fix: todos (#1346)

* fix: pub sub in new eventstore

* fix: todos

* fix: todos

* fix: todos

* fix: todos

* fix: todos

cmd/zitadel/main.go

@@ -61,11 +61,12 @@ type setupConfig struct {
 	Eventstore     types.SQL
 	SystemDefaults sd.SystemDefaults
 	SetUp          setup.IAMSetUp
+	InternalAuthZ  internal_authz.Config
 }
 
 var (
 	configPaths         = config.NewArrayFlags("authz.yaml", "startup.yaml", "system-defaults.yaml")
-	setupPaths          = config.NewArrayFlags("system-defaults.yaml", "setup.yaml")
+	setupPaths          = config.NewArrayFlags("authz.yaml", "system-defaults.yaml", "setup.yaml")
 	adminEnabled        = flag.Bool("admin", true, "enable admin api")
 	managementEnabled   = flag.Bool("management", true, "enable management api")
 	authEnabled         = flag.Bool("auth", true, "enable auth api")
@@ -106,7 +107,7 @@ func startZitadel(configPaths []string) {
 	if err != nil {
 		return
 	}
-	commands, err := command.StartCommands(esCommands, conf.SystemDefaults)
+	commands, err := command.StartCommands(esCommands, conf.SystemDefaults, conf.InternalAuthZ)
 	if err != nil {
 		return
 	}
@@ -189,7 +190,7 @@ func startSetup(configPaths []string, localDevMode bool) {
 	es, err := eventstore.Start(conf.Eventstore)
 	logging.Log("MAIN-Ddt3").OnError(err).Fatal("cannot start eventstore")
 
-	commands, err := command.StartCommands(es, conf.SystemDefaults)
+	commands, err := command.StartCommands(es, conf.SystemDefaults, conf.InternalAuthZ)
 	logging.Log("MAIN-dsjrr").OnError(err).Fatal("cannot start command side")
 
 	err = setup.Execute(ctx, conf.SetUp, conf.SystemDefaults.IamID, commands)

internal/api/grpc/admin/iam_member_converter.go

@@ -7,7 +7,6 @@ import (
 	"google.golang.org/protobuf/types/known/timestamppb"
 
 	iam_model "github.com/caos/zitadel/internal/iam/model"
-	"github.com/caos/zitadel/internal/model"
 	"github.com/caos/zitadel/pkg/grpc/admin"
 )
 
@@ -68,20 +67,20 @@ func iamMemberSearchKeyToModel(key admin.IamMemberSearchKey) iam_model.IAMMember
 	}
 }
 
-func searchMethodToModel(key admin.SearchMethod) model.SearchMethod {
+func searchMethodToModel(key admin.SearchMethod) domain.SearchMethod {
 	switch key {
 	case admin.SearchMethod_SEARCHMETHOD_CONTAINS:
-		return model.SearchMethodContains
+		return domain.SearchMethodContains
 	case admin.SearchMethod_SEARCHMETHOD_CONTAINS_IGNORE_CASE:
-		return model.SearchMethodContainsIgnoreCase
+		return domain.SearchMethodContainsIgnoreCase
 	case admin.SearchMethod_SEARCHMETHOD_EQUALS:
-		return model.SearchMethodEquals
+		return domain.SearchMethodEquals
 	case admin.SearchMethod_SEARCHMETHOD_EQUALS_IGNORE_CASE:
-		return model.SearchMethodEqualsIgnoreCase
+		return domain.SearchMethodEqualsIgnoreCase
 	case admin.SearchMethod_SEARCHMETHOD_STARTS_WITH:
-		return model.SearchMethodStartsWith
+		return domain.SearchMethodStartsWith
 	case admin.SearchMethod_SEARCHMETHOD_STARTS_WITH_IGNORE_CASE:
-		return model.SearchMethodStartsWithIgnoreCase
+		return domain.SearchMethodStartsWithIgnoreCase
 	default:
 		return -1
 	}

internal/api/grpc/admin/org_converter.go

@@ -9,7 +9,6 @@ import (
 	iam_model "github.com/caos/zitadel/internal/iam/model"
 
 	"github.com/caos/zitadel/internal/eventstore/v1/models"
-	"github.com/caos/zitadel/internal/model"
 	org_model "github.com/caos/zitadel/internal/org/model"
 	usr_model "github.com/caos/zitadel/internal/user/model"
 	"github.com/caos/zitadel/pkg/grpc/admin"
@@ -164,14 +163,14 @@ func orgQueryKeyToModel(key admin.OrgSearchKey) org_model.OrgSearchKey {
 	}
 }
 
-func orgQueryMethodToModel(method admin.OrgSearchMethod) model.SearchMethod {
+func orgQueryMethodToModel(method admin.OrgSearchMethod) domain.SearchMethod {
 	switch method {
 	case admin.OrgSearchMethod_ORGSEARCHMETHOD_CONTAINS:
-		return model.SearchMethodContains
+		return domain.SearchMethodContains
 	case admin.OrgSearchMethod_ORGSEARCHMETHOD_EQUALS:
-		return model.SearchMethodEquals
+		return domain.SearchMethodEquals
 	case admin.OrgSearchMethod_ORGSEARCHMETHOD_STARTS_WITH:
-		return model.SearchMethodStartsWith
+		return domain.SearchMethodStartsWith
 	default:
 		return 0
 	}

internal/api/grpc/auth/search_converter.go

@@ -1,25 +1,25 @@
 package auth
 
 import (
-	"github.com/caos/zitadel/internal/model"
+	"github.com/caos/zitadel/internal/domain"
 	"github.com/caos/zitadel/pkg/grpc/auth"
 )
 
-func searchMethodToModel(method auth.SearchMethod) model.SearchMethod {
+func searchMethodToModel(method auth.SearchMethod) domain.SearchMethod {
 	switch method {
 	case auth.SearchMethod_SEARCHMETHOD_EQUALS:
-		return model.SearchMethodEquals
+		return domain.SearchMethodEquals
 	case auth.SearchMethod_SEARCHMETHOD_CONTAINS:
-		return model.SearchMethodContains
+		return domain.SearchMethodContains
 	case auth.SearchMethod_SEARCHMETHOD_STARTS_WITH:
-		return model.SearchMethodStartsWith
+		return domain.SearchMethodStartsWith
 	case auth.SearchMethod_SEARCHMETHOD_EQUALS_IGNORE_CASE:
-		return model.SearchMethodEqualsIgnoreCase
+		return domain.SearchMethodEqualsIgnoreCase
 	case auth.SearchMethod_SEARCHMETHOD_CONTAINS_IGNORE_CASE:
-		return model.SearchMethodContainsIgnoreCase
+		return domain.SearchMethodContainsIgnoreCase
 	case auth.SearchMethod_SEARCHMETHOD_STARTS_WITH_IGNORE_CASE:
-		return model.SearchMethodStartsWithIgnoreCase
+		return domain.SearchMethodStartsWithIgnoreCase
 	default:
-		return model.SearchMethodEquals
+		return domain.SearchMethodEquals
 	}
 }

internal/api/grpc/auth/user_converter.go

@@ -90,8 +90,7 @@ func profileViewFromModel(profile *usr_model.Profile) *auth.UserProfileView {
 		DisplayName:        profile.DisplayName,
 		NickName:           profile.NickName,
 		PreferredLanguage:  profile.PreferredLanguage.String(),
-		//TODO: Use converter
+		Gender:             genderFromModel(profile.Gender),
-		Gender:             auth.Gender(profile.Gender),
 		LoginNames:         profile.LoginNames,
 		PreferredLoginName: profile.PreferredLoginName,
 	}
@@ -346,6 +345,19 @@ func genderFromDomain(gender domain.Gender) auth.Gender {
 	}
 }
 
+func genderFromModel(gender usr_model.Gender) auth.Gender {
+	switch gender {
+	case usr_model.GenderFemale:
+		return auth.Gender_GENDER_FEMALE
+	case usr_model.GenderMale:
+		return auth.Gender_GENDER_MALE
+	case usr_model.GenderDiverse:
+		return auth.Gender_GENDER_DIVERSE
+	default:
+		return auth.Gender_GENDER_UNSPECIFIED
+	}
+}
+
 func genderToDomain(gender auth.Gender) domain.Gender {
 	switch gender {
 	case auth.Gender_GENDER_FEMALE:

internal/api/grpc/auth/user_human_converter.go

@@ -17,8 +17,7 @@ func humanViewFromModel(user *usr_model.HumanView) *auth.HumanView {
 		DisplayName:       user.DisplayName,
 		NickName:          user.NickName,
 		PreferredLanguage: user.PreferredLanguage,
-		//TODO: add converter
+		Gender:            genderFromModel(user.Gender),
-		Gender:          auth.Gender(user.Gender),
 		Email:             user.Email,
 		IsEmailVerified:   user.IsEmailVerified,
 		Phone:             user.Phone,

internal/api/grpc/management/application_converter.go

@@ -14,7 +14,6 @@ import (
 	"github.com/caos/zitadel/internal/domain"
 	"github.com/caos/zitadel/internal/eventstore/v1/models"
 	key_model "github.com/caos/zitadel/internal/key/model"
-	"github.com/caos/zitadel/internal/model"
 	proj_model "github.com/caos/zitadel/internal/project/model"
 	"github.com/caos/zitadel/pkg/grpc/management"
 	"github.com/caos/zitadel/pkg/grpc/message"
@@ -271,7 +270,7 @@ func applicationSearchQueriesToModel(projectID string, queries []*management.App
 	for i, q := range queries {
 		converted[i] = applicationSearchQueryToModel(q)
 	}
-	converted[len(queries)] = &proj_model.ApplicationSearchQuery{Key: proj_model.AppSearchKeyProjectID, Method: model.SearchMethodEquals, Value: projectID}
+	converted[len(queries)] = &proj_model.ApplicationSearchQuery{Key: proj_model.AppSearchKeyProjectID, Method: domain.SearchMethodEquals, Value: projectID}
 
 	return converted
 }
@@ -711,11 +710,11 @@ func clientKeySearchRequestToModel(req *management.ClientKeySearchRequest) *key_
 		Queries: []*key_model.AuthNKeySearchQuery{
 			{
 				Key:    key_model.AuthNKeyObjectType,
-				Method: model.SearchMethodEquals,
+				Method: domain.SearchMethodEquals,
 				Value:  key_model.AuthNKeyObjectTypeApplication,
 			}, {
 				Key:    key_model.AuthNKeyObjectID,
-				Method: model.SearchMethodEquals,
+				Method: domain.SearchMethodEquals,
 				Value:  req.ApplicationId,
 			},
 		},

internal/api/grpc/management/org_member_converter.go

@@ -9,7 +9,6 @@ import (
 
 	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/domain"
-	"github.com/caos/zitadel/internal/model"
 	org_model "github.com/caos/zitadel/internal/org/model"
 	"github.com/caos/zitadel/pkg/grpc/management"
 )
@@ -72,20 +71,20 @@ func orgMemberSearchKeyToModel(key management.OrgMemberSearchKey) org_model.OrgM
 	}
 }
 
-func orgMemberSearchMethodToModel(key management.SearchMethod) model.SearchMethod {
+func orgMemberSearchMethodToModel(key management.SearchMethod) domain.SearchMethod {
 	switch key {
 	case management.SearchMethod_SEARCHMETHOD_CONTAINS:
-		return model.SearchMethodContains
+		return domain.SearchMethodContains
 	case management.SearchMethod_SEARCHMETHOD_CONTAINS_IGNORE_CASE:
-		return model.SearchMethodContainsIgnoreCase
+		return domain.SearchMethodContainsIgnoreCase
 	case management.SearchMethod_SEARCHMETHOD_EQUALS:
-		return model.SearchMethodEquals
+		return domain.SearchMethodEquals
 	case management.SearchMethod_SEARCHMETHOD_EQUALS_IGNORE_CASE:
-		return model.SearchMethodEqualsIgnoreCase
+		return domain.SearchMethodEqualsIgnoreCase
 	case management.SearchMethod_SEARCHMETHOD_STARTS_WITH:
-		return model.SearchMethodStartsWith
+		return domain.SearchMethodStartsWith
 	case management.SearchMethod_SEARCHMETHOD_STARTS_WITH_IGNORE_CASE:
-		return model.SearchMethodStartsWithIgnoreCase
+		return domain.SearchMethodStartsWithIgnoreCase
 	default:
 		return -1
 	}

internal/api/grpc/management/project_grant_converter.go

@@ -8,7 +8,6 @@ import (
 	"github.com/golang/protobuf/ptypes"
 
 	"github.com/caos/zitadel/internal/eventstore/v1/models"
-	"github.com/caos/zitadel/internal/model"
 	proj_model "github.com/caos/zitadel/internal/project/model"
 	"github.com/caos/zitadel/pkg/grpc/management"
 )
@@ -77,7 +76,7 @@ func projectGrantSearchQueriesToModel(projectId string, queries []*management.Pr
 	converted := make([]*proj_model.ProjectGrantViewSearchQuery, 0)
 	converted = append(converted, &proj_model.ProjectGrantViewSearchQuery{
 		Key:    proj_model.GrantedProjectSearchKeyProjectID,
-		Method: model.SearchMethodEquals,
+		Method: domain.SearchMethodEquals,
 		Value:  projectId,
 	})
 	for i, query := range queries {

internal/api/grpc/management/project_grant_member_converter.go

@@ -3,7 +3,6 @@ package management
 import (
 	"github.com/caos/logging"
 	"github.com/caos/zitadel/internal/domain"
-	"github.com/caos/zitadel/internal/model"
 	"github.com/golang/protobuf/ptypes"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
@@ -66,8 +65,8 @@ func projectGrantMemberSearchRequestsToModel(memberSearch *management.ProjectGra
 		Limit:   memberSearch.Limit,
 		Queries: projectGrantMemberSearchQueriesToModel(memberSearch.Queries),
 	}
-	request.Queries = append(request.Queries, &proj_model.ProjectGrantMemberSearchQuery{Key: proj_model.ProjectGrantMemberSearchKeyProjectID, Method: model.SearchMethodEquals, Value: memberSearch.ProjectId})
+	request.Queries = append(request.Queries, &proj_model.ProjectGrantMemberSearchQuery{Key: proj_model.ProjectGrantMemberSearchKeyProjectID, Method: domain.SearchMethodEquals, Value: memberSearch.ProjectId})
-	request.Queries = append(request.Queries, &proj_model.ProjectGrantMemberSearchQuery{Key: proj_model.ProjectGrantMemberSearchKeyGrantID, Method: model.SearchMethodEquals, Value: memberSearch.GrantId})
+	request.Queries = append(request.Queries, &proj_model.ProjectGrantMemberSearchQuery{Key: proj_model.ProjectGrantMemberSearchKeyGrantID, Method: domain.SearchMethodEquals, Value: memberSearch.GrantId})
 	return request
 }
 

internal/api/grpc/management/search_converter.go

@@ -1,31 +1,31 @@
 package management
 
 import (
-	"github.com/caos/zitadel/internal/model"
+	"github.com/caos/zitadel/internal/domain"
 	"github.com/caos/zitadel/pkg/grpc/management"
 )
 
-func searchMethodToModel(method management.SearchMethod) model.SearchMethod {
+func searchMethodToModel(method management.SearchMethod) domain.SearchMethod {
 	switch method {
 	case management.SearchMethod_SEARCHMETHOD_EQUALS:
-		return model.SearchMethodEquals
+		return domain.SearchMethodEquals
 	case management.SearchMethod_SEARCHMETHOD_CONTAINS:
-		return model.SearchMethodContains
+		return domain.SearchMethodContains
 	case management.SearchMethod_SEARCHMETHOD_STARTS_WITH:
-		return model.SearchMethodStartsWith
+		return domain.SearchMethodStartsWith
 	case management.SearchMethod_SEARCHMETHOD_EQUALS_IGNORE_CASE:
-		return model.SearchMethodEqualsIgnoreCase
+		return domain.SearchMethodEqualsIgnoreCase
 	case management.SearchMethod_SEARCHMETHOD_CONTAINS_IGNORE_CASE:
-		return model.SearchMethodContainsIgnoreCase
+		return domain.SearchMethodContainsIgnoreCase
 	case management.SearchMethod_SEARCHMETHOD_STARTS_WITH_IGNORE_CASE:
-		return model.SearchMethodStartsWithIgnoreCase
+		return domain.SearchMethodStartsWithIgnoreCase
 	case management.SearchMethod_SEARCHMETHOD_NOT_EQUALS:
-		return model.SearchMethodNotEquals
+		return domain.SearchMethodNotEquals
 	case management.SearchMethod_SEARCHMETHOD_IS_ONE_OF:
-		return model.SearchMethodIsOneOf
+		return domain.SearchMethodIsOneOf
 	case management.SearchMethod_SEARCHMETHOD_LIST_CONTAINS:
-		return model.SearchMethodListContains
+		return domain.SearchMethodListContains
 	default:
-		return model.SearchMethodEquals
+		return domain.SearchMethodEquals
 	}
 }

internal/api/grpc/management/user_converter.go

@@ -13,7 +13,6 @@ import (
 	"github.com/caos/zitadel/internal/domain"
 
 	"github.com/caos/zitadel/internal/eventstore/v1/models"
-	"github.com/caos/zitadel/internal/model"
 	usr_model "github.com/caos/zitadel/internal/user/model"
 	"github.com/caos/zitadel/pkg/grpc/management"
 	"github.com/caos/zitadel/pkg/grpc/message"
@@ -74,7 +73,7 @@ func externalIDPSearchRequestToModel(request *management.ExternalIDPSearchReques
 	return &usr_model.ExternalIDPSearchRequest{
 		Limit:   request.Limit,
 		Offset:  request.Offset,
-		Queries: []*usr_model.ExternalIDPSearchQuery{{Key: usr_model.ExternalIDPSearchKeyUserID, Method: model.SearchMethodEquals, Value: request.UserId}},
+		Queries: []*usr_model.ExternalIDPSearchQuery{{Key: usr_model.ExternalIDPSearchKeyUserID, Method: domain.SearchMethodEquals, Value: request.UserId}},
 	}
 }
 
@@ -543,6 +542,19 @@ func genderFromDomain(gender domain.Gender) management.Gender {
 	}
 }
 
+func genderFromModel(gender usr_model.Gender) management.Gender {
+	switch gender {
+	case usr_model.GenderFemale:
+		return management.Gender_GENDER_FEMALE
+	case usr_model.GenderMale:
+		return management.Gender_GENDER_MALE
+	case usr_model.GenderDiverse:
+		return management.Gender_GENDER_DIVERSE
+	default:
+		return management.Gender_GENDER_UNSPECIFIED
+	}
+}
+
 func memberTypeFromModel(memberType usr_model.MemberType) management.MemberType {
 	switch memberType {
 	case usr_model.MemberTypeOrganisation:

internal/api/grpc/management/user_human_converter.go

@@ -47,8 +47,7 @@ func humanViewFromModel(user *usr_model.HumanView) *management.HumanView {
 		DisplayName:       user.DisplayName,
 		NickName:          user.NickName,
 		PreferredLanguage: user.PreferredLanguage,
-		//TODO: User converter
+		Gender:            genderFromModel(user.Gender),
-		Gender:          management.Gender(user.Gender),
 		Email:             user.Email,
 		IsEmailVerified:   user.IsEmailVerified,
 		Phone:             user.Phone,

internal/api/grpc/management/user_machine_converter.go

@@ -13,7 +13,6 @@ import (
 
 	"github.com/caos/zitadel/internal/eventstore/v1/models"
 	key_model "github.com/caos/zitadel/internal/key/model"
-	"github.com/caos/zitadel/internal/model"
 	usr_model "github.com/caos/zitadel/internal/user/model"
 	"github.com/caos/zitadel/pkg/grpc/management"
 )
@@ -151,11 +150,11 @@ func machineKeySearchRequestToModel(req *management.MachineKeySearchRequest) *ke
 		Queries: []*key_model.AuthNKeySearchQuery{
 			{
 				Key:    key_model.AuthNKeyObjectType,
-				Method: model.SearchMethodEquals,
+				Method: domain.SearchMethodEquals,
 				Value:  key_model.AuthNKeyObjectTypeUser,
 			}, {
 				Key:    key_model.AuthNKeyObjectID,
-				Method: model.SearchMethodEquals,
+				Method: domain.SearchMethodEquals,
 				Value:  req.UserId,
 			},
 		},

internal/auth/repository/eventsourcing/eventstore/user_grant.go

@@ -3,12 +3,12 @@ package eventstore
 import (
 	"context"
 	"github.com/caos/logging"
+	"github.com/caos/zitadel/internal/domain"
 
 	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/auth/repository/eventsourcing/view"
 	authz_repo "github.com/caos/zitadel/internal/authz/repository/eventsourcing"
 	caos_errs "github.com/caos/zitadel/internal/errors"
-	global_model "github.com/caos/zitadel/internal/model"
 	org_model "github.com/caos/zitadel/internal/org/model"
 	org_view_model "github.com/caos/zitadel/internal/org/repository/view/model"
 	"github.com/caos/zitadel/internal/telemetry/tracing"
@@ -30,7 +30,7 @@ func (repo *UserGrantRepo) SearchMyUserGrants(ctx context.Context, request *gran
 	request.EnsureLimit(repo.SearchLimit)
 	sequence, err := repo.View.GetLatestUserGrantSequence()
 	logging.Log("EVENT-Hd7s3").OnError(err).WithField("traceID", tracing.TraceIDFromCtx(ctx)).Warn("could not read latest user grant sequence")
-	request.Queries = append(request.Queries, &grant_model.UserGrantSearchQuery{Key: grant_model.UserGrantSearchKeyUserID, Method: global_model.SearchMethodEquals, Value: authz.GetCtxData(ctx).UserID})
+	request.Queries = append(request.Queries, &grant_model.UserGrantSearchQuery{Key: grant_model.UserGrantSearchKeyUserID, Method: domain.SearchMethodEquals, Value: authz.GetCtxData(ctx).UserID})
 	grants, count, err := repo.View.SearchUserGrants(request)
 	if err != nil {
 		return nil, err
@@ -68,7 +68,7 @@ func (repo *UserGrantRepo) SearchMyProjectOrgs(ctx context.Context, request *gra
 		}
 		return repo.searchZitadelOrgs(ctxData, request)
 	}
-	request.Queries = append(request.Queries, &grant_model.UserGrantSearchQuery{Key: grant_model.UserGrantSearchKeyProjectID, Method: global_model.SearchMethodEquals, Value: ctxData.ProjectID})
+	request.Queries = append(request.Queries, &grant_model.UserGrantSearchQuery{Key: grant_model.UserGrantSearchKeyProjectID, Method: domain.SearchMethodEquals, Value: ctxData.ProjectID})
 
 	grants, err := repo.SearchMyUserGrants(ctx, request)
 	if err != nil {
@@ -135,12 +135,12 @@ func (repo *UserGrantRepo) searchUserMemberships(ctx context.Context) ([]*user_v
 		Queries: []*user_model.UserMembershipSearchQuery{
 			{
 				Key:    user_model.UserMembershipSearchKeyUserID,
-				Method: global_model.SearchMethodEquals,
+				Method: domain.SearchMethodEquals,
 				Value:  ctxData.UserID,
 			},
 			{
 				Key:    user_model.UserMembershipSearchKeyResourceOwner,
-				Method: global_model.SearchMethodEquals,
+				Method: domain.SearchMethodEquals,
 				Value:  ctxData.OrgID,
 			},
 		},
@@ -152,12 +152,12 @@ func (repo *UserGrantRepo) searchUserMemberships(ctx context.Context) ([]*user_v
 		Queries: []*user_model.UserMembershipSearchQuery{
 			{
 				Key:    user_model.UserMembershipSearchKeyUserID,
-				Method: global_model.SearchMethodEquals,
+				Method: domain.SearchMethodEquals,
 				Value:  ctxData.UserID,
 			},
 			{
 				Key:    user_model.UserMembershipSearchKeyAggregateID,
-				Method: global_model.SearchMethodEquals,
+				Method: domain.SearchMethodEquals,
 				Value:  repo.IamID,
 			},
 		},
@@ -203,7 +203,7 @@ func (repo *UserGrantRepo) SearchAdminOrgs(request *grant_model.UserGrantSearchR
 func (repo *UserGrantRepo) IsIamAdmin(ctx context.Context) (bool, error) {
 	grantSearch := &grant_model.UserGrantSearchRequest{
 		Queries: []*grant_model.UserGrantSearchQuery{
-			{Key: grant_model.UserGrantSearchKeyResourceOwner, Method: global_model.SearchMethodEquals, Value: repo.IamID},
+			{Key: grant_model.UserGrantSearchKeyResourceOwner, Method: domain.SearchMethodEquals, Value: repo.IamID},
 		}}
 	result, err := repo.SearchMyUserGrants(ctx, grantSearch)
 	if err != nil {
@@ -246,7 +246,7 @@ func (repo *UserGrantRepo) searchZitadelOrgs(ctxData authz.CtxData, request *gra
 		Queries: []*user_model.UserMembershipSearchQuery{
 			{
 				Key:    user_model.UserMembershipSearchKeyUserID,
-				Method: global_model.SearchMethodEquals,
+				Method: domain.SearchMethodEquals,
 				Value:  ctxData.UserID,
 			},
 		},

internal/auth/repository/eventsourcing/view/application.go

@@ -2,10 +2,10 @@ package view
 
 import (
 	"context"
+	"github.com/caos/zitadel/internal/domain"
 
 	"github.com/caos/zitadel/internal/errors"
 	"github.com/caos/zitadel/internal/eventstore/v1/models"
-	global_model "github.com/caos/zitadel/internal/model"
 	proj_model "github.com/caos/zitadel/internal/project/model"
 	"github.com/caos/zitadel/internal/project/repository/view"
 	"github.com/caos/zitadel/internal/project/repository/view/model"
@@ -89,7 +89,7 @@ func (v *View) AppIDsFromProjectByClientID(ctx context.Context, clientID string)
 		Queries: []*proj_model.ApplicationSearchQuery{
 			{
 				Key:    proj_model.AppSearchKeyProjectID,
-				Method: global_model.SearchMethodEquals,
+				Method: domain.SearchMethodEquals,
 				Value:  app.ProjectID,
 			},
 		},
@@ -113,7 +113,7 @@ func (v *View) AppIDsFromProjectID(ctx context.Context, projectID string) ([]str
 		Queries: []*proj_model.ApplicationSearchQuery{
 			{
 				Key:    proj_model.AppSearchKeyProjectID,
-				Method: global_model.SearchMethodEquals,
+				Method: domain.SearchMethodEquals,
 				Value:  projectID,
 			},
 		},

internal/authz/repository/eventsourcing/eventstore/user_grant.go

@@ -14,7 +14,6 @@ import (
 	"github.com/caos/zitadel/internal/authz/repository/eventsourcing/view"
 	"github.com/caos/zitadel/internal/domain"
 	caos_errs "github.com/caos/zitadel/internal/errors"
-	global_model "github.com/caos/zitadel/internal/model"
 	user_model "github.com/caos/zitadel/internal/user/model"
 	user_view_model "github.com/caos/zitadel/internal/user/repository/view/model"
 	grant_model "github.com/caos/zitadel/internal/usergrant/model"
@@ -60,12 +59,12 @@ func (repo *UserGrantRepo) searchUserMemberships(ctx context.Context) ([]*user_v
 		Queries: []*user_model.UserMembershipSearchQuery{
 			{
 				Key:    user_model.UserMembershipSearchKeyUserID,
-				Method: global_model.SearchMethodEquals,
+				Method: domain.SearchMethodEquals,
 				Value:  ctxData.UserID,
 			},
 			{
 				Key:    user_model.UserMembershipSearchKeyResourceOwner,
-				Method: global_model.SearchMethodEquals,
+				Method: domain.SearchMethodEquals,
 				Value:  ctxData.OrgID,
 			},
 		},
@@ -77,12 +76,12 @@ func (repo *UserGrantRepo) searchUserMemberships(ctx context.Context) ([]*user_v
 		Queries: []*user_model.UserMembershipSearchQuery{
 			{
 				Key:    user_model.UserMembershipSearchKeyUserID,
-				Method: global_model.SearchMethodEquals,
+				Method: domain.SearchMethodEquals,
 				Value:  ctxData.UserID,
 			},
 			{
 				Key:    user_model.UserMembershipSearchKeyAggregateID,
-				Method: global_model.SearchMethodEquals,
+				Method: domain.SearchMethodEquals,
 				Value:  repo.IamID,
 			},
 		},

internal/command/command.go

@@ -2,7 +2,9 @@ package command
 
 import (
 	"context"
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/config/types"
+	"github.com/caos/zitadel/internal/domain"
 	"github.com/caos/zitadel/internal/eventstore"
 	"time"
 
@@ -10,7 +12,6 @@ import (
 	sd "github.com/caos/zitadel/internal/config/systemdefaults"
 	"github.com/caos/zitadel/internal/crypto"
 	"github.com/caos/zitadel/internal/id"
-	global_model "github.com/caos/zitadel/internal/model"
 	iam_repo "github.com/caos/zitadel/internal/repository/iam"
 	keypair "github.com/caos/zitadel/internal/repository/keypair"
 	"github.com/caos/zitadel/internal/repository/org"
@@ -25,6 +26,7 @@ type Commands struct {
 	eventstore   *eventstore.Eventstore
 	idGenerator  id.Generator
 	iamDomain    string
+	zitadelRoles []authz.RoleMapping
 
 	idpConfigSecretCrypto crypto.Crypto
 
@@ -40,8 +42,7 @@ type Commands struct {
 	domainVerificationAlg       *crypto.AESCrypto
 	domainVerificationGenerator crypto.Generator
 	domainVerificationValidator func(domain, token, verifier string, checkType http.CheckType) error
-	//TODO: remove global model, or move to domain
+	multifactors                domain.MultifactorConfigs
-	multifactors global_model.Multifactors
 
 	webauthn           *webauthn_helper.WebAuthN
 	keySize            int
@@ -54,11 +55,12 @@ type Config struct {
 	Eventstore types.SQLUser
 }
 
-func StartCommands(eventstore *eventstore.Eventstore, defaults sd.SystemDefaults) (repo *Commands, err error) {
+func StartCommands(eventstore *eventstore.Eventstore, defaults sd.SystemDefaults, authZConfig authz.Config) (repo *Commands, err error) {
 	repo = &Commands{
 		eventstore:         eventstore,
 		idGenerator:        id.SonyFlakeGenerator,
 		iamDomain:          defaults.Domain,
+		zitadelRoles:       authZConfig.RolePermissionMappings,
 		keySize:            defaults.KeyConfig.Size,
 		privateKeyLifetime: defaults.KeyConfig.PrivateKeyLifetime.Duration,
 		publicKeyLifetime:  defaults.KeyConfig.PublicKeyLifetime.Duration,
@@ -70,7 +72,6 @@ func StartCommands(eventstore *eventstore.Eventstore, defaults sd.SystemDefaults
 	proj_repo.RegisterEventMappers(repo.eventstore)
 	keypair.RegisterEventMappers(repo.eventstore)
 
-	//TODO: simplify!!!!
 	repo.idpConfigSecretCrypto, err = crypto.NewAESCrypto(defaults.IDPConfigVerificationKey)
 	if err != nil {
 		return nil, err
@@ -92,8 +93,8 @@ func StartCommands(eventstore *eventstore.Eventstore, defaults sd.SystemDefaults
 	if err != nil {
 		return nil, err
 	}
-	repo.multifactors = global_model.Multifactors{
+	repo.multifactors = domain.MultifactorConfigs{
-		OTP: global_model.OTP{
+		OTP: domain.OTPConfig{
 			CryptoMFA: aesOTPCrypto,
 			Issuer:    defaults.Multifactors.OTP.Issuer,
 		},

internal/command/iam.go

@@ -8,7 +8,7 @@ import (
 	"github.com/caos/zitadel/internal/repository/iam"
 )
 
-//TODO: private
+//TODO: private as soon as setup uses query
 func (c *Commands) GetIAM(ctx context.Context) (*domain.IAM, error) {
 	iamWriteModel := NewIAMWriteModel()
 	err := c.eventstore.FilterToQueryReducer(ctx, iamWriteModel)

internal/command/iam_converter.go

@@ -132,7 +132,6 @@ func writeModelToPasswordLockoutPolicy(wm *PasswordLockoutPolicyWriteModel) *dom
 func writeModelToIDPConfig(wm *IDPConfigWriteModel) *domain.IDPConfig {
 	return &domain.IDPConfig{
 		ObjectRoot:  writeModelToObjectRoot(wm.WriteModel),
-		OIDCConfig:  writeModelToIDPOIDCConfig(wm.OIDCConfig),
 		IDPConfigID: wm.ConfigID,
 		Name:        wm.Name,
 		State:       wm.State,

internal/command/iam_idp_config.go

@@ -141,6 +141,17 @@ func (c *Commands) RemoveDefaultIDPConfig(ctx context.Context, idpID string, idp
 	return err
 }
 
+func (c *Commands) getIAMIDPConfigByID(ctx context.Context, idpID string) (*domain.IDPConfig, error) {
+	config, err := c.iamIDPConfigWriteModelByID(ctx, idpID)
+	if err != nil {
+		return nil, err
+	}
+	if !config.State.Exists() {
+		return nil, caos_errs.ThrowNotFound(nil, "IAM-4M9so", "Errors.IAM.IDPConfig.NotExisting")
+	}
+	return writeModelToIDPConfig(&config.IDPConfigWriteModel), nil
+}
+
 func (c *Commands) iamIDPConfigWriteModelByID(ctx context.Context, idpID string) (policy *IAMIDPConfigWriteModel, err error) {
 	ctx, span := tracing.NewSpan(ctx)
 	defer func() { span.EndWithError(err) }()

internal/command/iam_member.go

@@ -32,11 +32,12 @@ func (c *Commands) AddIAMMember(ctx context.Context, member *domain.Member) (*do
 }
 
 func (c *Commands) addIAMMember(ctx context.Context, iamAgg *eventstore.Aggregate, addedMember *IAMMemberWriteModel, member *domain.Member) (eventstore.EventPusher, error) {
-	//TODO: check if roles valid
-
 	if !member.IsValid() {
 		return nil, caos_errs.ThrowPreconditionFailed(nil, "IAM-GR34U", "Errors.IAM.MemberInvalid")
 	}
+	if len(domain.CheckForInvalidRoles(member.Roles, domain.IAMRolePrefix, c.zitadelRoles)) > 0 {
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "IAM-4m0fS", "Errors.IAM.MemberInvalid")
+	}
 
 	err := c.eventstore.FilterToQueryReducer(ctx, addedMember)
 	if err != nil {
@@ -51,11 +52,12 @@ func (c *Commands) addIAMMember(ctx context.Context, iamAgg *eventstore.Aggregat
 
 //ChangeIAMMember updates an existing member
 func (c *Commands) ChangeIAMMember(ctx context.Context, member *domain.Member) (*domain.Member, error) {
-	//TODO: check if roles valid
-
 	if !member.IsValid() {
 		return nil, caos_errs.ThrowPreconditionFailed(nil, "IAM-LiaZi", "Errors.IAM.MemberInvalid")
 	}
+	if len(domain.CheckForInvalidRoles(member.Roles, domain.IAMRolePrefix, c.zitadelRoles)) > 0 {
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "IAM-3m9fs", "Errors.IAM.MemberInvalid")
+	}
 
 	existingMember, err := c.iamMemberWriteModelByID(ctx, member.UserID)
 	if err != nil {

internal/command/idp_config_model.go

@@ -14,22 +14,10 @@ type IDPConfigWriteModel struct {
 	ConfigID    string
 	Name        string
 	StylingType domain.IDPConfigStylingType
-
-	//TODO: sub writemodels not used anymore?
-	OIDCConfig *OIDCConfigWriteModel
 }
 
 func (rm *IDPConfigWriteModel) AppendEvents(events ...eventstore.EventReader) {
 	rm.WriteModel.AppendEvents(events...)
-	for _, event := range events {
-		switch event.(type) {
-		case *idpconfig.OIDCConfigAddedEvent:
-			rm.OIDCConfig = new(OIDCConfigWriteModel)
-			rm.OIDCConfig.AppendEvents(event)
-		case *idpconfig.OIDCConfigChangedEvent:
-			rm.OIDCConfig.AppendEvents(event)
-		}
-	}
 }
 
 func (rm *IDPConfigWriteModel) Reduce() error {
@@ -47,11 +35,6 @@ func (rm *IDPConfigWriteModel) Reduce() error {
 			rm.reduceConfigStateChanged(e.ConfigID, domain.IDPConfigStateRemoved)
 		}
 	}
-	if rm.OIDCConfig != nil {
-		if err := rm.OIDCConfig.Reduce(); err != nil {
-			return err
-		}
-	}
 	return rm.WriteModel.Reduce()
 }
 

internal/command/org_domain_model.go

@@ -72,8 +72,6 @@ func (wm *OrgDomainWriteModel) Reduce() error {
 		case *org.DomainVerificationAddedEvent:
 			wm.ValidationType = e.ValidationType
 			wm.ValidationCode = e.ValidationCode
-		case *org.DomainVerificationFailedEvent:
-			//TODO: not handled in v1
 		case *org.DomainVerifiedEvent:
 			wm.Verified = true
 		case *org.DomainPrimarySetEvent:

internal/command/org_idp_config.go

@@ -143,6 +143,17 @@ func (c *Commands) RemoveIDPConfig(ctx context.Context, idpID, orgID string, cas
 	return err
 }
 
+func (c *Commands) getOrgIDPConfigByID(ctx context.Context, idpID, orgID string) (*domain.IDPConfig, error) {
+	config, err := c.orgIDPConfigWriteModelByID(ctx, idpID, orgID)
+	if err != nil {
+		return nil, err
+	}
+	if !config.State.Exists() {
+		return nil, caos_errs.ThrowNotFound(nil, "IAM-4M9so", "Errors.Org.IDPConfig.NotExisting")
+	}
+	return writeModelToIDPConfig(&config.IDPConfigWriteModel), nil
+}
+
 func (c *Commands) orgIDPConfigWriteModelByID(ctx context.Context, idpID, orgID string) (policy *OrgIDPConfigWriteModel, err error) {
 	ctx, span := tracing.NewSpan(ctx)
 	defer func() { span.EndWithError(err) }()

internal/command/org_member.go

@@ -32,11 +32,12 @@ func (c *Commands) AddOrgMember(ctx context.Context, member *domain.Member) (*do
 }
 
 func (c *Commands) addOrgMember(ctx context.Context, orgAgg *eventstore.Aggregate, addedMember *OrgMemberWriteModel, member *domain.Member) (eventstore.EventPusher, error) {
-	//TODO: check if roles valid
-
 	if !member.IsValid() {
 		return nil, caos_errs.ThrowPreconditionFailed(nil, "Org-W8m4l", "Errors.Org.MemberInvalid")
 	}
+	if len(domain.CheckForInvalidRoles(member.Roles, domain.OrgRolePrefix, c.zitadelRoles)) > 0 {
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "IAM-3m9fs", "Errors.Org.MemberInvalid")
+	}
 
 	err := c.eventstore.FilterToQueryReducer(ctx, addedMember)
 	if err != nil {
@@ -51,11 +52,12 @@ func (c *Commands) addOrgMember(ctx context.Context, orgAgg *eventstore.Aggregat
 
 //ChangeOrgMember updates an existing member
 func (c *Commands) ChangeOrgMember(ctx context.Context, member *domain.Member) (*domain.Member, error) {
-	//TODO: check if roles valid
-
 	if !member.IsValid() {
 		return nil, caos_errs.ThrowPreconditionFailed(nil, "Org-LiaZi", "Errors.Org.MemberInvalid")
 	}
+	if len(domain.CheckForInvalidRoles(member.Roles, domain.OrgRolePrefix, c.zitadelRoles)) > 0 {
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "IAM-m9fG8", "Errors.Org.MemberInvalid")
+	}
 
 	existingMember, err := c.orgMemberWriteModelByID(ctx, member.AggregateID, member.UserID)
 	if err != nil {

internal/command/project_grant_member.go

@@ -44,11 +44,12 @@ func (c *Commands) AddProjectGrantMember(ctx context.Context, member *domain.Pro
 
 //ChangeProjectGrantMember updates an existing member
 func (c *Commands) ChangeProjectGrantMember(ctx context.Context, member *domain.ProjectGrantMember, resourceOwner string) (*domain.ProjectGrantMember, error) {
-	//TODO: check if roles valid
-
 	if !member.IsValid() {
 		return nil, caos_errs.ThrowPreconditionFailed(nil, "PROJECT-109fs", "Errors.Project.Member.Invalid")
 	}
+	if len(domain.CheckForInvalidRoles(member.Roles, domain.ProjectGrantRolePrefix, c.zitadelRoles)) > 0 {
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "PROJECT-m0sDf", "Errors.Project.Member.Invalid")
+	}
 
 	existingMember, err := c.projectGrantMemberWriteModelByID(ctx, member.AggregateID, member.UserID, member.GrantID)
 	if err != nil {

internal/command/project_member.go

@@ -33,11 +33,12 @@ func (c *Commands) AddProjectMember(ctx context.Context, member *domain.Member,
 }
 
 func (c *Commands) addProjectMember(ctx context.Context, projectAgg *eventstore.Aggregate, addedMember *ProjectMemberWriteModel, member *domain.Member) (eventstore.EventPusher, error) {
-	//TODO: check if roles valid
-
 	if !member.IsValid() {
 		return nil, caos_errs.ThrowPreconditionFailed(nil, "PROJECT-W8m4l", "Errors.Project.Member.Invalid")
 	}
+	if len(domain.CheckForInvalidRoles(member.Roles, domain.ProjectRolePrefix, c.zitadelRoles)) > 0 {
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "PROJECT-3m9ds", "Errors.Project.Member.Invalid")
+	}
 
 	err := c.checkUserExists(ctx, addedMember.UserID, "")
 	if err != nil {
@@ -56,11 +57,12 @@ func (c *Commands) addProjectMember(ctx context.Context, projectAgg *eventstore.
 
 //ChangeProjectMember updates an existing member
 func (c *Commands) ChangeProjectMember(ctx context.Context, member *domain.Member, resourceOwner string) (*domain.Member, error) {
-	//TODO: check if roles valid
-
 	if !member.IsValid() {
 		return nil, caos_errs.ThrowPreconditionFailed(nil, "PROJECT-LiaZi", "Errors.Project.Member.Invalid")
 	}
+	if len(domain.CheckForInvalidRoles(member.Roles, domain.ProjectRolePrefix, c.zitadelRoles)) > 0 {
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "PROJECT-3m9d", "Errors.Project.Member.Invalid")
+	}
 
 	existingMember, err := c.projectMemberWriteModelByID(ctx, member.AggregateID, member.UserID, resourceOwner)
 	if err != nil {

internal/command/user_human_externalidp.go

@@ -30,12 +30,18 @@ func (c *Commands) BulkAddedHumanExternalIDP(ctx context.Context, userID, resour
 	return err
 }
 
-func (c *Commands) addHumanExternalIDP(ctx context.Context, aggregate *eventstore.Aggregate, externalIDP *domain.ExternalIDP) (eventstore.EventPusher, error) {
+func (c *Commands) addHumanExternalIDP(ctx context.Context, humanAgg *eventstore.Aggregate, externalIDP *domain.ExternalIDP) (eventstore.EventPusher, error) {
 	if !externalIDP.IsValid() {
 		return nil, caos_errs.ThrowPreconditionFailed(nil, "COMMAND-6m9Kd", "Errors.User.ExternalIDP.Invalid")
 	}
-	//TODO: check if idpconfig exists
+	_, err := c.getOrgIDPConfigByID(ctx, externalIDP.IDPConfigID, humanAgg.ResourceOwner)
-	return user.NewHumanExternalIDPAddedEvent(ctx, aggregate, externalIDP.IDPConfigID, externalIDP.DisplayName, externalIDP.ExternalUserID), nil
+	if caos_errs.IsNotFound(err) {
+		_, err = c.getIAMIDPConfigByID(ctx, externalIDP.IDPConfigID)
+	}
+	if err != nil {
+		return nil, err
+	}
+	return user.NewHumanExternalIDPAddedEvent(ctx, humanAgg, externalIDP.IDPConfigID, externalIDP.DisplayName, externalIDP.ExternalUserID), nil
 }
 
 func (c *Commands) RemoveHumanExternalIDP(ctx context.Context, externalIDP *domain.ExternalIDP) error {

internal/command/user_human_phone.go

@@ -21,7 +21,7 @@ func (c *Commands) ChangeHumanPhone(ctx context.Context, phone *domain.Phone) (*
 	if err != nil {
 		return nil, err
 	}
-	if existingPhone.State == domain.PhoneStateUnspecified || existingPhone.State == domain.PhoneStateRemoved {
+	if !existingPhone.State.Exists() {
 		return nil, caos_errs.ThrowNotFound(nil, "COMMAND-aM9cs", "Errors.User.Phone.NotFound")
 	}
 
@@ -66,7 +66,7 @@ func (c *Commands) VerifyHumanPhone(ctx context.Context, userID, code, resourceo
 	if err != nil {
 		return err
 	}
-	if existingCode.Code == nil || existingCode.State == domain.PhoneStateUnspecified || existingCode.State == domain.PhoneStateRemoved {
+	if !existingCode.State.Exists() {
 		return caos_errs.ThrowNotFound(nil, "COMMAND-Rsj8c", "Errors.User.Code.NotFound")
 	}
 
@@ -92,8 +92,7 @@ func (c *Commands) CreateHumanPhoneVerificationCode(ctx context.Context, userID,
 		return err
 	}
 
-	//TODO: code like the following if is written many times find way to simplify
+	if !existingPhone.State.Exists() {
-	if existingPhone.State == domain.PhoneStateUnspecified || existingPhone.State == domain.PhoneStateRemoved {
 		return caos_errs.ThrowNotFound(nil, "COMMAND-2b7Hf", "Errors.User.Phone.NotFound")
 	}
 	if existingPhone.IsPhoneVerified {
@@ -115,7 +114,7 @@ func (c *Commands) HumanPhoneVerificationCodeSent(ctx context.Context, orgID, us
 	if err != nil {
 		return err
 	}
-	if existingPhone.State == domain.PhoneStateUnspecified || existingPhone.State == domain.PhoneStateRemoved {
+	if !existingPhone.State.Exists() {
 		return caos_errs.ThrowNotFound(nil, "COMMAND-66n8J", "Errors.User.Phone.NotFound")
 	}
 
@@ -133,7 +132,7 @@ func (c *Commands) RemoveHumanPhone(ctx context.Context, userID, resourceOwner s
 	if err != nil {
 		return err
 	}
-	if existingPhone.State == domain.PhoneStateUnspecified || existingPhone.State == domain.PhoneStateRemoved {
+	if !existingPhone.State.Exists() {
 		return caos_errs.ThrowNotFound(nil, "COMMAND-p6rsc", "Errors.User.Phone.NotFound")
 	}
 

internal/command/user_human_webauthn.go

@@ -2,6 +2,7 @@ package command
 
 import (
 	"context"
+	"github.com/caos/logging"
 	"github.com/caos/zitadel/internal/eventstore"
 
 	"github.com/caos/zitadel/internal/domain"
@@ -165,7 +166,7 @@ func (c *Commands) HumanVerifyU2FSetup(ctx context.Context, userID, resourceowne
 		usr_repo.NewHumanU2FVerifiedEvent(
 			ctx,
 			userAgg,
-			verifyWebAuthN.WebauthNTokenID, //TODO: webAuthN andverifyWebAuthN same TokenID?
+			verifyWebAuthN.WebauthNTokenID,
 			webAuthN.WebAuthNTokenName,
 			webAuthN.AttestationType,
 			webAuthN.KeyID,
@@ -191,7 +192,7 @@ func (c *Commands) HumanHumanPasswordlessSetup(ctx context.Context, userID, reso
 		usr_repo.NewHumanPasswordlessVerifiedEvent(
 			ctx,
 			userAgg,
-			verifyWebAuthN.WebauthNTokenID, //TODO: webAuthN andverifyWebAuthN same TokenID?
+			verifyWebAuthN.WebauthNTokenID,
 			webAuthN.WebAuthNTokenName,
 			webAuthN.AttestationType,
 			webAuthN.KeyID,
@@ -305,10 +306,23 @@ func (c *Commands) HumanFinishU2FLogin(ctx context.Context, userID, resourceOwne
 
 	userAgg, token, signCount, err := c.finishWebAuthNLogin(ctx, userID, resourceOwner, credentialData, webAuthNLogin, u2fTokens, isLoginUI)
 	if err != nil {
+		_, pushErr := c.eventstore.PushEvents(ctx,
+			usr_repo.NewHumanU2FCheckFailedEvent(
+				ctx,
+				userAgg,
+				authRequestDomainToAuthRequestInfo(authRequest),
+			),
+		)
+		logging.Log("EVENT-33M9f").OnError(pushErr).WithField("userID", userID).Warn("could not push failed passwordless check event")
 		return err
 	}
 
 	_, err = c.eventstore.PushEvents(ctx,
+		usr_repo.NewHumanU2FCheckSucceededEvent(
+			ctx,
+			userAgg,
+			authRequestDomainToAuthRequestInfo(authRequest),
+		),
 		usr_repo.NewHumanU2FSignCountChangedEvent(
 			ctx,
 			userAgg,
@@ -333,10 +347,23 @@ func (c *Commands) HumanFinishPasswordlessLogin(ctx context.Context, userID, res
 
 	userAgg, token, signCount, err := c.finishWebAuthNLogin(ctx, userID, resourceOwner, credentialData, webAuthNLogin, passwordlessTokens, isLoginUI)
 	if err != nil {
+		_, pushErr := c.eventstore.PushEvents(ctx,
+			usr_repo.NewHumanPasswordlessCheckFailedEvent(
+				ctx,
+				userAgg,
+				authRequestDomainToAuthRequestInfo(authRequest),
+			),
+		)
+		logging.Log("EVENT-33M9f").OnError(pushErr).WithField("userID", userID).Warn("could not push failed passwordless check event")
 		return err
 	}
 
 	_, err = c.eventstore.PushEvents(ctx,
+		usr_repo.NewHumanU2FCheckSucceededEvent(
+			ctx,
+			userAgg,
+			authRequestDomainToAuthRequestInfo(authRequest),
+		),
 		usr_repo.NewHumanPasswordlessSignCountChangedEvent(
 			ctx,
 			userAgg,

internal/command/user_machine.go

@@ -24,7 +24,6 @@ func (c *Commands) AddMachine(ctx context.Context, orgID string, machine *domain
 	if err != nil {
 		return nil, err
 	}
-	//TODO: adlerhurst are no machines allowed in global org? or what if I create an org which allowes all suffixes?
 	if !orgIAMPolicy.UserLoginMustBeDomain {
 		return nil, caos_errs.ThrowInvalidArgument(nil, "COMMAND-6M0ds", "Errors.User.Invalid")
 	}

internal/domain/human_phone.go

@@ -64,3 +64,7 @@ const (
 func (s PhoneState) Valid() bool {
 	return s >= 0 && s < phoneStateCount
 }
+
+func (s PhoneState) Exists() bool {
+	return s == PhoneStateActive
+}

internal/domain/human_web_auth_n.go

@@ -29,8 +29,6 @@ type WebAuthNLogin struct {
 	Challenge               string
 	AllowedCredentialIDs    [][]byte
 	UserVerification        UserVerificationRequirement
-	//TODO: Add Auth Request
-	//*model.AuthRequest
 }
 
 type UserVerificationRequirement int32

internal/domain/idp_config.go

@@ -73,8 +73,12 @@ const (
 	idpConfigStateCount
 )
 
-func (f IDPConfigState) Valid() bool {
+func (s IDPConfigState) Valid() bool {
-	return f >= 0 && f < idpConfigStateCount
+	return s >= 0 && s < idpConfigStateCount
+}
+
+func (s IDPConfigState) Exists() bool {
+	return s != IDPConfigStateUnspecified || s == IDPConfigStateRemoved
 }
 
 type IDPConfigStylingType int32

internal/domain/mfa.go

@@ -1,5 +1,7 @@
 package domain
 
+import "github.com/caos/zitadel/internal/crypto"
+
 type MFAState int32
 
 const (
@@ -14,3 +16,12 @@ const (
 func (f MFAState) Valid() bool {
 	return f >= 0 && f < stateCount
 }
+
+type MultifactorConfigs struct {
+	OTP OTPConfig
+}
+
+type OTPConfig struct {
+	Issuer    string
+	CryptoMFA crypto.EncryptionAlgorithm
+}

internal/domain/roles.go

@@ -1,9 +1,37 @@
 package domain
 
+import (
+	"github.com/caos/zitadel/internal/api/authz"
+	"strings"
+)
+
 const (
+	IAMRolePrefix          = "IAM"
+	OrgRolePrefix          = "ORG"
+	ProjectRolePrefix      = "PROJECT"
+	ProjectGrantRolePrefix = "PROJECT_GRANT"
 	RoleOrgOwner           = "ORG_OWNER"
 	RoleOrgProjectCreator  = "ORG_PROJECT_CREATOR"
 	RoleIAMOwner           = "IAM_OWNER"
 	RoleProjectOwner       = "PROJECT_OWNER"
 	RoleProjectOwnerGlobal = "PROJECT_OWNER_GLOBAL"
 )
+
+func CheckForInvalidRoles(roles []string, rolePrefix string, validRoles []authz.RoleMapping) []string {
+	invalidRoles := make([]string, 0)
+	for _, role := range roles {
+		if !containsRole(role, rolePrefix, validRoles) {
+			invalidRoles = append(invalidRoles, role)
+		}
+	}
+	return invalidRoles
+}
+
+func containsRole(role, rolePrefix string, validRoles []authz.RoleMapping) bool {
+	for _, validRole := range validRoles {
+		if role == validRole.Role && strings.HasPrefix(role, rolePrefix) {
+			return true
+		}
+	}
+	return false
+}

internal/domain/search_method.go

@@ -1,4 +1,4 @@
-package model
+package domain
 
 type SearchMethod int32
 

internal/iam/model/iam_member_view.go

@@ -1,9 +1,8 @@
 package model
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	"time"
-
-	"github.com/caos/zitadel/internal/model"
 )
 
 type IAMMemberView struct {
@@ -42,7 +41,7 @@ const (
 
 type IAMMemberSearchQuery struct {
 	Key    IAMMemberSearchKey
-	Method model.SearchMethod
+	Method domain.SearchMethod
 	Value  interface{}
 }
 

internal/iam/model/idp_config_view.go

@@ -2,7 +2,7 @@ package model
 
 import (
 	"github.com/caos/zitadel/internal/crypto"
-	"github.com/caos/zitadel/internal/model"
+	"github.com/caos/zitadel/internal/domain"
 	"time"
 )
 
@@ -46,7 +46,7 @@ const (
 
 type IDPConfigSearchQuery struct {
 	Key    IDPConfigSearchKey
-	Method model.SearchMethod
+	Method domain.SearchMethod
 	Value  interface{}
 }
 
@@ -66,5 +66,5 @@ func (r *IDPConfigSearchRequest) EnsureLimit(limit uint64) {
 }
 
 func (r *IDPConfigSearchRequest) AppendMyOrgQuery(orgID, iamID string) {
-	r.Queries = append(r.Queries, &IDPConfigSearchQuery{Key: IDPConfigSearchKeyAggregateID, Method: model.SearchMethodIsOneOf, Value: []string{orgID, iamID}})
+	r.Queries = append(r.Queries, &IDPConfigSearchQuery{Key: IDPConfigSearchKeyAggregateID, Method: domain.SearchMethodIsOneOf, Value: []string{orgID, iamID}})
 }

internal/iam/model/idp_provider_view.go

@@ -2,7 +2,6 @@ package model
 
 import (
 	"github.com/caos/zitadel/internal/domain"
-	"github.com/caos/zitadel/internal/model"
 	"time"
 )
 
@@ -39,7 +38,7 @@ const (
 
 type IDPProviderSearchQuery struct {
 	Key    IDPProviderSearchKey
-	Method model.SearchMethod
+	Method domain.SearchMethod
 	Value  interface{}
 }
 
@@ -59,7 +58,7 @@ func (r *IDPProviderSearchRequest) EnsureLimit(limit uint64) {
 }
 
 func (r *IDPProviderSearchRequest) AppendAggregateIDQuery(aggregateID string) {
-	r.Queries = append(r.Queries, &IDPProviderSearchQuery{Key: IDPProviderSearchKeyAggregateID, Method: model.SearchMethodEquals, Value: aggregateID})
+	r.Queries = append(r.Queries, &IDPProviderSearchQuery{Key: IDPProviderSearchKeyAggregateID, Method: domain.SearchMethodEquals, Value: aggregateID})
 }
 
 func IdpProviderViewsToDomain(idpProviders []*IDPProviderView) []*domain.IDPProvider {

internal/iam/model/label_policy_view.go

@@ -1,9 +1,8 @@
 package model
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	"time"
-
-	"github.com/caos/zitadel/internal/model"
 )
 
 type LabelPolicyView struct {
@@ -34,7 +33,7 @@ const (
 
 type LabelPolicySearchQuery struct {
 	Key    LabelPolicySearchKey
-	Method model.SearchMethod
+	Method domain.SearchMethod
 	Value  interface{}
 }
 

internal/iam/model/login_policy_view.go

@@ -3,7 +3,6 @@ package model
 import (
 	"github.com/caos/zitadel/internal/domain"
 	"github.com/caos/zitadel/internal/eventstore/v1/models"
-	"github.com/caos/zitadel/internal/model"
 	"time"
 )
 
@@ -41,7 +40,7 @@ const (
 
 type LoginPolicySearchQuery struct {
 	Key    LoginPolicySearchKey
-	Method model.SearchMethod
+	Method domain.SearchMethod
 	Value  interface{}
 }
 

internal/iam/model/mail_template_view.go

@@ -1,9 +1,8 @@
 package model
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	"time"
-
-	"github.com/caos/zitadel/internal/model"
 )
 
 type MailTemplateView struct {
@@ -33,7 +32,7 @@ const (
 
 type MailTemplateSearchQuery struct {
 	Key    MailTemplateSearchKey
-	Method model.SearchMethod
+	Method domain.SearchMethod
 	Value  interface{}
 }
 

internal/iam/model/mail_text_view.go

@@ -1,9 +1,8 @@
 package model
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	"time"
-
-	"github.com/caos/zitadel/internal/model"
 )
 
 type MailTextsView struct {
@@ -46,7 +45,7 @@ const (
 
 type MailTextSearchQuery struct {
 	Key    MailTextSearchKey
-	Method model.SearchMethod
+	Method domain.SearchMethod
 	Value  interface{}
 }
 

internal/iam/model/mfa_view.go

@@ -1,7 +1,7 @@
 package model
 
 import (
-	"github.com/caos/zitadel/internal/model"
+	"github.com/caos/zitadel/internal/domain"
 )
 
 type SecondFactorsSearchRequest struct {
@@ -17,7 +17,7 @@ type MultiFactorsSearchRequest struct {
 
 type MFASearchQuery struct {
 	Key    MFASearchKey
-	Method model.SearchMethod
+	Method domain.SearchMethod
 	Value  interface{}
 }
 
@@ -39,9 +39,9 @@ type MultiFactorsSearchResponse struct {
 }
 
 func (r *SecondFactorsSearchRequest) AppendAggregateIDQuery(aggregateID string) {
-	r.Queries = append(r.Queries, &MFASearchQuery{Key: MFASearchKeyAggregateID, Method: model.SearchMethodEquals, Value: aggregateID})
+	r.Queries = append(r.Queries, &MFASearchQuery{Key: MFASearchKeyAggregateID, Method: domain.SearchMethodEquals, Value: aggregateID})
 }
 
 func (r *MultiFactorsSearchRequest) AppendAggregateIDQuery(aggregateID string) {
-	r.Queries = append(r.Queries, &MFASearchQuery{Key: MFASearchKeyAggregateID, Method: model.SearchMethodEquals, Value: aggregateID})
+	r.Queries = append(r.Queries, &MFASearchQuery{Key: MFASearchKeyAggregateID, Method: domain.SearchMethodEquals, Value: aggregateID})
 }

internal/iam/model/org_iam_policy_view.go

@@ -1,7 +1,7 @@
 package model
 
 import (
-	"github.com/caos/zitadel/internal/model"
+	"github.com/caos/zitadel/internal/domain"
 	"time"
 )
 
@@ -33,7 +33,7 @@ const (
 
 type OrgIAMPolicySearchQuery struct {
 	Key    OrgIAMPolicySearchKey
-	Method model.SearchMethod
+	Method domain.SearchMethod
 	Value  interface{}
 }
 

internal/iam/model/password_age_policy_view.go

@@ -1,7 +1,7 @@
 package model
 
 import (
-	"github.com/caos/zitadel/internal/model"
+	"github.com/caos/zitadel/internal/domain"
 	"time"
 )
 
@@ -33,7 +33,7 @@ const (
 
 type PasswordAgePolicySearchQuery struct {
 	Key    PasswordAgePolicySearchKey
-	Method model.SearchMethod
+	Method domain.SearchMethod
 	Value  interface{}
 }
 

internal/iam/model/password_complexity_policy_view.go

@@ -1,8 +1,8 @@
 package model
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	caos_errs "github.com/caos/zitadel/internal/errors"
-	"github.com/caos/zitadel/internal/model"
 	"time"
 )
 
@@ -37,7 +37,7 @@ const (
 
 type PasswordComplexityPolicySearchQuery struct {
 	Key    PasswordComplexityPolicySearchKey
-	Method model.SearchMethod
+	Method domain.SearchMethod
 	Value  interface{}
 }
 

internal/iam/model/password_lockout_policy_view.go

@@ -1,7 +1,7 @@
 package model
 
 import (
-	"github.com/caos/zitadel/internal/model"
+	"github.com/caos/zitadel/internal/domain"
 	"time"
 )
 
@@ -33,7 +33,7 @@ const (
 
 type PasswordLockoutPolicySearchQuery struct {
 	Key    PasswordLockoutPolicySearchKey
-	Method model.SearchMethod
+	Method domain.SearchMethod
 	Value  interface{}
 }
 

internal/iam/repository/view/iam_member_view.go

@@ -1,10 +1,10 @@
 package view
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	caos_errs "github.com/caos/zitadel/internal/errors"
 	iam_model "github.com/caos/zitadel/internal/iam/model"
 	"github.com/caos/zitadel/internal/iam/repository/view/model"
-	global_model "github.com/caos/zitadel/internal/model"
 	"github.com/caos/zitadel/internal/view/repository"
 	"github.com/jinzhu/gorm"
 )
@@ -12,8 +12,8 @@ import (
 func IAMMemberByIDs(db *gorm.DB, table, orgID, userID string) (*model.IAMMemberView, error) {
 	member := new(model.IAMMemberView)
 
-	iamIDQuery := &model.IAMMemberSearchQuery{Key: iam_model.IAMMemberSearchKeyIamID, Value: orgID, Method: global_model.SearchMethodEquals}
+	iamIDQuery := &model.IAMMemberSearchQuery{Key: iam_model.IAMMemberSearchKeyIamID, Value: orgID, Method: domain.SearchMethodEquals}
-	userIDQuery := &model.IAMMemberSearchQuery{Key: iam_model.IAMMemberSearchKeyUserID, Value: userID, Method: global_model.SearchMethodEquals}
+	userIDQuery := &model.IAMMemberSearchQuery{Key: iam_model.IAMMemberSearchKeyUserID, Value: userID, Method: domain.SearchMethodEquals}
 	query := repository.PrepareGetByQuery(table, iamIDQuery, userIDQuery)
 	err := query(db, member)
 	if caos_errs.IsNotFound(err) {
@@ -37,7 +37,7 @@ func IAMMembersByUserID(db *gorm.DB, table string, userID string) ([]*model.IAMM
 		{
 			Key:    iam_model.IAMMemberSearchKeyUserID,
 			Value:  userID,
-			Method: global_model.SearchMethodEquals,
+			Method: domain.SearchMethodEquals,
 		},
 	}
 	query := repository.PrepareSearchQuery(table, model.IAMMemberSearchRequest{Queries: queries})

internal/iam/repository/view/idp_provider_view.go

@@ -1,18 +1,18 @@
 package view
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	caos_errs "github.com/caos/zitadel/internal/errors"
 	iam_model "github.com/caos/zitadel/internal/iam/model"
 	"github.com/caos/zitadel/internal/iam/repository/view/model"
-	global_model "github.com/caos/zitadel/internal/model"
 	"github.com/caos/zitadel/internal/view/repository"
 	"github.com/jinzhu/gorm"
 )
 
 func GetIDPProviderByAggregateIDAndConfigID(db *gorm.DB, table, aggregateID, idpConfigID string) (*model.IDPProviderView, error) {
 	policy := new(model.IDPProviderView)
-	aggIDQuery := &model.IDPProviderSearchQuery{Key: iam_model.IDPProviderSearchKeyAggregateID, Value: aggregateID, Method: global_model.SearchMethodEquals}
+	aggIDQuery := &model.IDPProviderSearchQuery{Key: iam_model.IDPProviderSearchKeyAggregateID, Value: aggregateID, Method: domain.SearchMethodEquals}
-	idpConfigIDQuery := &model.IDPProviderSearchQuery{Key: iam_model.IDPProviderSearchKeyIdpConfigID, Value: idpConfigID, Method: global_model.SearchMethodEquals}
+	idpConfigIDQuery := &model.IDPProviderSearchQuery{Key: iam_model.IDPProviderSearchKeyIdpConfigID, Value: idpConfigID, Method: domain.SearchMethodEquals}
 	query := repository.PrepareGetByQuery(table, aggIDQuery, idpConfigIDQuery)
 	err := query(db, policy)
 	if caos_errs.IsNotFound(err) {
@@ -27,7 +27,7 @@ func IDPProvidersByIdpConfigID(db *gorm.DB, table string, idpConfigID string) ([
 		{
 			Key:    iam_model.IDPProviderSearchKeyIdpConfigID,
 			Value:  idpConfigID,
-			Method: global_model.SearchMethodEquals,
+			Method: domain.SearchMethodEquals,
 		},
 	}
 	query := repository.PrepareSearchQuery(table, model.IDPProviderSearchRequest{Queries: queries})
@@ -44,12 +44,12 @@ func IDPProvidersByAggregateIDAndState(db *gorm.DB, table string, aggregateID st
 		{
 			Key:    iam_model.IDPProviderSearchKeyAggregateID,
 			Value:  aggregateID,
-			Method: global_model.SearchMethodEquals,
+			Method: domain.SearchMethodEquals,
 		},
 		{
 			Key:    iam_model.IDPProviderSearchKeyState,
 			Value:  int(idpConfigState),
-			Method: global_model.SearchMethodEquals,
+			Method: domain.SearchMethodEquals,
 		},
 	}
 	query := repository.PrepareSearchQuery(table, model.IDPProviderSearchRequest{Queries: queries})

internal/iam/repository/view/idp_view.go

@@ -1,17 +1,17 @@
 package view
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	caos_errs "github.com/caos/zitadel/internal/errors"
 	iam_model "github.com/caos/zitadel/internal/iam/model"
 	"github.com/caos/zitadel/internal/iam/repository/view/model"
-	global_model "github.com/caos/zitadel/internal/model"
 	"github.com/caos/zitadel/internal/view/repository"
 	"github.com/jinzhu/gorm"
 )
 
 func IDPByID(db *gorm.DB, table, idpID string) (*model.IDPConfigView, error) {
 	idp := new(model.IDPConfigView)
-	idpIDQuery := &model.IDPConfigSearchQuery{Key: iam_model.IDPConfigSearchKeyIdpConfigID, Value: idpID, Method: global_model.SearchMethodEquals}
+	idpIDQuery := &model.IDPConfigSearchQuery{Key: iam_model.IDPConfigSearchKeyIdpConfigID, Value: idpID, Method: domain.SearchMethodEquals}
 	query := repository.PrepareGetByQuery(table, idpIDQuery)
 	err := query(db, idp)
 	if caos_errs.IsNotFound(err) {
@@ -26,7 +26,7 @@ func GetIDPConfigsByAggregateID(db *gorm.DB, table string, aggregateID string) (
 		{
 			Key:    iam_model.IDPConfigSearchKeyAggregateID,
 			Value:  aggregateID,
-			Method: global_model.SearchMethodEquals,
+			Method: domain.SearchMethodEquals,
 		},
 	}
 	query := repository.PrepareSearchQuery(table, model.IDPConfigSearchRequest{Queries: queries})

internal/iam/repository/view/label_policy_view.go

@@ -1,17 +1,17 @@
 package view
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	caos_errs "github.com/caos/zitadel/internal/errors"
 	iam_model "github.com/caos/zitadel/internal/iam/model"
 	"github.com/caos/zitadel/internal/iam/repository/view/model"
-	global_model "github.com/caos/zitadel/internal/model"
 	"github.com/caos/zitadel/internal/view/repository"
 	"github.com/jinzhu/gorm"
 )
 
 func GetLabelPolicyByAggregateID(db *gorm.DB, table, aggregateID string) (*model.LabelPolicyView, error) {
 	policy := new(model.LabelPolicyView)
-	aggregateIDQuery := &model.LabelPolicySearchQuery{Key: iam_model.LabelPolicySearchKeyAggregateID, Value: aggregateID, Method: global_model.SearchMethodEquals}
+	aggregateIDQuery := &model.LabelPolicySearchQuery{Key: iam_model.LabelPolicySearchKeyAggregateID, Value: aggregateID, Method: domain.SearchMethodEquals}
 	query := repository.PrepareGetByQuery(table, aggregateIDQuery)
 	err := query(db, policy)
 	if caos_errs.IsNotFound(err) {

internal/iam/repository/view/login_policy_view.go

@@ -1,10 +1,10 @@
 package view
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	caos_errs "github.com/caos/zitadel/internal/errors"
 	iam_model "github.com/caos/zitadel/internal/iam/model"
 	"github.com/caos/zitadel/internal/iam/repository/view/model"
-	global_model "github.com/caos/zitadel/internal/model"
 	"github.com/caos/zitadel/internal/view/repository"
 	"github.com/jinzhu/gorm"
 )
@@ -12,7 +12,7 @@ import (
 func GetDefaultLoginPolicies(db *gorm.DB, table string) ([]*model.LoginPolicyView, error) {
 	loginPolicies := make([]*model.LoginPolicyView, 0)
 	queries := []*iam_model.LoginPolicySearchQuery{
-		{Key: iam_model.LoginPolicySearchKeyDefault, Value: true, Method: global_model.SearchMethodEquals},
+		{Key: iam_model.LoginPolicySearchKeyDefault, Value: true, Method: domain.SearchMethodEquals},
 	}
 	query := repository.PrepareSearchQuery(table, model.LoginPolicySearchRequest{Queries: queries})
 	_, err := query(db, &loginPolicies)
@@ -24,7 +24,7 @@ func GetDefaultLoginPolicies(db *gorm.DB, table string) ([]*model.LoginPolicyVie
 
 func GetLoginPolicyByAggregateID(db *gorm.DB, table, aggregateID string) (*model.LoginPolicyView, error) {
 	policy := new(model.LoginPolicyView)
-	aggregateIDQuery := &model.LoginPolicySearchQuery{Key: iam_model.LoginPolicySearchKeyAggregateID, Value: aggregateID, Method: global_model.SearchMethodEquals}
+	aggregateIDQuery := &model.LoginPolicySearchQuery{Key: iam_model.LoginPolicySearchKeyAggregateID, Value: aggregateID, Method: domain.SearchMethodEquals}
 	query := repository.PrepareGetByQuery(table, aggregateIDQuery)
 	err := query(db, policy)
 	if caos_errs.IsNotFound(err) {

internal/iam/repository/view/mail_template_view.go

@@ -1,17 +1,17 @@
 package view
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	caos_errs "github.com/caos/zitadel/internal/errors"
 	iam_model "github.com/caos/zitadel/internal/iam/model"
 	"github.com/caos/zitadel/internal/iam/repository/view/model"
-	global_model "github.com/caos/zitadel/internal/model"
 	"github.com/caos/zitadel/internal/view/repository"
 	"github.com/jinzhu/gorm"
 )
 
 func GetMailTemplateByAggregateID(db *gorm.DB, table, aggregateID string) (*model.MailTemplateView, error) {
 	template := new(model.MailTemplateView)
-	aggregateIDQuery := &model.MailTemplateSearchQuery{Key: iam_model.MailTemplateSearchKeyAggregateID, Value: aggregateID, Method: global_model.SearchMethodEquals}
+	aggregateIDQuery := &model.MailTemplateSearchQuery{Key: iam_model.MailTemplateSearchKeyAggregateID, Value: aggregateID, Method: domain.SearchMethodEquals}
 	query := repository.PrepareGetByQuery(table, aggregateIDQuery)
 	err := query(db, template)
 	if caos_errs.IsNotFound(err) {

internal/iam/repository/view/mail_text_view.go

@@ -1,10 +1,10 @@
 package view
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	caos_errs "github.com/caos/zitadel/internal/errors"
 	iam_model "github.com/caos/zitadel/internal/iam/model"
 	"github.com/caos/zitadel/internal/iam/repository/view/model"
-	global_model "github.com/caos/zitadel/internal/model"
 	"github.com/caos/zitadel/internal/view/repository"
 	"github.com/jinzhu/gorm"
 	"strings"
@@ -16,7 +16,7 @@ func GetMailTexts(db *gorm.DB, table string, aggregateID string) ([]*model.MailT
 		{
 			Key:    iam_model.MailTextSearchKeyAggregateID,
 			Value:  aggregateID,
-			Method: global_model.SearchMethodEquals,
+			Method: domain.SearchMethodEquals,
 		},
 	}
 	query := repository.PrepareSearchQuery(table, model.MailTextSearchRequest{Queries: queries})
@@ -29,9 +29,9 @@ func GetMailTexts(db *gorm.DB, table string, aggregateID string) ([]*model.MailT
 
 func GetMailTextByIDs(db *gorm.DB, table, aggregateID string, textType string, language string) (*model.MailTextView, error) {
 	mailText := new(model.MailTextView)
-	aggregateIDQuery := &model.MailTextSearchQuery{Key: iam_model.MailTextSearchKeyAggregateID, Value: aggregateID, Method: global_model.SearchMethodEquals}
+	aggregateIDQuery := &model.MailTextSearchQuery{Key: iam_model.MailTextSearchKeyAggregateID, Value: aggregateID, Method: domain.SearchMethodEquals}
-	textTypeQuery := &model.MailTextSearchQuery{Key: iam_model.MailTextSearchKeyMailTextType, Value: textType, Method: global_model.SearchMethodEquals}
+	textTypeQuery := &model.MailTextSearchQuery{Key: iam_model.MailTextSearchKeyMailTextType, Value: textType, Method: domain.SearchMethodEquals}
-	languageQuery := &model.MailTextSearchQuery{Key: iam_model.MailTextSearchKeyLanguage, Value: strings.ToUpper(language), Method: global_model.SearchMethodEquals}
+	languageQuery := &model.MailTextSearchQuery{Key: iam_model.MailTextSearchKeyLanguage, Value: strings.ToUpper(language), Method: domain.SearchMethodEquals}
 	query := repository.PrepareGetByQuery(table, aggregateIDQuery, textTypeQuery, languageQuery)
 	err := query(db, mailText)
 	if caos_errs.IsNotFound(err) {

internal/iam/repository/view/model/iam_member_query.go

@@ -1,8 +1,8 @@
 package model
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	iam_model "github.com/caos/zitadel/internal/iam/model"
-	global_model "github.com/caos/zitadel/internal/model"
 	"github.com/caos/zitadel/internal/view/repository"
 )
 
@@ -41,7 +41,7 @@ func (req IAMMemberSearchQuery) GetKey() repository.ColumnKey {
 	return IAMMemberSearchKey(req.Key)
 }
 
-func (req IAMMemberSearchQuery) GetMethod() global_model.SearchMethod {
+func (req IAMMemberSearchQuery) GetMethod() domain.SearchMethod {
 	return req.Method
 }
 

internal/iam/repository/view/model/idp_config_query.go

@@ -1,8 +1,8 @@
 package model
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	iam_model "github.com/caos/zitadel/internal/iam/model"
-	global_model "github.com/caos/zitadel/internal/model"
 	"github.com/caos/zitadel/internal/view/repository"
 )
 
@@ -41,7 +41,7 @@ func (req IDPConfigSearchQuery) GetKey() repository.ColumnKey {
 	return IDPConfigSearchKey(req.Key)
 }
 
-func (req IDPConfigSearchQuery) GetMethod() global_model.SearchMethod {
+func (req IDPConfigSearchQuery) GetMethod() domain.SearchMethod {
 	return req.Method
 }
 

internal/iam/repository/view/model/idp_provider_query.go

@@ -1,8 +1,8 @@
 package model
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	iam_model "github.com/caos/zitadel/internal/iam/model"
-	global_model "github.com/caos/zitadel/internal/model"
 	"github.com/caos/zitadel/internal/view/repository"
 )
 
@@ -41,7 +41,7 @@ func (req IDPProviderSearchQuery) GetKey() repository.ColumnKey {
 	return IDPProviderSearchKey(req.Key)
 }
 
-func (req IDPProviderSearchQuery) GetMethod() global_model.SearchMethod {
+func (req IDPProviderSearchQuery) GetMethod() domain.SearchMethod {
 	return req.Method
 }
 

internal/iam/repository/view/model/label_policy_query.go

@@ -1,8 +1,8 @@
 package model
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	iam_model "github.com/caos/zitadel/internal/iam/model"
-	global_model "github.com/caos/zitadel/internal/model"
 	"github.com/caos/zitadel/internal/view/repository"
 )
 
@@ -41,7 +41,7 @@ func (req LabelPolicySearchQuery) GetKey() repository.ColumnKey {
 	return LabelPolicySearchKey(req.Key)
 }
 
-func (req LabelPolicySearchQuery) GetMethod() global_model.SearchMethod {
+func (req LabelPolicySearchQuery) GetMethod() domain.SearchMethod {
 	return req.Method
 }
 

internal/iam/repository/view/model/login_policy_query.go

@@ -1,8 +1,8 @@
 package model
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	iam_model "github.com/caos/zitadel/internal/iam/model"
-	global_model "github.com/caos/zitadel/internal/model"
 	"github.com/caos/zitadel/internal/view/repository"
 )
 
@@ -41,7 +41,7 @@ func (req LoginPolicySearchQuery) GetKey() repository.ColumnKey {
 	return LoginPolicySearchKey(req.Key)
 }
 
-func (req LoginPolicySearchQuery) GetMethod() global_model.SearchMethod {
+func (req LoginPolicySearchQuery) GetMethod() domain.SearchMethod {
 	return req.Method
 }
 

internal/iam/repository/view/model/mail_template_query.go

@@ -1,8 +1,8 @@
 package model
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	iam_model "github.com/caos/zitadel/internal/iam/model"
-	global_model "github.com/caos/zitadel/internal/model"
 	"github.com/caos/zitadel/internal/view/repository"
 )
 
@@ -41,7 +41,7 @@ func (req MailTemplateSearchQuery) GetKey() repository.ColumnKey {
 	return MailTemplateSearchKey(req.Key)
 }
 
-func (req MailTemplateSearchQuery) GetMethod() global_model.SearchMethod {
+func (req MailTemplateSearchQuery) GetMethod() domain.SearchMethod {
 	return req.Method
 }
 

internal/iam/repository/view/model/mail_text_query.go

@@ -1,8 +1,8 @@
 package model
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	iam_model "github.com/caos/zitadel/internal/iam/model"
-	global_model "github.com/caos/zitadel/internal/model"
 	"github.com/caos/zitadel/internal/view/repository"
 )
 
@@ -41,7 +41,7 @@ func (req MailTextSearchQuery) GetKey() repository.ColumnKey {
 	return MailTextSearchKey(req.Key)
 }
 
-func (req MailTextSearchQuery) GetMethod() global_model.SearchMethod {
+func (req MailTextSearchQuery) GetMethod() domain.SearchMethod {
 	return req.Method
 }
 

internal/iam/repository/view/model/org_iam_policy_query.go

@@ -1,8 +1,8 @@
 package model
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	iam_model "github.com/caos/zitadel/internal/iam/model"
-	global_model "github.com/caos/zitadel/internal/model"
 	"github.com/caos/zitadel/internal/view/repository"
 )
 
@@ -41,7 +41,7 @@ func (req OrgIAMPolicySearchQuery) GetKey() repository.ColumnKey {
 	return OrgIAMPolicySearchKey(req.Key)
 }
 
-func (req OrgIAMPolicySearchQuery) GetMethod() global_model.SearchMethod {
+func (req OrgIAMPolicySearchQuery) GetMethod() domain.SearchMethod {
 	return req.Method
 }
 

internal/iam/repository/view/model/password_age_policy_query.go

@@ -1,8 +1,8 @@
 package model
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	iam_model "github.com/caos/zitadel/internal/iam/model"
-	global_model "github.com/caos/zitadel/internal/model"
 	"github.com/caos/zitadel/internal/view/repository"
 )
 
@@ -41,7 +41,7 @@ func (req PasswordAgePolicySearchQuery) GetKey() repository.ColumnKey {
 	return PasswordAgePolicySearchKey(req.Key)
 }
 
-func (req PasswordAgePolicySearchQuery) GetMethod() global_model.SearchMethod {
+func (req PasswordAgePolicySearchQuery) GetMethod() domain.SearchMethod {
 	return req.Method
 }
 

internal/iam/repository/view/model/password_complexity_policy_query.go

@@ -1,8 +1,8 @@
 package model
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	iam_model "github.com/caos/zitadel/internal/iam/model"
-	global_model "github.com/caos/zitadel/internal/model"
 	"github.com/caos/zitadel/internal/view/repository"
 )
 
@@ -41,7 +41,7 @@ func (req PasswordComplexityPolicySearchQuery) GetKey() repository.ColumnKey {
 	return PasswordComplexityPolicySearchKey(req.Key)
 }
 
-func (req PasswordComplexityPolicySearchQuery) GetMethod() global_model.SearchMethod {
+func (req PasswordComplexityPolicySearchQuery) GetMethod() domain.SearchMethod {
 	return req.Method
 }
 

internal/iam/repository/view/model/password_lockout_policy_query.go

@@ -1,8 +1,8 @@
 package model
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	iam_model "github.com/caos/zitadel/internal/iam/model"
-	global_model "github.com/caos/zitadel/internal/model"
 	"github.com/caos/zitadel/internal/view/repository"
 )
 
@@ -41,7 +41,7 @@ func (req PasswordLockoutPolicySearchQuery) GetKey() repository.ColumnKey {
 	return PasswordLockoutPolicySearchKey(req.Key)
 }
 
-func (req PasswordLockoutPolicySearchQuery) GetMethod() global_model.SearchMethod {
+func (req PasswordLockoutPolicySearchQuery) GetMethod() domain.SearchMethod {
 	return req.Method
 }
 

internal/iam/repository/view/org_iam_policy_view.go

@@ -1,17 +1,17 @@
 package view
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	caos_errs "github.com/caos/zitadel/internal/errors"
 	iam_model "github.com/caos/zitadel/internal/iam/model"
 	"github.com/caos/zitadel/internal/iam/repository/view/model"
-	global_model "github.com/caos/zitadel/internal/model"
 	"github.com/caos/zitadel/internal/view/repository"
 	"github.com/jinzhu/gorm"
 )
 
 func GetOrgIAMPolicyByAggregateID(db *gorm.DB, table, aggregateID string) (*model.OrgIAMPolicyView, error) {
 	policy := new(model.OrgIAMPolicyView)
-	aggregateIDQuery := &model.OrgIAMPolicySearchQuery{Key: iam_model.OrgIAMPolicySearchKeyAggregateID, Value: aggregateID, Method: global_model.SearchMethodEquals}
+	aggregateIDQuery := &model.OrgIAMPolicySearchQuery{Key: iam_model.OrgIAMPolicySearchKeyAggregateID, Value: aggregateID, Method: domain.SearchMethodEquals}
 	query := repository.PrepareGetByQuery(table, aggregateIDQuery)
 	err := query(db, policy)
 	if caos_errs.IsNotFound(err) {

internal/iam/repository/view/password_age_policy_view.go

@@ -1,17 +1,17 @@
 package view
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	caos_errs "github.com/caos/zitadel/internal/errors"
 	iam_model "github.com/caos/zitadel/internal/iam/model"
 	"github.com/caos/zitadel/internal/iam/repository/view/model"
-	global_model "github.com/caos/zitadel/internal/model"
 	"github.com/caos/zitadel/internal/view/repository"
 	"github.com/jinzhu/gorm"
 )
 
 func GetPasswordAgePolicyByAggregateID(db *gorm.DB, table, aggregateID string) (*model.PasswordAgePolicyView, error) {
 	policy := new(model.PasswordAgePolicyView)
-	aggregateIDQuery := &model.PasswordAgePolicySearchQuery{Key: iam_model.PasswordAgePolicySearchKeyAggregateID, Value: aggregateID, Method: global_model.SearchMethodEquals}
+	aggregateIDQuery := &model.PasswordAgePolicySearchQuery{Key: iam_model.PasswordAgePolicySearchKeyAggregateID, Value: aggregateID, Method: domain.SearchMethodEquals}
 	query := repository.PrepareGetByQuery(table, aggregateIDQuery)
 	err := query(db, policy)
 	if caos_errs.IsNotFound(err) {

internal/iam/repository/view/password_complexity_policy_view.go

@@ -1,17 +1,17 @@
 package view
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	caos_errs "github.com/caos/zitadel/internal/errors"
 	iam_model "github.com/caos/zitadel/internal/iam/model"
 	"github.com/caos/zitadel/internal/iam/repository/view/model"
-	global_model "github.com/caos/zitadel/internal/model"
 	"github.com/caos/zitadel/internal/view/repository"
 	"github.com/jinzhu/gorm"
 )
 
 func GetPasswordComplexityPolicyByAggregateID(db *gorm.DB, table, aggregateID string) (*model.PasswordComplexityPolicyView, error) {
 	policy := new(model.PasswordComplexityPolicyView)
-	aggregateIDQuery := &model.PasswordComplexityPolicySearchQuery{Key: iam_model.PasswordComplexityPolicySearchKeyAggregateID, Value: aggregateID, Method: global_model.SearchMethodEquals}
+	aggregateIDQuery := &model.PasswordComplexityPolicySearchQuery{Key: iam_model.PasswordComplexityPolicySearchKeyAggregateID, Value: aggregateID, Method: domain.SearchMethodEquals}
 	query := repository.PrepareGetByQuery(table, aggregateIDQuery)
 	err := query(db, policy)
 	if caos_errs.IsNotFound(err) {

internal/iam/repository/view/password_lockout_policy_view.go

@@ -1,17 +1,17 @@
 package view
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	caos_errs "github.com/caos/zitadel/internal/errors"
 	iam_model "github.com/caos/zitadel/internal/iam/model"
 	"github.com/caos/zitadel/internal/iam/repository/view/model"
-	global_model "github.com/caos/zitadel/internal/model"
 	"github.com/caos/zitadel/internal/view/repository"
 	"github.com/jinzhu/gorm"
 )
 
 func GetPasswordLockoutPolicyByAggregateID(db *gorm.DB, table, aggregateID string) (*model.PasswordLockoutPolicyView, error) {
 	policy := new(model.PasswordLockoutPolicyView)
-	aggregateIDQuery := &model.PasswordLockoutPolicySearchQuery{Key: iam_model.PasswordLockoutPolicySearchKeyAggregateID, Value: aggregateID, Method: global_model.SearchMethodEquals}
+	aggregateIDQuery := &model.PasswordLockoutPolicySearchQuery{Key: iam_model.PasswordLockoutPolicySearchKeyAggregateID, Value: aggregateID, Method: domain.SearchMethodEquals}
 	query := repository.PrepareGetByQuery(table, aggregateIDQuery)
 	err := query(db, policy)
 	if caos_errs.IsNotFound(err) {

internal/key/model/authn_key.go

@@ -1,10 +1,10 @@
 package model
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	"time"
 
 	"github.com/caos/zitadel/internal/eventstore/v1/models"
-	"github.com/caos/zitadel/internal/model"
 )
 
 const (
@@ -77,7 +77,7 @@ const (
 
 type AuthNKeySearchQuery struct {
 	Key    AuthNKeySearchKey
-	Method model.SearchMethod
+	Method domain.SearchMethod
 	Value  interface{}
 }
 

internal/key/model/key_view.go

@@ -1,11 +1,11 @@
 package model
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	"time"
 
 	"github.com/caos/zitadel/internal/crypto"
 	"github.com/caos/zitadel/internal/errors"
-	"github.com/caos/zitadel/internal/model"
 )
 
 type KeyView struct {
@@ -52,7 +52,7 @@ const (
 
 type KeySearchQuery struct {
 	Key    KeySearchKey
-	Method model.SearchMethod
+	Method domain.SearchMethod
 	Value  interface{}
 }
 

internal/key/repository/view/authn_key_view.go

@@ -1,10 +1,10 @@
 package view
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	caos_errs "github.com/caos/zitadel/internal/errors"
 	key_model "github.com/caos/zitadel/internal/key/model"
 	"github.com/caos/zitadel/internal/key/repository/view/model"
-	global_model "github.com/caos/zitadel/internal/model"
 	"github.com/caos/zitadel/internal/view/repository"
 	"github.com/jinzhu/gorm"
 )
@@ -12,8 +12,8 @@ import (
 func AuthNKeyByIDs(db *gorm.DB, table, objectID, keyID string) (*model.AuthNKeyView, error) {
 	key := new(model.AuthNKeyView)
 	query := repository.PrepareGetByQuery(table,
-		model.AuthNKeySearchQuery{Key: key_model.AuthNKeyObjectID, Method: global_model.SearchMethodEquals, Value: objectID},
+		model.AuthNKeySearchQuery{Key: key_model.AuthNKeyObjectID, Method: domain.SearchMethodEquals, Value: objectID},
-		model.AuthNKeySearchQuery{Key: key_model.AuthNKeyKeyID, Method: global_model.SearchMethodEquals, Value: keyID},
+		model.AuthNKeySearchQuery{Key: key_model.AuthNKeyKeyID, Method: domain.SearchMethodEquals, Value: keyID},
 	)
 	err := query(db, key)
 	if caos_errs.IsNotFound(err) {
@@ -38,7 +38,7 @@ func AuthNKeysByObjectID(db *gorm.DB, table string, objectID string) ([]*model.A
 		{
 			Key:    key_model.AuthNKeyObjectID,
 			Value:  objectID,
-			Method: global_model.SearchMethodEquals,
+			Method: domain.SearchMethodEquals,
 		},
 	}
 	query := repository.PrepareSearchQuery(table, model.AuthNKeySearchRequest{Queries: queries})
@@ -52,7 +52,7 @@ func AuthNKeysByObjectID(db *gorm.DB, table string, objectID string) ([]*model.A
 func AuthNKeyByID(db *gorm.DB, table string, keyID string) (*model.AuthNKeyView, error) {
 	key := new(model.AuthNKeyView)
 	query := repository.PrepareGetByQuery(table,
-		model.AuthNKeySearchQuery{Key: key_model.AuthNKeyKeyID, Method: global_model.SearchMethodEquals, Value: keyID},
+		model.AuthNKeySearchQuery{Key: key_model.AuthNKeyKeyID, Method: domain.SearchMethodEquals, Value: keyID},
 	)
 	err := query(db, key)
 	if caos_errs.IsNotFound(err) {

internal/key/repository/view/key.go

@@ -1,6 +1,7 @@
 package view
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	"time"
 
 	caos_errs "github.com/caos/zitadel/internal/errors"
@@ -10,14 +11,13 @@ import (
 
 	key_model "github.com/caos/zitadel/internal/key/model"
 	"github.com/caos/zitadel/internal/key/repository/view/model"
-	global_model "github.com/caos/zitadel/internal/model"
 )
 
 func KeyByIDAndType(db *gorm.DB, table, keyID string, private bool) (*model.KeyView, error) {
 	key := new(model.KeyView)
 	query := repository.PrepareGetByQuery(table,
-		model.KeySearchQuery{Key: key_model.KeySearchKeyID, Method: global_model.SearchMethodEquals, Value: keyID},
+		model.KeySearchQuery{Key: key_model.KeySearchKeyID, Method: domain.SearchMethodEquals, Value: keyID},
-		model.KeySearchQuery{Key: key_model.KeySearchKeyPrivate, Method: global_model.SearchMethodEquals, Value: private},
+		model.KeySearchQuery{Key: key_model.KeySearchKeyPrivate, Method: domain.SearchMethodEquals, Value: private},
 	)
 	err := query(db, key)
 	return key, err
@@ -31,9 +31,9 @@ func GetSigningKey(db *gorm.DB, table string, expiry time.Time) (*model.KeyView,
 	query := repository.PrepareSearchQuery(table,
 		model.KeySearchRequest{
 			Queries: []*key_model.KeySearchQuery{
-				{Key: key_model.KeySearchKeyPrivate, Method: global_model.SearchMethodEquals, Value: true},
+				{Key: key_model.KeySearchKeyPrivate, Method: domain.SearchMethodEquals, Value: true},
-				{Key: key_model.KeySearchKeyUsage, Method: global_model.SearchMethodEquals, Value: key_model.KeyUsageSigning},
+				{Key: key_model.KeySearchKeyUsage, Method: domain.SearchMethodEquals, Value: key_model.KeyUsageSigning},
-				{Key: key_model.KeySearchKeyExpiry, Method: global_model.SearchMethodGreaterThan, Value: time.Now().UTC()},
+				{Key: key_model.KeySearchKeyExpiry, Method: domain.SearchMethodGreaterThan, Value: time.Now().UTC()},
 			},
 			SortingColumn: key_model.KeySearchKeyExpiry,
 			Limit:         1,
@@ -54,9 +54,9 @@ func GetActivePublicKeys(db *gorm.DB, table string) ([]*model.KeyView, error) {
 	query := repository.PrepareSearchQuery(table,
 		model.KeySearchRequest{
 			Queries: []*key_model.KeySearchQuery{
-				{Key: key_model.KeySearchKeyPrivate, Method: global_model.SearchMethodEquals, Value: false},
+				{Key: key_model.KeySearchKeyPrivate, Method: domain.SearchMethodEquals, Value: false},
-				{Key: key_model.KeySearchKeyUsage, Method: global_model.SearchMethodEquals, Value: key_model.KeyUsageSigning},
+				{Key: key_model.KeySearchKeyUsage, Method: domain.SearchMethodEquals, Value: key_model.KeyUsageSigning},
-				{Key: key_model.KeySearchKeyExpiry, Method: global_model.SearchMethodGreaterThan, Value: time.Now().UTC()},
+				{Key: key_model.KeySearchKeyExpiry, Method: domain.SearchMethodGreaterThan, Value: time.Now().UTC()},
 			},
 		},
 	)

internal/key/repository/view/model/authn_key_query.go

@@ -1,8 +1,8 @@
 package model
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	key_model "github.com/caos/zitadel/internal/key/model"
-	global_model "github.com/caos/zitadel/internal/model"
 	"github.com/caos/zitadel/internal/view/repository"
 )
 
@@ -41,7 +41,7 @@ func (req AuthNKeySearchQuery) GetKey() repository.ColumnKey {
 	return AuthNKeySearchKey(req.Key)
 }
 
-func (req AuthNKeySearchQuery) GetMethod() global_model.SearchMethod {
+func (req AuthNKeySearchQuery) GetMethod() domain.SearchMethod {
 	return req.Method
 }
 

internal/key/repository/view/model/key_query.go

@@ -1,8 +1,8 @@
 package model
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	key_model "github.com/caos/zitadel/internal/key/model"
-	global_model "github.com/caos/zitadel/internal/model"
 	"github.com/caos/zitadel/internal/view/repository"
 )
 
@@ -41,7 +41,7 @@ func (req KeySearchQuery) GetKey() repository.ColumnKey {
 	return KeySearchKey(req.Key)
 }
 
-func (req KeySearchQuery) GetMethod() global_model.SearchMethod {
+func (req KeySearchQuery) GetMethod() domain.SearchMethod {
 	return req.Method
 }
 

internal/management/repository/eventsourcing/eventstore/org.go

@@ -21,7 +21,6 @@ import (
 	iam_es_model "github.com/caos/zitadel/internal/iam/repository/view/model"
 	iam_view_model "github.com/caos/zitadel/internal/iam/repository/view/model"
 	mgmt_view "github.com/caos/zitadel/internal/management/repository/eventsourcing/view"
-	global_model "github.com/caos/zitadel/internal/model"
 	org_model "github.com/caos/zitadel/internal/org/model"
 	org_es_model "github.com/caos/zitadel/internal/org/repository/eventsourcing/model"
 	"github.com/caos/zitadel/internal/org/repository/view/model"
@@ -74,7 +73,7 @@ func (repo *OrgRepository) GetMyOrgIamPolicy(ctx context.Context) (*iam_model.Or
 
 func (repo *OrgRepository) SearchMyOrgDomains(ctx context.Context, request *org_model.OrgDomainSearchRequest) (*org_model.OrgDomainSearchResponse, error) {
 	request.EnsureLimit(repo.SearchLimit)
-	request.Queries = append(request.Queries, &org_model.OrgDomainSearchQuery{Key: org_model.OrgDomainSearchKeyOrgID, Method: global_model.SearchMethodEquals, Value: authz.GetCtxData(ctx).OrgID})
+	request.Queries = append(request.Queries, &org_model.OrgDomainSearchQuery{Key: org_model.OrgDomainSearchKeyOrgID, Method: domain.SearchMethodEquals, Value: authz.GetCtxData(ctx).OrgID})
 	sequence, sequenceErr := repo.View.GetLatestOrgDomainSequence()
 	logging.Log("EVENT-SLowp").OnError(sequenceErr).WithField("traceID", tracing.TraceIDFromCtx(ctx)).Warn("could not read latest org domain sequence")
 	domains, count, err := repo.View.SearchOrgDomains(request)
@@ -124,7 +123,7 @@ func (repo *OrgRepository) OrgMemberByID(ctx context.Context, orgID, userID stri
 
 func (repo *OrgRepository) SearchMyOrgMembers(ctx context.Context, request *org_model.OrgMemberSearchRequest) (*org_model.OrgMemberSearchResponse, error) {
 	request.EnsureLimit(repo.SearchLimit)
-	request.Queries[len(request.Queries)-1] = &org_model.OrgMemberSearchQuery{Key: org_model.OrgMemberSearchKeyOrgID, Method: global_model.SearchMethodEquals, Value: authz.GetCtxData(ctx).OrgID}
+	request.Queries[len(request.Queries)-1] = &org_model.OrgMemberSearchQuery{Key: org_model.OrgMemberSearchKeyOrgID, Method: domain.SearchMethodEquals, Value: authz.GetCtxData(ctx).OrgID}
 	sequence, sequenceErr := repo.View.GetLatestOrgMemberSequence()
 	logging.Log("EVENT-Smu3d").OnError(sequenceErr).Warn("could not read latest org member sequence")
 	members, count, err := repo.View.SearchOrgMembers(request)

internal/management/repository/eventsourcing/eventstore/project.go

@@ -21,7 +21,6 @@ import (
 	key_model "github.com/caos/zitadel/internal/key/model"
 	key_view_model "github.com/caos/zitadel/internal/key/repository/view/model"
 	"github.com/caos/zitadel/internal/management/repository/eventsourcing/view"
-	global_model "github.com/caos/zitadel/internal/model"
 	proj_model "github.com/caos/zitadel/internal/project/model"
 	proj_view "github.com/caos/zitadel/internal/project/repository/view"
 	"github.com/caos/zitadel/internal/project/repository/view/model"
@@ -100,7 +99,7 @@ func (repo *ProjectRepo) SearchProjects(ctx context.Context, request *proj_model
 				return result, nil
 			}
 		} else {
-			request.Queries = append(request.Queries, &proj_model.ProjectViewSearchQuery{Key: proj_model.ProjectViewSearchKeyProjectID, Method: global_model.SearchMethodIsOneOf, Value: ids})
+			request.Queries = append(request.Queries, &proj_model.ProjectViewSearchQuery{Key: proj_model.ProjectViewSearchKeyProjectID, Method: domain.SearchMethodIsOneOf, Value: ids})
 		}
 	}
 
@@ -392,7 +391,7 @@ func (repo *ProjectRepo) SearchGrantedProjects(ctx context.Context, request *pro
 				return result, nil
 			}
 		} else {
-			request.Queries = append(request.Queries, &proj_model.ProjectGrantViewSearchQuery{Key: proj_model.GrantedProjectSearchKeyGrantID, Method: global_model.SearchMethodIsOneOf, Value: ids})
+			request.Queries = append(request.Queries, &proj_model.ProjectGrantViewSearchQuery{Key: proj_model.GrantedProjectSearchKeyGrantID, Method: domain.SearchMethodIsOneOf, Value: ids})
 		}
 	}
 

internal/management/repository/eventsourcing/eventstore/user.go

@@ -2,6 +2,7 @@ package eventstore
 
 import (
 	"context"
+	"github.com/caos/zitadel/internal/domain"
 	"github.com/caos/zitadel/internal/eventstore/v1"
 	"github.com/caos/zitadel/internal/eventstore/v1/models"
 	usr_view "github.com/caos/zitadel/internal/user/repository/view"
@@ -16,7 +17,6 @@ import (
 	key_model "github.com/caos/zitadel/internal/key/model"
 	key_view_model "github.com/caos/zitadel/internal/key/repository/view/model"
 	"github.com/caos/zitadel/internal/management/repository/eventsourcing/view"
-	global_model "github.com/caos/zitadel/internal/model"
 	usr_model "github.com/caos/zitadel/internal/user/model"
 	"github.com/caos/zitadel/internal/user/repository/view/model"
 	"github.com/caos/zitadel/internal/view/repository"
@@ -342,10 +342,10 @@ func handleSearchUserMembershipsPermissions(ctx context.Context, request *usr_mo
 		return nil
 	}
 	if !iamPerm {
-		request.Queries = append(request.Queries, &usr_model.UserMembershipSearchQuery{Key: usr_model.UserMembershipSearchKeyMemberType, Method: global_model.SearchMethodNotEquals, Value: usr_model.MemberTypeIam})
+		request.Queries = append(request.Queries, &usr_model.UserMembershipSearchQuery{Key: usr_model.UserMembershipSearchKeyMemberType, Method: domain.SearchMethodNotEquals, Value: usr_model.MemberTypeIam})
 	}
 	if !orgPerm {
-		request.Queries = append(request.Queries, &usr_model.UserMembershipSearchQuery{Key: usr_model.UserMembershipSearchKeyMemberType, Method: global_model.SearchMethodNotEquals, Value: usr_model.MemberTypeOrganisation})
+		request.Queries = append(request.Queries, &usr_model.UserMembershipSearchQuery{Key: usr_model.UserMembershipSearchKeyMemberType, Method: domain.SearchMethodNotEquals, Value: usr_model.MemberTypeOrganisation})
 	}
 
 	ids := authz.GetExplicitPermissionCtxIDs(permissions, projectMemberReadPerm)
@@ -372,6 +372,6 @@ func handleSearchUserMembershipsPermissions(ctx context.Context, request *usr_mo
 			return result
 		}
 	}
-	request.Queries = append(request.Queries, &usr_model.UserMembershipSearchQuery{Key: usr_model.UserMembershipSearchKeyObjectID, Method: global_model.SearchMethodIsOneOf, Value: ids})
+	request.Queries = append(request.Queries, &usr_model.UserMembershipSearchQuery{Key: usr_model.UserMembershipSearchKeyObjectID, Method: domain.SearchMethodIsOneOf, Value: ids})
 	return nil
 }

internal/management/repository/eventsourcing/eventstore/user_grant.go

@@ -2,11 +2,11 @@ package eventstore
 
 import (
 	"context"
+	"github.com/caos/zitadel/internal/domain"
 
 	"github.com/caos/logging"
 	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/management/repository/eventsourcing/view"
-	global_model "github.com/caos/zitadel/internal/model"
 	grant_model "github.com/caos/zitadel/internal/usergrant/model"
 	"github.com/caos/zitadel/internal/usergrant/repository/view/model"
 	"github.com/caos/zitadel/internal/view/repository"
@@ -105,7 +105,7 @@ func handleSearchUserGrantPermissions(ctx context.Context, request *grant_model.
 			return result
 		}
 	}
-	request.Queries = append(request.Queries, &grant_model.UserGrantSearchQuery{Key: grant_model.UserGrantSearchKeyProjectID, Method: global_model.SearchMethodIsOneOf, Value: ids})
+	request.Queries = append(request.Queries, &grant_model.UserGrantSearchQuery{Key: grant_model.UserGrantSearchKeyProjectID, Method: domain.SearchMethodIsOneOf, Value: ids})
 	return nil
 }
 

internal/model/enum.go

@@ -1,6 +0,0 @@
-package model
-
-//Deprecated: Enum is useless, better use normal enums, because we rarely need string value
-type Enum interface {
-	String() string
-}

internal/model/mfa.go

@@ -1,12 +0,0 @@
-package model
-
-import "github.com/caos/zitadel/internal/crypto"
-
-type Multifactors struct {
-	OTP OTP
-}
-
-type OTP struct {
-	Issuer    string
-	CryptoMFA crypto.EncryptionAlgorithm
-}

internal/org/model/domain_view.go

@@ -1,9 +1,8 @@
 package model
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	"time"
-
-	"github.com/caos/zitadel/internal/model"
 )
 
 type OrgDomainView struct {
@@ -36,7 +35,7 @@ const (
 
 type OrgDomainSearchQuery struct {
 	Key    OrgDomainSearchKey
-	Method model.SearchMethod
+	Method domain.SearchMethod
 	Value  interface{}
 }
 

internal/org/model/org_member_view.go

@@ -1,9 +1,8 @@
 package model
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	"time"
-
-	"github.com/caos/zitadel/internal/model"
 )
 
 type OrgMemberView struct {
@@ -42,7 +41,7 @@ const (
 
 type OrgMemberSearchQuery struct {
 	Key    OrgMemberSearchKey
-	Method model.SearchMethod
+	Method domain.SearchMethod
 	Value  interface{}
 }
 

internal/org/model/org_view.go

@@ -1,10 +1,10 @@
 package model
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	"time"
 
 	"github.com/caos/zitadel/internal/eventstore/v1/models"
-	"github.com/caos/zitadel/internal/model"
 )
 
 type OrgView struct {
@@ -39,7 +39,7 @@ const (
 
 type OrgSearchQuery struct {
 	Key    OrgSearchKey
-	Method model.SearchMethod
+	Method domain.SearchMethod
 	Value  interface{}
 }
 

internal/org/repository/view/model/org_domain_query.go

@@ -1,7 +1,7 @@
 package model
 
 import (
-	global_model "github.com/caos/zitadel/internal/model"
+	"github.com/caos/zitadel/internal/domain"
 	org_model "github.com/caos/zitadel/internal/org/model"
 	"github.com/caos/zitadel/internal/view/repository"
 )
@@ -41,7 +41,7 @@ func (req OrgDomainSearchQuery) GetKey() repository.ColumnKey {
 	return OrgDomainSearchKey(req.Key)
 }
 
-func (req OrgDomainSearchQuery) GetMethod() global_model.SearchMethod {
+func (req OrgDomainSearchQuery) GetMethod() domain.SearchMethod {
 	return req.Method
 }
 

internal/org/repository/view/model/org_member_query.go

@@ -1,7 +1,7 @@
 package model
 
 import (
-	global_model "github.com/caos/zitadel/internal/model"
+	"github.com/caos/zitadel/internal/domain"
 	org_model "github.com/caos/zitadel/internal/org/model"
 	"github.com/caos/zitadel/internal/view/repository"
 )
@@ -41,7 +41,7 @@ func (req OrgMemberSearchQuery) GetKey() repository.ColumnKey {
 	return OrgMemberSearchKey(req.Key)
 }
 
-func (req OrgMemberSearchQuery) GetMethod() global_model.SearchMethod {
+func (req OrgMemberSearchQuery) GetMethod() domain.SearchMethod {
 	return req.Method
 }
 

internal/org/repository/view/model/org_query.go

@@ -1,7 +1,7 @@
 package model
 
 import (
-	global_model "github.com/caos/zitadel/internal/model"
+	"github.com/caos/zitadel/internal/domain"
 	usr_model "github.com/caos/zitadel/internal/org/model"
 	"github.com/caos/zitadel/internal/view/repository"
 )
@@ -41,7 +41,7 @@ func (req OrgSearchQuery) GetKey() repository.ColumnKey {
 	return OrgSearchKey(req.Key)
 }
 
-func (req OrgSearchQuery) GetMethod() global_model.SearchMethod {
+func (req OrgSearchQuery) GetMethod() domain.SearchMethod {
 	return req.Method
 }
 

internal/org/repository/view/org_domain_view.go

@@ -1,8 +1,8 @@
 package view
 
 import (
+	domain2 "github.com/caos/zitadel/internal/domain"
 	caos_errs "github.com/caos/zitadel/internal/errors"
-	global_model "github.com/caos/zitadel/internal/model"
 	org_model "github.com/caos/zitadel/internal/org/model"
 	"github.com/caos/zitadel/internal/org/repository/view/model"
 	"github.com/caos/zitadel/internal/view/repository"
@@ -11,8 +11,8 @@ import (
 
 func OrgDomainByOrgIDAndDomain(db *gorm.DB, table, orgID, domain string) (*model.OrgDomainView, error) {
 	domainView := new(model.OrgDomainView)
-	orgIDQuery := &model.OrgDomainSearchQuery{Key: org_model.OrgDomainSearchKeyOrgID, Value: orgID, Method: global_model.SearchMethodEquals}
+	orgIDQuery := &model.OrgDomainSearchQuery{Key: org_model.OrgDomainSearchKeyOrgID, Value: orgID, Method: domain2.SearchMethodEquals}
-	domainQuery := &model.OrgDomainSearchQuery{Key: org_model.OrgDomainSearchKeyDomain, Value: domain, Method: global_model.SearchMethodEquals}
+	domainQuery := &model.OrgDomainSearchQuery{Key: org_model.OrgDomainSearchKeyDomain, Value: domain, Method: domain2.SearchMethodEquals}
 	query := repository.PrepareGetByQuery(table, orgIDQuery, domainQuery)
 	err := query(db, domainView)
 	if caos_errs.IsNotFound(err) {
@@ -23,8 +23,8 @@ func OrgDomainByOrgIDAndDomain(db *gorm.DB, table, orgID, domain string) (*model
 
 func VerifiedOrgDomain(db *gorm.DB, table, domain string) (*model.OrgDomainView, error) {
 	domainView := new(model.OrgDomainView)
-	domainQuery := &model.OrgDomainSearchQuery{Key: org_model.OrgDomainSearchKeyDomain, Value: domain, Method: global_model.SearchMethodEquals}
+	domainQuery := &model.OrgDomainSearchQuery{Key: org_model.OrgDomainSearchKeyDomain, Value: domain, Method: domain2.SearchMethodEquals}
-	verifiedQuery := &model.OrgDomainSearchQuery{Key: org_model.OrgDomainSearchKeyVerified, Value: true, Method: global_model.SearchMethodEquals}
+	verifiedQuery := &model.OrgDomainSearchQuery{Key: org_model.OrgDomainSearchKeyVerified, Value: true, Method: domain2.SearchMethodEquals}
 	query := repository.PrepareGetByQuery(table, domainQuery, verifiedQuery)
 	err := query(db, domainView)
 	if caos_errs.IsNotFound(err) {
@@ -49,7 +49,7 @@ func OrgDomainsByOrgID(db *gorm.DB, table string, orgID string) ([]*model.OrgDom
 		{
 			Key:    org_model.OrgDomainSearchKeyOrgID,
 			Value:  orgID,
-			Method: global_model.SearchMethodEquals,
+			Method: domain2.SearchMethodEquals,
 		},
 	}
 	query := repository.PrepareSearchQuery(table, model.OrgDomainSearchRequest{Queries: queries})

internal/org/repository/view/org_member_view.go

@@ -1,8 +1,8 @@
 package view
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	caos_errs "github.com/caos/zitadel/internal/errors"
-	global_model "github.com/caos/zitadel/internal/model"
 	org_model "github.com/caos/zitadel/internal/org/model"
 	"github.com/caos/zitadel/internal/org/repository/view/model"
 	"github.com/caos/zitadel/internal/view/repository"
@@ -12,8 +12,8 @@ import (
 func OrgMemberByIDs(db *gorm.DB, table, orgID, userID string) (*model.OrgMemberView, error) {
 	member := new(model.OrgMemberView)
 
-	orgIDQuery := &model.OrgMemberSearchQuery{Key: org_model.OrgMemberSearchKeyOrgID, Value: orgID, Method: global_model.SearchMethodEquals}
+	orgIDQuery := &model.OrgMemberSearchQuery{Key: org_model.OrgMemberSearchKeyOrgID, Value: orgID, Method: domain.SearchMethodEquals}
-	userIDQuery := &model.OrgMemberSearchQuery{Key: org_model.OrgMemberSearchKeyUserID, Value: userID, Method: global_model.SearchMethodEquals}
+	userIDQuery := &model.OrgMemberSearchQuery{Key: org_model.OrgMemberSearchKeyUserID, Value: userID, Method: domain.SearchMethodEquals}
 	query := repository.PrepareGetByQuery(table, orgIDQuery, userIDQuery)
 	err := query(db, member)
 	if caos_errs.IsNotFound(err) {
@@ -37,7 +37,7 @@ func OrgMembersByUserID(db *gorm.DB, table string, userID string) ([]*model.OrgM
 		{
 			Key:    org_model.OrgMemberSearchKeyUserID,
 			Value:  userID,
-			Method: global_model.SearchMethodEquals,
+			Method: domain.SearchMethodEquals,
 		},
 	}
 	query := repository.PrepareSearchQuery(table, model.OrgMemberSearchRequest{Queries: queries})

internal/project/model/application_view.go

@@ -1,9 +1,8 @@
 package model
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	"time"
-
-	"github.com/caos/zitadel/internal/model"
 )
 
 type ApplicationView struct {
@@ -58,7 +57,7 @@ const (
 
 type ApplicationSearchQuery struct {
 	Key    AppSearchKey
-	Method model.SearchMethod
+	Method domain.SearchMethod
 	Value  interface{}
 }
 

internal/project/model/project_grant_member_view.go

@@ -1,9 +1,8 @@
 package model
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	"time"
-
-	"github.com/caos/zitadel/internal/model"
 )
 
 type ProjectGrantMemberView struct {
@@ -44,7 +43,7 @@ const (
 
 type ProjectGrantMemberSearchQuery struct {
 	Key    ProjectGrantMemberSearchKey
-	Method model.SearchMethod
+	Method domain.SearchMethod
 	Value  interface{}
 }
 

internal/project/model/project_grant_view.go

@@ -1,7 +1,7 @@
 package model
 
 import (
-	"github.com/caos/zitadel/internal/model"
+	"github.com/caos/zitadel/internal/domain"
 	"time"
 )
 
@@ -43,7 +43,7 @@ const (
 
 type ProjectGrantViewSearchQuery struct {
 	Key    ProjectGrantViewSearchKey
-	Method model.SearchMethod
+	Method domain.SearchMethod
 	Value  interface{}
 }
 
@@ -66,15 +66,15 @@ func (r *ProjectGrantViewSearchRequest) GetSearchQuery(key ProjectGrantViewSearc
 }
 
 func (r *ProjectGrantViewSearchRequest) AppendMyOrgQuery(orgID string) {
-	r.Queries = append(r.Queries, &ProjectGrantViewSearchQuery{Key: GrantedProjectSearchKeyOrgID, Method: model.SearchMethodEquals, Value: orgID})
+	r.Queries = append(r.Queries, &ProjectGrantViewSearchQuery{Key: GrantedProjectSearchKeyOrgID, Method: domain.SearchMethodEquals, Value: orgID})
 }
 
 func (r *ProjectGrantViewSearchRequest) AppendNotMyOrgQuery(orgID string) {
-	r.Queries = append(r.Queries, &ProjectGrantViewSearchQuery{Key: GrantedProjectSearchKeyOrgID, Method: model.SearchMethodNotEquals, Value: orgID})
+	r.Queries = append(r.Queries, &ProjectGrantViewSearchQuery{Key: GrantedProjectSearchKeyOrgID, Method: domain.SearchMethodNotEquals, Value: orgID})
 }
 
 func (r *ProjectGrantViewSearchRequest) AppendMyResourceOwnerQuery(orgID string) {
-	r.Queries = append(r.Queries, &ProjectGrantViewSearchQuery{Key: GrantedProjectSearchKeyResourceOwner, Method: model.SearchMethodEquals, Value: orgID})
+	r.Queries = append(r.Queries, &ProjectGrantViewSearchQuery{Key: GrantedProjectSearchKeyResourceOwner, Method: domain.SearchMethodEquals, Value: orgID})
 }
 
 func (r *ProjectGrantViewSearchRequest) EnsureLimit(limit uint64) {

internal/project/model/project_member_view.go

@@ -1,9 +1,8 @@
 package model
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	"time"
-
-	"github.com/caos/zitadel/internal/model"
 )
 
 type ProjectMemberView struct {
@@ -42,7 +41,7 @@ const (
 
 type ProjectMemberSearchQuery struct {
 	Key    ProjectMemberSearchKey
-	Method model.SearchMethod
+	Method domain.SearchMethod
 	Value  interface{}
 }
 
@@ -61,5 +60,5 @@ func (r *ProjectMemberSearchRequest) EnsureLimit(limit uint64) {
 	}
 }
 func (r *ProjectMemberSearchRequest) AppendProjectQuery(projectID string) {
-	r.Queries = append(r.Queries, &ProjectMemberSearchQuery{Key: ProjectMemberSearchKeyProjectID, Method: model.SearchMethodEquals, Value: projectID})
+	r.Queries = append(r.Queries, &ProjectMemberSearchQuery{Key: ProjectMemberSearchKeyProjectID, Method: domain.SearchMethodEquals, Value: projectID})
 }

internal/project/model/project_role_view.go

@@ -1,9 +1,8 @@
 package model
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	"time"
-
-	"github.com/caos/zitadel/internal/model"
 )
 
 type ProjectRoleView struct {
@@ -39,7 +38,7 @@ const (
 
 type ProjectRoleSearchQuery struct {
 	Key    ProjectRoleSearchKey
-	Method model.SearchMethod
+	Method domain.SearchMethod
 	Value  interface{}
 }
 
@@ -53,10 +52,10 @@ type ProjectRoleSearchResponse struct {
 }
 
 func (r *ProjectRoleSearchRequest) AppendMyOrgQuery(orgID string) {
-	r.Queries = append(r.Queries, &ProjectRoleSearchQuery{Key: ProjectRoleSearchKeyOrgID, Method: model.SearchMethodEquals, Value: orgID})
+	r.Queries = append(r.Queries, &ProjectRoleSearchQuery{Key: ProjectRoleSearchKeyOrgID, Method: domain.SearchMethodEquals, Value: orgID})
 }
 func (r *ProjectRoleSearchRequest) AppendProjectQuery(projectID string) {
-	r.Queries = append(r.Queries, &ProjectRoleSearchQuery{Key: ProjectRoleSearchKeyProjectID, Method: model.SearchMethodEquals, Value: projectID})
+	r.Queries = append(r.Queries, &ProjectRoleSearchQuery{Key: ProjectRoleSearchKeyProjectID, Method: domain.SearchMethodEquals, Value: projectID})
 }
 
 func (r *ProjectRoleSearchRequest) EnsureLimit(limit uint64) {

internal/project/model/project_view.go

@@ -1,9 +1,8 @@
 package model
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	"time"
-
-	"github.com/caos/zitadel/internal/model"
 )
 
 type ProjectView struct {
@@ -37,7 +36,7 @@ const (
 
 type ProjectViewSearchQuery struct {
 	Key    ProjectViewSearchKey
-	Method model.SearchMethod
+	Method domain.SearchMethod
 	Value  interface{}
 }
 
@@ -60,7 +59,7 @@ func (r *ProjectViewSearchRequest) GetSearchQuery(key ProjectViewSearchKey) (int
 }
 
 func (r *ProjectViewSearchRequest) AppendMyResourceOwnerQuery(orgID string) {
-	r.Queries = append(r.Queries, &ProjectViewSearchQuery{Key: ProjectViewSearchKeyResourceOwner, Method: model.SearchMethodEquals, Value: orgID})
+	r.Queries = append(r.Queries, &ProjectViewSearchQuery{Key: ProjectViewSearchKeyResourceOwner, Method: domain.SearchMethodEquals, Value: orgID})
 }
 
 func (r *ProjectViewSearchRequest) EnsureLimit(limit uint64) {

internal/project/repository/view/application_view.go

@@ -1,8 +1,8 @@
 package view
 
 import (
+	"github.com/caos/zitadel/internal/domain"
 	caos_errs "github.com/caos/zitadel/internal/errors"
-	global_model "github.com/caos/zitadel/internal/model"
 	proj_model "github.com/caos/zitadel/internal/project/model"
 	"github.com/caos/zitadel/internal/project/repository/view/model"
 	"github.com/caos/zitadel/internal/view/repository"
@@ -11,8 +11,8 @@ import (
 
 func ApplicationByID(db *gorm.DB, table, projectID, appID string) (*model.ApplicationView, error) {
 	app := new(model.ApplicationView)
-	projectIDQuery := &model.ApplicationSearchQuery{Key: proj_model.AppSearchKeyProjectID, Value: projectID, Method: global_model.SearchMethodEquals}
+	projectIDQuery := &model.ApplicationSearchQuery{Key: proj_model.AppSearchKeyProjectID, Value: projectID, Method: domain.SearchMethodEquals}
-	appIDQuery := &model.ApplicationSearchQuery{Key: proj_model.AppSearchKeyAppID, Value: appID, Method: global_model.SearchMethodEquals}
+	appIDQuery := &model.ApplicationSearchQuery{Key: proj_model.AppSearchKeyAppID, Value: appID, Method: domain.SearchMethodEquals}
 	query := repository.PrepareGetByQuery(table, projectIDQuery, appIDQuery)
 	err := query(db, app)
 	if caos_errs.IsNotFound(err) {
@@ -24,7 +24,7 @@ func ApplicationByID(db *gorm.DB, table, projectID, appID string) (*model.Applic
 func ApplicationsByProjectID(db *gorm.DB, table, projectID string) ([]*model.ApplicationView, error) {
 	applications := make([]*model.ApplicationView, 0)
 	queries := []*proj_model.ApplicationSearchQuery{
-		{Key: proj_model.AppSearchKeyProjectID, Value: projectID, Method: global_model.SearchMethodEquals},
+		{Key: proj_model.AppSearchKeyProjectID, Value: projectID, Method: domain.SearchMethodEquals},
 	}
 	query := repository.PrepareSearchQuery(table, model.ApplicationSearchRequest{Queries: queries})
 	_, err := query(db, &applications)
@@ -36,7 +36,7 @@ func ApplicationsByProjectID(db *gorm.DB, table, projectID string) ([]*model.App
 
 func ApplicationByOIDCClientID(db *gorm.DB, table, clientID string) (*model.ApplicationView, error) {
 	app := new(model.ApplicationView)
-	clientIDQuery := model.ApplicationSearchQuery{Key: proj_model.AppSearchKeyOIDCClientID, Value: clientID, Method: global_model.SearchMethodEquals}
+	clientIDQuery := model.ApplicationSearchQuery{Key: proj_model.AppSearchKeyOIDCClientID, Value: clientID, Method: domain.SearchMethodEquals}
 	query := repository.PrepareGetByQuery(table, clientIDQuery)
 	err := query(db, app)
 	if caos_errs.IsNotFound(err) {
@@ -47,8 +47,8 @@ func ApplicationByOIDCClientID(db *gorm.DB, table, clientID string) (*model.Appl
 
 func ApplicationByProjectIDAndAppName(db *gorm.DB, table, projectID, appName string) (*model.ApplicationView, error) {
 	app := new(model.ApplicationView)
-	projectIDQuery := model.ApplicationSearchQuery{Key: proj_model.AppSearchKeyProjectID, Value: projectID, Method: global_model.SearchMethodEquals}
+	projectIDQuery := model.ApplicationSearchQuery{Key: proj_model.AppSearchKeyProjectID, Value: projectID, Method: domain.SearchMethodEquals}
-	appNameQuery := model.ApplicationSearchQuery{Key: proj_model.AppSearchKeyName, Value: appName, Method: global_model.SearchMethodEquals}
+	appNameQuery := model.ApplicationSearchQuery{Key: proj_model.AppSearchKeyName, Value: appName, Method: domain.SearchMethodEquals}
 	query := repository.PrepareGetByQuery(table, projectIDQuery, appNameQuery)
 	err := query(db, app)
 	if caos_errs.IsNotFound(err) {

internal/project/repository/view/model/application_query.go

@@ -1,7 +1,7 @@
 package model
 
 import (
-	global_model "github.com/caos/zitadel/internal/model"
+	"github.com/caos/zitadel/internal/domain"
 	proj_model "github.com/caos/zitadel/internal/project/model"
 	"github.com/caos/zitadel/internal/view/repository"
 )
@@ -41,7 +41,7 @@ func (req ApplicationSearchQuery) GetKey() repository.ColumnKey {
 	return ApplicationSearchKey(req.Key)
 }
 
-func (req ApplicationSearchQuery) GetMethod() global_model.SearchMethod {
+func (req ApplicationSearchQuery) GetMethod() domain.SearchMethod {
 	return req.Method
 }