feat(crypto): use passwap for machine and app secrets (#7657)

* feat(crypto): use passwap for machine and app secrets

* fix command package tests

* add hash generator command test

* naming convention, fix query tests

* rename PasswordHasher and cleanup start commands

* add reducer tests

* fix intergration tests, cleanup old config

* add app secret unit tests

* solve setup panics

* fix push of updated events

* add missing event translations

* update documentation

* solve linter errors

* remove nolint:SA1019 as it doesn't seem to help anyway

* add nolint to deprecated filter usage

* update users migration version

* remove unused ClientSecret from APIConfigChangedEvent

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>

internal/query/projection/app_test.go

@@ -46,7 +46,7 @@ func TestAppProjection_reduces(t *testing.T) {
 				executer: &testExecuter{
 					executions: []execution{
 						{
-							expectedStmt: "INSERT INTO projections.apps6 (id, name, project_id, creation_date, change_date, resource_owner, instance_id, state, sequence) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)",
+							expectedStmt: "INSERT INTO projections.apps7 (id, name, project_id, creation_date, change_date, resource_owner, instance_id, state, sequence) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)",
 							expectedArgs: []interface{}{
 								"app-id",
 								"my-app",
@@ -83,7 +83,7 @@ func TestAppProjection_reduces(t *testing.T) {
 				executer: &testExecuter{
 					executions: []execution{
 						{
-							expectedStmt: "UPDATE projections.apps6 SET (name, change_date, sequence) = ($1, $2, $3) WHERE (id = $4) AND (instance_id = $5)",
+							expectedStmt: "UPDATE projections.apps7 SET (name, change_date, sequence) = ($1, $2, $3) WHERE (id = $4) AND (instance_id = $5)",
 							expectedArgs: []interface{}{
 								"my-app",
 								anyArg{},
@@ -136,7 +136,7 @@ func TestAppProjection_reduces(t *testing.T) {
 				executer: &testExecuter{
 					executions: []execution{
 						{
-							expectedStmt: "UPDATE projections.apps6 SET (state, change_date, sequence) = ($1, $2, $3) WHERE (id = $4) AND (instance_id = $5)",
+							expectedStmt: "UPDATE projections.apps7 SET (state, change_date, sequence) = ($1, $2, $3) WHERE (id = $4) AND (instance_id = $5)",
 							expectedArgs: []interface{}{
 								domain.AppStateInactive,
 								anyArg{},
@@ -168,7 +168,7 @@ func TestAppProjection_reduces(t *testing.T) {
 				executer: &testExecuter{
 					executions: []execution{
 						{
-							expectedStmt: "UPDATE projections.apps6 SET (state, change_date, sequence) = ($1, $2, $3) WHERE (id = $4) AND (instance_id = $5)",
+							expectedStmt: "UPDATE projections.apps7 SET (state, change_date, sequence) = ($1, $2, $3) WHERE (id = $4) AND (instance_id = $5)",
 							expectedArgs: []interface{}{
 								domain.AppStateActive,
 								anyArg{},
@@ -200,7 +200,7 @@ func TestAppProjection_reduces(t *testing.T) {
 				executer: &testExecuter{
 					executions: []execution{
 						{
-							expectedStmt: "DELETE FROM projections.apps6 WHERE (id = $1) AND (instance_id = $2)",
+							expectedStmt: "DELETE FROM projections.apps7 WHERE (id = $1) AND (instance_id = $2)",
 							expectedArgs: []interface{}{
 								"app-id",
 								"instance-id",
@@ -227,7 +227,7 @@ func TestAppProjection_reduces(t *testing.T) {
 				executer: &testExecuter{
 					executions: []execution{
 						{
-							expectedStmt: "DELETE FROM projections.apps6 WHERE (project_id = $1) AND (instance_id = $2)",
+							expectedStmt: "DELETE FROM projections.apps7 WHERE (project_id = $1) AND (instance_id = $2)",
 							expectedArgs: []interface{}{
 								"agg-id",
 								"instance-id",
@@ -254,7 +254,7 @@ func TestAppProjection_reduces(t *testing.T) {
 				executer: &testExecuter{
 					executions: []execution{
 						{
-							expectedStmt: "DELETE FROM projections.apps6 WHERE (instance_id = $1)",
+							expectedStmt: "DELETE FROM projections.apps7 WHERE (instance_id = $1)",
 							expectedArgs: []interface{}{
 								"agg-id",
 							},
@@ -264,7 +264,7 @@ func TestAppProjection_reduces(t *testing.T) {
 			},
 		},
 		{
-			name: "project reduceAPIConfigAdded",
+			name: "project reduceAPIConfigAdded, v1 secret",
 			args: args{
 				event: getEvent(
 					testEvent(
@@ -273,7 +273,7 @@ func TestAppProjection_reduces(t *testing.T) {
 						[]byte(`{
 		            "appId": "app-id",
 					"clientId": "client-id",
-					"clientSecret": {},
+					"clientSecret": {"CryptoType":1,"Algorithm":"bcrypt","Crypted":"c2VjcmV0"},
 				    "authMethodType": 1
 				}`),
 					), project.APIConfigAddedEventMapper),
@@ -285,17 +285,61 @@ func TestAppProjection_reduces(t *testing.T) {
 				executer: &testExecuter{
 					executions: []execution{
 						{
-							expectedStmt: "INSERT INTO projections.apps6_api_configs (app_id, instance_id, client_id, client_secret, auth_method) VALUES ($1, $2, $3, $4, $5)",
+							expectedStmt: "INSERT INTO projections.apps7_api_configs (app_id, instance_id, client_id, client_secret, auth_method) VALUES ($1, $2, $3, $4, $5)",
 							expectedArgs: []interface{}{
 								"app-id",
 								"instance-id",
 								"client-id",
-								anyArg{},
+								"secret",
 								domain.APIAuthMethodTypePrivateKeyJWT,
 							},
 						},
 						{
-							expectedStmt: "UPDATE projections.apps6 SET (change_date, sequence) = ($1, $2) WHERE (id = $3) AND (instance_id = $4)",
+							expectedStmt: "UPDATE projections.apps7 SET (change_date, sequence) = ($1, $2) WHERE (id = $3) AND (instance_id = $4)",
+							expectedArgs: []interface{}{
+								anyArg{},
+								uint64(15),
+								"app-id",
+								"instance-id",
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "project reduceAPIConfigAdded, v2 secret",
+			args: args{
+				event: getEvent(
+					testEvent(
+						project.APIConfigAddedType,
+						project.AggregateType,
+						[]byte(`{
+		            "appId": "app-id",
+					"clientId": "client-id",
+					"hashedSecret": "secret",
+				    "authMethodType": 1
+				}`),
+					), project.APIConfigAddedEventMapper),
+			},
+			reduce: (&appProjection{}).reduceAPIConfigAdded,
+			want: wantReduce{
+				aggregateType: eventstore.AggregateType("project"),
+				sequence:      15,
+				executer: &testExecuter{
+					executions: []execution{
+						{
+							expectedStmt: "INSERT INTO projections.apps7_api_configs (app_id, instance_id, client_id, client_secret, auth_method) VALUES ($1, $2, $3, $4, $5)",
+							expectedArgs: []interface{}{
+								"app-id",
+								"instance-id",
+								"client-id",
+								"secret",
+								domain.APIAuthMethodTypePrivateKeyJWT,
+							},
+						},
+						{
+							expectedStmt: "UPDATE projections.apps7 SET (change_date, sequence) = ($1, $2) WHERE (id = $3) AND (instance_id = $4)",
 							expectedArgs: []interface{}{
 								anyArg{},
 								uint64(15),
@@ -317,7 +361,6 @@ func TestAppProjection_reduces(t *testing.T) {
 						[]byte(`{
 		            "appId": "app-id",
 					"clientId": "client-id",
-					"clientSecret": {},
 				    "authMethodType": 1
 				}`),
 					), project.APIConfigChangedEventMapper),
@@ -329,16 +372,15 @@ func TestAppProjection_reduces(t *testing.T) {
 				executer: &testExecuter{
 					executions: []execution{
 						{
-							expectedStmt: "UPDATE projections.apps6_api_configs SET (client_secret, auth_method) = ($1, $2) WHERE (app_id = $3) AND (instance_id = $4)",
+							expectedStmt: "UPDATE projections.apps7_api_configs SET auth_method = $1 WHERE (app_id = $2) AND (instance_id = $3)",
 							expectedArgs: []interface{}{
-								anyArg{},
 								domain.APIAuthMethodTypePrivateKeyJWT,
 								"app-id",
 								"instance-id",
 							},
 						},
 						{
-							expectedStmt: "UPDATE projections.apps6 SET (change_date, sequence) = ($1, $2) WHERE (id = $3) AND (instance_id = $4)",
+							expectedStmt: "UPDATE projections.apps7 SET (change_date, sequence) = ($1, $2) WHERE (id = $3) AND (instance_id = $4)",
 							expectedArgs: []interface{}{
 								anyArg{},
 								uint64(15),
@@ -372,16 +414,16 @@ func TestAppProjection_reduces(t *testing.T) {
 			},
 		},
 		{
-			name: "project reduceAPIConfigSecretChanged",
+			name: "project reduceAPIConfigSecretChanged, v1 secret",
 			args: args{
 				event: getEvent(
 					testEvent(
 						project.APIConfigSecretChangedType,
 						project.AggregateType,
 						[]byte(`{
-                        "appId": "app-id",
-                        "client_secret": {}
-		}`),
+							"appId": "app-id",
+							"clientSecret": {"CryptoType":1,"Algorithm":"bcrypt","Crypted":"c2VjcmV0"}
+						}`),
 					), project.APIConfigSecretChangedEventMapper),
 			},
 			reduce: (&appProjection{}).reduceAPIConfigSecretChanged,
@@ -391,15 +433,15 @@ func TestAppProjection_reduces(t *testing.T) {
 				executer: &testExecuter{
 					executions: []execution{
 						{
-							expectedStmt: "UPDATE projections.apps6_api_configs SET client_secret = $1 WHERE (app_id = $2) AND (instance_id = $3)",
+							expectedStmt: "UPDATE projections.apps7_api_configs SET client_secret = $1 WHERE (app_id = $2) AND (instance_id = $3)",
 							expectedArgs: []interface{}{
-								anyArg{},
+								"secret",
 								"app-id",
 								"instance-id",
 							},
 						},
 						{
-							expectedStmt: "UPDATE projections.apps6 SET (change_date, sequence) = ($1, $2) WHERE (id = $3) AND (instance_id = $4)",
+							expectedStmt: "UPDATE projections.apps7 SET (change_date, sequence) = ($1, $2) WHERE (id = $3) AND (instance_id = $4)",
 							expectedArgs: []interface{}{
 								anyArg{},
 								uint64(15),
@@ -412,7 +454,87 @@ func TestAppProjection_reduces(t *testing.T) {
 			},
 		},
 		{
-			name: "project reduceOIDCConfigAdded",
+			name: "project reduceAPIConfigSecretChanged, v2 secret",
+			args: args{
+				event: getEvent(
+					testEvent(
+						project.APIConfigSecretChangedType,
+						project.AggregateType,
+						[]byte(`{
+							"appId": "app-id",
+							"hashedSecret": "secret"
+						}`),
+					), project.APIConfigSecretChangedEventMapper),
+			},
+			reduce: (&appProjection{}).reduceAPIConfigSecretChanged,
+			want: wantReduce{
+				aggregateType: eventstore.AggregateType("project"),
+				sequence:      15,
+				executer: &testExecuter{
+					executions: []execution{
+						{
+							expectedStmt: "UPDATE projections.apps7_api_configs SET client_secret = $1 WHERE (app_id = $2) AND (instance_id = $3)",
+							expectedArgs: []interface{}{
+								"secret",
+								"app-id",
+								"instance-id",
+							},
+						},
+						{
+							expectedStmt: "UPDATE projections.apps7 SET (change_date, sequence) = ($1, $2) WHERE (id = $3) AND (instance_id = $4)",
+							expectedArgs: []interface{}{
+								anyArg{},
+								uint64(15),
+								"app-id",
+								"instance-id",
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "project reduceAPIConfigSecretHashUpdated",
+			args: args{
+				event: getEvent(
+					testEvent(
+						project.APIConfigSecretHashUpdatedType,
+						project.AggregateType,
+						[]byte(`{
+							"appId": "app-id",
+							"hashedSecret": "secret"
+						}`),
+					), eventstore.GenericEventMapper[project.APIConfigSecretHashUpdatedEvent]),
+			},
+			reduce: (&appProjection{}).reduceAPIConfigSecretHashUpdated,
+			want: wantReduce{
+				aggregateType: eventstore.AggregateType("project"),
+				sequence:      15,
+				executer: &testExecuter{
+					executions: []execution{
+						{
+							expectedStmt: "UPDATE projections.apps7_api_configs SET client_secret = $1 WHERE (app_id = $2) AND (instance_id = $3)",
+							expectedArgs: []interface{}{
+								"secret",
+								"app-id",
+								"instance-id",
+							},
+						},
+						{
+							expectedStmt: "UPDATE projections.apps7 SET (change_date, sequence) = ($1, $2) WHERE (id = $3) AND (instance_id = $4)",
+							expectedArgs: []interface{}{
+								anyArg{},
+								uint64(15),
+								"app-id",
+								"instance-id",
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "project reduceOIDCConfigAdded, v1 secret",
 			args: args{
 				event: getEvent(
 					testEvent(
@@ -422,7 +544,7 @@ func TestAppProjection_reduces(t *testing.T) {
                         "oidcVersion": 0,
                         "appId": "app-id",
                         "clientId": "client-id",
-                        "clientSecret": {},
+						"clientSecret": {"CryptoType":1,"Algorithm":"bcrypt","Crypted":"c2VjcmV0"},
                         "redirectUris": ["redirect.one.ch", "redirect.two.ch"],
                         "responseTypes": [1,2],
                         "grantTypes": [1,2],
@@ -447,13 +569,13 @@ func TestAppProjection_reduces(t *testing.T) {
 				executer: &testExecuter{
 					executions: []execution{
 						{
-							expectedStmt: "INSERT INTO projections.apps6_oidc_configs (app_id, instance_id, version, client_id, client_secret, redirect_uris, response_types, grant_types, application_type, auth_method_type, post_logout_redirect_uris, is_dev_mode, access_token_type, access_token_role_assertion, id_token_role_assertion, id_token_userinfo_assertion, clock_skew, additional_origins, skip_native_app_success_page) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19)",
+							expectedStmt: "INSERT INTO projections.apps7_oidc_configs (app_id, instance_id, version, client_id, client_secret, redirect_uris, response_types, grant_types, application_type, auth_method_type, post_logout_redirect_uris, is_dev_mode, access_token_type, access_token_role_assertion, id_token_role_assertion, id_token_userinfo_assertion, clock_skew, additional_origins, skip_native_app_success_page) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19)",
 							expectedArgs: []interface{}{
 								"app-id",
 								"instance-id",
 								domain.OIDCVersionV1,
 								"client-id",
-								anyArg{},
+								"secret",
 								database.TextArray[string]{"redirect.one.ch", "redirect.two.ch"},
 								database.NumberArray[domain.OIDCResponseType]{1, 2},
 								database.NumberArray[domain.OIDCGrantType]{1, 2},
@@ -471,7 +593,79 @@ func TestAppProjection_reduces(t *testing.T) {
 							},
 						},
 						{
-							expectedStmt: "UPDATE projections.apps6 SET (change_date, sequence) = ($1, $2) WHERE (id = $3) AND (instance_id = $4)",
+							expectedStmt: "UPDATE projections.apps7 SET (change_date, sequence) = ($1, $2) WHERE (id = $3) AND (instance_id = $4)",
+							expectedArgs: []interface{}{
+								anyArg{},
+								uint64(15),
+								"app-id",
+								"instance-id",
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "project reduceOIDCConfigAdded, v2 secret",
+			args: args{
+				event: getEvent(
+					testEvent(
+						project.OIDCConfigAddedType,
+						project.AggregateType,
+						[]byte(`{
+                        "oidcVersion": 0,
+                        "appId": "app-id",
+                        "clientId": "client-id",
+						"hashedSecret": "secret",
+                        "redirectUris": ["redirect.one.ch", "redirect.two.ch"],
+                        "responseTypes": [1,2],
+                        "grantTypes": [1,2],
+                        "applicationType": 2,
+                        "authMethodType": 2,
+                        "postLogoutRedirectUris": ["logout.one.ch", "logout.two.ch"],
+                        "devMode": true,
+                        "accessTokenType": 1,
+                        "accessTokenRoleAssertion": true,
+                        "idTokenRoleAssertion": true,
+                        "idTokenUserinfoAssertion": true,
+                        "clockSkew": 1000,
+                        "additionalOrigins": ["origin.one.ch", "origin.two.ch"],
+						"skipNativeAppSuccessPage": true
+		}`),
+					), project.OIDCConfigAddedEventMapper),
+			},
+			reduce: (&appProjection{}).reduceOIDCConfigAdded,
+			want: wantReduce{
+				aggregateType: eventstore.AggregateType("project"),
+				sequence:      15,
+				executer: &testExecuter{
+					executions: []execution{
+						{
+							expectedStmt: "INSERT INTO projections.apps7_oidc_configs (app_id, instance_id, version, client_id, client_secret, redirect_uris, response_types, grant_types, application_type, auth_method_type, post_logout_redirect_uris, is_dev_mode, access_token_type, access_token_role_assertion, id_token_role_assertion, id_token_userinfo_assertion, clock_skew, additional_origins, skip_native_app_success_page) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19)",
+							expectedArgs: []interface{}{
+								"app-id",
+								"instance-id",
+								domain.OIDCVersionV1,
+								"client-id",
+								"secret",
+								database.TextArray[string]{"redirect.one.ch", "redirect.two.ch"},
+								database.NumberArray[domain.OIDCResponseType]{1, 2},
+								database.NumberArray[domain.OIDCGrantType]{1, 2},
+								domain.OIDCApplicationTypeNative,
+								domain.OIDCAuthMethodTypeNone,
+								database.TextArray[string]{"logout.one.ch", "logout.two.ch"},
+								true,
+								domain.OIDCTokenTypeJWT,
+								true,
+								true,
+								true,
+								1 * time.Microsecond,
+								database.TextArray[string]{"origin.one.ch", "origin.two.ch"},
+								true,
+							},
+						},
+						{
+							expectedStmt: "UPDATE projections.apps7 SET (change_date, sequence) = ($1, $2) WHERE (id = $3) AND (instance_id = $4)",
 							expectedArgs: []interface{}{
 								anyArg{},
 								uint64(15),
@@ -518,7 +712,7 @@ func TestAppProjection_reduces(t *testing.T) {
 				executer: &testExecuter{
 					executions: []execution{
 						{
-							expectedStmt: "UPDATE projections.apps6_oidc_configs SET (version, redirect_uris, response_types, grant_types, application_type, auth_method_type, post_logout_redirect_uris, is_dev_mode, access_token_type, access_token_role_assertion, id_token_role_assertion, id_token_userinfo_assertion, clock_skew, additional_origins, skip_native_app_success_page) = ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15) WHERE (app_id = $16) AND (instance_id = $17)",
+							expectedStmt: "UPDATE projections.apps7_oidc_configs SET (version, redirect_uris, response_types, grant_types, application_type, auth_method_type, post_logout_redirect_uris, is_dev_mode, access_token_type, access_token_role_assertion, id_token_role_assertion, id_token_userinfo_assertion, clock_skew, additional_origins, skip_native_app_success_page) = ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15) WHERE (app_id = $16) AND (instance_id = $17)",
 							expectedArgs: []interface{}{
 								domain.OIDCVersionV1,
 								database.TextArray[string]{"redirect.one.ch", "redirect.two.ch"},
@@ -540,7 +734,7 @@ func TestAppProjection_reduces(t *testing.T) {
 							},
 						},
 						{
-							expectedStmt: "UPDATE projections.apps6 SET (change_date, sequence) = ($1, $2) WHERE (id = $3) AND (instance_id = $4)",
+							expectedStmt: "UPDATE projections.apps7 SET (change_date, sequence) = ($1, $2) WHERE (id = $3) AND (instance_id = $4)",
 							expectedArgs: []interface{}{
 								anyArg{},
 								uint64(15),
@@ -574,7 +768,7 @@ func TestAppProjection_reduces(t *testing.T) {
 			},
 		},
 		{
-			name: "project reduceOIDCConfigSecretChanged",
+			name: "project reduceOIDCConfigSecretChanged, v1 secret",
 			args: args{
 				event: getEvent(
 					testEvent(
@@ -582,7 +776,7 @@ func TestAppProjection_reduces(t *testing.T) {
 						project.AggregateType,
 						[]byte(`{
                         "appId": "app-id",
-                        "client_secret": {}
+						"clientSecret": {"CryptoType":1,"Algorithm":"bcrypt","Crypted":"c2VjcmV0"}
 		}`),
 					), project.OIDCConfigSecretChangedEventMapper),
 			},
@@ -593,15 +787,95 @@ func TestAppProjection_reduces(t *testing.T) {
 				executer: &testExecuter{
 					executions: []execution{
 						{
-							expectedStmt: "UPDATE projections.apps6_oidc_configs SET client_secret = $1 WHERE (app_id = $2) AND (instance_id = $3)",
+							expectedStmt: "UPDATE projections.apps7_oidc_configs SET client_secret = $1 WHERE (app_id = $2) AND (instance_id = $3)",
 							expectedArgs: []interface{}{
-								anyArg{},
+								"secret",
 								"app-id",
 								"instance-id",
 							},
 						},
 						{
-							expectedStmt: "UPDATE projections.apps6 SET (change_date, sequence) = ($1, $2) WHERE (id = $3) AND (instance_id = $4)",
+							expectedStmt: "UPDATE projections.apps7 SET (change_date, sequence) = ($1, $2) WHERE (id = $3) AND (instance_id = $4)",
+							expectedArgs: []interface{}{
+								anyArg{},
+								uint64(15),
+								"app-id",
+								"instance-id",
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "project reduceOIDCConfigSecretChanged, v2 secret",
+			args: args{
+				event: getEvent(
+					testEvent(
+						project.OIDCConfigSecretChangedType,
+						project.AggregateType,
+						[]byte(`{
+                        "appId": "app-id",
+						"hashedSecret": "secret"
+		}`),
+					), project.OIDCConfigSecretChangedEventMapper),
+			},
+			reduce: (&appProjection{}).reduceOIDCConfigSecretChanged,
+			want: wantReduce{
+				aggregateType: eventstore.AggregateType("project"),
+				sequence:      15,
+				executer: &testExecuter{
+					executions: []execution{
+						{
+							expectedStmt: "UPDATE projections.apps7_oidc_configs SET client_secret = $1 WHERE (app_id = $2) AND (instance_id = $3)",
+							expectedArgs: []interface{}{
+								"secret",
+								"app-id",
+								"instance-id",
+							},
+						},
+						{
+							expectedStmt: "UPDATE projections.apps7 SET (change_date, sequence) = ($1, $2) WHERE (id = $3) AND (instance_id = $4)",
+							expectedArgs: []interface{}{
+								anyArg{},
+								uint64(15),
+								"app-id",
+								"instance-id",
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "project reduceOIDCConfigSecretHashUpdated",
+			args: args{
+				event: getEvent(
+					testEvent(
+						project.OIDCConfigSecretHashUpdatedType,
+						project.AggregateType,
+						[]byte(`{
+                        "appId": "app-id",
+						"hashedSecret": "secret"
+		}`),
+					), eventstore.GenericEventMapper[project.OIDCConfigSecretHashUpdatedEvent]),
+			},
+			reduce: (&appProjection{}).reduceOIDCConfigSecretHashUpdated,
+			want: wantReduce{
+				aggregateType: eventstore.AggregateType("project"),
+				sequence:      15,
+				executer: &testExecuter{
+					executions: []execution{
+						{
+							expectedStmt: "UPDATE projections.apps7_oidc_configs SET client_secret = $1 WHERE (app_id = $2) AND (instance_id = $3)",
+							expectedArgs: []interface{}{
+								"secret",
+								"app-id",
+								"instance-id",
+							},
+						},
+						{
+							expectedStmt: "UPDATE projections.apps7 SET (change_date, sequence) = ($1, $2) WHERE (id = $3) AND (instance_id = $4)",
 							expectedArgs: []interface{}{
 								anyArg{},
 								uint64(15),
@@ -630,7 +904,7 @@ func TestAppProjection_reduces(t *testing.T) {
 				executer: &testExecuter{
 					executions: []execution{
 						{
-							expectedStmt: "DELETE FROM projections.apps6 WHERE (instance_id = $1) AND (resource_owner = $2)",
+							expectedStmt: "DELETE FROM projections.apps7 WHERE (instance_id = $1) AND (resource_owner = $2)",
 							expectedArgs: []interface{}{
 								"instance-id",
 								"agg-id",