perf(actionsv2): execution target router (#10564)

# Which Problems Are Solved The event execution system currently uses a projection handler that subscribes to and processes all events for all instances. This creates a high static cost because the system over-fetches event data, handling many events that are not needed by most instances. This inefficiency is also reflected in high "rows returned" metrics in the database. # How the Problems Are Solved Eliminate the use of a project handler. Instead, events for which "execution targets" are defined, are directly pushed to the queue by the eventstore. A Router is populated in the Instance object in the authz middleware. - By joining the execution targets to the instance, no additional queries are needed anymore. - As part of the instance object, execution targets are now cached as well. - Events are queued within the same transaction, giving transactional guarantees on delivery. - Uses the "insert many fast` variant of River. Multiple jobs are queued in a single round-trip to the database. - Fix compatibility with PostgreSQL 15 # Additional Changes - The signing key was stored as plain-text in the river job payload in the DB. This violated our [Secrets Storage](https://zitadel.com/docs/concepts/architecture/secrets#secrets-storage) principle. This change removed the field and only uses the encrypted version of the signing key. - Fixed the target ordering from descending to ascending. - Some minor linter warnings on the use of `io.WriteString()`. # Additional Context - Introduced in https://github.com/zitadel/zitadel/pull/9249 - Closes https://github.com/zitadel/zitadel/issues/10553 - Closes https://github.com/zitadel/zitadel/issues/9832 - Closes https://github.com/zitadel/zitadel/issues/10372 - Closes https://github.com/zitadel/zitadel/issues/10492 --------- Co-authored-by: Stefan Benz <46600784+stebenz@users.noreply.github.com> (cherry picked from commit a9ebc06c77)
2025-12-07 07:16:54 +00:00 · 2025-09-01 08:21:10 +03:00
parent d0d8e904c4
commit 2727fa719d
76 changed files with 1316 additions and 1815 deletions
--- a/internal/execution/execution.go
+++ b/internal/execution/execution.go
@@ -6,14 +6,15 @@ import (
 	"encoding/json"
 	"io"
 	"net/http"
-	"strings"
 	"time"

 	"github.com/zitadel/logging"

+	"github.com/zitadel/zitadel/internal/api/authz"
 	zhttp "github.com/zitadel/zitadel/internal/api/http"
+	"github.com/zitadel/zitadel/internal/crypto"
 	"github.com/zitadel/zitadel/internal/domain"
-	"github.com/zitadel/zitadel/internal/query"
+	target_domain "github.com/zitadel/zitadel/internal/execution/target"
 	"github.com/zitadel/zitadel/internal/repository/execution"
 	"github.com/zitadel/zitadel/internal/telemetry/tracing"
 	"github.com/zitadel/zitadel/internal/zerrors"
@@ -26,27 +27,19 @@ type ContextInfo interface {
 	SetHTTPResponseBody([]byte) error
 }

-type Target interface {
-	GetTargetID() string
-	IsInterruptOnError() bool
-	GetEndpoint() string
-	GetTargetType() domain.TargetType
-	GetTimeout() time.Duration
-	GetSigningKey() string
-}
-
 // CallTargets call a list of targets in order with handling of error and responses
 func CallTargets(
 	ctx context.Context,
-	targets []Target,
+	targets []target_domain.Target,
 	info ContextInfo,
+	alg crypto.EncryptionAlgorithm,
 ) (_ interface{}, err error) {
 	ctx, span := tracing.NewSpan(ctx)
 	defer func() { span.EndWithError(err) }()

 	for _, target := range targets {
 		// call the type of target
-		resp, err := CallTarget(ctx, target, info)
+		resp, err := CallTarget(ctx, target, info, alg)
 		// handle error if interrupt is set
 		if err != nil && target.IsInterruptOnError() {
 			return nil, err
@@ -68,22 +61,28 @@ type ContextInfoRequest interface {
 // CallTarget call the desired type of target with handling of responses
 func CallTarget(
 	ctx context.Context,
-	target Target,
+	target target_domain.Target,
 	info ContextInfoRequest,
+	alg crypto.EncryptionAlgorithm,
 ) (res []byte, err error) {
 	ctx, span := tracing.NewSpan(ctx)
 	defer func() { span.EndWithError(err) }()

+	signingKey, err := target.GetSigningKey(alg)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "EXEC-thiiCh5b", "Errors.Internal")
+	}
+
 	switch target.GetTargetType() {
 	// get request, ignore response and return request and error for handling in list of targets
-	case domain.TargetTypeWebhook:
-		return nil, webhook(ctx, target.GetEndpoint(), target.GetTimeout(), info.GetHTTPRequestBody(), target.GetSigningKey())
+	case target_domain.TargetTypeWebhook:
+		return nil, webhook(ctx, target.GetEndpoint(), target.GetTimeout(), info.GetHTTPRequestBody(), signingKey)
 	// get request, return response and error
-	case domain.TargetTypeCall:
-		return Call(ctx, target.GetEndpoint(), target.GetTimeout(), info.GetHTTPRequestBody(), target.GetSigningKey())
-	case domain.TargetTypeAsync:
-		go func(ctx context.Context, target Target, info []byte) {
-			if _, err := Call(ctx, target.GetEndpoint(), target.GetTimeout(), info, target.GetSigningKey()); err != nil {
+	case target_domain.TargetTypeCall:
+		return Call(ctx, target.GetEndpoint(), target.GetTimeout(), info.GetHTTPRequestBody(), signingKey)
+	case target_domain.TargetTypeAsync:
+		go func(ctx context.Context, target target_domain.Target, info []byte) {
+			if _, err := Call(ctx, target.GetEndpoint(), target.GetTimeout(), info, signingKey); err != nil {
 				logging.WithFields("target", target.GetTargetID()).OnError(err).Info(err)
 			}
 		}(context.WithoutCancel(ctx), target, info.GetHTTPRequestBody())
@@ -157,58 +156,29 @@ type ErrorBody struct {
 	ForwardedErrorMessage string `json:"forwardedErrorMessage,omitempty"`
 }

-type ExecutionTargetsQueries interface {
-	TargetsByExecutionID(ctx context.Context, ids []string) (execution []*query.ExecutionTarget, err error)
-	TargetsByExecutionIDs(ctx context.Context, ids1, ids2 []string) (execution []*query.ExecutionTarget, err error)
-}
-
-func QueryExecutionTargetsForRequestAndResponse(
+func QueryExecutionTargetsForRequest(
 	ctx context.Context,
-	queries ExecutionTargetsQueries,
 	fullMethod string,
-) ([]Target, []Target) {
+) []target_domain.Target {
 	ctx, span := tracing.NewSpan(ctx)
 	defer span.End()

-	targets, err := queries.TargetsByExecutionIDs(ctx,
-		idsForFullMethod(fullMethod, domain.ExecutionTypeRequest),
-		idsForFullMethod(fullMethod, domain.ExecutionTypeResponse),
-	)
-	requestTargets := make([]Target, 0, len(targets))
-	responseTargets := make([]Target, 0, len(targets))
-	if err != nil {
-		logging.WithFields("fullMethod", fullMethod).WithError(err).Info("unable to query targets")
-		return requestTargets, responseTargets
-	}
-
-	for _, target := range targets {
-		if strings.HasPrefix(target.GetExecutionID(), execution.IDAll(domain.ExecutionTypeRequest)) {
-			requestTargets = append(requestTargets, target)
-		} else if strings.HasPrefix(target.GetExecutionID(), execution.IDAll(domain.ExecutionTypeResponse)) {
-			responseTargets = append(responseTargets, target)
-		}
-	}
-
-	return requestTargets, responseTargets
+	requestTargets, _ := authz.GetInstance(ctx).ExecutionRouter().GetEventBestMatch(execution.ID(domain.ExecutionTypeRequest, fullMethod))
+	return requestTargets
 }

-func idsForFullMethod(fullMethod string, executionType domain.ExecutionType) []string {
-	return []string{execution.ID(executionType, fullMethod), execution.ID(executionType, serviceFromFullMethod(fullMethod)), execution.IDAll(executionType)}
+func QueryExecutionTargetsForResponse(
+	ctx context.Context,
+	fullMethod string,
+) []target_domain.Target {
+	ctx, span := tracing.NewSpan(ctx)
+	defer span.End()
+
+	responseTargets, _ := authz.GetInstance(ctx).ExecutionRouter().GetEventBestMatch(execution.ID(domain.ExecutionTypeResponse, fullMethod))
+	return responseTargets
 }

-func serviceFromFullMethod(s string) string {
-	parts := strings.Split(s, "/")
-	return parts[1]
-}
-
-func QueryExecutionTargetsForFunction(ctx context.Context, query ExecutionTargetsQueries, function string) ([]Target, error) {
-	queriedActionsV2, err := query.TargetsByExecutionID(ctx, []string{function})
-	if err != nil {
-		return nil, err
-	}
-	executionTargets := make([]Target, len(queriedActionsV2))
-	for i, action := range queriedActionsV2 {
-		executionTargets[i] = action
-	}
-	return executionTargets, nil
+func QueryExecutionTargetsForFunction(ctx context.Context, function string) []target_domain.Target {
+	executionTargets, _ := authz.GetInstance(ctx).ExecutionRouter().GetEventBestMatch(function)
+	return executionTargets
 }
--- a/internal/execution/execution_test.go
+++ b/internal/execution/execution_test.go
@@ -13,11 +13,13 @@ import (

 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 	"google.golang.org/protobuf/types/known/structpb"

 	"github.com/zitadel/zitadel/internal/api/grpc/server/middleware"
-	"github.com/zitadel/zitadel/internal/domain"
+	"github.com/zitadel/zitadel/internal/crypto"
 	"github.com/zitadel/zitadel/internal/execution"
+	target_domain "github.com/zitadel/zitadel/internal/execution/target"
 	"github.com/zitadel/zitadel/internal/zerrors"
 	"github.com/zitadel/zitadel/pkg/actions"
 )
@@ -132,7 +134,7 @@ func Test_CallTarget(t *testing.T) {
 		ctx    context.Context
 		info   *middleware.ContextInfoRequest
 		server *callTestServer
-		target *mockTarget
+		target target_domain.Target
 	}
 	type res struct {
 		body    []byte
@@ -155,7 +157,7 @@ func Test_CallTarget(t *testing.T) {
 					timeout:     time.Second,
 					statusCode:  http.StatusInternalServerError,
 				},
-				target: &mockTarget{
+				target: target_domain.Target{
 					TargetType: 4,
 				},
 			},
@@ -175,8 +177,8 @@ func Test_CallTarget(t *testing.T) {
 					respondBody: []byte("{\"content\":\"request2\"}"),
 					statusCode:  http.StatusInternalServerError,
 				},
-				target: &mockTarget{
-					TargetType: domain.TargetTypeWebhook,
+				target: target_domain.Target{
+					TargetType: target_domain.TargetTypeWebhook,
 					Timeout:    time.Minute,
 				},
 			},
@@ -196,8 +198,8 @@ func Test_CallTarget(t *testing.T) {
 					respondBody: []byte("{\"content\":\"request2\"}"),
 					statusCode:  http.StatusOK,
 				},
-				target: &mockTarget{
-					TargetType: domain.TargetTypeWebhook,
+				target: target_domain.Target{
+					TargetType: target_domain.TargetTypeWebhook,
 					Timeout:    time.Minute,
 				},
 			},
@@ -218,10 +220,14 @@ func Test_CallTarget(t *testing.T) {
 					statusCode:  http.StatusOK,
 					signingKey:  "signingkey",
 				},
-				target: &mockTarget{
-					TargetType: domain.TargetTypeWebhook,
+				target: target_domain.Target{
+					TargetType: target_domain.TargetTypeWebhook,
 					Timeout:    time.Minute,
-					SigningKey: "signingkey",
+					SigningKey: &crypto.CryptoValue{
+						Algorithm: "enc",
+						KeyID:     "id",
+						Crypted:   []byte("signingkey"),
+					},
 				},
 			},
 			res{
@@ -240,8 +246,8 @@ func Test_CallTarget(t *testing.T) {
 					respondBody: []byte("{\"content\":\"request2\"}"),
 					statusCode:  http.StatusInternalServerError,
 				},
-				target: &mockTarget{
-					TargetType: domain.TargetTypeCall,
+				target: target_domain.Target{
+					TargetType: target_domain.TargetTypeCall,
 					Timeout:    time.Minute,
 				},
 			},
@@ -261,8 +267,8 @@ func Test_CallTarget(t *testing.T) {
 					respondBody: []byte("{\"content\":\"request2\"}"),
 					statusCode:  http.StatusOK,
 				},
-				target: &mockTarget{
-					TargetType: domain.TargetTypeCall,
+				target: target_domain.Target{
+					TargetType: target_domain.TargetTypeCall,
 					Timeout:    time.Minute,
 				},
 			},
@@ -283,10 +289,14 @@ func Test_CallTarget(t *testing.T) {
 					statusCode:  http.StatusOK,
 					signingKey:  "signingkey",
 				},
-				target: &mockTarget{
-					TargetType: domain.TargetTypeCall,
+				target: target_domain.Target{
+					TargetType: target_domain.TargetTypeCall,
 					Timeout:    time.Minute,
-					SigningKey: "signingkey",
+					SigningKey: &crypto.CryptoValue{
+						Algorithm: "enc",
+						KeyID:     "id",
+						Crypted:   []byte("signingkey"),
+					},
 				},
 			},
 			res{
@@ -296,7 +306,7 @@ func Test_CallTarget(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			respBody, err := testServer(t, tt.args.server, testCallTarget(tt.args.ctx, tt.args.info, tt.args.target))
+			respBody, err := testServer(t, tt.args.server, testCallTarget(tt.args.ctx, tt.args.info, tt.args.target, crypto.CreateMockEncryptionAlg(gomock.NewController(t))))
 			if tt.res.wantErr {
 				assert.Error(t, err)
 			} else {
@@ -312,7 +322,7 @@ func Test_CallTargets(t *testing.T) {
 		ctx     context.Context
 		info    *middleware.ContextInfoRequest
 		servers []*callTestServer
-		targets []*mockTarget
+		targets []target_domain.Target
 	}
 	type res struct {
 		ret     interface{}
@@ -341,7 +351,7 @@ func Test_CallTargets(t *testing.T) {
 					respondBody: requestContextInfoBody2,
 					statusCode:  http.StatusInternalServerError,
 				}},
-				targets: []*mockTarget{
+				targets: []target_domain.Target{
 					{InterruptOnError: false},
 					{InterruptOnError: true},
 				},
@@ -368,7 +378,7 @@ func Test_CallTargets(t *testing.T) {
 					respondBody: requestContextInfoBody2,
 					statusCode:  http.StatusInternalServerError,
 				}},
-				targets: []*mockTarget{
+				targets: []target_domain.Target{
 					{InterruptOnError: false},
 					{InterruptOnError: false},
 				},
@@ -395,7 +405,7 @@ func Test_CallTargets(t *testing.T) {
 					respondBody: []byte("just a string, not json"),
 					statusCode:  http.StatusOK,
 				}},
-				targets: []*mockTarget{
+				targets: []target_domain.Target{
 					{InterruptOnError: false},
 					{InterruptOnError: true},
 				},
@@ -422,7 +432,7 @@ func Test_CallTargets(t *testing.T) {
 					respondBody: []byte("just a string, not json"),
 					statusCode:  http.StatusOK,
 				}},
-				targets: []*mockTarget{
+				targets: []target_domain.Target{
 					{InterruptOnError: false},
 					{InterruptOnError: false},
 				}},
@@ -435,7 +445,7 @@ func Test_CallTargets(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			respBody, err := testServers(t,
 				tt.args.servers,
-				testCallTargets(tt.args.ctx, tt.args.info, tt.args.targets),
+				testCallTargets(tt.args.ctx, tt.args.info, tt.args.targets, crypto.CreateMockEncryptionAlg(gomock.NewController(t))),
 			)
 			if tt.res.wantErr {
 				assert.Error(t, err)
@@ -447,38 +457,6 @@ func Test_CallTargets(t *testing.T) {
 	}
 }

-var _ execution.Target = &mockTarget{}
-
-type mockTarget struct {
-	InstanceID       string
-	ExecutionID      string
-	TargetID         string
-	TargetType       domain.TargetType
-	Endpoint         string
-	Timeout          time.Duration
-	InterruptOnError bool
-	SigningKey       string
-}
-
-func (e *mockTarget) GetTargetID() string {
-	return e.TargetID
-}
-func (e *mockTarget) IsInterruptOnError() bool {
-	return e.InterruptOnError
-}
-func (e *mockTarget) GetEndpoint() string {
-	return e.Endpoint
-}
-func (e *mockTarget) GetTargetType() domain.TargetType {
-	return e.TargetType
-}
-func (e *mockTarget) GetTimeout() time.Duration {
-	return e.Timeout
-}
-func (e *mockTarget) GetSigningKey() string {
-	return e.SigningKey
-}
-
 type callTestServer struct {
 	method      string
 	expectBody  []byte
@@ -527,7 +505,7 @@ func listen(
 		time.Sleep(c.timeout)

 		w.Header().Set("Content-Type", "application/json")
-		if _, err := io.WriteString(w, string(c.respondBody)); err != nil {
+		if _, err := w.Write(c.respondBody); err != nil {
 			http.Error(w, "error", http.StatusInternalServerError)
 			return
 		}
@@ -554,25 +532,27 @@ func testCall(ctx context.Context, timeout time.Duration, body []byte, signingKe

 func testCallTarget(ctx context.Context,
 	info *middleware.ContextInfoRequest,
-	target *mockTarget,
+	target target_domain.Target,
+	alg crypto.EncryptionAlgorithm,
 ) func(string) ([]byte, error) {
 	return func(url string) (r []byte, err error) {
 		target.Endpoint = url
-		return execution.CallTarget(ctx, target, info)
+		return execution.CallTarget(ctx, target, info, alg)
 	}
 }

 func testCallTargets(ctx context.Context,
 	info *middleware.ContextInfoRequest,
-	target []*mockTarget,
+	target []target_domain.Target,
+	alg crypto.EncryptionAlgorithm,
 ) func([]string) (interface{}, error) {
 	return func(urls []string) (interface{}, error) {
-		targets := make([]execution.Target, len(target))
+		targets := make([]target_domain.Target, len(target))
 		for i, t := range target {
 			t.Endpoint = urls[i]
 			targets[i] = t
 		}
-		return execution.CallTargets(ctx, targets, info)
+		return execution.CallTargets(ctx, targets, info, alg)
 	}
 }

--- a/internal/execution/gen_mock.go
+++ b/internal/execution/gen_mock.go
@@ -1,4 +1,3 @@
 package execution

-//go:generate mockgen -package mock -destination ./mock/queries.mock.go github.com/zitadel/zitadel/internal/execution Queries
 //go:generate mockgen -package mock -destination ./mock/queue.mock.go github.com/zitadel/zitadel/internal/execution Queue
--- a/internal/execution/handlers.go
+++ b/internal/execution/handlers.go
@@ -1,159 +0,0 @@
-package execution
-
-import (
-	"context"
-	"encoding/json"
-	"slices"
-	"strings"
-
-	"github.com/riverqueue/river"
-
-	"github.com/zitadel/zitadel/internal/api/authz"
-	"github.com/zitadel/zitadel/internal/domain"
-	"github.com/zitadel/zitadel/internal/eventstore"
-	"github.com/zitadel/zitadel/internal/eventstore/handler/v2"
-	"github.com/zitadel/zitadel/internal/query"
-	"github.com/zitadel/zitadel/internal/queue"
-	exec_repo "github.com/zitadel/zitadel/internal/repository/execution"
-)
-
-const (
-	HandlerTable = "projections.execution_handler"
-)
-
-type Queue interface {
-	Insert(ctx context.Context, args river.JobArgs, opts ...queue.InsertOpt) error
-}
-
-type Queries interface {
-	TargetsByExecutionID(ctx context.Context, ids []string) (execution []*query.ExecutionTarget, err error)
-	InstanceByID(ctx context.Context, id string) (instance authz.Instance, err error)
-}
-
-type eventHandler struct {
-	eventTypes                 []string
-	aggregateTypeFromEventType func(typ eventstore.EventType) eventstore.AggregateType
-	query                      Queries
-	queue                      Queue
-}
-
-func NewEventHandler(
-	ctx context.Context,
-	config handler.Config,
-	eventTypes []string,
-	aggregateTypeFromEventType func(typ eventstore.EventType) eventstore.AggregateType,
-	query Queries,
-	queue Queue,
-) *handler.Handler {
-	return handler.NewHandler(ctx, &config, &eventHandler{
-		eventTypes:                 eventTypes,
-		aggregateTypeFromEventType: aggregateTypeFromEventType,
-		query:                      query,
-		queue:                      queue,
-	})
-}
-
-func (u *eventHandler) Name() string {
-	return HandlerTable
-}
-
-func (u *eventHandler) Reducers() []handler.AggregateReducer {
-	aggList := make(map[eventstore.AggregateType][]eventstore.EventType)
-	for _, eventType := range u.eventTypes {
-		aggType := u.aggregateTypeFromEventType(eventstore.EventType(eventType))
-		aggEventTypes := aggList[aggType]
-		if !slices.Contains(aggEventTypes, eventstore.EventType(eventType)) {
-			aggList[aggType] = append(aggList[aggType], eventstore.EventType(eventType))
-		}
-	}
-
-	aggReducers := make([]handler.AggregateReducer, 0, len(aggList))
-	for aggType, aggEventTypes := range aggList {
-		eventReducers := make([]handler.EventReducer, len(aggEventTypes))
-		for j, eventType := range aggEventTypes {
-			eventReducers[j] = handler.EventReducer{
-				Event:  eventType,
-				Reduce: u.reduce,
-			}
-		}
-		aggReducers = append(aggReducers, handler.AggregateReducer{
-			Aggregate:     aggType,
-			EventReducers: eventReducers,
-		})
-	}
-	return aggReducers
-}
-
-// FilterGlobalEvents implements [handler.GlobalProjection]
-func (u *eventHandler) FilterGlobalEvents() {}
-
-func groupsFromEventType(s string) []string {
-	parts := strings.Split(s, ".")
-	groups := make([]string, len(parts))
-	for i := range parts {
-		groups[i] = strings.Join(parts[:i+1], ".")
-		if i < len(parts)-1 {
-			groups[i] += ".*"
-		}
-	}
-	slices.Reverse(groups)
-	return groups
-}
-
-func idsForEventType(eventType string) []string {
-	ids := make([]string, 0)
-	for _, group := range groupsFromEventType(eventType) {
-		ids = append(ids,
-			exec_repo.ID(domain.ExecutionTypeEvent, group),
-		)
-	}
-	return append(ids,
-		exec_repo.IDAll(domain.ExecutionTypeEvent),
-	)
-}
-
-func (u *eventHandler) reduce(e eventstore.Event) (*handler.Statement, error) {
-	ctx := HandlerContext(context.Background(), e.Aggregate())
-
-	targets, err := u.query.TargetsByExecutionID(ctx, idsForEventType(string(e.Type())))
-	if err != nil {
-		return nil, err
-	}
-
-	// no execution from worker necessary
-	if len(targets) == 0 {
-		return handler.NewNoOpStatement(e), nil
-	}
-
-	return handler.NewStatement(e, func(ctx context.Context, ex handler.Executer, projectionName string) error {
-		ctx = HandlerContext(ctx, e.Aggregate())
-		req, err := NewRequest(e, targets)
-		if err != nil {
-			return err
-		}
-		return u.queue.Insert(ctx,
-			req,
-			queue.WithQueueName(exec_repo.QueueName),
-		)
-	}), nil
-}
-
-func NewRequest(e eventstore.Event, targets []*query.ExecutionTarget) (*exec_repo.Request, error) {
-	targetsData, err := json.Marshal(targets)
-	if err != nil {
-		return nil, err
-	}
-	eventData, err := json.Marshal(e)
-	if err != nil {
-		return nil, err
-	}
-	return &exec_repo.Request{
-		Aggregate:   e.Aggregate(),
-		Sequence:    e.Sequence(),
-		EventType:   e.Type(),
-		CreatedAt:   e.CreatedAt(),
-		UserID:      e.Creator(),
-		EventData:   eventData,
-		TargetsData: targetsData,
-	}, nil
-}
--- a/internal/execution/handlers_test.go
+++ b/internal/execution/handlers_test.go
@@ -1,487 +0,0 @@
-package execution
-
-import (
-	"database/sql"
-	"encoding/json"
-	"errors"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"go.uber.org/mock/gomock"
-
-	"github.com/zitadel/zitadel/internal/domain"
-	"github.com/zitadel/zitadel/internal/eventstore"
-	"github.com/zitadel/zitadel/internal/eventstore/repository"
-	"github.com/zitadel/zitadel/internal/execution/mock"
-	"github.com/zitadel/zitadel/internal/query"
-	"github.com/zitadel/zitadel/internal/repository/action"
-	execution_rp "github.com/zitadel/zitadel/internal/repository/execution"
-	"github.com/zitadel/zitadel/internal/repository/session"
-	"github.com/zitadel/zitadel/internal/repository/user"
-	"github.com/zitadel/zitadel/internal/zerrors"
-)
-
-func Test_EventExecution(t *testing.T) {
-	type args struct {
-		event   eventstore.Event
-		targets []*query.ExecutionTarget
-	}
-	type res struct {
-		targets     []Target
-		contextInfo *execution_rp.ContextInfoEvent
-		wantErr     bool
-	}
-	tests := []struct {
-		name string
-		args args
-		res  res
-	}{
-		{
-			"session added, ok",
-			args{
-				event: &eventstore.BaseEvent{
-					Agg: &eventstore.Aggregate{
-						ID:            "aggID",
-						Type:          session.AggregateType,
-						ResourceOwner: "resourceOwner",
-						InstanceID:    "instanceID",
-						Version:       session.AggregateVersion,
-					},
-					EventType: session.AddedType,
-					Seq:       1,
-					Creation:  time.Date(2024, 1, 1, 1, 1, 1, 1, time.UTC),
-					User:      userID,
-					Data:      []byte(`{"ID":"","Seq":1,"Pos":0,"Creation":"2024-01-01T01:01:01.000000001Z"}`),
-				},
-				targets: []*query.ExecutionTarget{{
-					InstanceID:       instanceID,
-					ExecutionID:      "executionID",
-					TargetID:         "targetID",
-					TargetType:       domain.TargetTypeWebhook,
-					Endpoint:         "endpoint",
-					Timeout:          time.Minute,
-					InterruptOnError: true,
-					SigningKey:       "key",
-				}},
-			},
-			res{
-				targets: []Target{
-					&query.ExecutionTarget{
-						InstanceID:       instanceID,
-						ExecutionID:      "executionID",
-						TargetID:         "targetID",
-						TargetType:       domain.TargetTypeWebhook,
-						Endpoint:         "endpoint",
-						Timeout:          time.Minute,
-						InterruptOnError: true,
-						SigningKey:       "key",
-					},
-				},
-				contextInfo: &execution_rp.ContextInfoEvent{
-					AggregateID:   "aggID",
-					AggregateType: "session",
-					ResourceOwner: "resourceOwner",
-					InstanceID:    "instanceID",
-					Version:       "v1",
-					Sequence:      1,
-					EventType:     "session.added",
-					CreatedAt:     time.Date(2024, 1, 1, 1, 1, 1, 1, time.UTC).Format(time.RFC3339Nano),
-					UserID:        userID,
-					EventPayload:  []byte(`{"ID":"","Seq":1,"Pos":0,"Creation":"2024-01-01T01:01:01.000000001Z"}`),
-				},
-			},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			request, err := NewRequest(tt.args.event, tt.args.targets)
-			if tt.res.wantErr {
-				assert.Error(t, err)
-				assert.Nil(t, request)
-				return
-			}
-			assert.NoError(t, err)
-			targets, err := TargetsFromRequest(request)
-			assert.NoError(t, err)
-			assert.Equal(t, tt.res.targets, targets)
-			assert.Equal(t, tt.res.contextInfo, execution_rp.ContextInfoFromRequest(request))
-		})
-	}
-}
-
-func Test_groupsFromEventType(t *testing.T) {
-	type args struct {
-		eventType eventstore.EventType
-	}
-	type res struct {
-		groups []string
-	}
-	tests := []struct {
-		name string
-		args args
-		res  res
-	}{
-		{
-			"user human mfa init skipped, ok",
-			args{
-				eventType: user.HumanMFAInitSkippedType,
-			},
-			res{
-				groups: []string{
-					"user.human.mfa.init.skipped",
-					"user.human.mfa.init.*",
-					"user.human.mfa.*",
-					"user.human.*",
-					"user.*",
-				},
-			},
-		},
-		{
-			"session added, ok",
-			args{
-				eventType: session.AddedType,
-			},
-			res{
-				groups: []string{
-					"session.added",
-					"session.*",
-				},
-			},
-		},
-		{
-			"user added, ok",
-			args{
-				eventType: user.HumanAddedType,
-			},
-			res{
-				groups: []string{
-					"user.human.added",
-					"user.human.*",
-					"user.*",
-				},
-			},
-		},
-		{
-			"execution set, ok",
-			args{
-				eventType: execution_rp.SetEventV2Type,
-			},
-			res{
-				groups: []string{
-					"execution.v2.set",
-					"execution.v2.*",
-					"execution.*",
-				},
-			},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.res.groups, groupsFromEventType(string(tt.args.eventType)))
-		})
-	}
-}
-
-func Test_idsForEventType(t *testing.T) {
-	type args struct {
-		eventType eventstore.EventType
-	}
-	type res struct {
-		groups []string
-	}
-	tests := []struct {
-		name string
-		args args
-		res  res
-	}{
-		{
-			"session added, ok",
-			args{
-				eventType: session.AddedType,
-			},
-			res{
-				groups: []string{
-					"event/session.added",
-					"event/session.*",
-					"event",
-				},
-			},
-		},
-		{
-			"user added, ok",
-			args{
-				eventType: user.HumanAddedType,
-			},
-			res{
-				groups: []string{
-					"event/user.human.added",
-					"event/user.human.*",
-					"event/user.*",
-					"event",
-				},
-			},
-		},
-		{
-			"execution set, ok",
-			args{
-				eventType: execution_rp.SetEventV2Type,
-			},
-			res{
-				groups: []string{
-					"event/execution.v2.set",
-					"event/execution.v2.*",
-					"event/execution.*",
-					"event",
-				},
-			},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.res.groups, idsForEventType(string(tt.args.eventType)))
-		})
-	}
-}
-
-func TestActionProjection_reduces(t *testing.T) {
-	tests := []struct {
-		name string
-		test func(*gomock.Controller, *mock.MockQueries, *mock.MockQueue) (fields, args, want)
-	}{
-		{
-			name: "reduce, action, error",
-			test: func(ctrl *gomock.Controller, queries *mock.MockQueries, q *mock.MockQueue) (f fields, a args, w want) {
-				queries.EXPECT().TargetsByExecutionID(gomock.Any(), gomock.Any()).Return(nil, zerrors.ThrowInternal(nil, "QUERY-37ardr0pki", "Errors.Query.CloseRows"))
-				return fields{
-						queries: queries,
-						queue:   q,
-					}, args{
-						event: &action.AddedEvent{
-							BaseEvent: *eventstore.BaseEventFromRepo(&repository.Event{
-								InstanceID:    instanceID,
-								AggregateID:   eventID,
-								ResourceOwner: sql.NullString{String: orgID},
-								CreationDate:  time.Now().UTC(),
-								Typ:           action.AddedEventType,
-								Data:          []byte(eventData),
-								EditorUser:    userID,
-								Seq:           1,
-								AggregateType: action.AggregateType,
-								Version:       action.AggregateVersion,
-							}),
-							Name:          "name",
-							Script:        "name(){}",
-							Timeout:       3 * time.Second,
-							AllowedToFail: true,
-						},
-						mapper: action.AddedEventMapper,
-					}, want{
-						err: func(tt assert.TestingT, err error, i ...interface{}) bool {
-							return errors.Is(err, zerrors.ThrowInternal(nil, "QUERY-37ardr0pki", "Errors.Query.CloseRows"))
-						},
-					}
-			},
-		},
-
-		{
-			name: "reduce, action, none",
-			test: func(ctrl *gomock.Controller, queries *mock.MockQueries, q *mock.MockQueue) (f fields, a args, w want) {
-				queries.EXPECT().TargetsByExecutionID(gomock.Any(), gomock.Any()).Return([]*query.ExecutionTarget{}, nil)
-				return fields{
-						queries: queries,
-						queue:   q,
-					}, args{
-						event: &action.AddedEvent{
-							BaseEvent: *eventstore.BaseEventFromRepo(&repository.Event{
-								InstanceID:    instanceID,
-								AggregateID:   eventID,
-								ResourceOwner: sql.NullString{String: orgID},
-								CreationDate:  time.Now().UTC(),
-								Typ:           action.AddedEventType,
-								Data:          []byte(eventData),
-								EditorUser:    userID,
-								Seq:           1,
-								AggregateType: action.AggregateType,
-								Version:       action.AggregateVersion,
-							}),
-							Name:          "name",
-							Script:        "name(){}",
-							Timeout:       3 * time.Second,
-							AllowedToFail: true,
-						},
-						mapper: action.AddedEventMapper,
-					}, want{
-						noOperation: true,
-					}
-			},
-		},
-		{
-			name: "reduce, action, single",
-			test: func(ctrl *gomock.Controller, queries *mock.MockQueries, q *mock.MockQueue) (f fields, a args, w want) {
-				targets := mockTargets(1)
-				queries.EXPECT().TargetsByExecutionID(gomock.Any(), gomock.Any()).Return(targets, nil)
-				createdAt := time.Now().UTC()
-				q.EXPECT().Insert(
-					gomock.Any(),
-					&execution_rp.Request{
-						Aggregate: &eventstore.Aggregate{
-							InstanceID:    instanceID,
-							Type:          action.AggregateType,
-							Version:       action.AggregateVersion,
-							ID:            eventID,
-							ResourceOwner: orgID,
-						},
-						Sequence:    1,
-						CreatedAt:   createdAt,
-						EventType:   action.AddedEventType,
-						UserID:      userID,
-						EventData:   []byte(eventData),
-						TargetsData: mockTargetsToBytes(targets),
-					},
-					gomock.Any(),
-				).Return(nil)
-				return fields{
-						queries: queries,
-						queue:   q,
-					}, args{
-						event: &action.AddedEvent{
-							BaseEvent: *eventstore.BaseEventFromRepo(&repository.Event{
-								InstanceID:    instanceID,
-								AggregateID:   eventID,
-								ResourceOwner: sql.NullString{String: orgID},
-								CreationDate:  createdAt,
-								Typ:           action.AddedEventType,
-								Data:          []byte(eventData),
-								EditorUser:    userID,
-								Seq:           1,
-								AggregateType: action.AggregateType,
-								Version:       action.AggregateVersion,
-							}),
-							Name:          "name",
-							Script:        "name(){}",
-							Timeout:       3 * time.Second,
-							AllowedToFail: true,
-						},
-						mapper: action.AddedEventMapper,
-					}, w
-			},
-		},
-		{
-			name: "reduce, action, multiple",
-			test: func(ctrl *gomock.Controller, queries *mock.MockQueries, q *mock.MockQueue) (f fields, a args, w want) {
-				targets := mockTargets(3)
-				queries.EXPECT().TargetsByExecutionID(gomock.Any(), gomock.Any()).Return(targets, nil)
-				createdAt := time.Now().UTC()
-				q.EXPECT().Insert(
-					gomock.Any(),
-					&execution_rp.Request{
-						Aggregate: &eventstore.Aggregate{
-							InstanceID:    instanceID,
-							Type:          action.AggregateType,
-							Version:       action.AggregateVersion,
-							ID:            eventID,
-							ResourceOwner: orgID,
-						},
-						Sequence:    1,
-						CreatedAt:   createdAt,
-						EventType:   action.AddedEventType,
-						UserID:      userID,
-						EventData:   []byte(eventData),
-						TargetsData: mockTargetsToBytes(targets),
-					},
-					gomock.Any(),
-				).Return(nil)
-				return fields{
-						queries: queries,
-						queue:   q,
-					}, args{
-						event: &action.AddedEvent{
-							BaseEvent: *eventstore.BaseEventFromRepo(&repository.Event{
-								InstanceID:    instanceID,
-								AggregateID:   eventID,
-								ResourceOwner: sql.NullString{String: orgID},
-								CreationDate:  createdAt,
-								Typ:           action.AddedEventType,
-								Data:          []byte(eventData),
-								EditorUser:    userID,
-								Seq:           1,
-								AggregateType: action.AggregateType,
-								Version:       action.AggregateVersion,
-							}),
-							Name:          "name",
-							Script:        "name(){}",
-							Timeout:       3 * time.Second,
-							AllowedToFail: true,
-						},
-						mapper: action.AddedEventMapper,
-					}, w
-			},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ctrl := gomock.NewController(t)
-			queries := mock.NewMockQueries(ctrl)
-			queue := mock.NewMockQueue(ctrl)
-			f, a, w := tt.test(ctrl, queries, queue)
-
-			event, err := a.mapper(a.event)
-			assert.NoError(t, err)
-
-			stmt, err := newEventExecutionsHandler(queries, f).reduce(event)
-			if w.err != nil {
-				w.err(t, err)
-				return
-			}
-			assert.NoError(t, err)
-
-			if w.noOperation {
-				assert.Nil(t, stmt.Execute)
-				return
-			}
-			err = stmt.Execute(t.Context(), nil, "")
-			if w.stmtErr != nil {
-				w.stmtErr(t, err)
-				return
-			}
-			assert.NoError(t, err)
-		})
-	}
-}
-
-func mockTarget() *query.ExecutionTarget {
-	return &query.ExecutionTarget{
-		InstanceID:       "instanceID",
-		ExecutionID:      "executionID",
-		TargetID:         "targetID",
-		TargetType:       domain.TargetTypeWebhook,
-		Endpoint:         "endpoint",
-		Timeout:          time.Minute,
-		InterruptOnError: true,
-		SigningKey:       "key",
-	}
-}
-
-func mockTargets(count int) []*query.ExecutionTarget {
-	var targets []*query.ExecutionTarget
-	if count > 0 {
-		targets = make([]*query.ExecutionTarget, count)
-		for i := range targets {
-			targets[i] = mockTarget()
-		}
-	}
-	return targets
-}
-
-func mockTargetsToBytes(targets []*query.ExecutionTarget) []byte {
-	data, _ := json.Marshal(targets)
-	return data
-}
-
-func newEventExecutionsHandler(queries *mock.MockQueries, f fields) *eventHandler {
-	return &eventHandler{
-		queue: f.queue,
-		query: queries,
-	}
-}
--- a/internal/execution/mock/queries.mock.go
+++ b/internal/execution/mock/queries.mock.go
@@ -1,72 +0,0 @@
-// Code generated by MockGen. DO NOT EDIT.
-// Source: github.com/zitadel/zitadel/internal/execution (interfaces: Queries)
-//
-// Generated by this command:
-//
-//	mockgen -package mock -destination ./mock/queries.mock.go github.com/zitadel/zitadel/internal/execution Queries
-//
-
-// Package mock is a generated GoMock package.
-package mock
-
-import (
-	context "context"
-	reflect "reflect"
-
-	authz "github.com/zitadel/zitadel/internal/api/authz"
-	query "github.com/zitadel/zitadel/internal/query"
-	gomock "go.uber.org/mock/gomock"
-)
-
-// MockQueries is a mock of Queries interface.
-type MockQueries struct {
-	ctrl     *gomock.Controller
-	recorder *MockQueriesMockRecorder
-}
-
-// MockQueriesMockRecorder is the mock recorder for MockQueries.
-type MockQueriesMockRecorder struct {
-	mock *MockQueries
-}
-
-// NewMockQueries creates a new mock instance.
-func NewMockQueries(ctrl *gomock.Controller) *MockQueries {
-	mock := &MockQueries{ctrl: ctrl}
-	mock.recorder = &MockQueriesMockRecorder{mock}
-	return mock
-}
-
-// EXPECT returns an object that allows the caller to indicate expected use.
-func (m *MockQueries) EXPECT() *MockQueriesMockRecorder {
-	return m.recorder
-}
-
-// InstanceByID mocks base method.
-func (m *MockQueries) InstanceByID(arg0 context.Context, arg1 string) (authz.Instance, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "InstanceByID", arg0, arg1)
-	ret0, _ := ret[0].(authz.Instance)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// InstanceByID indicates an expected call of InstanceByID.
-func (mr *MockQueriesMockRecorder) InstanceByID(arg0, arg1 any) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "InstanceByID", reflect.TypeOf((*MockQueries)(nil).InstanceByID), arg0, arg1)
-}
-
-// TargetsByExecutionID mocks base method.
-func (m *MockQueries) TargetsByExecutionID(arg0 context.Context, arg1 []string) ([]*query.ExecutionTarget, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "TargetsByExecutionID", arg0, arg1)
-	ret0, _ := ret[0].([]*query.ExecutionTarget)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// TargetsByExecutionID indicates an expected call of TargetsByExecutionID.
-func (mr *MockQueriesMockRecorder) TargetsByExecutionID(arg0, arg1 any) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "TargetsByExecutionID", reflect.TypeOf((*MockQueries)(nil).TargetsByExecutionID), arg0, arg1)
-}
--- a/internal/execution/mock/queue.mock.go
+++ b/internal/execution/mock/queue.mock.go
@@ -1,61 +0,0 @@
-// Code generated by MockGen. DO NOT EDIT.
-// Source: github.com/zitadel/zitadel/internal/execution (interfaces: Queue)
-//
-// Generated by this command:
-//
-//	mockgen -package mock -destination ./mock/queue.mock.go github.com/zitadel/zitadel/internal/execution Queue
-//
-
-// Package mock is a generated GoMock package.
-package mock
-
-import (
-	context "context"
-	reflect "reflect"
-
-	river "github.com/riverqueue/river"
-	queue "github.com/zitadel/zitadel/internal/queue"
-	gomock "go.uber.org/mock/gomock"
-)
-
-// MockQueue is a mock of Queue interface.
-type MockQueue struct {
-	ctrl     *gomock.Controller
-	recorder *MockQueueMockRecorder
-}
-
-// MockQueueMockRecorder is the mock recorder for MockQueue.
-type MockQueueMockRecorder struct {
-	mock *MockQueue
-}
-
-// NewMockQueue creates a new mock instance.
-func NewMockQueue(ctrl *gomock.Controller) *MockQueue {
-	mock := &MockQueue{ctrl: ctrl}
-	mock.recorder = &MockQueueMockRecorder{mock}
-	return mock
-}
-
-// EXPECT returns an object that allows the caller to indicate expected use.
-func (m *MockQueue) EXPECT() *MockQueueMockRecorder {
-	return m.recorder
-}
-
-// Insert mocks base method.
-func (m *MockQueue) Insert(arg0 context.Context, arg1 river.JobArgs, arg2 ...queue.InsertOpt) error {
-	m.ctrl.T.Helper()
-	varargs := []any{arg0, arg1}
-	for _, a := range arg2 {
-		varargs = append(varargs, a)
-	}
-	ret := m.ctrl.Call(m, "Insert", varargs...)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// Insert indicates an expected call of Insert.
-func (mr *MockQueueMockRecorder) Insert(arg0, arg1 any, arg2 ...any) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	varargs := append([]any{arg0, arg1}, arg2...)
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Insert", reflect.TypeOf((*MockQueue)(nil).Insert), varargs...)
-}
--- a/internal/execution/projections.go
+++ b/internal/execution/projections.go
@@ -3,10 +3,8 @@ package execution
 import (
 	"context"

-	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/crypto"
 	"github.com/zitadel/zitadel/internal/eventstore/handler/v2"
-	"github.com/zitadel/zitadel/internal/query"
-	"github.com/zitadel/zitadel/internal/query/projection"
 	"github.com/zitadel/zitadel/internal/queue"
 )

@@ -15,18 +13,12 @@ var (
 )

 func Register(
-	ctx context.Context,
-	executionsCustomConfig projection.CustomConfig,
 	workerConfig WorkerConfig,
-	queries *query.Queries,
-	eventTypes []string,
 	queue *queue.Queue,
+	targetEncAlg crypto.EncryptionAlgorithm,
 ) {
 	queue.ShouldStart()
-	projections = []*handler.Handler{
-		NewEventHandler(ctx, projection.ApplyCustomConfig(executionsCustomConfig), eventTypes, eventstore.AggregateTypeFromEventType, queries, queue),
-	}
-	queue.AddWorkers(NewWorker(workerConfig))
+	queue.AddWorkers(NewWorker(workerConfig, targetEncAlg))
 }

 func Start(ctx context.Context) {
--- a/internal/execution/target/router.go
+++ b/internal/execution/target/router.go
@@ -0,0 +1,69 @@
+package target
+
+import (
+	"slices"
+	"strings"
+)
+
+type element struct {
+	ID      string   `json:"id"`
+	Targets []Target `json:"targets,omitempty"`
+}
+
+type Router []element
+
+func NewRouter(targets []Target) Router {
+	m := make(map[string][]Target)
+	for _, t := range targets {
+		m[t.GetExecutionID()] = append(m[t.GetExecutionID()], t)
+	}
+	router := make(Router, 0, len(m))
+	for id, targets := range m {
+		router = append(router, element{
+			ID:      id,
+			Targets: targets,
+		})
+	}
+	slices.SortFunc(router, func(a, b element) int {
+		return strings.Compare(a.ID, b.ID)
+	})
+	return router
+}
+
+// Get execution targets by exact match of the executionID
+func (r Router) Get(executionID string) ([]Target, bool) {
+	i, ok := slices.BinarySearchFunc(r, executionID, func(a element, b string) int {
+		return strings.Compare(a.ID, b)
+	})
+	if ok {
+		return r[i].Targets, true
+	}
+	return nil, false
+}
+
+// GetEventBestMatch returns the best matching execution targets for an event.
+// The following match priority is used:
+//  1. Exact match
+//  2. Wildcard match
+//  3. Prefix match ("event")
+func (r Router) GetEventBestMatch(executionID string) ([]Target, bool) {
+	t, ok := r.Get(executionID)
+	if ok {
+		return t, true
+	}
+	var bestMatch element
+	for _, e := range r {
+		if e.ID == "event" && strings.HasPrefix(executionID, e.ID) {
+			bestMatch, ok = e, true
+		}
+		cut, has := strings.CutSuffix(e.ID, ".*")
+		if has && strings.HasPrefix(executionID, cut) {
+			bestMatch, ok = e, true
+		}
+	}
+	return bestMatch.Targets, ok
+}
+
+func (r Router) IsZero() bool {
+	return len(r) == 0
+}
--- a/internal/execution/target/router_test.go
+++ b/internal/execution/target/router_test.go
@@ -0,0 +1,129 @@
+package target
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+var (
+	eventGlobalTarget   = Target{ExecutionID: "event", TargetID: "event_global"}
+	eventGroupTarget    = Target{ExecutionID: "event/foo.*", TargetID: "event_group"}
+	eventMatchTarget    = Target{ExecutionID: "event/foo.bar", TargetID: "event_specific"}
+	functionCallTarget1 = Target{ExecutionID: "function/Call", TargetID: "function_call_1"}
+	functionCallTarget2 = Target{ExecutionID: "function/Call", TargetID: "function_call_2"}
+
+	testTargets = []Target{eventGlobalTarget, eventGroupTarget, eventMatchTarget, functionCallTarget1, functionCallTarget2}
+)
+
+func TestBinarySearchRouter_Get(t *testing.T) {
+	r := NewRouter(testTargets)
+	type args struct {
+		id string
+	}
+	tests := []struct {
+		name        string
+		args        args
+		wantTargets []Target
+		wantOk      bool
+	}{
+		{
+			name: "event global does not match exactly",
+			args: args{
+				id: "event/bar.foo",
+			},
+			wantTargets: nil,
+			wantOk:      false,
+		},
+		{
+			name: "event group does not match exactly",
+			args: args{
+				id: "event/foo.bar.baz",
+			},
+			wantTargets: nil,
+			wantOk:      false,
+		},
+		{
+			name: "event match",
+			args: args{
+				id: "event/foo.bar",
+			},
+			wantTargets: []Target{eventMatchTarget},
+			wantOk:      true,
+		},
+		{
+			name: "function match",
+			args: args{
+				id: "function/Call",
+			},
+			wantTargets: []Target{functionCallTarget1, functionCallTarget2},
+			wantOk:      true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, ok := r.Get(tt.args.id)
+			assert.Equal(t, tt.wantTargets, got)
+			assert.Equal(t, tt.wantOk, ok)
+		})
+	}
+}
+
+func TestBinarySearchRouter_GetEventBestMatch(t *testing.T) {
+	type args struct {
+		id string
+	}
+	tests := []struct {
+		name        string
+		targets     []Target
+		args        args
+		wantTargets []Target
+		wantOk      bool
+	}{
+
+		{
+			name:    "event global match",
+			targets: testTargets,
+			args: args{
+				id: "event/bar.foo",
+			},
+			wantTargets: []Target{eventGlobalTarget},
+			wantOk:      true,
+		},
+		{
+			name:    "event group match",
+			targets: testTargets[1:],
+			args: args{
+				id: "event/foo.bar.baz",
+			},
+			wantTargets: []Target{eventGroupTarget},
+			wantOk:      true,
+		},
+		{
+			name:    "event match",
+			targets: testTargets,
+			args: args{
+				id: "event/foo.bar",
+			},
+			wantTargets: []Target{eventMatchTarget},
+			wantOk:      true,
+		},
+		{
+			name:    "function match",
+			targets: testTargets,
+			args: args{
+				id: "function/Call",
+			},
+			wantTargets: []Target{functionCallTarget1, functionCallTarget2},
+			wantOk:      true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r := NewRouter(tt.targets)
+			got, ok := r.GetEventBestMatch(tt.args.id)
+			assert.Equal(t, tt.wantTargets, got)
+			assert.Equal(t, tt.wantOk, ok)
+		})
+	}
+}
--- a/internal/execution/target/target.go
+++ b/internal/execution/target/target.go
@@ -0,0 +1,50 @@
+package target
+
+import (
+	"time"
+
+	"github.com/zitadel/zitadel/internal/crypto"
+)
+
+type TargetType uint
+
+const (
+	TargetTypeWebhook TargetType = iota
+	TargetTypeCall
+	TargetTypeAsync
+)
+
+type Target struct {
+	ExecutionID      string              `json:"execution_id,omitempty"`
+	TargetID         string              `json:"target_id,omitempty"`
+	TargetType       TargetType          `json:"target_type,omitempty"`
+	Endpoint         string              `json:"endpoint,omitempty"`
+	Timeout          time.Duration       `json:"timeout,omitempty"`
+	InterruptOnError bool                `json:"interrupt_on_error,omitempty"`
+	SigningKey       *crypto.CryptoValue `json:"signing_key,omitempty"`
+}
+
+func (e *Target) GetExecutionID() string {
+	return e.ExecutionID
+}
+func (e *Target) GetTargetID() string {
+	return e.TargetID
+}
+func (e *Target) IsInterruptOnError() bool {
+	return e.InterruptOnError
+}
+func (e *Target) GetEndpoint() string {
+	return e.Endpoint
+}
+func (e *Target) GetTargetType() TargetType {
+	return e.TargetType
+}
+func (e *Target) GetTimeout() time.Duration {
+	return e.Timeout
+}
+func (e *Target) GetSigningKey(alg crypto.EncryptionAlgorithm) (string, error) {
+	if e.SigningKey == nil {
+		return "", nil
+	}
+	return crypto.DecryptString(e.SigningKey, alg)
+}
--- a/internal/execution/worker.go
+++ b/internal/execution/worker.go
@@ -9,7 +9,8 @@ import (

 	"github.com/riverqueue/river"

-	"github.com/zitadel/zitadel/internal/query"
+	"github.com/zitadel/zitadel/internal/crypto"
+	target_domain "github.com/zitadel/zitadel/internal/execution/target"
 	exec_repo "github.com/zitadel/zitadel/internal/repository/execution"
 )

@@ -18,6 +19,8 @@ type Worker struct {

 	config WorkerConfig
 	now    nowFunc
+
+	targetEncAlg crypto.EncryptionAlgorithm
 }

 // Timeout implements the Timeout-function of [river.Worker].
@@ -42,7 +45,7 @@ func (w *Worker) Work(ctx context.Context, job *river.Job[*exec_repo.Request]) e
 		return river.JobCancel(fmt.Errorf("unable to unmarshal targets because %w", err))
 	}

-	_, err = CallTargets(ctx, targets, exec_repo.ContextInfoFromRequest(job.Args))
+	_, err = CallTargets(ctx, targets, exec_repo.ContextInfoFromRequest(job.Args), w.targetEncAlg)
 	if err != nil {
 		// If there is an error returned from the targets, it means that the execution was interrupted
 		return river.JobCancel(fmt.Errorf("interruption during call of targets because %w", err))
@@ -61,10 +64,12 @@ type WorkerConfig struct {

 func NewWorker(
 	config WorkerConfig,
+	targetEncAlg crypto.EncryptionAlgorithm,
 ) *Worker {
 	return &Worker{
-		config: config,
-		now:    time.Now,
+		config:       config,
+		now:          time.Now,
+		targetEncAlg: targetEncAlg,
 	}
 }

@@ -77,14 +82,10 @@ func (w *Worker) Register(workers *river.Workers, queues map[string]river.QueueC
 	}
 }

-func TargetsFromRequest(e *exec_repo.Request) ([]Target, error) {
-	var execTargets []*query.ExecutionTarget
-	if err := json.Unmarshal(e.TargetsData, &execTargets); err != nil {
+func TargetsFromRequest(e *exec_repo.Request) ([]target_domain.Target, error) {
+	var targets []target_domain.Target
+	if err := json.Unmarshal(e.TargetsData, &targets); err != nil {
 		return nil, err
 	}
-	targets := make([]Target, len(execTargets))
-	for i, target := range execTargets {
-		targets[i] = target
-	}
 	return targets, nil
 }
--- a/internal/execution/worker_test.go
+++ b/internal/execution/worker_test.go
@@ -15,35 +15,21 @@ import (

 	"github.com/zitadel/zitadel/internal/api/authz"
 	"github.com/zitadel/zitadel/internal/eventstore"
-	"github.com/zitadel/zitadel/internal/execution/mock"
-	"github.com/zitadel/zitadel/internal/query"
+	target_domain "github.com/zitadel/zitadel/internal/execution/target"
 	"github.com/zitadel/zitadel/internal/repository/action"
 	exec_repo "github.com/zitadel/zitadel/internal/repository/execution"
 	"github.com/zitadel/zitadel/internal/repository/user"
 	"github.com/zitadel/zitadel/internal/zerrors"
 )

-type fields struct {
-	queries *mock.MockQueries
-	queue   *mock.MockQueue
-}
 type fieldsWorker struct {
 	now nowFunc
 }
-type args struct {
-	event  eventstore.Event
-	mapper func(event eventstore.Event) (eventstore.Event, error)
-}
 type argsWorker struct {
 	job *river.Job[*exec_repo.Request]
 }
-type want struct {
-	noOperation bool
-	err         assert.ErrorAssertionFunc
-	stmtErr     assert.ErrorAssertionFunc
-}
 type wantWorker struct {
-	targets        []*query.ExecutionTarget
+	targets        []target_domain.Target
 	sendStatusCode int
 	err            assert.ErrorAssertionFunc
 }
@@ -286,3 +272,25 @@ func Test_handleEventExecution(t *testing.T) {
 		})
 	}
 }
+
+func mockTarget() target_domain.Target {
+	return target_domain.Target{
+		ExecutionID:      "executionID",
+		TargetID:         "targetID",
+		TargetType:       target_domain.TargetTypeWebhook,
+		Endpoint:         "endpoint",
+		Timeout:          time.Minute,
+		InterruptOnError: true,
+	}
+}
+
+func mockTargets(count int) []target_domain.Target {
+	var targets []target_domain.Target
+	if count > 0 {
+		targets = make([]target_domain.Target, count)
+		for i := range targets {
+			targets[i] = mockTarget()
+		}
+	}
+	return targets
+}