perf(actionsv2): execution target router (#10564)

# Which Problems Are Solved The event execution system currently uses a projection handler that subscribes to and processes all events for all instances. This creates a high static cost because the system over-fetches event data, handling many events that are not needed by most instances. This inefficiency is also reflected in high "rows returned" metrics in the database. # How the Problems Are Solved Eliminate the use of a project handler. Instead, events for which "execution targets" are defined, are directly pushed to the queue by the eventstore. A Router is populated in the Instance object in the authz middleware. - By joining the execution targets to the instance, no additional queries are needed anymore. - As part of the instance object, execution targets are now cached as well. - Events are queued within the same transaction, giving transactional guarantees on delivery. - Uses the "insert many fast` variant of River. Multiple jobs are queued in a single round-trip to the database. - Fix compatibility with PostgreSQL 15 # Additional Changes - The signing key was stored as plain-text in the river job payload in the DB. This violated our [Secrets Storage](https://zitadel.com/docs/concepts/architecture/secrets#secrets-storage) principle. This change removed the field and only uses the encrypted version of the signing key. - Fixed the target ordering from descending to ascending. - Some minor linter warnings on the use of `io.WriteString()`. # Additional Context - Introduced in https://github.com/zitadel/zitadel/pull/9249 - Closes https://github.com/zitadel/zitadel/issues/10553 - Closes https://github.com/zitadel/zitadel/issues/9832 - Closes https://github.com/zitadel/zitadel/issues/10372 - Closes https://github.com/zitadel/zitadel/issues/10492 --------- Co-authored-by: Stefan Benz <46600784+stebenz@users.noreply.github.com> (cherry picked from commit a9ebc06c77)
2025-12-06 15:12:14 +00:00 · 2025-09-01 08:21:10 +03:00
parent d0d8e904c4
commit 2727fa719d
76 changed files with 1316 additions and 1815 deletions
--- a/internal/query/execution.go
+++ b/internal/query/execution.go
@@ -8,17 +8,13 @@ import (
 	"encoding/json"
 	"errors"
 	"slices"
-	"time"

 	sq "github.com/Masterminds/squirrel"

 	"github.com/zitadel/zitadel/internal/api/authz"
-	"github.com/zitadel/zitadel/internal/crypto"
-	"github.com/zitadel/zitadel/internal/database"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/query/projection"
 	exec "github.com/zitadel/zitadel/internal/repository/execution"
-	"github.com/zitadel/zitadel/internal/telemetry/tracing"
 	"github.com/zitadel/zitadel/internal/zerrors"
 )

@@ -65,10 +61,6 @@ var (
 var (
 	//go:embed execution_targets.sql
 	executionTargetsQuery string
-	//go:embed targets_by_execution_id.sql
-	TargetsByExecutionIDQuery string
-	//go:embed targets_by_execution_ids.sql
-	TargetsByExecutionIDsQuery string
 )

 type Executions struct {
@@ -156,71 +148,6 @@ func targetItemJSONB(t domain.ExecutionTargetType, targetItem string) ([]byte, e
 	return json.Marshal([]*executionTarget{target})
 }

-// TargetsByExecutionID query list of targets for best match of a list of IDs,  for example:
-// [ "request/zitadel.action.v3alpha.ActionService/GetTargetByID",
-// "request/zitadel.action.v3alpha.ActionService",
-// "request" ]
-func (q *Queries) TargetsByExecutionID(ctx context.Context, ids []string) (execution []*ExecutionTarget, err error) {
-	ctx, span := tracing.NewSpan(ctx)
-	defer func() { span.End() }()
-
-	instanceID := authz.GetInstance(ctx).InstanceID()
-	if instanceID == "" {
-		return nil, nil
-	}
-
-	err = q.client.QueryContext(ctx,
-		func(rows *sql.Rows) error {
-			execution, err = scanExecutionTargets(rows)
-			return err
-		},
-		TargetsByExecutionIDQuery,
-		instanceID,
-		database.TextArray[string](ids),
-	)
-	for i := range execution {
-		if err := execution[i].decryptSigningKey(q.targetEncryptionAlgorithm); err != nil {
-			return nil, err
-		}
-	}
-	return execution, err
-}
-
-// TargetsByExecutionIDs query list of targets for best matches of 2 separate lists of IDs, combined for performance, for example:
-// [ "request/zitadel.action.v3alpha.ActionService/GetTargetByID",
-// "request/zitadel.action.v3alpha.ActionService",
-// "request" ]
-// and
-// [ "response/zitadel.action.v3alpha.ActionService/GetTargetByID",
-// "response/zitadel.action.v3alpha.ActionService",
-// "response" ]
-func (q *Queries) TargetsByExecutionIDs(ctx context.Context, ids1, ids2 []string) (execution []*ExecutionTarget, err error) {
-	ctx, span := tracing.NewSpan(ctx)
-	defer func() { span.End() }()
-
-	instanceID := authz.GetInstance(ctx).InstanceID()
-	if instanceID == "" {
-		return nil, nil
-	}
-
-	err = q.client.QueryContext(ctx,
-		func(rows *sql.Rows) error {
-			execution, err = scanExecutionTargets(rows)
-			return err
-		},
-		TargetsByExecutionIDsQuery,
-		instanceID,
-		database.TextArray[string](ids1),
-		database.TextArray[string](ids2),
-	)
-	for i := range execution {
-		if err := execution[i].decryptSigningKey(q.targetEncryptionAlgorithm); err != nil {
-			return nil, err
-		}
-	}
-	return execution, err
-}
-
 func prepareExecutionQuery() (sq.SelectBuilder, func(row *sql.Row) (*Execution, error)) {
 	return sq.Select(
 			ExecutionColumnInstanceID.identifier(),
@@ -358,99 +285,3 @@ func scanExecutions(rows *sql.Rows) (*Executions, error) {
 		},
 	}, nil
 }
-
-type ExecutionTarget struct {
-	InstanceID       string
-	ExecutionID      string
-	TargetID         string
-	TargetType       domain.TargetType
-	Endpoint         string
-	Timeout          time.Duration
-	InterruptOnError bool
-	signingKey       *crypto.CryptoValue
-	SigningKey       string
-}
-
-func (e *ExecutionTarget) GetExecutionID() string {
-	return e.ExecutionID
-}
-func (e *ExecutionTarget) GetTargetID() string {
-	return e.TargetID
-}
-func (e *ExecutionTarget) IsInterruptOnError() bool {
-	return e.InterruptOnError
-}
-func (e *ExecutionTarget) GetEndpoint() string {
-	return e.Endpoint
-}
-func (e *ExecutionTarget) GetTargetType() domain.TargetType {
-	return e.TargetType
-}
-func (e *ExecutionTarget) GetTimeout() time.Duration {
-	return e.Timeout
-}
-func (e *ExecutionTarget) GetSigningKey() string {
-	return e.SigningKey
-}
-
-func (t *ExecutionTarget) decryptSigningKey(alg crypto.EncryptionAlgorithm) error {
-	if t.signingKey == nil {
-		return nil
-	}
-	keyValue, err := crypto.DecryptString(t.signingKey, alg)
-	if err != nil {
-		return zerrors.ThrowInternal(err, "QUERY-bxevy3YXwy", "Errors.Internal")
-	}
-	t.SigningKey = keyValue
-	return nil
-}
-
-func scanExecutionTargets(rows *sql.Rows) ([]*ExecutionTarget, error) {
-	targets := make([]*ExecutionTarget, 0)
-	for rows.Next() {
-		target := new(ExecutionTarget)
-
-		var (
-			instanceID       = &sql.NullString{}
-			executionID      = &sql.NullString{}
-			targetID         = &sql.NullString{}
-			targetType       = &sql.NullInt32{}
-			endpoint         = &sql.NullString{}
-			timeout          = &sql.NullInt64{}
-			interruptOnError = &sql.NullBool{}
-			signingKey       = &crypto.CryptoValue{}
-		)
-
-		err := rows.Scan(
-			executionID,
-			instanceID,
-			targetID,
-			targetType,
-			endpoint,
-			timeout,
-			interruptOnError,
-			signingKey,
-		)
-
-		if err != nil {
-			return nil, err
-		}
-
-		target.InstanceID = instanceID.String
-		target.ExecutionID = executionID.String
-		target.TargetID = targetID.String
-		target.TargetType = domain.TargetType(targetType.Int32)
-		target.Endpoint = endpoint.String
-		target.Timeout = time.Duration(timeout.Int64)
-		target.InterruptOnError = interruptOnError.Bool
-		target.signingKey = signingKey
-
-		targets = append(targets, target)
-	}
-
-	if err := rows.Close(); err != nil {
-		return nil, zerrors.ThrowInternal(err, "QUERY-37ardr0pki", "Errors.Query.CloseRows")
-	}
-
-	return targets, nil
-}
--- a/internal/query/execution_targets.sql
+++ b/internal/query/execution_targets.sql
@@ -1,10 +1,10 @@
 SELECT et.instance_id,
       et.execution_id,
       JSONB_AGG(
-               JSON_OBJECT(
-                       'position' : et.position,
-                       'include' : et.include,
-                       'target' : et.target_id
+               JSON_BUILD_OBJECT(
+                       'position', et.position,
+                       'include', et.include,
+                       'target', et.target_id
               )
       ) as targets
 FROM projections.executions1_targets AS et
--- a/internal/query/execution_test.go
+++ b/internal/query/execution_test.go
@@ -22,7 +22,7 @@ var (
 		` COUNT(*) OVER ()` +
 		` FROM projections.executions1` +
 		` JOIN (` +
-		`SELECT et.instance_id, et.execution_id, JSONB_AGG( JSON_OBJECT( 'position' : et.position, 'include' : et.include, 'target' : et.target_id ) ) as targets` +
+		`SELECT et.instance_id, et.execution_id, JSONB_AGG( JSON_BUILD_OBJECT( 'position', et.position, 'include', et.include, 'target', et.target_id ) ) as targets` +
 		` FROM projections.executions1_targets AS et` +
 		` INNER JOIN projections.targets2 AS t ON et.instance_id = t.instance_id AND et.target_id IS NOT NULL AND et.target_id = t.id` +
 		` GROUP BY et.instance_id, et.execution_id` +
@@ -46,7 +46,7 @@ var (
 		` execution_targets.targets` +
 		` FROM projections.executions1` +
 		` JOIN (` +
-		`SELECT et.instance_id, et.execution_id, JSONB_AGG( JSON_OBJECT( 'position' : et.position, 'include' : et.include, 'target' : et.target_id ) ) as targets` +
+		`SELECT et.instance_id, et.execution_id, JSONB_AGG( JSON_BUILD_OBJECT( 'position', et.position, 'include', et.include, 'target', et.target_id ) ) as targets` +
 		` FROM projections.executions1_targets AS et` +
 		` INNER JOIN projections.targets2 AS t ON et.instance_id = t.instance_id AND et.target_id IS NOT NULL AND et.target_id = t.id` +
 		` GROUP BY et.instance_id, et.execution_id` +
--- a/internal/query/generic.go
+++ b/internal/query/generic.go
@@ -5,6 +5,7 @@ import (
 	"database/sql"

 	sq "github.com/Masterminds/squirrel"
+	"github.com/zitadel/logging"

 	"github.com/zitadel/zitadel/internal/api/authz"
 	"github.com/zitadel/zitadel/internal/database"
@@ -24,6 +25,7 @@ func genericRowsQuery[R any](

 	stmt, args, err := query.ToSql()
 	if err != nil {
+		logging.OnError(err).Warn("query: invalid request")
 		return rnil, zerrors.ThrowInvalidArgument(err, "QUERY-05wf2q36ji", "Errors.Query.InvalidRequest")
 	}
 	err = client.QueryContext(ctx, func(rows *sql.Rows) error {
@@ -31,6 +33,7 @@ func genericRowsQuery[R any](
 		return err
 	}, stmt, args...)
 	if err != nil {
+		logging.OnError(err).Error("query: internal error")
 		return rnil, zerrors.ThrowInternal(err, "QUERY-y2u7vctrha", "Errors.Internal")
 	}
 	return resp, err
@@ -50,6 +53,7 @@ func genericRowsQueryWithState[R Stateful](
 	}
 	state, err := latestState(ctx, client, projection)
 	if err != nil {
+		logging.OnError(err).Error("query: latest state")
 		return rnil, err
 	}
 	resp.SetState(state)
--- a/internal/query/instance.go
+++ b/internal/query/instance.go
@@ -15,10 +15,12 @@ import (
 	"github.com/zitadel/logging"
 	"golang.org/x/text/language"

+	"github.com/zitadel/zitadel/cmd/build"
 	"github.com/zitadel/zitadel/internal/api/authz"
 	"github.com/zitadel/zitadel/internal/database"
 	"github.com/zitadel/zitadel/internal/eventstore"
 	"github.com/zitadel/zitadel/internal/eventstore/handler/v2"
+	target_domain "github.com/zitadel/zitadel/internal/execution/target"
 	"github.com/zitadel/zitadel/internal/feature"
 	"github.com/zitadel/zitadel/internal/query/projection"
 	"github.com/zitadel/zitadel/internal/telemetry/tracing"
@@ -216,7 +218,7 @@ func (q *Queries) InstanceByHost(ctx context.Context, instanceHost, publicHost s
 	publicDomain := strings.Split(publicHost, ":")[0]     // remove possible port

 	instance, ok := q.caches.instance.Get(ctx, instanceIndexByHost, instanceDomain)
-	if ok {
+	if ok && instance.ZitadelVersion == build.Version() {
 		return instance, instance.checkDomain(instanceDomain, publicDomain)
 	}
 	instance, scan := scanAuthzInstance()
@@ -239,14 +241,16 @@ func (q *Queries) InstanceByID(ctx context.Context, id string) (_ authz.Instance
 	}()

 	instance, ok := q.caches.instance.Get(ctx, instanceIndexByID, id)
-	if ok {
+	if ok && instance.ZitadelVersion == build.Version() {
 		return instance, nil
 	}

 	instance, scan := scanAuthzInstance()
 	err = q.client.QueryRowContext(ctx, scan, instanceByIDQuery, id)
 	logging.OnError(err).WithField("instance_id", id).Warn("instance by ID")
+
 	if err == nil {
+		instance.ZitadelVersion = build.Version()
 		q.caches.instance.Set(ctx, instance)
 	}
 	return instance, err
@@ -460,19 +464,21 @@ func prepareInstanceDomainQuery() (sq.SelectBuilder, func(*sql.Rows) (*Instance,
 }

 type authzInstance struct {
-	ID              string                     `json:"id,omitempty"`
-	IAMProjectID    string                     `json:"iam_project_id,omitempty"`
-	ConsoleID       string                     `json:"console_id,omitempty"`
-	ConsoleAppID    string                     `json:"console_app_id,omitempty"`
-	DefaultLang     language.Tag               `json:"default_lang,omitempty"`
-	DefaultOrgID    string                     `json:"default_org_id,omitempty"`
-	CSP             csp                        `json:"csp,omitempty"`
-	Impersonation   bool                       `json:"impersonation,omitempty"`
-	IsBlocked       *bool                      `json:"is_blocked,omitempty"`
-	LogRetention    *time.Duration             `json:"log_retention,omitempty"`
-	Feature         feature.Features           `json:"feature,omitempty"`
-	ExternalDomains database.TextArray[string] `json:"external_domains,omitempty"`
-	TrustedDomains  database.TextArray[string] `json:"trusted_domains,omitempty"`
+	ID               string                     `json:"id,omitempty"`
+	IAMProjectID     string                     `json:"iam_project_id,omitempty"`
+	ConsoleID        string                     `json:"console_id,omitempty"`
+	ConsoleAppID     string                     `json:"console_app_id,omitempty"`
+	DefaultLang      language.Tag               `json:"default_lang,omitempty"`
+	DefaultOrgID     string                     `json:"default_org_id,omitempty"`
+	CSP              csp                        `json:"csp,omitempty"`
+	Impersonation    bool                       `json:"impersonation,omitempty"`
+	IsBlocked        *bool                      `json:"is_blocked,omitempty"`
+	LogRetention     *time.Duration             `json:"log_retention,omitempty"`
+	Feature          feature.Features           `json:"feature,omitempty"`
+	ExternalDomains  database.TextArray[string] `json:"external_domains,omitempty"`
+	TrustedDomains   database.TextArray[string] `json:"trusted_domains,omitempty"`
+	ExecutionTargets target_domain.Router       `json:"execution_targets,omitzero"`
+	ZitadelVersion   string                     `json:"zitadel_version,omitempty"`
 }

 type csp struct {
@@ -527,6 +533,10 @@ func (i *authzInstance) Features() feature.Features {
 	return i.Feature
 }

+func (i *authzInstance) ExecutionRouter() target_domain.Router {
+	return i.ExecutionTargets
+}
+
 var errPublicDomain = "public domain %q not trusted"

 func (i *authzInstance) checkDomain(instanceDomain, publicDomain string) error {
@@ -562,6 +572,7 @@ func scanAuthzInstance() (*authzInstance, func(row *sql.Row) error) {
 			auditLogRetention     database.NullDuration
 			block                 sql.NullBool
 			features              []byte
+			executionTargetsBytes []byte
 		)
 		err := row.Scan(
 			&instance.ID,
@@ -578,6 +589,7 @@ func scanAuthzInstance() (*authzInstance, func(row *sql.Row) error) {
 			&features,
 			&instance.ExternalDomains,
 			&instance.TrustedDomains,
+			&executionTargetsBytes,
 		)
 		if errors.Is(err, sql.ErrNoRows) {
 			return zerrors.ThrowNotFound(nil, "QUERY-1kIjX", "Errors.IAM.NotFound")
@@ -600,6 +612,13 @@ func scanAuthzInstance() (*authzInstance, func(row *sql.Row) error) {
 		if err = json.Unmarshal(features, &instance.Feature); err != nil {
 			return zerrors.ThrowInternal(err, "QUERY-Po8ki", "Errors.Internal")
 		}
+		if len(executionTargetsBytes) > 0 {
+			var targets []target_domain.Target
+			if err := json.Unmarshal(executionTargetsBytes, &targets); err != nil {
+				return zerrors.ThrowInternal(err, "QUERY-aeKa2", "Errors.Internal")
+			}
+			instance.ExecutionTargets = target_domain.NewRouter(targets)
+		}
 		return nil
 	}
 }
@@ -616,6 +635,8 @@ func (c *Caches) registerInstanceInvalidation() {
 	invalidate = cacheInvalidationFunc(c.instance, instanceIndexByID, getResourceOwner)
 	projection.LimitsProjection.RegisterCacheInvalidation(invalidate)
 	projection.RestrictionsProjection.RegisterCacheInvalidation(invalidate)
+	projection.ExecutionProjection.RegisterCacheInvalidation(invalidate)
+	projection.TargetProjection.RegisterCacheInvalidation(invalidate)

 	// System feature update should invalidate all instances, so Truncate the cache.
 	projection.SystemFeatureProjection.RegisterCacheInvalidation(func(ctx context.Context, _ []*eventstore.Aggregate) {
--- a/internal/query/instance_by_domain.sql
+++ b/internal/query/instance_by_domain.sql
@@ -26,6 +26,29 @@ with domain as (
 	from domain d
 	join projections.instance_trusted_domains td on d.instance_id = td.instance_id
 	group by td.instance_id
+), execution_targets as (
+	select instance_id, json_agg(x.execution_targets) as execution_targets from (
+		select e.instance_id, json_build_object(
+			'execution_id', et.execution_id,
+			'target_id', t.id,
+			'target_type', t.target_type,
+			'endpoint', t.endpoint,
+			'timeout', t.timeout,
+			'interrupt_on_error', t.interrupt_on_error,
+			'signing_key', t.signing_key
+		) as execution_targets
+		from domain d
+		join projections.executions1 e
+			on d.instance_id = e.instance_id
+		join projections.executions1_targets et
+			on e.instance_id = et.instance_id
+			and e.id = et.execution_id
+		join projections.targets2 t
+			on et.instance_id = t.instance_id
+			and et.target_id = t.id
+		order by et.position asc
+	) as x
+	group by instance_id
 )
 select
    i.id,
@@ -41,11 +64,13 @@ select
    l.block,
 	f.features,
 	ed.domains as external_domains,
-	td.domains as trusted_domains
+	td.domains as trusted_domains,
+	et.execution_targets
 from domain d
 join projections.instances i on i.id = d.instance_id
 left join projections.security_policies2 s on i.id = s.instance_id
 left join projections.limits l on i.id = l.instance_id
 left join features f on i.id = f.instance_id
 left join external_domains ed on i.id = ed.instance_id
-left join trusted_domains td on i.id = td.instance_id;
+left join trusted_domains td on i.id = td.instance_id
+left join execution_targets et on i.id = et.instance_id;
--- a/internal/query/instance_by_id.sql
+++ b/internal/query/instance_by_id.sql
@@ -17,6 +17,28 @@ with features as (
 	from projections.instance_trusted_domains
    where instance_id = $1
 	group by instance_id
+), execution_targets as (
+	select instance_id, json_agg(x.execution_targets) as execution_targets from (
+		select e.instance_id, json_build_object(
+			'execution_id', et.execution_id,
+			'target_id', t.id,
+			'target_type', t.target_type,
+			'endpoint', t.endpoint,
+			'timeout', t.timeout,
+			'interrupt_on_error', t.interrupt_on_error,
+			'signing_key', t.signing_key
+		) as execution_targets
+		from projections.executions1 e
+		join projections.executions1_targets et
+			on e.instance_id = et.instance_id
+			and e.id = et.execution_id
+		join projections.targets2 t
+			on et.instance_id = t.instance_id
+			and et.target_id = t.id
+		where e.instance_id = $1
+		order by et.position asc
+	) as x
+	group by instance_id
 )
 select
    i.id,
@@ -32,11 +54,13 @@ select
    l.block,
 	f.features,
    ed.domains as external_domains,
-	td.domains as trusted_domains
+	td.domains as trusted_domains,
+	et.execution_targets
 from projections.instances i
 left join projections.security_policies2 s on i.id = s.instance_id
 left join projections.limits l on i.id = l.instance_id
 left join features f on i.id = f.instance_id
 left join external_domains ed on i.id = ed.instance_id
 left join trusted_domains td on i.id = td.instance_id
+left join execution_targets et on i.id = et.instance_id
 where i.id = $1;
--- a/internal/query/projection/target_test.go
+++ b/internal/query/projection/target_test.go
@@ -4,9 +4,9 @@ import (
 	"testing"
 	"time"

-	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/eventstore"
 	"github.com/zitadel/zitadel/internal/eventstore/handler/v2"
+	target_domain "github.com/zitadel/zitadel/internal/execution/target"
 	"github.com/zitadel/zitadel/internal/repository/instance"
 	"github.com/zitadel/zitadel/internal/repository/target"
 	"github.com/zitadel/zitadel/internal/zerrors"
@@ -51,7 +51,7 @@ func TestTargetProjection_reduces(t *testing.T) {
 								uint64(15),
 								"name",
 								"https://example.com",
-								domain.TargetTypeWebhook,
+								target_domain.TargetTypeWebhook,
 								3 * time.Second,
 								true,
 								anyArg{},
@@ -86,7 +86,7 @@ func TestTargetProjection_reduces(t *testing.T) {
 								uint64(15),
 								"ro-id",
 								"name2",
-								domain.TargetTypeWebhook,
+								target_domain.TargetTypeWebhook,
 								"https://example.com",
 								3 * time.Second,
 								true,
--- a/internal/query/target.go
+++ b/internal/query/target.go
@@ -11,6 +11,7 @@ import (
 	"github.com/zitadel/zitadel/internal/api/authz"
 	"github.com/zitadel/zitadel/internal/crypto"
 	"github.com/zitadel/zitadel/internal/domain"
+	target_domain "github.com/zitadel/zitadel/internal/execution/target"
 	"github.com/zitadel/zitadel/internal/query/projection"
 	"github.com/zitadel/zitadel/internal/zerrors"
 )
@@ -79,7 +80,7 @@ type Target struct {
 	domain.ObjectDetails

 	Name             string
-	TargetType       domain.TargetType
+	TargetType       target_domain.TargetType
 	Endpoint         string
 	Timeout          time.Duration
 	InterruptOnError bool
--- a/internal/query/target_test.go
+++ b/internal/query/target_test.go
@@ -11,6 +11,7 @@ import (

 	"github.com/zitadel/zitadel/internal/crypto"
 	"github.com/zitadel/zitadel/internal/domain"
+	target_domain "github.com/zitadel/zitadel/internal/execution/target"
 	"github.com/zitadel/zitadel/internal/zerrors"
 )

@@ -103,7 +104,7 @@ func Test_TargetPrepares(t *testing.T) {
 							testNow,
 							"ro",
 							"target-name",
-							domain.TargetTypeWebhook,
+							target_domain.TargetTypeWebhook,
 							1 * time.Second,
 							"https://example.com",
 							true,
@@ -130,7 +131,7 @@ func Test_TargetPrepares(t *testing.T) {
 							ResourceOwner: "ro",
 						},
 						Name:             "target-name",
-						TargetType:       domain.TargetTypeWebhook,
+						TargetType:       target_domain.TargetTypeWebhook,
 						Timeout:          1 * time.Second,
 						Endpoint:         "https://example.com",
 						InterruptOnError: true,
@@ -158,7 +159,7 @@ func Test_TargetPrepares(t *testing.T) {
 							testNow,
 							"ro",
 							"target-name1",
-							domain.TargetTypeWebhook,
+							target_domain.TargetTypeWebhook,
 							1 * time.Second,
 							"https://example.com",
 							true,
@@ -175,7 +176,7 @@ func Test_TargetPrepares(t *testing.T) {
 							testNow,
 							"ro",
 							"target-name2",
-							domain.TargetTypeWebhook,
+							target_domain.TargetTypeWebhook,
 							1 * time.Second,
 							"https://example.com",
 							false,
@@ -192,7 +193,7 @@ func Test_TargetPrepares(t *testing.T) {
 							testNow,
 							"ro",
 							"target-name3",
-							domain.TargetTypeAsync,
+							target_domain.TargetTypeAsync,
 							1 * time.Second,
 							"https://example.com",
 							false,
@@ -219,7 +220,7 @@ func Test_TargetPrepares(t *testing.T) {
 							ResourceOwner: "ro",
 						},
 						Name:             "target-name1",
-						TargetType:       domain.TargetTypeWebhook,
+						TargetType:       target_domain.TargetTypeWebhook,
 						Timeout:          1 * time.Second,
 						Endpoint:         "https://example.com",
 						InterruptOnError: true,
@@ -238,7 +239,7 @@ func Test_TargetPrepares(t *testing.T) {
 							ResourceOwner: "ro",
 						},
 						Name:             "target-name2",
-						TargetType:       domain.TargetTypeWebhook,
+						TargetType:       target_domain.TargetTypeWebhook,
 						Timeout:          1 * time.Second,
 						Endpoint:         "https://example.com",
 						InterruptOnError: false,
@@ -257,7 +258,7 @@ func Test_TargetPrepares(t *testing.T) {
 							ResourceOwner: "ro",
 						},
 						Name:             "target-name3",
-						TargetType:       domain.TargetTypeAsync,
+						TargetType:       target_domain.TargetTypeAsync,
 						Timeout:          1 * time.Second,
 						Endpoint:         "https://example.com",
 						InterruptOnError: false,
@@ -319,7 +320,7 @@ func Test_TargetPrepares(t *testing.T) {
 						testNow,
 						"ro",
 						"target-name",
-						domain.TargetTypeWebhook,
+						target_domain.TargetTypeWebhook,
 						1 * time.Second,
 						"https://example.com",
 						true,
@@ -340,7 +341,7 @@ func Test_TargetPrepares(t *testing.T) {
 					ResourceOwner: "ro",
 				},
 				Name:             "target-name",
-				TargetType:       domain.TargetTypeWebhook,
+				TargetType:       target_domain.TargetTypeWebhook,
 				Timeout:          1 * time.Second,
 				Endpoint:         "https://example.com",
 				InterruptOnError: true,
--- a/internal/query/targets_by_execution_id.sql
+++ b/internal/query/targets_by_execution_id.sql
@@ -1,40 +0,0 @@
-WITH RECURSIVE
-    matched AS (SELECT *
-                 FROM projections.executions1
-                 WHERE instance_id = $1
-                   AND id = ANY($2)
-                 ORDER BY id DESC
-                 LIMIT 1),
-    matched_targets_and_includes AS (SELECT pos.*
-                                     FROM matched m
-                                              JOIN
-                                          projections.executions1_targets pos
-                                          ON m.id = pos.execution_id
-                                              AND m.instance_id = pos.instance_id
-                                     ORDER BY execution_id,
-                                              position),
-    dissolved_execution_targets(execution_id, instance_id, position, "include", "target_id")
-        AS (SELECT execution_id
-                 , instance_id
-                 , ARRAY [position]
-                 , "include"
-                 , "target_id"
-            FROM matched_targets_and_includes
-            UNION ALL
-            SELECT e.execution_id
-                 , p.instance_id
-                 , e.position || p.position
-                 , p."include"
-                 , p."target_id"
-            FROM dissolved_execution_targets e
-                     JOIN projections.executions1_targets p
-                          ON e.instance_id = p.instance_id
-                              AND e.include IS NOT NULL
-                              AND e.include = p.execution_id)
-select e.execution_id, e.instance_id, e.target_id, t.target_type, t.endpoint, t.timeout, t.interrupt_on_error, t.signing_key
-FROM dissolved_execution_targets e
-         JOIN projections.targets2 t
-              ON e.instance_id = t.instance_id
-                  AND e.target_id = t.id
-WHERE "include" = ''
-ORDER BY position DESC;
--- a/internal/query/targets_by_execution_ids.sql
+++ b/internal/query/targets_by_execution_ids.sql
@@ -1,47 +0,0 @@
-WITH RECURSIVE
-    matched AS ((SELECT *
-                 FROM projections.executions1
-                 WHERE instance_id = $1
-                   AND id = ANY($2)
-                 ORDER BY id DESC
-                 LIMIT 1)
-                UNION ALL
-                (SELECT *
-                 FROM projections.executions1
-                 WHERE instance_id = $1
-                   AND id = ANY($3)
-                 ORDER BY id DESC
-                 LIMIT 1)),
-    matched_targets_and_includes AS (SELECT pos.*
-                                     FROM matched m
-                                              JOIN
-                                          projections.executions1_targets pos
-                                          ON m.id = pos.execution_id
-                                              AND m.instance_id = pos.instance_id
-                                     ORDER BY execution_id,
-                                              position),
-    dissolved_execution_targets(execution_id, instance_id, position, "include", "target_id")
-        AS (SELECT execution_id
-                 , instance_id
-                 , ARRAY [position]
-                 , "include"
-                 , "target_id"
-            FROM matched_targets_and_includes
-            UNION ALL
-            SELECT e.execution_id
-                 , p.instance_id
-                 , e.position || p.position
-                 , p."include"
-                 , p."target_id"
-            FROM dissolved_execution_targets e
-                     JOIN projections.executions1_targets p
-                          ON e.instance_id = p.instance_id
-                              AND e.include IS NOT NULL
-                              AND e.include = p.execution_id)
-select e.execution_id, e.instance_id, e.target_id, t.target_type, t.endpoint, t.timeout, t.interrupt_on_error, t.signing_key
-FROM dissolved_execution_targets e
-         JOIN projections.targets2 t
-              ON e.instance_id = t.instance_id
-                  AND e.target_id = t.id
-WHERE "include" = ''
-ORDER BY position DESC;