIDPProvidersByAggregateID(v.Db, idpProviderTable, aggregateID)
+func (v *View) DeleteIDPProvidersByAggregateID(aggregateID, instanceID string, event *models.Event) error {
+	err := view.DeleteIDPProvidersByAggregateID(v.Db, idpProviderTable, aggregateID, instanceID)
 	if err != nil && !errors.IsNotFound(err) {
 		return err
 	}
 	return v.ProcessedIDPProviderSequence(event)
 }
 
-func (v *View) GetLatestIDPProviderSequence() (*global_view.CurrentSequence, error) {
-	return v.latestSequence(idpProviderTable)
+func (v *View) GetLatestIDPProviderSequence(instanceID string) (*global_view.CurrentSequence, error) {
+	return v.latestSequence(idpProviderTable, instanceID)
+}
+
+func (v *View) GetLatestIDPProviderSequences() ([]*global_view.CurrentSequence, error) {
+	return v.latestSequences(idpProviderTable)
 }
 
 func (v *View) ProcessedIDPProviderSequence(event *models.Event) error {
@@ -73,8 +77,8 @@ func (v *View) UpdateIDPProviderSpoolerRunTimestamp() error {
 	return v.updateSpoolerRunSequence(idpProviderTable)
 }
 
-func (v *View) GetLatestIDPProviderFailedEvent(sequence uint64) (*global_view.FailedEvent, error) {
-	return v.latestFailedEvent(idpProviderTable, sequence)
+func (v *View) GetLatestIDPProviderFailedEvent(sequence uint64, instanceID string) (*global_view.FailedEvent, error) {
+	return v.latestFailedEvent(idpProviderTable, instanceID, sequence)
 }
 
 func (v *View) ProcessedIDPProviderFailedEvent(failedEvent *global_view.FailedEvent) error {

internal/auth/repository/eventsourcing/view/org_project_mapping.go

@@ -12,8 +12,8 @@ const (
 	orgPrgojectMappingTable = "auth.org_project_mapping"
 )
 
-func (v *View) OrgProjectMappingByIDs(orgID, projectID string) (*model.OrgProjectMapping, error) {
-	return view.OrgProjectMappingByIDs(v.Db, orgPrgojectMappingTable, orgID, projectID)
+func (v *View) OrgProjectMappingByIDs(orgID, projectID, instanceID string) (*model.OrgProjectMapping, error) {
+	return view.OrgProjectMappingByIDs(v.Db, orgPrgojectMappingTable, orgID, projectID, instanceID)
 }
 
 func (v *View) PutOrgProjectMapping(mapping *model.OrgProjectMapping, event *models.Event) error {
@@ -24,24 +24,28 @@ func (v *View) PutOrgProjectMapping(mapping *model.OrgProjectMapping, event *mod
 	return v.ProcessedOrgProjectMappingSequence(event)
 }
 
-func (v *View) DeleteOrgProjectMapping(orgID, projectID string, event *models.Event) error {
-	err := view.DeleteOrgProjectMapping(v.Db, orgPrgojectMappingTable, orgID, projectID)
+func (v *View) DeleteOrgProjectMapping(orgID, projectID, instanceID string, event *models.Event) error {
+	err := view.DeleteOrgProjectMapping(v.Db, orgPrgojectMappingTable, orgID, projectID, instanceID)
 	if err != nil && !errors.IsNotFound(err) {
 		return err
 	}
 	return v.ProcessedOrgProjectMappingSequence(event)
 }
 
-func (v *View) DeleteOrgProjectMappingsByProjectID(projectID string) error {
-	return view.DeleteOrgProjectMappingsByProjectID(v.Db, orgPrgojectMappingTable, projectID)
+func (v *View) DeleteOrgProjectMappingsByProjectID(projectID, instanceID string) error {
+	return view.DeleteOrgProjectMappingsByProjectID(v.Db, orgPrgojectMappingTable, projectID, instanceID)
 }
 
-func (v *View) DeleteOrgProjectMappingsByProjectGrantID(projectGrantID string) error {
-	return view.DeleteOrgProjectMappingsByProjectGrantID(v.Db, orgPrgojectMappingTable, projectGrantID)
+func (v *View) DeleteOrgProjectMappingsByProjectGrantID(projectGrantID, instanceID string) error {
+	return view.DeleteOrgProjectMappingsByProjectGrantID(v.Db, orgPrgojectMappingTable, projectGrantID, instanceID)
 }
 
-func (v *View) GetLatestOrgProjectMappingSequence() (*repository.CurrentSequence, error) {
-	return v.latestSequence(orgPrgojectMappingTable)
+func (v *View) GetLatestOrgProjectMappingSequence(instanceID string) (*repository.CurrentSequence, error) {
+	return v.latestSequence(orgPrgojectMappingTable, instanceID)
+}
+
+func (v *View) GetLatestOrgProjectMappingSequences() ([]*repository.CurrentSequence, error) {
+	return v.latestSequences(orgPrgojectMappingTable)
 }
 
 func (v *View) ProcessedOrgProjectMappingSequence(event *models.Event) error {
@@ -52,8 +56,8 @@ func (v *View) UpdateOrgProjectMappingSpoolerRunTimestamp() error {
 	return v.updateSpoolerRunSequence(orgPrgojectMappingTable)
 }
 
-func (v *View) GetLatestOrgProjectMappingFailedEvent(sequence uint64) (*repository.FailedEvent, error) {
-	return v.latestFailedEvent(orgPrgojectMappingTable, sequence)
+func (v *View) GetLatestOrgProjectMappingFailedEvent(sequence uint64, instanceID string) (*repository.FailedEvent, error) {
+	return v.latestFailedEvent(orgPrgojectMappingTable, instanceID, sequence)
 }
 
 func (v *View) ProcessedOrgProjectMappingFailedEvent(failedEvent *repository.FailedEvent) error {

internal/auth/repository/eventsourcing/view/refresh_token.go

@@ -13,12 +13,12 @@ const (
 	refreshTokenTable = "auth.refresh_tokens"
 )
 
-func (v *View) RefreshTokenByID(tokenID string) (*model.RefreshTokenView, error) {
-	return usr_view.RefreshTokenByID(v.Db, refreshTokenTable, tokenID)
+func (v *View) RefreshTokenByID(tokenID, instanceID string) (*model.RefreshTokenView, error) {
+	return usr_view.RefreshTokenByID(v.Db, refreshTokenTable, tokenID, instanceID)
 }
 
-func (v *View) RefreshTokensByUserID(userID string) ([]*model.RefreshTokenView, error) {
-	return usr_view.RefreshTokensByUserID(v.Db, refreshTokenTable, userID)
+func (v *View) RefreshTokensByUserID(userID, instanceID string) ([]*model.RefreshTokenView, error) {
+	return usr_view.RefreshTokensByUserID(v.Db, refreshTokenTable, userID, instanceID)
 }
 
 func (v *View) SearchRefreshTokens(request *user_model.RefreshTokenSearchRequest) ([]*model.RefreshTokenView, uint64, error) {
@@ -41,16 +41,16 @@ func (v *View) PutRefreshTokens(token []*model.RefreshTokenView, event *models.E
 	return v.ProcessedRefreshTokenSequence(event)
 }
 
-func (v *View) DeleteRefreshToken(tokenID string, event *models.Event) error {
-	err := usr_view.DeleteRefreshToken(v.Db, refreshTokenTable, tokenID)
+func (v *View) DeleteRefreshToken(tokenID, instanceID string, event *models.Event) error {
+	err := usr_view.DeleteRefreshToken(v.Db, refreshTokenTable, tokenID, instanceID)
 	if err != nil && !errors.IsNotFound(err) {
 		return err
 	}
 	return v.ProcessedRefreshTokenSequence(event)
 }
 
-func (v *View) DeleteUserRefreshTokens(userID string, event *models.Event) error {
-	err := usr_view.DeleteUserRefreshTokens(v.Db, refreshTokenTable, userID)
+func (v *View) DeleteUserRefreshTokens(userID, instanceID string, event *models.Event) error {
+	err := usr_view.DeleteUserRefreshTokens(v.Db, refreshTokenTable, userID, instanceID)
 	if err != nil && !errors.IsNotFound(err) {
 		return err
 	}
@@ -58,15 +58,19 @@ func (v *View) DeleteUserRefreshTokens(userID string, event *models.Event) error
 }
 
 func (v *View) DeleteApplicationRefreshTokens(event *models.Event, ids ...string) error {
-	err := usr_view.DeleteApplicationTokens(v.Db, refreshTokenTable, ids)
+	err := usr_view.DeleteApplicationTokens(v.Db, refreshTokenTable, event.InstanceID, ids)
 	if err != nil && !errors.IsNotFound(err) {
 		return err
 	}
 	return v.ProcessedRefreshTokenSequence(event)
 }
 
-func (v *View) GetLatestRefreshTokenSequence() (*repository.CurrentSequence, error) {
-	return v.latestSequence(refreshTokenTable)
+func (v *View) GetLatestRefreshTokenSequence(instanceID string) (*repository.CurrentSequence, error) {
+	return v.latestSequence(refreshTokenTable, instanceID)
+}
+
+func (v *View) GetLatestRefreshTokenSequences() ([]*repository.CurrentSequence, error) {
+	return v.latestSequences(refreshTokenTable)
 }
 
 func (v *View) ProcessedRefreshTokenSequence(event *models.Event) error {
@@ -77,8 +81,8 @@ func (v *View) UpdateRefreshTokenSpoolerRunTimestamp() error {
 	return v.updateSpoolerRunSequence(refreshTokenTable)
 }
 
-func (v *View) GetLatestRefreshTokenFailedEvent(sequence uint64) (*repository.FailedEvent, error) {
-	return v.latestFailedEvent(refreshTokenTable, sequence)
+func (v *View) GetLatestRefreshTokenFailedEvent(sequence uint64, instanceID string) (*repository.FailedEvent, error) {
+	return v.latestFailedEvent(refreshTokenTable, instanceID, sequence)
 }
 
 func (v *View) ProcessedRefreshTokenFailedEvent(failedEvent *repository.FailedEvent) error {

internal/auth/repository/eventsourcing/view/sequence.go

@@ -12,21 +12,27 @@ const (
 )
 
 func (v *View) saveCurrentSequence(viewName string, event *models.Event) error {
-	return repository.SaveCurrentSequence(v.Db, sequencesTable, viewName, event.Sequence, event.CreationDate)
+	return repository.SaveCurrentSequence(v.Db, sequencesTable, viewName, event.InstanceID, event.Sequence, event.CreationDate)
 }
 
-func (v *View) latestSequence(viewName string) (*repository.CurrentSequence, error) {
-	return repository.LatestSequence(v.Db, sequencesTable, viewName)
+func (v *View) latestSequence(viewName, instanceID string) (*repository.CurrentSequence, error) {
+	return repository.LatestSequence(v.Db, sequencesTable, viewName, instanceID)
+}
+
+func (v *View) latestSequences(viewName string) ([]*repository.CurrentSequence, error) {
+	return repository.LatestSequences(v.Db, sequencesTable, viewName)
 }
 
 func (v *View) updateSpoolerRunSequence(viewName string) error {
-	currentSequence, err := repository.LatestSequence(v.Db, sequencesTable, viewName)
+	currentSequences, err := repository.LatestSequences(v.Db, sequencesTable, viewName)
 	if err != nil {
 		return err
 	}
-	if currentSequence.ViewName == "" {
-		currentSequence.ViewName = viewName
+	for _, currentSequence := range currentSequences {
+		if currentSequence.ViewName == "" {
+			currentSequence.ViewName = viewName
+		}
+		currentSequence.LastSuccessfulSpoolerRun = time.Now()
 	}
-	currentSequence.LastSuccessfulSpoolerRun = time.Now()
-	return repository.UpdateCurrentSequence(v.Db, sequencesTable, currentSequence)
+	return repository.UpdateCurrentSequences(v.Db, sequencesTable, currentSequences)
 }

internal/auth/repository/eventsourcing/view/token.go

@@ -12,12 +12,12 @@ const (
 	tokenTable = "auth.tokens"
 )
 
-func (v *View) TokenByID(tokenID string) (*model.TokenView, error) {
-	return usr_view.TokenByID(v.Db, tokenTable, tokenID)
+func (v *View) TokenByID(tokenID, instanceID string) (*model.TokenView, error) {
+	return usr_view.TokenByID(v.Db, tokenTable, tokenID, instanceID)
 }
 
-func (v *View) TokensByUserID(userID string) ([]*model.TokenView, error) {
-	return usr_view.TokensByUserID(v.Db, tokenTable, userID)
+func (v *View) TokensByUserID(userID, instanceID string) ([]*model.TokenView, error) {
+	return usr_view.TokensByUserID(v.Db, tokenTable, userID, instanceID)
 }
 
 func (v *View) PutToken(token *model.TokenView, event *models.Event) error {
@@ -36,24 +36,24 @@ func (v *View) PutTokens(token []*model.TokenView, event *models.Event) error {
 	return v.ProcessedTokenSequence(event)
 }
 
-func (v *View) DeleteToken(tokenID string, event *models.Event) error {
-	err := usr_view.DeleteToken(v.Db, tokenTable, tokenID)
+func (v *View) DeleteToken(tokenID, instanceID string, event *models.Event) error {
+	err := usr_view.DeleteToken(v.Db, tokenTable, tokenID, instanceID)
 	if err != nil && !errors.IsNotFound(err) {
 		return err
 	}
 	return v.ProcessedTokenSequence(event)
 }
 
-func (v *View) DeleteSessionTokens(agentID, userID string, event *models.Event) error {
-	err := usr_view.DeleteSessionTokens(v.Db, tokenTable, agentID, userID)
+func (v *View) DeleteSessionTokens(agentID, userID, instanceID string, event *models.Event) error {
+	err := usr_view.DeleteSessionTokens(v.Db, tokenTable, agentID, userID, instanceID)
 	if err != nil && !errors.IsNotFound(err) {
 		return err
 	}
 	return v.ProcessedTokenSequence(event)
 }
 
-func (v *View) DeleteUserTokens(userID string, event *models.Event) error {
-	err := usr_view.DeleteUserTokens(v.Db, tokenTable, userID)
+func (v *View) DeleteUserTokens(userID, instanceID string, event *models.Event) error {
+	err := usr_view.DeleteUserTokens(v.Db, tokenTable, userID, instanceID)
 	if err != nil && !errors.IsNotFound(err) {
 		return err
 	}
@@ -61,23 +61,27 @@ func (v *View) DeleteUserTokens(userID string, event *models.Event) error {
 }
 
 func (v *View) DeleteApplicationTokens(event *models.Event, ids ...string) error {
-	err := usr_view.DeleteApplicationTokens(v.Db, tokenTable, ids)
+	err := usr_view.DeleteApplicationTokens(v.Db, tokenTable, event.InstanceID, ids)
 	if err != nil && !errors.IsNotFound(err) {
 		return err
 	}
 	return v.ProcessedTokenSequence(event)
 }
 
-func (v *View) DeleteTokensFromRefreshToken(refreshTokenID string, event *models.Event) error {
-	err := usr_view.DeleteTokensFromRefreshToken(v.Db, tokenTable, refreshTokenID)
+func (v *View) DeleteTokensFromRefreshToken(refreshTokenID, instanceID string, event *models.Event) error {
+	err := usr_view.DeleteTokensFromRefreshToken(v.Db, tokenTable, refreshTokenID, instanceID)
 	if err != nil && !errors.IsNotFound(err) {
 		return err
 	}
 	return v.ProcessedTokenSequence(event)
 }
 
-func (v *View) GetLatestTokenSequence() (*repository.CurrentSequence, error) {
-	return v.latestSequence(tokenTable)
+func (v *View) GetLatestTokenSequence(instanceID string) (*repository.CurrentSequence, error) {
+	return v.latestSequence(tokenTable, instanceID)
+}
+
+func (v *View) GetLatestTokenSequences() ([]*repository.CurrentSequence, error) {
+	return v.latestSequences(tokenTable)
 }
 
 func (v *View) ProcessedTokenSequence(event *models.Event) error {
@@ -88,8 +92,8 @@ func (v *View) UpdateTokenSpoolerRunTimestamp() error {
 	return v.updateSpoolerRunSequence(tokenTable)
 }
 
-func (v *View) GetLatestTokenFailedEvent(sequence uint64) (*repository.FailedEvent, error) {
-	return v.latestFailedEvent(tokenTable, sequence)
+func (v *View) GetLatestTokenFailedEvent(sequence uint64, instanceID string) (*repository.FailedEvent, error) {
+	return v.latestFailedEvent(tokenTable, instanceID, sequence)
 }
 
 func (v *View) ProcessedTokenFailedEvent(failedEvent *repository.FailedEvent) error {

internal/auth/repository/eventsourcing/view/user.go

@@ -13,40 +13,40 @@ const (
 	userTable = "auth.users"
 )
 
-func (v *View) UserByID(userID string) (*model.UserView, error) {
-	return view.UserByID(v.Db, userTable, userID)
+func (v *View) UserByID(userID, instanceID string) (*model.UserView, error) {
+	return view.UserByID(v.Db, userTable, userID, instanceID)
 }
 
-func (v *View) UserByUsername(userName string) (*model.UserView, error) {
-	return view.UserByUserName(v.Db, userTable, userName)
+func (v *View) UserByUsername(userName, instanceID string) (*model.UserView, error) {
+	return view.UserByUserName(v.Db, userTable, userName, instanceID)
 }
 
-func (v *View) UserByLoginName(loginName string) (*model.UserView, error) {
-	return view.UserByLoginName(v.Db, userTable, loginName)
+func (v *View) UserByLoginName(loginName, instanceID string) (*model.UserView, error) {
+	return view.UserByLoginName(v.Db, userTable, loginName, instanceID)
 }
 
-func (v *View) UserByLoginNameAndResourceOwner(loginName, resourceOwner string) (*model.UserView, error) {
-	return view.UserByLoginNameAndResourceOwner(v.Db, userTable, loginName, resourceOwner)
+func (v *View) UserByLoginNameAndResourceOwner(loginName, resourceOwner, instanceID string) (*model.UserView, error) {
+	return view.UserByLoginNameAndResourceOwner(v.Db, userTable, loginName, resourceOwner, instanceID)
 }
 
-func (v *View) UsersByOrgID(orgID string) ([]*model.UserView, error) {
-	return view.UsersByOrgID(v.Db, userTable, orgID)
+func (v *View) UsersByOrgID(orgID, instanceID string) ([]*model.UserView, error) {
+	return view.UsersByOrgID(v.Db, userTable, orgID, instanceID)
 }
 
-func (v *View) UserIDsByDomain(domain string) ([]string, error) {
-	return view.UserIDsByDomain(v.Db, userTable, domain)
+func (v *View) UserIDsByDomain(domain, instanceID string) ([]string, error) {
+	return view.UserIDsByDomain(v.Db, userTable, domain, instanceID)
 }
 
 func (v *View) SearchUsers(request *usr_model.UserSearchRequest) ([]*model.UserView, uint64, error) {
 	return view.SearchUsers(v.Db, userTable, request)
 }
 
-func (v *View) GetGlobalUserByLoginName(email string) (*model.UserView, error) {
-	return view.GetGlobalUserByLoginName(v.Db, userTable, email)
+func (v *View) GetGlobalUserByLoginName(email, instanceID string) (*model.UserView, error) {
+	return view.GetGlobalUserByLoginName(v.Db, userTable, email, instanceID)
 }
 
-func (v *View) UserMFAs(userID string) ([]*usr_model.MultiFactor, error) {
-	return view.UserMFAs(v.Db, userTable, userID)
+func (v *View) UserMFAs(userID, instanceID string) ([]*usr_model.MultiFactor, error) {
+	return view.UserMFAs(v.Db, userTable, userID, instanceID)
 }
 
 func (v *View) PutUser(user *model.UserView, event *models.Event) error {
@@ -65,16 +65,20 @@ func (v *View) PutUsers(users []*model.UserView, event *models.Event) error {
 	return v.ProcessedUserSequence(event)
 }
 
-func (v *View) DeleteUser(userID string, event *models.Event) error {
-	err := view.DeleteUser(v.Db, userTable, userID)
+func (v *View) DeleteUser(userID, instanceID string, event *models.Event) error {
+	err := view.DeleteUser(v.Db, userTable, userID, instanceID)
 	if err != nil && !errors.IsNotFound(err) {
 		return err
 	}
 	return v.ProcessedUserSequence(event)
 }
 
-func (v *View) GetLatestUserSequence() (*repository.CurrentSequence, error) {
-	return v.latestSequence(userTable)
+func (v *View) GetLatestUserSequence(instanceID string) (*repository.CurrentSequence, error) {
+	return v.latestSequence(userTable, instanceID)
+}
+
+func (v *View) GetLatestUserSequences() ([]*repository.CurrentSequence, error) {
+	return v.latestSequences(userTable)
 }
 
 func (v *View) ProcessedUserSequence(event *models.Event) error {
@@ -85,8 +89,8 @@ func (v *View) UpdateUserSpoolerRunTimestamp() error {
 	return v.updateSpoolerRunSequence(userTable)
 }
 
-func (v *View) GetLatestUserFailedEvent(sequence uint64) (*repository.FailedEvent, error) {
-	return v.latestFailedEvent(userTable, sequence)
+func (v *View) GetLatestUserFailedEvent(sequence uint64, instanceID string) (*repository.FailedEvent, error) {
+	return v.latestFailedEvent(userTable, instanceID, sequence)
 }
 
 func (v *View) ProcessedUserFailedEvent(failedEvent *repository.FailedEvent) error {

internal/auth/repository/eventsourcing/view/user_session.go

@@ -12,16 +12,16 @@ const (
 	userSessionTable = "auth.user_sessions"
 )
 
-func (v *View) UserSessionByIDs(agentID, userID string) (*model.UserSessionView, error) {
-	return view.UserSessionByIDs(v.Db, userSessionTable, agentID, userID)
+func (v *View) UserSessionByIDs(agentID, userID, instanceID string) (*model.UserSessionView, error) {
+	return view.UserSessionByIDs(v.Db, userSessionTable, agentID, userID, instanceID)
 }
 
-func (v *View) UserSessionsByUserID(userID string) ([]*model.UserSessionView, error) {
-	return view.UserSessionsByUserID(v.Db, userSessionTable, userID)
+func (v *View) UserSessionsByUserID(userID, instanceID string) ([]*model.UserSessionView, error) {
+	return view.UserSessionsByUserID(v.Db, userSessionTable, userID, instanceID)
 }
 
-func (v *View) UserSessionsByAgentID(agentID string) ([]*model.UserSessionView, error) {
-	return view.UserSessionsByAgentID(v.Db, userSessionTable, agentID)
+func (v *View) UserSessionsByAgentID(agentID, instanceID string) ([]*model.UserSessionView, error) {
+	return view.UserSessionsByAgentID(v.Db, userSessionTable, agentID, instanceID)
 }
 
 func (v *View) ActiveUserSessionsCount() (uint64, error) {
@@ -44,16 +44,20 @@ func (v *View) PutUserSessions(userSession []*model.UserSessionView, event *mode
 	return v.ProcessedUserSessionSequence(event)
 }
 
-func (v *View) DeleteUserSessions(userID string, event *models.Event) error {
-	err := view.DeleteUserSessions(v.Db, userSessionTable, userID)
+func (v *View) DeleteUserSessions(userID, instanceID string, event *models.Event) error {
+	err := view.DeleteUserSessions(v.Db, userSessionTable, userID, instanceID)
 	if err != nil && !errors.IsNotFound(err) {
 		return err
 	}
 	return v.ProcessedUserSessionSequence(event)
 }
 
-func (v *View) GetLatestUserSessionSequence() (*repository.CurrentSequence, error) {
-	return v.latestSequence(userSessionTable)
+func (v *View) GetLatestUserSessionSequence(instanceID string) (*repository.CurrentSequence, error) {
+	return v.latestSequence(userSessionTable, instanceID)
+}
+
+func (v *View) GetLatestUserSessionSequences() ([]*repository.CurrentSequence, error) {
+	return v.latestSequences(userSessionTable)
 }
 
 func (v *View) ProcessedUserSessionSequence(event *models.Event) error {
@@ -64,8 +68,8 @@ func (v *View) UpdateUserSessionSpoolerRunTimestamp() error {
 	return v.updateSpoolerRunSequence(userSessionTable)
 }
 
-func (v *View) GetLatestUserSessionFailedEvent(sequence uint64) (*repository.FailedEvent, error) {
-	return v.latestFailedEvent(userSessionTable, sequence)
+func (v *View) GetLatestUserSessionFailedEvent(sequence uint64, instanceID string) (*repository.FailedEvent, error) {
+	return v.latestFailedEvent(userSessionTable, instanceID, sequence)
 }
 
 func (v *View) ProcessedUserSessionFailedEvent(failedEvent *repository.FailedEvent) error {