fix: join on instanceIDs in queries (#4612)

internal/query/action.go

@@ -20,7 +20,8 @@ const (
 
 var (
 	actionTable = table{
-		name: projection.ActionTable,
+		name:          projection.ActionTable,
+		instanceIDCol: projection.ActionInstanceIDCol,
 	}
 	ActionColumnID = Column{
 		name:  projection.ActionIDCol,

internal/query/action_flow.go

@@ -15,7 +15,8 @@ import (
 
 var (
 	flowsTriggersTable = table{
-		name: projection.FlowTriggerTable,
+		name:          projection.FlowTriggerTable,
+		instanceIDCol: projection.FlowInstanceIDCol,
 	}
 	FlowsTriggersColumnFlowType = Column{
 		name:  projection.FlowTypeCol,

internal/query/app.go

@@ -83,7 +83,8 @@ func (q *AppSearchQueries) toQuery(query sq.SelectBuilder) sq.SelectBuilder {
 
 var (
 	appsTable = table{
-		name: projection.AppProjectionTable,
+		name:          projection.AppProjectionTable,
+		instanceIDCol: projection.AppColumnInstanceID,
 	}
 	AppColumnID = Column{
 		name:  projection.AppColumnID,
@@ -125,7 +126,8 @@ var (
 
 var (
 	appSAMLConfigsTable = table{
-		name: projection.AppSAMLTable,
+		name:          projection.AppSAMLTable,
+		instanceIDCol: projection.AppSAMLConfigColumnInstanceID,
 	}
 	AppSAMLConfigColumnAppID = Column{
 		name:  projection.AppSAMLConfigColumnAppID,
@@ -147,7 +149,8 @@ var (
 
 var (
 	appAPIConfigsTable = table{
-		name: projection.AppAPITable,
+		name:          projection.AppAPITable,
+		instanceIDCol: projection.AppAPIConfigColumnInstanceID,
 	}
 	AppAPIConfigColumnAppID = Column{
 		name:  projection.AppAPIConfigColumnAppID,
@@ -165,7 +168,8 @@ var (
 
 var (
 	appOIDCConfigsTable = table{
-		name: projection.AppOIDCTable,
+		name:          projection.AppOIDCTable,
+		instanceIDCol: projection.AppOIDCConfigColumnInstanceID,
 	}
 	AppOIDCConfigColumnAppID = Column{
 		name:  projection.AppOIDCConfigColumnAppID,

internal/query/app_test.go

@@ -50,9 +50,9 @@ var (
 		` projections.apps3_saml_configs.metadata,` +
 		` projections.apps3_saml_configs.metadata_url` +
 		` FROM projections.apps3` +
-		` LEFT JOIN projections.apps3_api_configs ON projections.apps3.id = projections.apps3_api_configs.app_id` +
+		` LEFT JOIN projections.apps3_api_configs ON projections.apps3.id = projections.apps3_api_configs.app_id AND projections.apps3.instance_id = projections.apps3_api_configs.instance_id` +
-		` LEFT JOIN projections.apps3_oidc_configs ON projections.apps3.id = projections.apps3_oidc_configs.app_id` +
+		` LEFT JOIN projections.apps3_oidc_configs ON projections.apps3.id = projections.apps3_oidc_configs.app_id AND projections.apps3.instance_id = projections.apps3_oidc_configs.instance_id` +
-		` LEFT JOIN projections.apps3_saml_configs ON projections.apps3.id = projections.apps3_saml_configs.app_id`)
+		` LEFT JOIN projections.apps3_saml_configs ON projections.apps3.id = projections.apps3_saml_configs.app_id AND projections.apps3.instance_id = projections.apps3_saml_configs.instance_id`)
 	expectedAppsQuery = regexp.QuoteMeta(`SELECT projections.apps3.id,` +
 		` projections.apps3.name,` +
 		` projections.apps3.project_id,` +
@@ -89,19 +89,19 @@ var (
 		` projections.apps3_saml_configs.metadata_url,` +
 		` COUNT(*) OVER ()` +
 		` FROM projections.apps3` +
-		` LEFT JOIN projections.apps3_api_configs ON projections.apps3.id = projections.apps3_api_configs.app_id` +
+		` LEFT JOIN projections.apps3_api_configs ON projections.apps3.id = projections.apps3_api_configs.app_id AND projections.apps3.instance_id = projections.apps3_api_configs.instance_id` +
-		` LEFT JOIN projections.apps3_oidc_configs ON projections.apps3.id = projections.apps3_oidc_configs.app_id` +
+		` LEFT JOIN projections.apps3_oidc_configs ON projections.apps3.id = projections.apps3_oidc_configs.app_id AND projections.apps3.instance_id = projections.apps3_oidc_configs.instance_id` +
-		` LEFT JOIN projections.apps3_saml_configs ON projections.apps3.id = projections.apps3_saml_configs.app_id`)
+		` LEFT JOIN projections.apps3_saml_configs ON projections.apps3.id = projections.apps3_saml_configs.app_id AND projections.apps3.instance_id = projections.apps3_saml_configs.instance_id`)
 	expectedAppIDsQuery = regexp.QuoteMeta(`SELECT projections.apps3_api_configs.client_id,` +
 		` projections.apps3_oidc_configs.client_id` +
 		` FROM projections.apps3` +
-		` LEFT JOIN projections.apps3_api_configs ON projections.apps3.id = projections.apps3_api_configs.app_id` +
+		` LEFT JOIN projections.apps3_api_configs ON projections.apps3.id = projections.apps3_api_configs.app_id AND projections.apps3.instance_id = projections.apps3_api_configs.instance_id` +
-		` LEFT JOIN projections.apps3_oidc_configs ON projections.apps3.id = projections.apps3_oidc_configs.app_id`)
+		` LEFT JOIN projections.apps3_oidc_configs ON projections.apps3.id = projections.apps3_oidc_configs.app_id AND projections.apps3.instance_id = projections.apps3_oidc_configs.instance_id`)
 	expectedProjectIDByAppQuery = regexp.QuoteMeta(`SELECT projections.apps3.project_id` +
 		` FROM projections.apps3` +
-		` LEFT JOIN projections.apps3_api_configs ON projections.apps3.id = projections.apps3_api_configs.app_id` +
+		` LEFT JOIN projections.apps3_api_configs ON projections.apps3.id = projections.apps3_api_configs.app_id AND projections.apps3.instance_id = projections.apps3_api_configs.instance_id` +
-		` LEFT JOIN projections.apps3_oidc_configs ON projections.apps3.id = projections.apps3_oidc_configs.app_id` +
+		` LEFT JOIN projections.apps3_oidc_configs ON projections.apps3.id = projections.apps3_oidc_configs.app_id AND projections.apps3.instance_id = projections.apps3_oidc_configs.instance_id` +
-		` LEFT JOIN projections.apps3_saml_configs ON projections.apps3.id = projections.apps3_saml_configs.app_id`)
+		` LEFT JOIN projections.apps3_saml_configs ON projections.apps3.id = projections.apps3_saml_configs.app_id AND projections.apps3.instance_id = projections.apps3_saml_configs.instance_id`)
 	expectedProjectByAppQuery = regexp.QuoteMeta(`SELECT projections.projects2.id,` +
 		` projections.projects2.creation_date,` +
 		` projections.projects2.change_date,` +
@@ -114,10 +114,10 @@ var (
 		` projections.projects2.has_project_check,` +
 		` projections.projects2.private_labeling_setting` +
 		` FROM projections.projects2` +
-		` JOIN projections.apps3 ON projections.projects2.id = projections.apps3.project_id` +
+		` JOIN projections.apps3 ON projections.projects2.id = projections.apps3.project_id AND projections.projects2.instance_id = projections.apps3.instance_id` +
-		` LEFT JOIN projections.apps3_api_configs ON projections.apps3.id = projections.apps3_api_configs.app_id` +
+		` LEFT JOIN projections.apps3_api_configs ON projections.apps3.id = projections.apps3_api_configs.app_id AND projections.apps3.instance_id = projections.apps3_api_configs.instance_id` +
-		` LEFT JOIN projections.apps3_oidc_configs ON projections.apps3.id = projections.apps3_oidc_configs.app_id` +
+		` LEFT JOIN projections.apps3_oidc_configs ON projections.apps3.id = projections.apps3_oidc_configs.app_id AND projections.apps3.instance_id = projections.apps3_oidc_configs.instance_id` +
-		` LEFT JOIN projections.apps3_saml_configs ON projections.apps3.id = projections.apps3_saml_configs.app_id`)
+		` LEFT JOIN projections.apps3_saml_configs ON projections.apps3.id = projections.apps3_saml_configs.app_id AND projections.apps3.instance_id = projections.apps3_saml_configs.instance_id`)
 
 	appCols = database.StringArray{
 		"id",

internal/query/authn_key.go

@@ -17,7 +17,8 @@ import (
 
 var (
 	authNKeyTable = table{
-		name: projection.AuthNKeyTable,
+		name:          projection.AuthNKeyTable,
+		instanceIDCol: projection.AuthNKeyInstanceIDCol,
 	}
 	AuthNKeyColumnID = Column{
 		name:  projection.AuthNKeyIDCol,

internal/query/certificate.go

@@ -47,7 +47,8 @@ func (c *rsaCertificate) Certificate() []byte {
 
 var (
 	certificateTable = table{
-		name: projection.CertificateTable,
+		name:          projection.CertificateTable,
+		instanceIDCol: projection.CertificateColumnInstanceID,
 	}
 	CertificateColID = Column{
 		name:  projection.CertificateColumnID,

internal/query/certificate_test.go

@@ -41,8 +41,8 @@ func Test_CertificatePrepares(t *testing.T) {
 						` projections.keys3_private.key,`+
 						` COUNT(*) OVER ()`+
 						` FROM projections.keys3`+
-						` LEFT JOIN projections.keys3_certificate ON projections.keys3.id = projections.keys3_certificate.id`+
+						` LEFT JOIN projections.keys3_certificate ON projections.keys3.id = projections.keys3_certificate.id AND projections.keys3.instance_id = projections.keys3_certificate.instance_id`+
-						` LEFT JOIN projections.keys3_private ON projections.keys3.id = projections.keys3_private.id`),
+						` LEFT JOIN projections.keys3_private ON projections.keys3.id = projections.keys3_private.id AND projections.keys3.instance_id = projections.keys3_private.instance_id`),
 					nil,
 					nil,
 				),
@@ -72,8 +72,8 @@ func Test_CertificatePrepares(t *testing.T) {
 						` projections.keys3_private.key,`+
 						` COUNT(*) OVER ()`+
 						` FROM projections.keys3`+
-						` LEFT JOIN projections.keys3_certificate ON projections.keys3.id = projections.keys3_certificate.id`+
+						` LEFT JOIN projections.keys3_certificate ON projections.keys3.id = projections.keys3_certificate.id AND projections.keys3.instance_id = projections.keys3_certificate.instance_id`+
-						` LEFT JOIN projections.keys3_private ON projections.keys3.id = projections.keys3_private.id`),
+						` LEFT JOIN projections.keys3_private ON projections.keys3.id = projections.keys3_private.id AND projections.keys3.instance_id = projections.keys3_private.instance_id`),
 					[]string{
 						"id",
 						"creation_date",
@@ -147,8 +147,8 @@ func Test_CertificatePrepares(t *testing.T) {
 						` projections.keys3_private.key,`+
 						` COUNT(*) OVER ()`+
 						` FROM projections.keys3`+
-						` LEFT JOIN projections.keys3_certificate ON projections.keys3.id = projections.keys3_certificate.id`+
+						` LEFT JOIN projections.keys3_certificate ON projections.keys3.id = projections.keys3_certificate.id AND projections.keys3.instance_id = projections.keys3_certificate.instance_id`+
-						` LEFT JOIN projections.keys3_private ON projections.keys3.id = projections.keys3_private.id`),
+						` LEFT JOIN projections.keys3_private ON projections.keys3.id = projections.keys3_private.id AND projections.keys3.instance_id = projections.keys3_private.instance_id`),
 					sql.ErrConnDone,
 				),
 				err: func(err error) (error, bool) {

internal/query/current_sequence.go

@@ -249,7 +249,8 @@ func prepareCurrentSequencesQuery() (sq.SelectBuilder, func(*sql.Rows) (*Current
 
 var (
 	currentSequencesTable = table{
-		name: projection.CurrentSeqTable,
+		name:          projection.CurrentSeqTable,
+		instanceIDCol: "instance_id",
 	}
 	CurrentSequenceColAggregateType = Column{
 		name:  "aggregate_type",
@@ -275,7 +276,8 @@ var (
 
 var (
 	locksTable = table{
-		name: projection.LocksTable,
+		name:          projection.LocksTable,
+		instanceIDCol: "instance_id",
 	}
 	LocksColLockerID = Column{
 		name:  "locker_id",

internal/query/custom_text.go

@@ -39,7 +39,8 @@ type CustomText struct {
 
 var (
 	customTextTable = table{
-		name: projection.CustomTextTable,
+		name:          projection.CustomTextTable,
+		instanceIDCol: projection.CustomTextInstanceIDCol,
 	}
 	CustomTextColAggregateID = Column{
 		name:  projection.CustomTextAggregateIDCol,

internal/query/domain_policy.go

@@ -32,7 +32,8 @@ type DomainPolicy struct {
 
 var (
 	domainPolicyTable = table{
-		name: projection.DomainPolicyTable,
+		name:          projection.DomainPolicyTable,
+		instanceIDCol: projection.DomainPolicyInstanceIDCol,
 	}
 	DomainPolicyColID = Column{
 		name:  projection.DomainPolicyIDCol,

internal/query/failed_events.go

@@ -21,7 +21,8 @@ const (
 
 var (
 	failedEventsTable = table{
-		name: projection.FailedEventsTable,
+		name:          projection.FailedEventsTable,
+		instanceIDCol: failedEventsColumnInstanceID,
 	}
 	FailedEventsColumnProjectionName = Column{
 		name:  failedEventsColumnProjectionName,
@@ -39,10 +40,6 @@ var (
 		name:  failedEventsColumnError,
 		table: failedEventsTable,
 	}
-	FailedEventsColumnInstanceID = Column{
-		name:  failedEventsColumnInstanceID,
-		table: failedEventsTable,
-	}
 )
 
 type FailedEvents struct {

internal/query/iam_member.go

@@ -14,8 +14,9 @@ import (
 
 var (
 	instanceMemberTable = table{
-		name:  projection.InstanceMemberProjectionTable,
+		name:          projection.InstanceMemberProjectionTable,
-		alias: "members",
+		alias:         "members",
+		instanceIDCol: projection.MemberInstanceID,
 	}
 	InstanceMemberUserID = Column{
 		name:  projection.MemberUserIDCol,

internal/query/iam_member_test.go

@@ -29,11 +29,11 @@ var (
 		", COUNT(*) OVER () " +
 		"FROM projections.instance_members2 AS members " +
 		"LEFT JOIN projections.users4_humans " +
-		"ON members.user_id = projections.users4_humans.user_id " +
+		"ON members.user_id = projections.users4_humans.user_id AND members.instance_id = projections.users4_humans.instance_id " +
 		"LEFT JOIN projections.users4_machines " +
-		"ON members.user_id = projections.users4_machines.user_id " +
+		"ON members.user_id = projections.users4_machines.user_id AND members.instance_id = projections.users4_machines.instance_id " +
 		"LEFT JOIN projections.login_names " +
-		"ON members.user_id = projections.login_names.user_id " +
+		"ON members.user_id = projections.login_names.user_id AND members.instance_id = projections.login_names.instance_id " +
 		"WHERE projections.login_names.is_primary = $1")
 	instanceMembersColumns = []string{
 		"creation_date",

internal/query/idp.go

@@ -59,7 +59,8 @@ type JWTIDP struct {
 
 var (
 	idpTable = table{
-		name: projection.IDPTable,
+		name:          projection.IDPTable,
+		instanceIDCol: projection.IDPInstanceIDCol,
 	}
 	IDPIDCol = Column{
 		name:  projection.IDPIDCol,
@@ -113,7 +114,8 @@ var (
 
 var (
 	oidcIDPTable = table{
-		name: projection.IDPOIDCTable,
+		name:          projection.IDPOIDCTable,
+		instanceIDCol: projection.OIDCConfigInstanceIDCol,
 	}
 	OIDCIDPColIDPID = Column{
 		name:  projection.OIDCConfigIDPIDCol,
@@ -155,7 +157,8 @@ var (
 
 var (
 	jwtIDPTable = table{
-		name: projection.IDPJWTTable,
+		name:          projection.IDPJWTTable,
+		instanceIDCol: projection.JWTConfigInstanceIDCol,
 	}
 	JWTIDPColIDPID = Column{
 		name:  projection.JWTConfigIDPIDCol,
@@ -179,7 +182,7 @@ var (
 	}
 )
 
-//IDPByIDAndResourceOwner searches for the requested id in the context of the resource owner and IAM
+// IDPByIDAndResourceOwner searches for the requested id in the context of the resource owner and IAM
 func (q *Queries) IDPByIDAndResourceOwner(ctx context.Context, shouldTriggerBulk bool, id, resourceOwner string) (*IDP, error) {
 	if shouldTriggerBulk {
 		projection.IDPProjection.Trigger(ctx)
@@ -210,7 +213,7 @@ func (q *Queries) IDPByIDAndResourceOwner(ctx context.Context, shouldTriggerBulk
 	return scan(row)
 }
 
-//IDPs searches idps matching the query
+// IDPs searches idps matching the query
 func (q *Queries) IDPs(ctx context.Context, queries *IDPSearchQueries) (idps *IDPs, err error) {
 	query, scan := prepareIDPsQuery()
 	stmt, args, err := queries.toQuery(query).

internal/query/idp_login_policy_link.go

@@ -38,7 +38,8 @@ func (q *IDPLoginPolicyLinksSearchQuery) toQuery(query sq.SelectBuilder) sq.Sele
 
 var (
 	idpLoginPolicyLinkTable = table{
-		name: projection.IDPLoginPolicyLinkTable,
+		name:          projection.IDPLoginPolicyLinkTable,
+		instanceIDCol: projection.IDPLoginPolicyLinkInstanceIDCol,
 	}
 	IDPLoginPolicyLinkIDPIDCol = Column{
 		name:  projection.IDPLoginPolicyLinkIDPIDCol,

internal/query/idp_test.go

@@ -14,6 +14,121 @@ import (
 	errs "github.com/zitadel/zitadel/internal/errors"
 )
 
+var (
+	idpQuery = `SELECT projections.idps2.id,` +
+		` projections.idps2.resource_owner,` +
+		` projections.idps2.creation_date,` +
+		` projections.idps2.change_date,` +
+		` projections.idps2.sequence,` +
+		` projections.idps2.state,` +
+		` projections.idps2.name,` +
+		` projections.idps2.styling_type,` +
+		` projections.idps2.owner_type,` +
+		` projections.idps2.auto_register,` +
+		` projections.idps2_oidc_config.idp_id,` +
+		` projections.idps2_oidc_config.client_id,` +
+		` projections.idps2_oidc_config.client_secret,` +
+		` projections.idps2_oidc_config.issuer,` +
+		` projections.idps2_oidc_config.scopes,` +
+		` projections.idps2_oidc_config.display_name_mapping,` +
+		` projections.idps2_oidc_config.username_mapping,` +
+		` projections.idps2_oidc_config.authorization_endpoint,` +
+		` projections.idps2_oidc_config.token_endpoint,` +
+		` projections.idps2_jwt_config.idp_id,` +
+		` projections.idps2_jwt_config.issuer,` +
+		` projections.idps2_jwt_config.keys_endpoint,` +
+		` projections.idps2_jwt_config.header_name,` +
+		` projections.idps2_jwt_config.endpoint` +
+		` FROM projections.idps2` +
+		` LEFT JOIN projections.idps2_oidc_config ON projections.idps2.id = projections.idps2_oidc_config.idp_id AND projections.idps2.instance_id = projections.idps2_oidc_config.instance_id` +
+		` LEFT JOIN projections.idps2_jwt_config ON projections.idps2.id = projections.idps2_jwt_config.idp_id AND projections.idps2.instance_id = projections.idps2_jwt_config.instance_id`
+	idpCols = []string{
+		"id",
+		"resource_owner",
+		"creation_date",
+		"change_date",
+		"sequence",
+		"state",
+		"name",
+		"styling_type",
+		"owner_type",
+		"auto_register",
+		// oidc config
+		"idp_id",
+		"client_id",
+		"client_secret",
+		"issuer",
+		"scopes",
+		"display_name_mapping",
+		"username_mapping",
+		"authorization_endpoint",
+		"token_endpoint",
+		// jwt config
+		"idp_id",
+		"issuer",
+		"keys_endpoint",
+		"header_name",
+		"endpoint",
+	}
+	idpsQuery = `SELECT projections.idps2.id,` +
+		` projections.idps2.resource_owner,` +
+		` projections.idps2.creation_date,` +
+		` projections.idps2.change_date,` +
+		` projections.idps2.sequence,` +
+		` projections.idps2.state,` +
+		` projections.idps2.name,` +
+		` projections.idps2.styling_type,` +
+		` projections.idps2.owner_type,` +
+		` projections.idps2.auto_register,` +
+		` projections.idps2_oidc_config.idp_id,` +
+		` projections.idps2_oidc_config.client_id,` +
+		` projections.idps2_oidc_config.client_secret,` +
+		` projections.idps2_oidc_config.issuer,` +
+		` projections.idps2_oidc_config.scopes,` +
+		` projections.idps2_oidc_config.display_name_mapping,` +
+		` projections.idps2_oidc_config.username_mapping,` +
+		` projections.idps2_oidc_config.authorization_endpoint,` +
+		` projections.idps2_oidc_config.token_endpoint,` +
+		` projections.idps2_jwt_config.idp_id,` +
+		` projections.idps2_jwt_config.issuer,` +
+		` projections.idps2_jwt_config.keys_endpoint,` +
+		` projections.idps2_jwt_config.header_name,` +
+		` projections.idps2_jwt_config.endpoint,` +
+		` COUNT(*) OVER ()` +
+		` FROM projections.idps2` +
+		` LEFT JOIN projections.idps2_oidc_config ON projections.idps2.id = projections.idps2_oidc_config.idp_id AND projections.idps2.instance_id = projections.idps2_oidc_config.instance_id` +
+		` LEFT JOIN projections.idps2_jwt_config ON projections.idps2.id = projections.idps2_jwt_config.idp_id AND projections.idps2.instance_id = projections.idps2_jwt_config.instance_id`
+	idpsCols = []string{
+		"id",
+		"resource_owner",
+		"creation_date",
+		"change_date",
+		"sequence",
+		"state",
+		"name",
+		"styling_type",
+		"owner_type",
+		"auto_register",
+		// oidc config
+		"idp_id",
+		"client_id",
+		"client_secret",
+		"issuer",
+		"scopes",
+		"display_name_mapping",
+		"username_mapping",
+		"authorization_endpoint",
+		"token_endpoint",
+		// jwt config
+		"idp_id",
+		"issuer",
+		"keys_endpoint",
+		"header_name",
+		"endpoint",
+		"count",
+	}
+)
+
 func Test_IDPPrepares(t *testing.T) {
 	type want struct {
 		sqlExpectations sqlExpectation
@@ -30,33 +145,7 @@ func Test_IDPPrepares(t *testing.T) {
 			prepare: prepareIDPByIDQuery,
 			want: want{
 				sqlExpectations: mockQuery(
-					regexp.QuoteMeta(`SELECT projections.idps2.id,`+
+					regexp.QuoteMeta(idpQuery),
-						` projections.idps2.resource_owner,`+
-						` projections.idps2.creation_date,`+
-						` projections.idps2.change_date,`+
-						` projections.idps2.sequence,`+
-						` projections.idps2.state,`+
-						` projections.idps2.name,`+
-						` projections.idps2.styling_type,`+
-						` projections.idps2.owner_type,`+
-						` projections.idps2.auto_register,`+
-						` projections.idps2_oidc_config.idp_id,`+
-						` projections.idps2_oidc_config.client_id,`+
-						` projections.idps2_oidc_config.client_secret,`+
-						` projections.idps2_oidc_config.issuer,`+
-						` projections.idps2_oidc_config.scopes,`+
-						` projections.idps2_oidc_config.display_name_mapping,`+
-						` projections.idps2_oidc_config.username_mapping,`+
-						` projections.idps2_oidc_config.authorization_endpoint,`+
-						` projections.idps2_oidc_config.token_endpoint,`+
-						` projections.idps2_jwt_config.idp_id,`+
-						` projections.idps2_jwt_config.issuer,`+
-						` projections.idps2_jwt_config.keys_endpoint,`+
-						` projections.idps2_jwt_config.header_name,`+
-						` projections.idps2_jwt_config.endpoint`+
-						` FROM projections.idps2`+
-						` LEFT JOIN projections.idps2_oidc_config ON projections.idps2.id = projections.idps2_oidc_config.idp_id`+
-						` LEFT JOIN projections.idps2_jwt_config ON projections.idps2.id = projections.idps2_jwt_config.idp_id`),
 					nil,
 					nil,
 				),
@@ -74,61 +163,8 @@ func Test_IDPPrepares(t *testing.T) {
 			prepare: prepareIDPByIDQuery,
 			want: want{
 				sqlExpectations: mockQuery(
-					regexp.QuoteMeta(`SELECT projections.idps2.id,`+
+					regexp.QuoteMeta(idpQuery),
-						` projections.idps2.resource_owner,`+
+					idpCols,
-						` projections.idps2.creation_date,`+
-						` projections.idps2.change_date,`+
-						` projections.idps2.sequence,`+
-						` projections.idps2.state,`+
-						` projections.idps2.name,`+
-						` projections.idps2.styling_type,`+
-						` projections.idps2.owner_type,`+
-						` projections.idps2.auto_register,`+
-						` projections.idps2_oidc_config.idp_id,`+
-						` projections.idps2_oidc_config.client_id,`+
-						` projections.idps2_oidc_config.client_secret,`+
-						` projections.idps2_oidc_config.issuer,`+
-						` projections.idps2_oidc_config.scopes,`+
-						` projections.idps2_oidc_config.display_name_mapping,`+
-						` projections.idps2_oidc_config.username_mapping,`+
-						` projections.idps2_oidc_config.authorization_endpoint,`+
-						` projections.idps2_oidc_config.token_endpoint,`+
-						` projections.idps2_jwt_config.idp_id,`+
-						` projections.idps2_jwt_config.issuer,`+
-						` projections.idps2_jwt_config.keys_endpoint,`+
-						` projections.idps2_jwt_config.header_name,`+
-						` projections.idps2_jwt_config.endpoint`+
-						` FROM projections.idps2`+
-						` LEFT JOIN projections.idps2_oidc_config ON projections.idps2.id = projections.idps2_oidc_config.idp_id`+
-						` LEFT JOIN projections.idps2_jwt_config ON projections.idps2.id = projections.idps2_jwt_config.idp_id`),
-					[]string{
-						"id",
-						"resource_owner",
-						"creation_date",
-						"change_date",
-						"sequence",
-						"state",
-						"name",
-						"styling_type",
-						"owner_type",
-						"auto_register",
-						// oidc config
-						"idp_id",
-						"client_id",
-						"client_secret",
-						"issuer",
-						"scopes",
-						"display_name_mapping",
-						"username_mapping",
-						"authorization_endpoint",
-						"token_endpoint",
-						// jwt config
-						"idp_id",
-						"issuer",
-						"keys_endpoint",
-						"header_name",
-						"endpoint",
-					},
 					[]driver.Value{
 						"idp-id",
 						"ro",
@@ -188,61 +224,8 @@ func Test_IDPPrepares(t *testing.T) {
 			prepare: prepareIDPByIDQuery,
 			want: want{
 				sqlExpectations: mockQuery(
-					regexp.QuoteMeta(`SELECT projections.idps2.id,`+
+					regexp.QuoteMeta(idpQuery),
-						` projections.idps2.resource_owner,`+
+					idpCols,
-						` projections.idps2.creation_date,`+
-						` projections.idps2.change_date,`+
-						` projections.idps2.sequence,`+
-						` projections.idps2.state,`+
-						` projections.idps2.name,`+
-						` projections.idps2.styling_type,`+
-						` projections.idps2.owner_type,`+
-						` projections.idps2.auto_register,`+
-						` projections.idps2_oidc_config.idp_id,`+
-						` projections.idps2_oidc_config.client_id,`+
-						` projections.idps2_oidc_config.client_secret,`+
-						` projections.idps2_oidc_config.issuer,`+
-						` projections.idps2_oidc_config.scopes,`+
-						` projections.idps2_oidc_config.display_name_mapping,`+
-						` projections.idps2_oidc_config.username_mapping,`+
-						` projections.idps2_oidc_config.authorization_endpoint,`+
-						` projections.idps2_oidc_config.token_endpoint,`+
-						` projections.idps2_jwt_config.idp_id,`+
-						` projections.idps2_jwt_config.issuer,`+
-						` projections.idps2_jwt_config.keys_endpoint,`+
-						` projections.idps2_jwt_config.header_name,`+
-						` projections.idps2_jwt_config.endpoint`+
-						` FROM projections.idps2`+
-						` LEFT JOIN projections.idps2_oidc_config ON projections.idps2.id = projections.idps2_oidc_config.idp_id`+
-						` LEFT JOIN projections.idps2_jwt_config ON projections.idps2.id = projections.idps2_jwt_config.idp_id`),
-					[]string{
-						"id",
-						"resource_owner",
-						"creation_date",
-						"change_date",
-						"sequence",
-						"state",
-						"name",
-						"styling_type",
-						"owner_type",
-						"auto_register",
-						// oidc config
-						"idp_id",
-						"client_id",
-						"client_secret",
-						"issuer",
-						"scopes",
-						"display_name_mapping",
-						"username_mapping",
-						"authorization_endpoint",
-						"token_endpoint",
-						// jwt config
-						"idp_id",
-						"issuer",
-						"keys_endpoint",
-						"header_name",
-						"endpoint",
-					},
 					[]driver.Value{
 						"idp-id",
 						"ro",
@@ -298,61 +281,8 @@ func Test_IDPPrepares(t *testing.T) {
 			prepare: prepareIDPByIDQuery,
 			want: want{
 				sqlExpectations: mockQuery(
-					regexp.QuoteMeta(`SELECT projections.idps2.id,`+
+					regexp.QuoteMeta(idpQuery),
-						` projections.idps2.resource_owner,`+
+					idpCols,
-						` projections.idps2.creation_date,`+
-						` projections.idps2.change_date,`+
-						` projections.idps2.sequence,`+
-						` projections.idps2.state,`+
-						` projections.idps2.name,`+
-						` projections.idps2.styling_type,`+
-						` projections.idps2.owner_type,`+
-						` projections.idps2.auto_register,`+
-						` projections.idps2_oidc_config.idp_id,`+
-						` projections.idps2_oidc_config.client_id,`+
-						` projections.idps2_oidc_config.client_secret,`+
-						` projections.idps2_oidc_config.issuer,`+
-						` projections.idps2_oidc_config.scopes,`+
-						` projections.idps2_oidc_config.display_name_mapping,`+
-						` projections.idps2_oidc_config.username_mapping,`+
-						` projections.idps2_oidc_config.authorization_endpoint,`+
-						` projections.idps2_oidc_config.token_endpoint,`+
-						` projections.idps2_jwt_config.idp_id,`+
-						` projections.idps2_jwt_config.issuer,`+
-						` projections.idps2_jwt_config.keys_endpoint,`+
-						` projections.idps2_jwt_config.header_name,`+
-						` projections.idps2_jwt_config.endpoint`+
-						` FROM projections.idps2`+
-						` LEFT JOIN projections.idps2_oidc_config ON projections.idps2.id = projections.idps2_oidc_config.idp_id`+
-						` LEFT JOIN projections.idps2_jwt_config ON projections.idps2.id = projections.idps2_jwt_config.idp_id`),
-					[]string{
-						"id",
-						"resource_owner",
-						"creation_date",
-						"change_date",
-						"sequence",
-						"state",
-						"name",
-						"styling_type",
-						"owner_type",
-						"auto_register",
-						// oidc config
-						"idp_id",
-						"client_id",
-						"client_secret",
-						"issuer",
-						"scopes",
-						"display_name_mapping",
-						"username_mapping",
-						"authorization_endpoint",
-						"token_endpoint",
-						// jwt config
-						"idp_id",
-						"issuer",
-						"keys_endpoint",
-						"header_name",
-						"endpoint",
-					},
 					[]driver.Value{
 						"idp-id",
 						"ro",
@@ -401,33 +331,7 @@ func Test_IDPPrepares(t *testing.T) {
 			prepare: prepareIDPByIDQuery,
 			want: want{
 				sqlExpectations: mockQueryErr(
-					regexp.QuoteMeta(`SELECT projections.idps2.id,`+
+					regexp.QuoteMeta(idpQuery),
-						` projections.idps2.resource_owner,`+
-						` projections.idps2.creation_date,`+
-						` projections.idps2.change_date,`+
-						` projections.idps2.sequence,`+
-						` projections.idps2.state,`+
-						` projections.idps2.name,`+
-						` projections.idps2.styling_type,`+
-						` projections.idps2.owner_type,`+
-						` projections.idps2.auto_register,`+
-						` projections.idps2_oidc_config.idp_id,`+
-						` projections.idps2_oidc_config.client_id,`+
-						` projections.idps2_oidc_config.client_secret,`+
-						` projections.idps2_oidc_config.issuer,`+
-						` projections.idps2_oidc_config.scopes,`+
-						` projections.idps2_oidc_config.display_name_mapping,`+
-						` projections.idps2_oidc_config.username_mapping,`+
-						` projections.idps2_oidc_config.authorization_endpoint,`+
-						` projections.idps2_oidc_config.token_endpoint,`+
-						` projections.idps2_jwt_config.idp_id,`+
-						` projections.idps2_jwt_config.issuer,`+
-						` projections.idps2_jwt_config.keys_endpoint,`+
-						` projections.idps2_jwt_config.header_name,`+
-						` projections.idps2_jwt_config.endpoint`+
-						` FROM projections.idps2`+
-						` LEFT JOIN projections.idps2_oidc_config ON projections.idps2.id = projections.idps2_oidc_config.idp_id`+
-						` LEFT JOIN projections.idps2_jwt_config ON projections.idps2.id = projections.idps2_jwt_config.idp_id`),
 					sql.ErrConnDone,
 				),
 				err: func(err error) (error, bool) {
@@ -444,34 +348,7 @@ func Test_IDPPrepares(t *testing.T) {
 			prepare: prepareIDPsQuery,
 			want: want{
 				sqlExpectations: mockQueries(
-					regexp.QuoteMeta(`SELECT projections.idps2.id,`+
+					regexp.QuoteMeta(idpsQuery),
-						` projections.idps2.resource_owner,`+
-						` projections.idps2.creation_date,`+
-						` projections.idps2.change_date,`+
-						` projections.idps2.sequence,`+
-						` projections.idps2.state,`+
-						` projections.idps2.name,`+
-						` projections.idps2.styling_type,`+
-						` projections.idps2.owner_type,`+
-						` projections.idps2.auto_register,`+
-						` projections.idps2_oidc_config.idp_id,`+
-						` projections.idps2_oidc_config.client_id,`+
-						` projections.idps2_oidc_config.client_secret,`+
-						` projections.idps2_oidc_config.issuer,`+
-						` projections.idps2_oidc_config.scopes,`+
-						` projections.idps2_oidc_config.display_name_mapping,`+
-						` projections.idps2_oidc_config.username_mapping,`+
-						` projections.idps2_oidc_config.authorization_endpoint,`+
-						` projections.idps2_oidc_config.token_endpoint,`+
-						` projections.idps2_jwt_config.idp_id,`+
-						` projections.idps2_jwt_config.issuer,`+
-						` projections.idps2_jwt_config.keys_endpoint,`+
-						` projections.idps2_jwt_config.header_name,`+
-						` projections.idps2_jwt_config.endpoint,`+
-						` COUNT(*) OVER ()`+
-						` FROM projections.idps2`+
-						` LEFT JOIN projections.idps2_oidc_config ON projections.idps2.id = projections.idps2_oidc_config.idp_id`+
-						` LEFT JOIN projections.idps2_jwt_config ON projections.idps2.id = projections.idps2_jwt_config.idp_id`),
 					nil,
 					nil,
 				),
@@ -489,63 +366,8 @@ func Test_IDPPrepares(t *testing.T) {
 			prepare: prepareIDPsQuery,
 			want: want{
 				sqlExpectations: mockQueries(
-					regexp.QuoteMeta(`SELECT projections.idps2.id,`+
+					regexp.QuoteMeta(idpsQuery),
-						` projections.idps2.resource_owner,`+
+					idpsCols,
-						` projections.idps2.creation_date,`+
-						` projections.idps2.change_date,`+
-						` projections.idps2.sequence,`+
-						` projections.idps2.state,`+
-						` projections.idps2.name,`+
-						` projections.idps2.styling_type,`+
-						` projections.idps2.owner_type,`+
-						` projections.idps2.auto_register,`+
-						` projections.idps2_oidc_config.idp_id,`+
-						` projections.idps2_oidc_config.client_id,`+
-						` projections.idps2_oidc_config.client_secret,`+
-						` projections.idps2_oidc_config.issuer,`+
-						` projections.idps2_oidc_config.scopes,`+
-						` projections.idps2_oidc_config.display_name_mapping,`+
-						` projections.idps2_oidc_config.username_mapping,`+
-						` projections.idps2_oidc_config.authorization_endpoint,`+
-						` projections.idps2_oidc_config.token_endpoint,`+
-						` projections.idps2_jwt_config.idp_id,`+
-						` projections.idps2_jwt_config.issuer,`+
-						` projections.idps2_jwt_config.keys_endpoint,`+
-						` projections.idps2_jwt_config.header_name,`+
-						` projections.idps2_jwt_config.endpoint,`+
-						` COUNT(*) OVER ()`+
-						` FROM projections.idps2`+
-						` LEFT JOIN projections.idps2_oidc_config ON projections.idps2.id = projections.idps2_oidc_config.idp_id`+
-						` LEFT JOIN projections.idps2_jwt_config ON projections.idps2.id = projections.idps2_jwt_config.idp_id`),
-					[]string{
-						"id",
-						"resource_owner",
-						"creation_date",
-						"change_date",
-						"sequence",
-						"state",
-						"name",
-						"styling_type",
-						"owner_type",
-						"auto_register",
-						// oidc config
-						"idp_id",
-						"client_id",
-						"client_secret",
-						"issuer",
-						"scopes",
-						"display_name_mapping",
-						"username_mapping",
-						"authorization_endpoint",
-						"token_endpoint",
-						// jwt config
-						"idp_id",
-						"issuer",
-						"keys_endpoint",
-						"header_name",
-						"endpoint",
-						"count",
-					},
 					[][]driver.Value{
 						{
 							"idp-id",
@@ -614,62 +436,8 @@ func Test_IDPPrepares(t *testing.T) {
 			prepare: prepareIDPsQuery,
 			want: want{
 				sqlExpectations: mockQueries(
-					regexp.QuoteMeta(`SELECT projections.idps2.id,`+
+					regexp.QuoteMeta(idpsQuery),
-						` projections.idps2.resource_owner,`+
+					idpsCols,
-						` projections.idps2.creation_date,`+
-						` projections.idps2.change_date,`+
-						` projections.idps2.sequence,`+
-						` projections.idps2.state,`+
-						` projections.idps2.name,`+
-						` projections.idps2.styling_type,`+
-						` projections.idps2.owner_type,`+
-						` projections.idps2.auto_register,`+
-						` projections.idps2_oidc_config.idp_id,`+
-						` projections.idps2_oidc_config.client_id,`+
-						` projections.idps2_oidc_config.client_secret,`+
-						` projections.idps2_oidc_config.issuer,`+
-						` projections.idps2_oidc_config.scopes,`+
-						` projections.idps2_oidc_config.display_name_mapping,`+
-						` projections.idps2_oidc_config.username_mapping,`+
-						` projections.idps2_oidc_config.authorization_endpoint,`+
-						` projections.idps2_oidc_config.token_endpoint,`+
-						` projections.idps2_jwt_config.idp_id,`+
-						` projections.idps2_jwt_config.issuer,`+
-						` projections.idps2_jwt_config.keys_endpoint,`+
-						` projections.idps2_jwt_config.header_name,`+
-						` projections.idps2_jwt_config.endpoint,`+
-						` COUNT(*) OVER ()`+
-						` FROM projections.idps2`+
-						` LEFT JOIN projections.idps2_oidc_config ON projections.idps2.id = projections.idps2_oidc_config.idp_id`+
-						` LEFT JOIN projections.idps2_jwt_config ON projections.idps2.id = projections.idps2_jwt_config.idp_id`),
-					[]string{
-						"id",
-						"resource_owner",
-						"creation_date",
-						"change_date",
-						"sequence",
-						"state",
-						"name",
-						"styling_type",
-						"owner_type",
-						"auto_register",
-						// oidc config
-						"idp_id",
-						"client_id",
-						"client_secret",
-						"issuer",
-						"scopes",
-						"display_name_mapping",
-						"username_mapping",
-						"authorization_endpoint",
-						"token_endpoint",
-						"idp_id",
-						"issuer",
-						"keys_endpoint",
-						"header_name",
-						"endpoint",
-						"count",
-					},
 					[][]driver.Value{
 						{
 							"idp-id",
@@ -734,62 +502,8 @@ func Test_IDPPrepares(t *testing.T) {
 			prepare: prepareIDPsQuery,
 			want: want{
 				sqlExpectations: mockQueries(
-					regexp.QuoteMeta(`SELECT projections.idps2.id,`+
+					regexp.QuoteMeta(idpsQuery),
-						` projections.idps2.resource_owner,`+
+					idpsCols,
-						` projections.idps2.creation_date,`+
-						` projections.idps2.change_date,`+
-						` projections.idps2.sequence,`+
-						` projections.idps2.state,`+
-						` projections.idps2.name,`+
-						` projections.idps2.styling_type,`+
-						` projections.idps2.owner_type,`+
-						` projections.idps2.auto_register,`+
-						` projections.idps2_oidc_config.idp_id,`+
-						` projections.idps2_oidc_config.client_id,`+
-						` projections.idps2_oidc_config.client_secret,`+
-						` projections.idps2_oidc_config.issuer,`+
-						` projections.idps2_oidc_config.scopes,`+
-						` projections.idps2_oidc_config.display_name_mapping,`+
-						` projections.idps2_oidc_config.username_mapping,`+
-						` projections.idps2_oidc_config.authorization_endpoint,`+
-						` projections.idps2_oidc_config.token_endpoint,`+
-						` projections.idps2_jwt_config.idp_id,`+
-						` projections.idps2_jwt_config.issuer,`+
-						` projections.idps2_jwt_config.keys_endpoint,`+
-						` projections.idps2_jwt_config.header_name,`+
-						` projections.idps2_jwt_config.endpoint,`+
-						` COUNT(*) OVER ()`+
-						` FROM projections.idps2`+
-						` LEFT JOIN projections.idps2_oidc_config ON projections.idps2.id = projections.idps2_oidc_config.idp_id`+
-						` LEFT JOIN projections.idps2_jwt_config ON projections.idps2.id = projections.idps2_jwt_config.idp_id`),
-					[]string{
-						"id",
-						"resource_owner",
-						"creation_date",
-						"change_date",
-						"sequence",
-						"state",
-						"name",
-						"styling_type",
-						"owner_type",
-						"auto_register",
-						// oidc config
-						"idp_id",
-						"client_id",
-						"client_secret",
-						"issuer",
-						"scopes",
-						"display_name_mapping",
-						"username_mapping",
-						"authorization_endpoint",
-						"token_endpoint",
-						"idp_id",
-						"issuer",
-						"keys_endpoint",
-						"header_name",
-						"endpoint",
-						"count",
-					},
 					[][]driver.Value{
 						{
 							"idp-id",
@@ -847,62 +561,8 @@ func Test_IDPPrepares(t *testing.T) {
 			prepare: prepareIDPsQuery,
 			want: want{
 				sqlExpectations: mockQueries(
-					regexp.QuoteMeta(`SELECT projections.idps2.id,`+
+					regexp.QuoteMeta(idpsQuery),
-						` projections.idps2.resource_owner,`+
+					idpsCols,
-						` projections.idps2.creation_date,`+
-						` projections.idps2.change_date,`+
-						` projections.idps2.sequence,`+
-						` projections.idps2.state,`+
-						` projections.idps2.name,`+
-						` projections.idps2.styling_type,`+
-						` projections.idps2.owner_type,`+
-						` projections.idps2.auto_register,`+
-						` projections.idps2_oidc_config.idp_id,`+
-						` projections.idps2_oidc_config.client_id,`+
-						` projections.idps2_oidc_config.client_secret,`+
-						` projections.idps2_oidc_config.issuer,`+
-						` projections.idps2_oidc_config.scopes,`+
-						` projections.idps2_oidc_config.display_name_mapping,`+
-						` projections.idps2_oidc_config.username_mapping,`+
-						` projections.idps2_oidc_config.authorization_endpoint,`+
-						` projections.idps2_oidc_config.token_endpoint,`+
-						` projections.idps2_jwt_config.idp_id,`+
-						` projections.idps2_jwt_config.issuer,`+
-						` projections.idps2_jwt_config.keys_endpoint,`+
-						` projections.idps2_jwt_config.header_name,`+
-						` projections.idps2_jwt_config.endpoint,`+
-						` COUNT(*) OVER ()`+
-						` FROM projections.idps2`+
-						` LEFT JOIN projections.idps2_oidc_config ON projections.idps2.id = projections.idps2_oidc_config.idp_id`+
-						` LEFT JOIN projections.idps2_jwt_config ON projections.idps2.id = projections.idps2_jwt_config.idp_id`),
-					[]string{
-						"id",
-						"resource_owner",
-						"creation_date",
-						"change_date",
-						"sequence",
-						"state",
-						"name",
-						"styling_type",
-						"owner_type",
-						"auto_register",
-						// oidc config
-						"idp_id",
-						"client_id",
-						"client_secret",
-						"issuer",
-						"scopes",
-						"display_name_mapping",
-						"username_mapping",
-						"authorization_endpoint",
-						"token_endpoint",
-						"idp_id",
-						"issuer",
-						"keys_endpoint",
-						"header_name",
-						"endpoint",
-						"count",
-					},
 					[][]driver.Value{
 						{
 							"idp-id-1",
@@ -1058,34 +718,7 @@ func Test_IDPPrepares(t *testing.T) {
 			prepare: prepareIDPsQuery,
 			want: want{
 				sqlExpectations: mockQueryErr(
-					regexp.QuoteMeta(`SELECT projections.idps2.id,`+
+					regexp.QuoteMeta(idpsQuery),
-						` projections.idps2.resource_owner,`+
-						` projections.idps2.creation_date,`+
-						` projections.idps2.change_date,`+
-						` projections.idps2.sequence,`+
-						` projections.idps2.state,`+
-						` projections.idps2.name,`+
-						` projections.idps2.styling_type,`+
-						` projections.idps2.owner_type,`+
-						` projections.idps2.auto_register,`+
-						` projections.idps2_oidc_config.idp_id,`+
-						` projections.idps2_oidc_config.client_id,`+
-						` projections.idps2_oidc_config.client_secret,`+
-						` projections.idps2_oidc_config.issuer,`+
-						` projections.idps2_oidc_config.scopes,`+
-						` projections.idps2_oidc_config.display_name_mapping,`+
-						` projections.idps2_oidc_config.username_mapping,`+
-						` projections.idps2_oidc_config.authorization_endpoint,`+
-						` projections.idps2_oidc_config.token_endpoint,`+
-						` projections.idps2_jwt_config.idp_id,`+
-						` projections.idps2_jwt_config.issuer,`+
-						` projections.idps2_jwt_config.keys_endpoint,`+
-						` projections.idps2_jwt_config.header_name,`+
-						` projections.idps2_jwt_config.endpoint,`+
-						` COUNT(*) OVER ()`+
-						` FROM projections.idps2`+
-						` LEFT JOIN projections.idps2_oidc_config ON projections.idps2.id = projections.idps2_oidc_config.idp_id`+
-						` LEFT JOIN projections.idps2_jwt_config ON projections.idps2.id = projections.idps2_jwt_config.idp_id`),
 					sql.ErrConnDone,
 				),
 				err: func(err error) (error, bool) {

internal/query/idp_user_link.go

@@ -42,7 +42,8 @@ func (q *IDPUserLinksSearchQuery) toQuery(query sq.SelectBuilder) sq.SelectBuild
 
 var (
 	idpUserLinkTable = table{
-		name: projection.IDPUserLinkTable,
+		name:          projection.IDPUserLinkTable,
+		instanceIDCol: projection.IDPUserLinkInstanceIDCol,
 	}
 	IDPUserLinkIDPIDCol = Column{
 		name:  projection.IDPUserLinkIDPIDCol,

internal/query/instance.go

@@ -21,7 +21,8 @@ const (
 
 var (
 	instanceTable = table{
-		name: projection.InstanceProjectionTable,
+		name:          projection.InstanceProjectionTable,
+		instanceIDCol: projection.InstanceColumnID,
 	}
 	InstanceColumnID = Column{
 		name:  projection.InstanceColumnID,

internal/query/instance_domain.go

@@ -139,7 +139,8 @@ func prepareInstanceDomainsQuery() (sq.SelectBuilder, func(*sql.Rows) (*Instance
 
 var (
 	instanceDomainsTable = table{
-		name: projection.InstanceDomainTable,
+		name:          projection.InstanceDomainTable,
+		instanceIDCol: projection.InstanceDomainInstanceIDCol,
 	}
 
 	InstanceDomainCreationDateCol = Column{

internal/query/instance_test.go

@@ -14,6 +14,68 @@ import (
 	errs "github.com/zitadel/zitadel/internal/errors"
 )
 
+var (
+	instanceQuery = `SELECT projections.instances.id,` +
+		` projections.instances.creation_date,` +
+		` projections.instances.change_date,` +
+		` projections.instances.sequence,` +
+		` projections.instances.default_org_id,` +
+		` projections.instances.iam_project_id,` +
+		` projections.instances.console_client_id,` +
+		` projections.instances.console_app_id,` +
+		` projections.instances.default_language` +
+		` FROM projections.instances`
+	instanceCols = []string{
+		"id",
+		"creation_date",
+		"change_date",
+		"sequence",
+		"default_org_id",
+		"iam_project_id",
+		"console_client_id",
+		"console_app_id",
+		"default_language",
+	}
+	instancesQuery = `SELECT f.count, f.id,` +
+		` projections.instances.creation_date,` +
+		` projections.instances.change_date,` +
+		` projections.instances.sequence,` +
+		` projections.instances.name,` +
+		` projections.instances.default_org_id,` +
+		` projections.instances.iam_project_id,` +
+		` projections.instances.console_client_id,` +
+		` projections.instances.console_app_id,` +
+		` projections.instances.default_language,` +
+		` projections.instance_domains.domain,` +
+		` projections.instance_domains.is_primary,` +
+		` projections.instance_domains.is_generated,` +
+		` projections.instance_domains.creation_date,` +
+		` projections.instance_domains.change_date, ` +
+		` projections.instance_domains.sequence` +
+		` FROM (SELECT projections.instances.id, COUNT(*) OVER () FROM projections.instances) AS f` +
+		` LEFT JOIN projections.instances ON f.id = projections.instances.id AND f.id = projections.instances.id` +
+		` LEFT JOIN projections.instance_domains ON f.id = projections.instance_domains.instance_id AND f.id = projections.instance_domains.instance_id`
+	instancesCols = []string{
+		"count",
+		"id",
+		"creation_date",
+		"change_date",
+		"sequence",
+		"name",
+		"default_org_id",
+		"iam_project_id",
+		"console_client_id",
+		"console_app_id",
+		"default_language",
+		"domain",
+		"is_primary",
+		"is_generated",
+		"creation_date",
+		"change_date",
+		"sequence",
+	}
+)
+
 func Test_InstancePrepares(t *testing.T) {
 	type want struct {
 		sqlExpectations sqlExpectation
@@ -32,16 +94,7 @@ func Test_InstancePrepares(t *testing.T) {
 			},
 			want: want{
 				sqlExpectations: mockQueries(
-					regexp.QuoteMeta(`SELECT projections.instances.id,`+
+					regexp.QuoteMeta(instanceQuery),
-						` projections.instances.creation_date,`+
-						` projections.instances.change_date,`+
-						` projections.instances.sequence,`+
-						` projections.instances.default_org_id,`+
-						` projections.instances.iam_project_id,`+
-						` projections.instances.console_client_id,`+
-						` projections.instances.console_app_id,`+
-						` projections.instances.default_language`+
-						` FROM projections.instances`),
 					nil,
 					nil,
 				),
@@ -61,27 +114,8 @@ func Test_InstancePrepares(t *testing.T) {
 			},
 			want: want{
 				sqlExpectations: mockQuery(
-					regexp.QuoteMeta(`SELECT projections.instances.id,`+
+					regexp.QuoteMeta(instanceQuery),
-						` projections.instances.creation_date,`+
+					instanceCols,
-						` projections.instances.change_date,`+
-						` projections.instances.sequence,`+
-						` projections.instances.default_org_id,`+
-						` projections.instances.iam_project_id,`+
-						` projections.instances.console_client_id,`+
-						` projections.instances.console_app_id,`+
-						` projections.instances.default_language`+
-						` FROM projections.instances`),
-					[]string{
-						"id",
-						"creation_date",
-						"change_date",
-						"sequence",
-						"default_org_id",
-						"iam_project_id",
-						"console_client_id",
-						"console_app_id",
-						"default_language",
-					},
 					[]driver.Value{
 						"id",
 						testNow,
@@ -114,16 +148,7 @@ func Test_InstancePrepares(t *testing.T) {
 			},
 			want: want{
 				sqlExpectations: mockQueryErr(
-					regexp.QuoteMeta(`SELECT projections.instances.id,`+
+					regexp.QuoteMeta(instanceQuery),
-						` projections.instances.creation_date,`+
-						` projections.instances.change_date,`+
-						` projections.instances.sequence,`+
-						` projections.instances.default_org_id,`+
-						` projections.instances.iam_project_id,`+
-						` projections.instances.console_client_id,`+
-						` projections.instances.console_app_id,`+
-						` projections.instances.default_language`+
-						` FROM projections.instances`),
 					sql.ErrConnDone,
 				),
 				err: func(err error) (error, bool) {
@@ -143,25 +168,7 @@ func Test_InstancePrepares(t *testing.T) {
 			},
 			want: want{
 				sqlExpectations: mockQueries(
-					regexp.QuoteMeta(`SELECT f.count, f.id,`+
+					regexp.QuoteMeta(instancesQuery),
-						` projections.instances.creation_date,`+
-						` projections.instances.change_date,`+
-						` projections.instances.sequence,`+
-						` projections.instances.name,`+
-						` projections.instances.default_org_id,`+
-						` projections.instances.iam_project_id,`+
-						` projections.instances.console_client_id,`+
-						` projections.instances.console_app_id,`+
-						` projections.instances.default_language,`+
-						` projections.instance_domains.domain,`+
-						` projections.instance_domains.is_primary,`+
-						` projections.instance_domains.is_generated,`+
-						` projections.instance_domains.creation_date,`+
-						` projections.instance_domains.change_date, `+
-						` projections.instance_domains.sequence`+
-						` FROM (SELECT projections.instances.id, COUNT(*) OVER () FROM projections.instances) AS f`+
-						` LEFT JOIN projections.instances ON f.id = projections.instances.id`+
-						` LEFT JOIN projections.instance_domains ON f.id = projections.instance_domains.instance_id`),
 					nil,
 					nil,
 				),
@@ -176,44 +183,8 @@ func Test_InstancePrepares(t *testing.T) {
 			},
 			want: want{
 				sqlExpectations: mockQueries(
-					regexp.QuoteMeta(`SELECT f.count, f.id,`+
+					regexp.QuoteMeta(instancesQuery),
-						` projections.instances.creation_date,`+
+					instancesCols,
-						` projections.instances.change_date,`+
-						` projections.instances.sequence,`+
-						` projections.instances.name,`+
-						` projections.instances.default_org_id,`+
-						` projections.instances.iam_project_id,`+
-						` projections.instances.console_client_id,`+
-						` projections.instances.console_app_id,`+
-						` projections.instances.default_language,`+
-						` projections.instance_domains.domain,`+
-						` projections.instance_domains.is_primary,`+
-						` projections.instance_domains.is_generated,`+
-						` projections.instance_domains.creation_date,`+
-						` projections.instance_domains.change_date, `+
-						` projections.instance_domains.sequence`+
-						` FROM (SELECT projections.instances.id, COUNT(*) OVER () FROM projections.instances) AS f`+
-						` LEFT JOIN projections.instances ON f.id = projections.instances.id`+
-						` LEFT JOIN projections.instance_domains ON f.id = projections.instance_domains.instance_id`),
-					[]string{
-						"count",
-						"id",
-						"creation_date",
-						"change_date",
-						"sequence",
-						"name",
-						"default_org_id",
-						"iam_project_id",
-						"console_client_id",
-						"console_app_id",
-						"default_language",
-						"domain",
-						"is_primary",
-						"is_generated",
-						"creation_date",
-						"change_date",
-						"sequence",
-					},
 					[][]driver.Value{
 						{
 							"1",
@@ -276,44 +247,8 @@ func Test_InstancePrepares(t *testing.T) {
 			},
 			want: want{
 				sqlExpectations: mockQueries(
-					regexp.QuoteMeta(`SELECT f.count, f.id,`+
+					regexp.QuoteMeta(instancesQuery),
-						` projections.instances.creation_date,`+
+					instancesCols,
-						` projections.instances.change_date,`+
-						` projections.instances.sequence,`+
-						` projections.instances.name,`+
-						` projections.instances.default_org_id,`+
-						` projections.instances.iam_project_id,`+
-						` projections.instances.console_client_id,`+
-						` projections.instances.console_app_id,`+
-						` projections.instances.default_language,`+
-						` projections.instance_domains.domain,`+
-						` projections.instance_domains.is_primary,`+
-						` projections.instance_domains.is_generated,`+
-						` projections.instance_domains.creation_date,`+
-						` projections.instance_domains.change_date, `+
-						` projections.instance_domains.sequence`+
-						` FROM (SELECT projections.instances.id, COUNT(*) OVER () FROM projections.instances) AS f`+
-						` LEFT JOIN projections.instances ON f.id = projections.instances.id`+
-						` LEFT JOIN projections.instance_domains ON f.id = projections.instance_domains.instance_id`),
-					[]string{
-						"count",
-						"id",
-						"creation_date",
-						"change_date",
-						"sequence",
-						"name",
-						"default_org_id",
-						"iam_project_id",
-						"console_client_id",
-						"console_app_id",
-						"default_language",
-						"domain",
-						"is_primary",
-						"is_generated",
-						"creation_date",
-						"change_date",
-						"sequence",
-					},
 					[][]driver.Value{
 						{
 							2,
@@ -445,25 +380,7 @@ func Test_InstancePrepares(t *testing.T) {
 			},
 			want: want{
 				sqlExpectations: mockQueryErr(
-					regexp.QuoteMeta(`SELECT f.count, f.id,`+
+					regexp.QuoteMeta(instancesQuery),
-						` projections.instances.creation_date,`+
-						` projections.instances.change_date,`+
-						` projections.instances.sequence,`+
-						` projections.instances.name,`+
-						` projections.instances.default_org_id,`+
-						` projections.instances.iam_project_id,`+
-						` projections.instances.console_client_id,`+
-						` projections.instances.console_app_id,`+
-						` projections.instances.default_language,`+
-						` projections.instance_domains.domain,`+
-						` projections.instance_domains.is_primary,`+
-						` projections.instance_domains.is_generated,`+
-						` projections.instance_domains.creation_date,`+
-						` projections.instance_domains.change_date, `+
-						` projections.instance_domains.sequence`+
-						` FROM (SELECT projections.instances.id, COUNT(*) OVER () FROM projections.instances) AS f`+
-						` LEFT JOIN projections.instances ON f.id = projections.instances.id`+
-						` LEFT JOIN projections.instance_domains ON f.id = projections.instance_domains.instance_id`),
 					sql.ErrConnDone,
 				),
 				err: func(err error) (error, bool) {

internal/query/key.go

@@ -101,7 +101,8 @@ func (r *rsaPublicKey) Key() interface{} {
 
 var (
 	keyTable = table{
-		name: projection.KeyProjectionTable,
+		name:          projection.KeyProjectionTable,
+		instanceIDCol: projection.KeyColumnInstanceID,
 	}
 	KeyColID = Column{
 		name:  projection.KeyColumnID,
@@ -139,7 +140,8 @@ var (
 
 var (
 	keyPrivateTable = table{
-		name: projection.KeyPrivateTable,
+		name:          projection.KeyPrivateTable,
+		instanceIDCol: projection.KeyPrivateColumnInstanceID,
 	}
 	KeyPrivateColID = Column{
 		name:  projection.KeyPrivateColumnID,
@@ -157,7 +159,8 @@ var (
 
 var (
 	keyPublicTable = table{
-		name: projection.KeyPublicTable,
+		name:          projection.KeyPublicTable,
+		instanceIDCol: projection.KeyPrivateColumnInstanceID,
 	}
 	KeyPublicColID = Column{
 		name:  projection.KeyPublicColumnID,

internal/query/label_policy.go

@@ -130,7 +130,8 @@ func (q *Queries) DefaultPreviewLabelPolicy(ctx context.Context) (*LabelPolicy,
 
 var (
 	labelPolicyTable = table{
-		name: projection.LabelPolicyTable,
+		name:          projection.LabelPolicyTable,
+		instanceIDCol: projection.LabelPolicyInstanceIDCol,
 	}
 	LabelPolicyColCreationDate = Column{
 		name: projection.LabelPolicyCreationDateCol,

internal/query/lockout_policy.go

@@ -31,7 +31,8 @@ type LockoutPolicy struct {
 
 var (
 	lockoutTable = table{
-		name: projection.LockoutPolicyTable,
+		name:          projection.LockoutPolicyTable,
+		instanceIDCol: projection.LockoutPolicyInstanceIDCol,
 	}
 	LockoutColID = Column{
 		name:  projection.LockoutPolicyIDCol,

internal/query/login_name.go

@@ -4,7 +4,8 @@ import "github.com/zitadel/zitadel/internal/query/projection"
 
 var (
 	loginNameTable = table{
-		name: projection.LoginNameProjectionTable,
+		name:          projection.LoginNameProjectionTable,
+		instanceIDCol: projection.LoginNameUserInstanceIDCol,
 	}
 	LoginNameUserIDCol = Column{
 		name:  "user_id",

internal/query/login_policy.go

@@ -54,7 +54,8 @@ type MultiFactors struct {
 
 var (
 	loginPolicyTable = table{
-		name: projection.LoginPolicyTable,
+		name:          projection.LoginPolicyTable,
+		instanceIDCol: projection.LoginPolicyInstanceIDCol,
 	}
 	LoginPolicyColumnOrgID = Column{
 		name:  projection.LoginPolicyIDCol,

internal/query/login_policy_test.go

@@ -14,6 +14,70 @@ import (
 	errs "github.com/zitadel/zitadel/internal/errors"
 )
 
+var (
+	loginPolicyQuery = `SELECT projections.login_policies3.aggregate_id,` +
+		` projections.login_policies3.creation_date,` +
+		` projections.login_policies3.change_date,` +
+		` projections.login_policies3.sequence,` +
+		` projections.login_policies3.allow_register,` +
+		` projections.login_policies3.allow_username_password,` +
+		` projections.login_policies3.allow_external_idps,` +
+		` projections.login_policies3.force_mfa,` +
+		` projections.login_policies3.second_factors,` +
+		` projections.login_policies3.multi_factors,` +
+		` projections.login_policies3.passwordless_type,` +
+		` projections.login_policies3.is_default,` +
+		` projections.login_policies3.hide_password_reset,` +
+		` projections.login_policies3.ignore_unknown_usernames,` +
+		` projections.login_policies3.allow_domain_discovery,` +
+		` projections.login_policies3.disable_login_with_email,` +
+		` projections.login_policies3.disable_login_with_phone,` +
+		` projections.login_policies3.default_redirect_uri,` +
+		` projections.login_policies3.password_check_lifetime,` +
+		` projections.login_policies3.external_login_check_lifetime,` +
+		` projections.login_policies3.mfa_init_skip_lifetime,` +
+		` projections.login_policies3.second_factor_check_lifetime,` +
+		` projections.login_policies3.multi_factor_check_lifetime,` +
+		` projections.idp_login_policy_links3.idp_id,` +
+		` projections.idps2.name,` +
+		` projections.idps2.type` +
+		` FROM projections.login_policies3` +
+		` LEFT JOIN projections.idp_login_policy_links3 ON ` +
+		` projections.login_policies3.aggregate_id = projections.idp_login_policy_links3.aggregate_id` +
+		` AND projections.login_policies3.instance_id = projections.idp_login_policy_links3.instance_id` +
+		` LEFT JOIN projections.idps2 ON` +
+		` projections.idp_login_policy_links3.idp_id = projections.idps2.id` +
+		` AND projections.idp_login_policy_links3.instance_id = projections.idps2.instance_id`
+	loginPolicyCols = []string{
+		"aggregate_id",
+		"creation_date",
+		"change_date",
+		"sequence",
+		"allow_register",
+		"allow_username_password",
+		"allow_external_idps",
+		"force_mfa",
+		"second_factors",
+		"multi_factors",
+		"passwordless_type",
+		"is_default",
+		"hide_password_reset",
+		"ignore_unknown_usernames",
+		"allow_domain_discovery",
+		"disable_login_with_email",
+		"disable_login_with_phone",
+		"default_redirect_uri",
+		"password_check_lifetime",
+		"external_login_check_lifetime",
+		"mfa_init_skip_lifetime",
+		"second_factor_check_lifetime",
+		"multi_factor_check_lifetime",
+		"idp_id",
+		"name",
+		"type",
+	}
+)
+
 func Test_LoginPolicyPrepares(t *testing.T) {
 	type want struct {
 		sqlExpectations sqlExpectation
@@ -30,37 +94,7 @@ func Test_LoginPolicyPrepares(t *testing.T) {
 			prepare: prepareLoginPolicyQuery,
 			want: want{
 				sqlExpectations: mockQueries(
-					regexp.QuoteMeta(`SELECT projections.login_policies3.aggregate_id,`+
+					regexp.QuoteMeta(loginPolicyQuery),
-						` projections.login_policies3.creation_date,`+
-						` projections.login_policies3.change_date,`+
-						` projections.login_policies3.sequence,`+
-						` projections.login_policies3.allow_register,`+
-						` projections.login_policies3.allow_username_password,`+
-						` projections.login_policies3.allow_external_idps,`+
-						` projections.login_policies3.force_mfa,`+
-						` projections.login_policies3.second_factors,`+
-						` projections.login_policies3.multi_factors,`+
-						` projections.login_policies3.passwordless_type,`+
-						` projections.login_policies3.is_default,`+
-						` projections.login_policies3.hide_password_reset,`+
-						` projections.login_policies3.ignore_unknown_usernames,`+
-						` projections.login_policies3.allow_domain_discovery,`+
-						` projections.login_policies3.disable_login_with_email,`+
-						` projections.login_policies3.disable_login_with_phone,`+
-						` projections.login_policies3.default_redirect_uri,`+
-						` projections.login_policies3.password_check_lifetime,`+
-						` projections.login_policies3.external_login_check_lifetime,`+
-						` projections.login_policies3.mfa_init_skip_lifetime,`+
-						` projections.login_policies3.second_factor_check_lifetime,`+
-						` projections.login_policies3.multi_factor_check_lifetime,`+
-						` projections.idp_login_policy_links3.idp_id,`+
-						` projections.idps2.name,`+
-						` projections.idps2.type`+
-						` FROM projections.login_policies3`+
-						` LEFT JOIN projections.idp_login_policy_links3 ON `+
-						` projections.login_policies3.aggregate_id = projections.idp_login_policy_links3.aggregate_id`+
-						` LEFT JOIN projections.idps2 ON`+
-						` projections.idp_login_policy_links3.idp_id = projections.idps2.id`),
 					nil,
 					nil,
 				),
@@ -78,65 +112,8 @@ func Test_LoginPolicyPrepares(t *testing.T) {
 			prepare: prepareLoginPolicyQuery,
 			want: want{
 				sqlExpectations: mockQuery(
-					regexp.QuoteMeta(`SELECT projections.login_policies3.aggregate_id,`+
+					regexp.QuoteMeta(loginPolicyQuery),
-						` projections.login_policies3.creation_date,`+
+					loginPolicyCols,
-						` projections.login_policies3.change_date,`+
-						` projections.login_policies3.sequence,`+
-						` projections.login_policies3.allow_register,`+
-						` projections.login_policies3.allow_username_password,`+
-						` projections.login_policies3.allow_external_idps,`+
-						` projections.login_policies3.force_mfa,`+
-						` projections.login_policies3.second_factors,`+
-						` projections.login_policies3.multi_factors,`+
-						` projections.login_policies3.passwordless_type,`+
-						` projections.login_policies3.is_default,`+
-						` projections.login_policies3.hide_password_reset,`+
-						` projections.login_policies3.ignore_unknown_usernames,`+
-						` projections.login_policies3.allow_domain_discovery,`+
-						` projections.login_policies3.disable_login_with_email,`+
-						` projections.login_policies3.disable_login_with_phone,`+
-						` projections.login_policies3.default_redirect_uri,`+
-						` projections.login_policies3.password_check_lifetime,`+
-						` projections.login_policies3.external_login_check_lifetime,`+
-						` projections.login_policies3.mfa_init_skip_lifetime,`+
-						` projections.login_policies3.second_factor_check_lifetime,`+
-						` projections.login_policies3.multi_factor_check_lifetime,`+
-						` projections.idp_login_policy_links3.idp_id,`+
-						` projections.idps2.name,`+
-						` projections.idps2.type`+
-						` FROM projections.login_policies3`+
-						` LEFT JOIN projections.idp_login_policy_links3 ON `+
-						` projections.login_policies3.aggregate_id = projections.idp_login_policy_links3.aggregate_id`+
-						` LEFT JOIN projections.idps2 ON`+
-						` projections.idp_login_policy_links3.idp_id = projections.idps2.id`),
-					[]string{
-						"aggregate_id",
-						"creation_date",
-						"change_date",
-						"sequence",
-						"allow_register",
-						"allow_username_password",
-						"allow_external_idps",
-						"force_mfa",
-						"second_factors",
-						"multi_factors",
-						"passwordless_type",
-						"is_default",
-						"hide_password_reset",
-						"ignore_unknown_usernames",
-						"allow_domain_discovery",
-						"disable_login_with_email",
-						"disable_login_with_phone",
-						"default_redirect_uri",
-						"password_check_lifetime",
-						"external_login_check_lifetime",
-						"mfa_init_skip_lifetime",
-						"second_factor_check_lifetime",
-						"multi_factor_check_lifetime",
-						"idp_id",
-						"name",
-						"type",
-					},
 					[]driver.Value{
 						"ro",
 						testNow,
@@ -205,37 +182,7 @@ func Test_LoginPolicyPrepares(t *testing.T) {
 			prepare: prepareLoginPolicyQuery,
 			want: want{
 				sqlExpectations: mockQueryErr(
-					regexp.QuoteMeta(`SELECT projections.login_policies3.aggregate_id,`+
+					regexp.QuoteMeta(loginPolicyQuery),
-						` projections.login_policies3.creation_date,`+
-						` projections.login_policies3.change_date,`+
-						` projections.login_policies3.sequence,`+
-						` projections.login_policies3.allow_register,`+
-						` projections.login_policies3.allow_username_password,`+
-						` projections.login_policies3.allow_external_idps,`+
-						` projections.login_policies3.force_mfa,`+
-						` projections.login_policies3.second_factors,`+
-						` projections.login_policies3.multi_factors,`+
-						` projections.login_policies3.passwordless_type,`+
-						` projections.login_policies3.is_default,`+
-						` projections.login_policies3.hide_password_reset,`+
-						` projections.login_policies3.ignore_unknown_usernames,`+
-						` projections.login_policies3.allow_domain_discovery,`+
-						` projections.login_policies3.disable_login_with_email,`+
-						` projections.login_policies3.disable_login_with_phone,`+
-						` projections.login_policies3.default_redirect_uri,`+
-						` projections.login_policies3.password_check_lifetime,`+
-						` projections.login_policies3.external_login_check_lifetime,`+
-						` projections.login_policies3.mfa_init_skip_lifetime,`+
-						` projections.login_policies3.second_factor_check_lifetime,`+
-						` projections.login_policies3.multi_factor_check_lifetime,`+
-						` projections.idp_login_policy_links3.idp_id,`+
-						` projections.idps2.name,`+
-						` projections.idps2.type`+
-						` FROM projections.login_policies3`+
-						` LEFT JOIN projections.idp_login_policy_links3 ON `+
-						` projections.login_policies3.aggregate_id = projections.idp_login_policy_links3.aggregate_id`+
-						` LEFT JOIN projections.idps2 ON`+
-						` projections.idp_login_policy_links3.idp_id = projections.idps2.id`),
 					sql.ErrConnDone,
 				),
 				err: func(err error) (error, bool) {

internal/query/mail_template.go

@@ -27,7 +27,8 @@ type MailTemplate struct {
 
 var (
 	mailTemplateTable = table{
-		name: projection.MailTemplateTable,
+		name:          projection.MailTemplateTable,
+		instanceIDCol: projection.MailTemplateInstanceIDCol,
 	}
 	MailTemplateColAggregateID = Column{
 		name:  projection.MailTemplateAggregateIDCol,

internal/query/member.go

@@ -64,8 +64,9 @@ type Member struct {
 
 var (
 	memberTableAlias = table{
-		name:  "members",
+		name:          "members",
-		alias: "members",
+		alias:         "members",
+		instanceIDCol: projection.MemberInstanceID,
 	}
 	memberUserID = Column{
 		name:  projection.MemberUserIDCol,

internal/query/message_text.go

@@ -53,7 +53,8 @@ type MessageText struct {
 
 var (
 	messageTextTable = table{
-		name: projection.MessageTextTable,
+		name:          projection.MessageTextTable,
+		instanceIDCol: projection.MessageTextInstanceIDCol,
 	}
 	MessageTextColAggregateID = Column{
 		name:  projection.MessageTextAggregateIDCol,

internal/query/notification_provider.go

@@ -28,7 +28,8 @@ type DebugNotificationProvider struct {
 
 var (
 	notificationProviderTable = table{
-		name: projection.DebugNotificationProviderTable,
+		name:          projection.DebugNotificationProviderTable,
+		instanceIDCol: projection.DebugNotificationProviderInstanceIDCol,
 	}
 	NotificationProviderColumnAggID = Column{
 		name:  projection.DebugNotificationProviderAggIDCol,

internal/query/oidc_settings.go

@@ -15,7 +15,8 @@ import (
 
 var (
 	oidcSettingsTable = table{
-		name: projection.OIDCSettingsProjectionTable,
+		name:          projection.OIDCSettingsProjectionTable,
+		instanceIDCol: projection.OIDCSettingsColumnInstanceID,
 	}
 	OIDCSettingsColumnAggregateID = Column{
 		name:  projection.OIDCSettingsColumnAggregateID,

internal/query/org.go

@@ -16,7 +16,8 @@ import (
 
 var (
 	orgsTable = table{
-		name: projection.OrgProjectionTable,
+		name:          projection.OrgProjectionTable,
+		instanceIDCol: projection.OrgColumnInstanceID,
 	}
 	OrgColumnID = Column{
 		name:  projection.OrgColumnID,

internal/query/org_domain.go

@@ -125,7 +125,8 @@ func prepareDomainsQuery() (sq.SelectBuilder, func(*sql.Rows) (*Domains, error))
 
 var (
 	orgDomainsTable = table{
-		name: projection.OrgDomainTable,
+		name:          projection.OrgDomainTable,
+		instanceIDCol: projection.OrgDomainInstanceIDCol,
 	}
 
 	OrgDomainCreationDateCol = Column{

internal/query/org_member.go

@@ -13,8 +13,9 @@ import (
 
 var (
 	orgMemberTable = table{
-		name:  projection.OrgMemberProjectionTable,
+		name:          projection.OrgMemberProjectionTable,
-		alias: "members",
+		alias:         "members",
+		instanceIDCol: projection.MemberInstanceID,
 	}
 	OrgMemberUserID = Column{
 		name:  projection.MemberUserIDCol,

internal/query/org_member_test.go

@@ -30,10 +30,13 @@ var (
 		"FROM projections.org_members2 AS members " +
 		"LEFT JOIN projections.users4_humans " +
 		"ON members.user_id = projections.users4_humans.user_id " +
+		"AND members.instance_id = projections.users4_humans.instance_id " +
 		"LEFT JOIN projections.users4_machines " +
 		"ON members.user_id = projections.users4_machines.user_id " +
+		"AND members.instance_id = projections.users4_machines.instance_id " +
 		"LEFT JOIN projections.login_names " +
 		"ON members.user_id = projections.login_names.user_id " +
+		"AND members.instance_id = projections.login_names.instance_id " +
 		"WHERE projections.login_names.is_primary = $1")
 	orgMembersColumns = []string{
 		"creation_date",

internal/query/org_metadata.go

@@ -34,7 +34,8 @@ type OrgMetadataSearchQueries struct {
 
 var (
 	orgMetadataTable = table{
-		name: projection.OrgMetadataProjectionTable,
+		name:          projection.OrgMetadataProjectionTable,
+		instanceIDCol: projection.OrgMetadataColumnInstanceID,
 	}
 	OrgMetadataOrgIDCol = Column{
 		name:  projection.OrgMetadataColumnOrgID,

internal/query/password_age_policy.go

@@ -30,7 +30,8 @@ type PasswordAgePolicy struct {
 
 var (
 	passwordAgeTable = table{
-		name: projection.PasswordAgeTable,
+		name:          projection.PasswordAgeTable,
+		instanceIDCol: projection.AgePolicyInstanceIDCol,
 	}
 	PasswordAgeColID = Column{
 		name:  projection.AgePolicyIDCol,

internal/query/password_complexity_policy.go

@@ -83,7 +83,8 @@ func (q *Queries) DefaultPasswordComplexityPolicy(ctx context.Context, shouldTri
 
 var (
 	passwordComplexityTable = table{
-		name: projection.PasswordComplexityTable,
+		name:          projection.PasswordComplexityTable,
+		instanceIDCol: projection.ComplexityPolicyInstanceIDCol,
 	}
 	PasswordComplexityColID = Column{
 		name:  projection.ComplexityPolicyIDCol,

internal/query/privacy_policy.go

@@ -31,7 +31,8 @@ type PrivacyPolicy struct {
 
 var (
 	privacyTable = table{
-		name: projection.PrivacyPolicyTable,
+		name:          projection.PrivacyPolicyTable,
+		instanceIDCol: projection.PrivacyPolicyInstanceIDCol,
 	}
 	PrivacyColID = Column{
 		name:  projection.PrivacyPolicyIDCol,

internal/query/project.go

@@ -17,7 +17,8 @@ import (
 
 var (
 	projectsTable = table{
-		name: projection.ProjectProjectionTable,
+		name:          projection.ProjectProjectionTable,
+		instanceIDCol: projection.ProjectColumnInstanceID,
 	}
 	ProjectColumnID = Column{
 		name:  projection.ProjectColumnID,

internal/query/project_grant.go

@@ -23,7 +23,8 @@ const (
 
 var (
 	projectGrantsTable = table{
-		name: projection.ProjectGrantProjectionTable,
+		name:          projection.ProjectGrantProjectionTable,
+		instanceIDCol: projection.ProjectGrantColumnInstanceID,
 	}
 	ProjectGrantColumnCreationDate = Column{
 		name:  projection.ProjectGrantColumnCreationDate,

internal/query/project_grant_member.go

@@ -14,8 +14,9 @@ import (
 
 var (
 	projectGrantMemberTable = table{
-		name:  projection.ProjectGrantMemberProjectionTable,
+		name:          projection.ProjectGrantMemberProjectionTable,
-		alias: "members",
+		alias:         "members",
+		instanceIDCol: projection.MemberInstanceID,
 	}
 	ProjectGrantMemberUserID = Column{
 		name:  projection.MemberUserIDCol,

internal/query/project_grant_member_test.go

@@ -30,12 +30,16 @@ var (
 		"FROM projections.project_grant_members2 AS members " +
 		"LEFT JOIN projections.users4_humans " +
 		"ON members.user_id = projections.users4_humans.user_id " +
+		"AND members.instance_id = projections.users4_humans.instance_id " +
 		"LEFT JOIN projections.users4_machines " +
 		"ON members.user_id = projections.users4_machines.user_id " +
+		"AND members.instance_id = projections.users4_machines.instance_id " +
 		"LEFT JOIN projections.login_names " +
 		"ON members.user_id = projections.login_names.user_id " +
+		"AND members.instance_id = projections.login_names.instance_id " +
 		"LEFT JOIN projections.project_grants2 " +
 		"ON members.grant_id = projections.project_grants2.grant_id " +
+		"AND members.instance_id = projections.project_grants2.instance_id " +
 		"WHERE projections.login_names.is_primary = $1")
 	projectGrantMembersColumns = []string{
 		"creation_date",

internal/query/project_grant_test.go

@@ -13,6 +13,71 @@ import (
 	errs "github.com/zitadel/zitadel/internal/errors"
 )
 
+var (
+	projectGrantsQuery = `SELECT projections.project_grants2.project_id,` +
+		` projections.project_grants2.grant_id,` +
+		` projections.project_grants2.creation_date,` +
+		` projections.project_grants2.change_date,` +
+		` projections.project_grants2.resource_owner,` +
+		` projections.project_grants2.state,` +
+		` projections.project_grants2.sequence,` +
+		` projections.projects2.name,` +
+		` projections.project_grants2.granted_org_id,` +
+		` o.name,` +
+		` projections.project_grants2.granted_role_keys,` +
+		` r.name,` +
+		` COUNT(*) OVER () ` +
+		` FROM projections.project_grants2 ` +
+		` LEFT JOIN projections.projects2 ON projections.project_grants2.project_id = projections.projects2.id AND projections.project_grants2.instance_id = projections.projects2.instance_id ` +
+		` LEFT JOIN projections.orgs AS r ON projections.project_grants2.resource_owner = r.id AND projections.project_grants2.instance_id = r.instance_id` +
+		` LEFT JOIN projections.orgs AS o ON projections.project_grants2.granted_org_id = o.id AND projections.project_grants2.instance_id = o.instance_id`
+	projectGrantsCols = []string{
+		"project_id",
+		"grant_id",
+		"creation_date",
+		"change_date",
+		"resource_owner",
+		"state",
+		"sequence",
+		"name",
+		"granted_org_id",
+		"name",
+		"granted_role_keys",
+		"name",
+		"count",
+	}
+	projectGrantQuery = `SELECT projections.project_grants2.project_id,` +
+		` projections.project_grants2.grant_id,` +
+		` projections.project_grants2.creation_date,` +
+		` projections.project_grants2.change_date,` +
+		` projections.project_grants2.resource_owner,` +
+		` projections.project_grants2.state,` +
+		` projections.project_grants2.sequence,` +
+		` projections.projects2.name,` +
+		` projections.project_grants2.granted_org_id,` +
+		` o.name,` +
+		` projections.project_grants2.granted_role_keys,` +
+		` r.name` +
+		` FROM projections.project_grants2 ` +
+		` LEFT JOIN projections.projects2 ON projections.project_grants2.project_id = projections.projects2.id AND projections.project_grants2.instance_id = projections.projects2.instance_id ` +
+		` LEFT JOIN projections.orgs AS r ON projections.project_grants2.resource_owner = r.id AND projections.project_grants2.instance_id = r.instance_id` +
+		` LEFT JOIN projections.orgs AS o ON projections.project_grants2.granted_org_id = o.id AND projections.project_grants2.instance_id = o.instance_id`
+	projectGrantCols = []string{
+		"project_id",
+		"grant_id",
+		"creation_date",
+		"change_date",
+		"resource_owner",
+		"state",
+		"sequence",
+		"name",
+		"granted_org_id",
+		"name",
+		"granted_role_keys",
+		"name",
+	}
+)
+
 func Test_ProjectGrantPrepares(t *testing.T) {
 	type want struct {
 		sqlExpectations sqlExpectation
@@ -29,23 +94,7 @@ func Test_ProjectGrantPrepares(t *testing.T) {
 			prepare: prepareProjectGrantsQuery,
 			want: want{
 				sqlExpectations: mockQueries(
-					regexp.QuoteMeta(` SELECT projections.project_grants2.project_id,`+
+					regexp.QuoteMeta(projectGrantsQuery),
-						` projections.project_grants2.grant_id,`+
-						` projections.project_grants2.creation_date,`+
-						` projections.project_grants2.change_date,`+
-						` projections.project_grants2.resource_owner,`+
-						` projections.project_grants2.state,`+
-						` projections.project_grants2.sequence,`+
-						` projections.projects2.name,`+
-						` projections.project_grants2.granted_org_id,`+
-						` o.name,`+
-						` projections.project_grants2.granted_role_keys,`+
-						` r.name,`+
-						` COUNT(*) OVER () `+
-						` FROM projections.project_grants2 `+
-						` LEFT JOIN projections.projects2 ON projections.project_grants2.project_id = projections.projects2.id `+
-						` LEFT JOIN projections.orgs AS r ON projections.project_grants2.resource_owner = r.id`+
-						` LEFT JOIN projections.orgs AS o ON projections.project_grants2.granted_org_id = o.id`),
 					nil,
 					nil,
 				),
@@ -57,38 +106,8 @@ func Test_ProjectGrantPrepares(t *testing.T) {
 			prepare: prepareProjectGrantsQuery,
 			want: want{
 				sqlExpectations: mockQueries(
-					regexp.QuoteMeta(` SELECT projections.project_grants2.project_id,`+
+					regexp.QuoteMeta(projectGrantsQuery),
-						` projections.project_grants2.grant_id,`+
+					projectGrantsCols,
-						` projections.project_grants2.creation_date,`+
-						` projections.project_grants2.change_date,`+
-						` projections.project_grants2.resource_owner,`+
-						` projections.project_grants2.state,`+
-						` projections.project_grants2.sequence,`+
-						` projections.projects2.name,`+
-						` projections.project_grants2.granted_org_id,`+
-						` o.name,`+
-						` projections.project_grants2.granted_role_keys,`+
-						` r.name,`+
-						` COUNT(*) OVER ()`+
-						` FROM projections.project_grants2`+
-						` LEFT JOIN projections.projects2 ON projections.project_grants2.project_id = projections.projects2.id`+
-						` LEFT JOIN projections.orgs AS r ON projections.project_grants2.resource_owner = r.id`+
-						` LEFT JOIN projections.orgs AS o ON projections.project_grants2.granted_org_id = o.id`),
-					[]string{
-						"project_id",
-						"grant_id",
-						"creation_date",
-						"change_date",
-						"resource_owner",
-						"state",
-						"sequence",
-						"name",
-						"granted_org_id",
-						"name",
-						"granted_role_keys",
-						"name",
-						"count",
-					},
 					[][]driver.Value{
 						{
 							"project-id",
@@ -134,38 +153,8 @@ func Test_ProjectGrantPrepares(t *testing.T) {
 			prepare: prepareProjectGrantsQuery,
 			want: want{
 				sqlExpectations: mockQueries(
-					regexp.QuoteMeta(` SELECT projections.project_grants2.project_id,`+
+					regexp.QuoteMeta(projectGrantsQuery),
-						` projections.project_grants2.grant_id,`+
+					projectGrantsCols,
-						` projections.project_grants2.creation_date,`+
-						` projections.project_grants2.change_date,`+
-						` projections.project_grants2.resource_owner,`+
-						` projections.project_grants2.state,`+
-						` projections.project_grants2.sequence,`+
-						` projections.projects2.name,`+
-						` projections.project_grants2.granted_org_id,`+
-						` o.name,`+
-						` projections.project_grants2.granted_role_keys,`+
-						` r.name,`+
-						` COUNT(*) OVER () `+
-						` FROM projections.project_grants2 `+
-						` LEFT JOIN projections.projects2 ON projections.project_grants2.project_id = projections.projects2.id `+
-						` LEFT JOIN projections.orgs AS r ON projections.project_grants2.resource_owner = r.id`+
-						` LEFT JOIN projections.orgs AS o ON projections.project_grants2.granted_org_id = o.id`),
-					[]string{
-						"project_id",
-						"grant_id",
-						"creation_date",
-						"change_date",
-						"resource_owner",
-						"state",
-						"sequence",
-						"name",
-						"granted_org_id",
-						"name",
-						"granted_role_keys",
-						"name",
-						"count",
-					},
 					[][]driver.Value{
 						{
 							"project-id",
@@ -211,38 +200,8 @@ func Test_ProjectGrantPrepares(t *testing.T) {
 			prepare: prepareProjectGrantsQuery,
 			want: want{
 				sqlExpectations: mockQueries(
-					regexp.QuoteMeta(` SELECT projections.project_grants2.project_id,`+
+					regexp.QuoteMeta(projectGrantsQuery),
-						` projections.project_grants2.grant_id,`+
+					projectGrantsCols,
-						` projections.project_grants2.creation_date,`+
-						` projections.project_grants2.change_date,`+
-						` projections.project_grants2.resource_owner,`+
-						` projections.project_grants2.state,`+
-						` projections.project_grants2.sequence,`+
-						` projections.projects2.name,`+
-						` projections.project_grants2.granted_org_id,`+
-						` o.name,`+
-						` projections.project_grants2.granted_role_keys,`+
-						` r.name,`+
-						` COUNT(*) OVER () `+
-						` FROM projections.project_grants2 `+
-						` LEFT JOIN projections.projects2 ON projections.project_grants2.project_id = projections.projects2.id `+
-						` LEFT JOIN projections.orgs AS r ON projections.project_grants2.resource_owner = r.id`+
-						` LEFT JOIN projections.orgs AS o ON projections.project_grants2.granted_org_id = o.id`),
-					[]string{
-						"project_id",
-						"grant_id",
-						"creation_date",
-						"change_date",
-						"resource_owner",
-						"state",
-						"sequence",
-						"name",
-						"granted_org_id",
-						"name",
-						"granted_role_keys",
-						"name",
-						"count",
-					},
 					[][]driver.Value{
 						{
 							"project-id",
@@ -288,38 +247,8 @@ func Test_ProjectGrantPrepares(t *testing.T) {
 			prepare: prepareProjectGrantsQuery,
 			want: want{
 				sqlExpectations: mockQueries(
-					regexp.QuoteMeta(` SELECT projections.project_grants2.project_id,`+
+					regexp.QuoteMeta(projectGrantsQuery),
-						` projections.project_grants2.grant_id,`+
+					projectGrantsCols,
-						` projections.project_grants2.creation_date,`+
-						` projections.project_grants2.change_date,`+
-						` projections.project_grants2.resource_owner,`+
-						` projections.project_grants2.state,`+
-						` projections.project_grants2.sequence,`+
-						` projections.projects2.name,`+
-						` projections.project_grants2.granted_org_id,`+
-						` o.name,`+
-						` projections.project_grants2.granted_role_keys,`+
-						` r.name,`+
-						` COUNT(*) OVER () `+
-						` FROM projections.project_grants2 `+
-						` LEFT JOIN projections.projects2 ON projections.project_grants2.project_id = projections.projects2.id `+
-						` LEFT JOIN projections.orgs AS r ON projections.project_grants2.resource_owner = r.id`+
-						` LEFT JOIN projections.orgs AS o ON projections.project_grants2.granted_org_id = o.id`),
-					[]string{
-						"project_id",
-						"grant_id",
-						"creation_date",
-						"change_date",
-						"resource_owner",
-						"state",
-						"sequence",
-						"name",
-						"granted_org_id",
-						"name",
-						"granted_role_keys",
-						"name",
-						"count",
-					},
 					[][]driver.Value{
 						{
 							"project-id",
@@ -365,38 +294,8 @@ func Test_ProjectGrantPrepares(t *testing.T) {
 			prepare: prepareProjectGrantsQuery,
 			want: want{
 				sqlExpectations: mockQueries(
-					regexp.QuoteMeta(` SELECT projections.project_grants2.project_id,`+
+					regexp.QuoteMeta(projectGrantsQuery),
-						` projections.project_grants2.grant_id,`+
+					projectGrantsCols,
-						` projections.project_grants2.creation_date,`+
-						` projections.project_grants2.change_date,`+
-						` projections.project_grants2.resource_owner,`+
-						` projections.project_grants2.state,`+
-						` projections.project_grants2.sequence,`+
-						` projections.projects2.name,`+
-						` projections.project_grants2.granted_org_id,`+
-						` o.name,`+
-						` projections.project_grants2.granted_role_keys,`+
-						` r.name,`+
-						` COUNT(*) OVER () `+
-						` FROM projections.project_grants2 `+
-						` LEFT JOIN projections.projects2 ON projections.project_grants2.project_id = projections.projects2.id `+
-						` LEFT JOIN projections.orgs AS r ON projections.project_grants2.resource_owner = r.id`+
-						` LEFT JOIN projections.orgs AS o ON projections.project_grants2.granted_org_id = o.id`),
-					[]string{
-						"project_id",
-						"grant_id",
-						"creation_date",
-						"change_date",
-						"resource_owner",
-						"state",
-						"sequence",
-						"name",
-						"granted_org_id",
-						"name",
-						"granted_role_keys",
-						"name",
-						"count",
-					},
 					[][]driver.Value{
 						{
 							"project-id",
@@ -470,23 +369,7 @@ func Test_ProjectGrantPrepares(t *testing.T) {
 			prepare: prepareProjectGrantsQuery,
 			want: want{
 				sqlExpectations: mockQueryErr(
-					regexp.QuoteMeta(` SELECT projections.project_grants2.project_id,`+
+					regexp.QuoteMeta(projectGrantsQuery),
-						` projections.project_grants2.grant_id,`+
-						` projections.project_grants2.creation_date,`+
-						` projections.project_grants2.change_date,`+
-						` projections.project_grants2.resource_owner,`+
-						` projections.project_grants2.state,`+
-						` projections.project_grants2.sequence,`+
-						` projections.projects2.name,`+
-						` projections.project_grants2.granted_org_id,`+
-						` o.name,`+
-						` projections.project_grants2.granted_role_keys,`+
-						` r.name,`+
-						` COUNT(*) OVER () `+
-						` FROM projections.project_grants2 `+
-						` LEFT JOIN projections.projects2 ON projections.project_grants2.project_id = projections.projects2.id `+
-						` LEFT JOIN projections.orgs AS r ON projections.project_grants2.resource_owner = r.id`+
-						` LEFT JOIN projections.orgs AS o ON projections.project_grants2.granted_org_id = o.id`),
 					sql.ErrConnDone,
 				),
 				err: func(err error) (error, bool) {
@@ -503,22 +386,7 @@ func Test_ProjectGrantPrepares(t *testing.T) {
 			prepare: prepareProjectGrantQuery,
 			want: want{
 				sqlExpectations: mockQueries(
-					regexp.QuoteMeta(` SELECT projections.project_grants2.project_id,`+
+					regexp.QuoteMeta(projectGrantQuery),
-						` projections.project_grants2.grant_id,`+
-						` projections.project_grants2.creation_date,`+
-						` projections.project_grants2.change_date,`+
-						` projections.project_grants2.resource_owner,`+
-						` projections.project_grants2.state,`+
-						` projections.project_grants2.sequence,`+
-						` projections.projects2.name,`+
-						` projections.project_grants2.granted_org_id,`+
-						` o.name,`+
-						` projections.project_grants2.granted_role_keys,`+
-						` r.name`+
-						` FROM projections.project_grants2 `+
-						` LEFT JOIN projections.projects2 ON projections.project_grants2.project_id = projections.projects2.id `+
-						` LEFT JOIN projections.orgs AS r ON projections.project_grants2.resource_owner = r.id`+
-						` LEFT JOIN projections.orgs AS o ON projections.project_grants2.granted_org_id = o.id`),
 					nil,
 					nil,
 				),
@@ -536,36 +404,8 @@ func Test_ProjectGrantPrepares(t *testing.T) {
 			prepare: prepareProjectGrantQuery,
 			want: want{
 				sqlExpectations: mockQuery(
-					regexp.QuoteMeta(` SELECT projections.project_grants2.project_id,`+
+					regexp.QuoteMeta(projectGrantQuery),
-						` projections.project_grants2.grant_id,`+
+					projectGrantCols,
-						` projections.project_grants2.creation_date,`+
-						` projections.project_grants2.change_date,`+
-						` projections.project_grants2.resource_owner,`+
-						` projections.project_grants2.state,`+
-						` projections.project_grants2.sequence,`+
-						` projections.projects2.name,`+
-						` projections.project_grants2.granted_org_id,`+
-						` o.name,`+
-						` projections.project_grants2.granted_role_keys,`+
-						` r.name`+
-						` FROM projections.project_grants2 `+
-						` LEFT JOIN projections.projects2 ON projections.project_grants2.project_id = projections.projects2.id `+
-						` LEFT JOIN projections.orgs AS r ON projections.project_grants2.resource_owner = r.id`+
-						` LEFT JOIN projections.orgs AS o ON projections.project_grants2.granted_org_id = o.id`),
-					[]string{
-						"project_id",
-						"grant_id",
-						"creation_date",
-						"change_date",
-						"resource_owner",
-						"state",
-						"sequence",
-						"name",
-						"granted_org_id",
-						"name",
-						"granted_role_keys",
-						"name",
-					},
 					[]driver.Value{
 						"project-id",
 						"grant-id",
@@ -602,36 +442,8 @@ func Test_ProjectGrantPrepares(t *testing.T) {
 			prepare: prepareProjectGrantQuery,
 			want: want{
 				sqlExpectations: mockQuery(
-					regexp.QuoteMeta(` SELECT projections.project_grants2.project_id,`+
+					regexp.QuoteMeta(projectGrantQuery),
-						` projections.project_grants2.grant_id,`+
+					projectGrantCols,
-						` projections.project_grants2.creation_date,`+
-						` projections.project_grants2.change_date,`+
-						` projections.project_grants2.resource_owner,`+
-						` projections.project_grants2.state,`+
-						` projections.project_grants2.sequence,`+
-						` projections.projects2.name,`+
-						` projections.project_grants2.granted_org_id,`+
-						` o.name,`+
-						` projections.project_grants2.granted_role_keys,`+
-						` r.name`+
-						` FROM projections.project_grants2 `+
-						` LEFT JOIN projections.projects2 ON projections.project_grants2.project_id = projections.projects2.id `+
-						` LEFT JOIN projections.orgs AS r ON projections.project_grants2.resource_owner = r.id`+
-						` LEFT JOIN projections.orgs AS o ON projections.project_grants2.granted_org_id = o.id`),
-					[]string{
-						"project_id",
-						"grant_id",
-						"creation_date",
-						"change_date",
-						"resource_owner",
-						"state",
-						"sequence",
-						"name",
-						"granted_org_id",
-						"name",
-						"granted_role_keys",
-						"name",
-					},
 					[]driver.Value{
 						"project-id",
 						"grant-id",
@@ -668,36 +480,8 @@ func Test_ProjectGrantPrepares(t *testing.T) {
 			prepare: prepareProjectGrantQuery,
 			want: want{
 				sqlExpectations: mockQuery(
-					regexp.QuoteMeta(` SELECT projections.project_grants2.project_id,`+
+					regexp.QuoteMeta(projectGrantQuery),
-						` projections.project_grants2.grant_id,`+
+					projectGrantCols,
-						` projections.project_grants2.creation_date,`+
-						` projections.project_grants2.change_date,`+
-						` projections.project_grants2.resource_owner,`+
-						` projections.project_grants2.state,`+
-						` projections.project_grants2.sequence,`+
-						` projections.projects2.name,`+
-						` projections.project_grants2.granted_org_id,`+
-						` o.name,`+
-						` projections.project_grants2.granted_role_keys,`+
-						` r.name`+
-						` FROM projections.project_grants2 `+
-						` LEFT JOIN projections.projects2 ON projections.project_grants2.project_id = projections.projects2.id `+
-						` LEFT JOIN projections.orgs AS r ON projections.project_grants2.resource_owner = r.id`+
-						` LEFT JOIN projections.orgs AS o ON projections.project_grants2.granted_org_id = o.id`),
-					[]string{
-						"project_id",
-						"grant_id",
-						"creation_date",
-						"change_date",
-						"resource_owner",
-						"state",
-						"sequence",
-						"name",
-						"granted_org_id",
-						"name",
-						"granted_role_keys",
-						"name",
-					},
 					[]driver.Value{
 						"project-id",
 						"grant-id",
@@ -734,36 +518,8 @@ func Test_ProjectGrantPrepares(t *testing.T) {
 			prepare: prepareProjectGrantQuery,
 			want: want{
 				sqlExpectations: mockQuery(
-					regexp.QuoteMeta(` SELECT projections.project_grants2.project_id,`+
+					regexp.QuoteMeta(projectGrantQuery),
-						` projections.project_grants2.grant_id,`+
+					projectGrantCols,
-						` projections.project_grants2.creation_date,`+
-						` projections.project_grants2.change_date,`+
-						` projections.project_grants2.resource_owner,`+
-						` projections.project_grants2.state,`+
-						` projections.project_grants2.sequence,`+
-						` projections.projects2.name,`+
-						` projections.project_grants2.granted_org_id,`+
-						` o.name,`+
-						` projections.project_grants2.granted_role_keys,`+
-						` r.name`+
-						` FROM projections.project_grants2 `+
-						` LEFT JOIN projections.projects2 ON projections.project_grants2.project_id = projections.projects2.id `+
-						` LEFT JOIN projections.orgs AS r ON projections.project_grants2.resource_owner = r.id`+
-						` LEFT JOIN projections.orgs AS o ON projections.project_grants2.granted_org_id = o.id`),
-					[]string{
-						"project_id",
-						"grant_id",
-						"creation_date",
-						"change_date",
-						"resource_owner",
-						"state",
-						"sequence",
-						"name",
-						"granted_org_id",
-						"name",
-						"granted_role_keys",
-						"name",
-					},
 					[]driver.Value{
 						"project-id",
 						"grant-id",
@@ -800,22 +556,7 @@ func Test_ProjectGrantPrepares(t *testing.T) {
 			prepare: prepareProjectGrantQuery,
 			want: want{
 				sqlExpectations: mockQueryErr(
-					regexp.QuoteMeta(` SELECT projections.project_grants2.project_id,`+
+					regexp.QuoteMeta(projectGrantQuery),
-						` projections.project_grants2.grant_id,`+
-						` projections.project_grants2.creation_date,`+
-						` projections.project_grants2.change_date,`+
-						` projections.project_grants2.resource_owner,`+
-						` projections.project_grants2.state,`+
-						` projections.project_grants2.sequence,`+
-						` projections.projects2.name,`+
-						` projections.project_grants2.granted_org_id,`+
-						` o.name,`+
-						` projections.project_grants2.granted_role_keys,`+
-						` r.name`+
-						` FROM projections.project_grants2 `+
-						` LEFT JOIN projections.projects2 ON projections.project_grants2.project_id = projections.projects2.id `+
-						` LEFT JOIN projections.orgs AS r ON projections.project_grants2.resource_owner = r.id`+
-						` LEFT JOIN projections.orgs AS o ON projections.project_grants2.granted_org_id = o.id`),
 					sql.ErrConnDone,
 				),
 				err: func(err error) (error, bool) {

internal/query/project_member.go

@@ -14,8 +14,9 @@ import (
 
 var (
 	projectMemberTable = table{
-		name:  projection.ProjectMemberProjectionTable,
+		name:          projection.ProjectMemberProjectionTable,
-		alias: "members",
+		alias:         "members",
+		instanceIDCol: projection.MemberInstanceID,
 	}
 	ProjectMemberUserID = Column{
 		name:  projection.MemberUserIDCol,

internal/query/project_member_test.go

@@ -30,10 +30,13 @@ var (
 		"FROM projections.project_members2 AS members " +
 		"LEFT JOIN projections.users4_humans " +
 		"ON members.user_id = projections.users4_humans.user_id " +
+		"AND members.instance_id = projections.users4_humans.instance_id " +
 		"LEFT JOIN projections.users4_machines " +
 		"ON members.user_id = projections.users4_machines.user_id " +
+		"AND members.instance_id = projections.users4_machines.instance_id " +
 		"LEFT JOIN projections.login_names " +
 		"ON members.user_id = projections.login_names.user_id " +
+		"AND members.instance_id = projections.login_names.instance_id " +
 		"WHERE projections.login_names.is_primary = $1")
 	projectMembersColumns = []string{
 		"creation_date",

internal/query/project_role.go

@@ -14,7 +14,8 @@ import (
 
 var (
 	projectRolesTable = table{
-		name: projection.ProjectRoleProjectionTable,
+		name:          projection.ProjectRoleProjectionTable,
+		instanceIDCol: projection.ProjectRoleColumnInstanceID,
 	}
 	ProjectRoleColumnCreationDate = Column{
 		name:  projection.ProjectRoleColumnCreationDate,

internal/query/search_query.go

@@ -365,8 +365,9 @@ var (
 )
 
 type table struct {
-	name  string
+	name          string
-	alias string
+	alias         string
+	instanceIDCol string
 }
 
 func (t table) setAlias(a string) table {
@@ -385,6 +386,13 @@ func (t table) isZero() bool {
 	return t.name == ""
 }
 
+func (t table) InstanceIDIdentifier() string {
+	if t.alias != "" {
+		return t.alias + "." + t.instanceIDCol
+	}
+	return t.name + "." + t.instanceIDCol
+}
+
 type Column struct {
 	name           string
 	table          table
@@ -418,7 +426,7 @@ func (c Column) isZero() bool {
 }
 
 func join(join, from Column) string {
-	return join.table.identifier() + " ON " + from.identifier() + " = " + join.identifier()
+	return join.table.identifier() + " ON " + from.identifier() + " = " + join.identifier() + " AND " + from.table.InstanceIDIdentifier() + " = " + join.table.InstanceIDIdentifier()
 }
 
 type listContains struct {

internal/query/search_query_test.go

@@ -6,13 +6,15 @@ import (
 	"testing"
 
 	sq "github.com/Masterminds/squirrel"
+
 	"github.com/zitadel/zitadel/internal/domain"
 )
 
 var (
 	testTable = table{
-		name:  "test_table",
+		name:          "test_table",
-		alias: "test_table",
+		alias:         "test_table",
+		instanceIDCol: "instance_id",
 	}
 	testCol = Column{
 		name:  "test_col",

internal/query/secret_generators.go

@@ -19,7 +19,8 @@ import (
 
 var (
 	secretGeneratorsTable = table{
-		name: projection.SecretGeneratorProjectionTable,
+		name:          projection.SecretGeneratorProjectionTable,
+		instanceIDCol: projection.SecretGeneratorColumnInstanceID,
 	}
 	SecretGeneratorColumnAggregateID = Column{
 		name:  projection.SecretGeneratorColumnAggregateID,

internal/query/sms.go

@@ -53,7 +53,8 @@ func (q *SMSConfigsSearchQueries) toQuery(query sq.SelectBuilder) sq.SelectBuild
 
 var (
 	smsConfigsTable = table{
-		name: projection.SMSConfigProjectionTable,
+		name:          projection.SMSConfigProjectionTable,
+		instanceIDCol: projection.SMSColumnInstanceID,
 	}
 	SMSConfigColumnID = Column{
 		name:  projection.SMSColumnID,
@@ -91,7 +92,8 @@ var (
 
 var (
 	smsTwilioConfigsTable = table{
-		name: projection.SMSTwilioTable,
+		name:          projection.SMSTwilioTable,
+		instanceIDCol: projection.SMSTwilioColumnInstanceID,
 	}
 	SMSTwilioConfigColumnSMSID = Column{
 		name:  projection.SMSTwilioConfigColumnSMSID,

internal/query/smtp.go

@@ -18,7 +18,8 @@ import (
 
 var (
 	smtpConfigsTable = table{
-		name: projection.SMTPConfigProjectionTable,
+		name:          projection.SMTPConfigProjectionTable,
+		instanceIDCol: projection.SMTPConfigColumnInstanceID,
 	}
 	SMTPConfigColumnAggregateID = Column{
 		name:  projection.SMTPConfigColumnAggregateID,

internal/query/user.go

@@ -122,7 +122,8 @@ type UserSearchQueries struct {
 
 var (
 	userTable = table{
-		name: projection.UserTable,
+		name:          projection.UserTable,
+		instanceIDCol: projection.UserInstanceIDCol,
 	}
 	UserIDCol = Column{
 		name:  projection.UserIDCol,
@@ -179,7 +180,8 @@ var (
 
 var (
 	humanTable = table{
-		name: projection.UserHumanTable,
+		name:          projection.UserHumanTable,
+		instanceIDCol: projection.HumanUserInstanceIDCol,
 	}
 	// profile
 	HumanUserIDCol = Column{
@@ -243,7 +245,8 @@ var (
 
 var (
 	machineTable = table{
-		name: projection.UserMachineTable,
+		name:          projection.UserMachineTable,
+		instanceIDCol: projection.MachineUserInstanceIDCol,
 	}
 	MachineUserIDCol = Column{
 		name:  projection.MachineUserIDCol,
@@ -262,7 +265,8 @@ var (
 
 var (
 	notifyTable = table{
-		name: projection.UserNotifyTable,
+		name:          projection.UserNotifyTable,
+		instanceIDCol: projection.NotifyInstanceIDCol,
 	}
 	NotifyUserIDCol = Column{
 		name:  projection.NotifyUserIDCol,

internal/query/user_auth_method.go

@@ -15,7 +15,8 @@ import (
 
 var (
 	userAuthMethodTable = table{
-		name: projection.UserAuthMethodTable,
+		name:          projection.UserAuthMethodTable,
+		instanceIDCol: projection.UserAuthMethodInstanceIDCol,
 	}
 	UserAuthMethodColumnTokenID = Column{
 		name:  projection.UserAuthMethodTokenIDCol,

internal/query/user_grant.go

@@ -143,7 +143,8 @@ func NewUserGrantContainsRolesSearchQuery(roles ...string) (SearchQuery, error)
 
 var (
 	userGrantTable = table{
-		name: projection.UserGrantProjectionTable,
+		name:          projection.UserGrantProjectionTable,
+		instanceIDCol: projection.UserGrantInstanceID,
 	}
 	UserGrantID = Column{
 		name:  projection.UserGrantID,

internal/query/user_grant_test.go

@@ -38,11 +38,11 @@ var (
 			", projections.user_grants2.project_id" +
 			", projections.projects2.name" +
 			" FROM projections.user_grants2" +
-			" LEFT JOIN projections.users4 ON projections.user_grants2.user_id = projections.users4.id" +
+			" LEFT JOIN projections.users4 ON projections.user_grants2.user_id = projections.users4.id AND projections.user_grants2.instance_id = projections.users4.instance_id" +
-			" LEFT JOIN projections.users4_humans ON projections.user_grants2.user_id = projections.users4_humans.user_id" +
+			" LEFT JOIN projections.users4_humans ON projections.user_grants2.user_id = projections.users4_humans.user_id AND projections.user_grants2.instance_id = projections.users4_humans.instance_id" +
-			" LEFT JOIN projections.orgs ON projections.user_grants2.resource_owner = projections.orgs.id" +
+			" LEFT JOIN projections.orgs ON projections.user_grants2.resource_owner = projections.orgs.id AND projections.user_grants2.instance_id = projections.orgs.instance_id" +
-			" LEFT JOIN projections.projects2 ON projections.user_grants2.project_id = projections.projects2.id" +
+			" LEFT JOIN projections.projects2 ON projections.user_grants2.project_id = projections.projects2.id AND projections.user_grants2.instance_id = projections.projects2.instance_id" +
-			" LEFT JOIN projections.login_names ON projections.user_grants2.user_id = projections.login_names.user_id" +
+			" LEFT JOIN projections.login_names ON projections.user_grants2.user_id = projections.login_names.user_id AND projections.user_grants2.instance_id = projections.login_names.instance_id" +
 			" WHERE projections.login_names.is_primary = $1")
 	userGrantCols = []string{
 		"id",
@@ -93,11 +93,11 @@ var (
 			", projections.projects2.name" +
 			", COUNT(*) OVER ()" +
 			" FROM projections.user_grants2" +
-			" LEFT JOIN projections.users4 ON projections.user_grants2.user_id = projections.users4.id" +
+			" LEFT JOIN projections.users4 ON projections.user_grants2.user_id = projections.users4.id AND projections.user_grants2.instance_id = projections.users4.instance_id" +
-			" LEFT JOIN projections.users4_humans ON projections.user_grants2.user_id = projections.users4_humans.user_id" +
+			" LEFT JOIN projections.users4_humans ON projections.user_grants2.user_id = projections.users4_humans.user_id AND projections.user_grants2.instance_id = projections.users4_humans.instance_id" +
-			" LEFT JOIN projections.orgs ON projections.user_grants2.resource_owner = projections.orgs.id" +
+			" LEFT JOIN projections.orgs ON projections.user_grants2.resource_owner = projections.orgs.id AND projections.user_grants2.instance_id = projections.orgs.instance_id" +
-			" LEFT JOIN projections.projects2 ON projections.user_grants2.project_id = projections.projects2.id" +
+			" LEFT JOIN projections.projects2 ON projections.user_grants2.project_id = projections.projects2.id AND projections.user_grants2.instance_id = projections.projects2.instance_id" +
-			" LEFT JOIN projections.login_names ON projections.user_grants2.user_id = projections.login_names.user_id" +
+			" LEFT JOIN projections.login_names ON projections.user_grants2.user_id = projections.login_names.user_id AND projections.user_grants2.instance_id = projections.login_names.instance_id" +
 			" WHERE projections.login_names.is_primary = $1")
 	userGrantsCols = append(
 		userGrantCols,

internal/query/user_membership.go

@@ -132,7 +132,8 @@ func (q *Queries) Memberships(ctx context.Context, queries *MembershipSearchQuer
 var (
 	//membershipAlias is a hack to satisfy checks in the queries
 	membershipAlias = table{
-		name: "memberships",
+		name:          "memberships",
+		instanceIDCol: projection.MemberInstanceID,
 	}
 	membershipUserID = Column{
 		name:  projection.MemberUserIDCol,

internal/query/user_membership_test.go

@@ -80,9 +80,9 @@ var (
 			", members.grant_id" +
 			" FROM projections.project_grant_members2 AS members" +
 			") AS memberships" +
-			" LEFT JOIN projections.projects2 ON memberships.project_id = projections.projects2.id" +
+			" LEFT JOIN projections.projects2 ON memberships.project_id = projections.projects2.id AND memberships.instance_id = projections.projects2.instance_id" +
-			" LEFT JOIN projections.orgs ON memberships.org_id = projections.orgs.id" +
+			" LEFT JOIN projections.orgs ON memberships.org_id = projections.orgs.id AND memberships.instance_id = projections.orgs.instance_id" +
-			" LEFT JOIN projections.project_grants2 ON memberships.grant_id = projections.project_grants2.grant_id")
+			" LEFT JOIN projections.project_grants2 ON memberships.grant_id = projections.project_grants2.grant_id AND memberships.instance_id = projections.project_grants2.instance_id")
 	membershipCols = []string{
 		"user_id",
 		"roles",

internal/query/user_metadata.go

@@ -35,7 +35,8 @@ type UserMetadataSearchQueries struct {
 
 var (
 	userMetadataTable = table{
-		name: projection.UserMetadataProjectionTable,
+		name:          projection.UserMetadataProjectionTable,
+		instanceIDCol: projection.UserMetadataColumnInstanceID,
 	}
 	UserMetadataUserIDCol = Column{
 		name:  projection.UserMetadataColumnUserID,

internal/query/user_personal_access_token.go

@@ -18,7 +18,8 @@ import (
 
 var (
 	personalAccessTokensTable = table{
-		name: projection.PersonalAccessTokenProjectionTable,
+		name:          projection.PersonalAccessTokenProjectionTable,
+		instanceIDCol: projection.PersonalAccessTokenColumnInstanceID,
 	}
 	PersonalAccessTokenColumnID = Column{
 		name:  projection.PersonalAccessTokenColumnID,

internal/query/user_test.go

@@ -44,8 +44,8 @@ var (
 		` projections.users4_machines.description,` +
 		` COUNT(*) OVER ()` +
 		` FROM projections.users4` +
-		` LEFT JOIN projections.users4_humans ON projections.users4.id = projections.users4_humans.user_id` +
+		` LEFT JOIN projections.users4_humans ON projections.users4.id = projections.users4_humans.user_id AND projections.users4.instance_id = projections.users4_humans.instance_id` +
-		` LEFT JOIN projections.users4_machines ON projections.users4.id = projections.users4_machines.user_id` +
+		` LEFT JOIN projections.users4_machines ON projections.users4.id = projections.users4_machines.user_id AND projections.users4.instance_id = projections.users4_machines.instance_id` +
 		` LEFT JOIN` +
 		` (SELECT login_names.user_id, ARRAY_AGG(login_names.login_name)::TEXT[] AS loginnames` +
 		` FROM projections.login_names AS login_names` +
@@ -99,7 +99,7 @@ var (
 		` projections.users4_humans.gender,` +
 		` projections.users4_humans.avatar_key` +
 		` FROM projections.users4` +
-		` LEFT JOIN projections.users4_humans ON projections.users4.id = projections.users4_humans.user_id`
+		` LEFT JOIN projections.users4_humans ON projections.users4.id = projections.users4_humans.user_id AND projections.users4.instance_id = projections.users4_humans.instance_id`
 	profileCols = []string{
 		"id",
 		"creation_date",
@@ -124,7 +124,7 @@ var (
 		` projections.users4_humans.email,` +
 		` projections.users4_humans.is_email_verified` +
 		` FROM projections.users4` +
-		` LEFT JOIN projections.users4_humans ON projections.users4.id = projections.users4_humans.user_id`
+		` LEFT JOIN projections.users4_humans ON projections.users4.id = projections.users4_humans.user_id AND projections.users4.instance_id = projections.users4_humans.instance_id`
 	emailCols = []string{
 		"id",
 		"creation_date",
@@ -144,7 +144,7 @@ var (
 		` projections.users4_humans.phone,` +
 		` projections.users4_humans.is_phone_verified` +
 		` FROM projections.users4` +
-		` LEFT JOIN projections.users4_humans ON projections.users4.id = projections.users4_humans.user_id`
+		` LEFT JOIN projections.users4_humans ON projections.users4.id = projections.users4_humans.user_id AND projections.users4.instance_id = projections.users4_humans.instance_id`
 	phoneCols = []string{
 		"id",
 		"creation_date",
@@ -162,7 +162,7 @@ var (
 		` projections.users4_humans.email,` +
 		` projections.users4_humans.is_email_verified` +
 		` FROM projections.users4` +
-		` LEFT JOIN projections.users4_humans ON projections.users4.id = projections.users4_humans.user_id`
+		` LEFT JOIN projections.users4_humans ON projections.users4.id = projections.users4_humans.user_id AND projections.users4.instance_id = projections.users4_humans.instance_id`
 	userUniqueCols = []string{
 		"id",
 		"state",
@@ -197,8 +197,8 @@ var (
 		` projections.users4_notifications.password_set,` +
 		` COUNT(*) OVER ()` +
 		` FROM projections.users4` +
-		` LEFT JOIN projections.users4_humans ON projections.users4.id = projections.users4_humans.user_id` +
+		` LEFT JOIN projections.users4_humans ON projections.users4.id = projections.users4_humans.user_id AND projections.users4.instance_id = projections.users4_humans.instance_id` +
-		` LEFT JOIN projections.users4_notifications ON projections.users4.id = projections.users4_notifications.user_id` +
+		` LEFT JOIN projections.users4_notifications ON projections.users4.id = projections.users4_notifications.user_id AND projections.users4.instance_id = projections.users4_notifications.instance_id` +
 		` LEFT JOIN` +
 		` (SELECT login_names.user_id, ARRAY_AGG(login_names.login_name) AS loginnames` +
 		` FROM projections.login_names AS login_names` +
@@ -264,8 +264,8 @@ var (
 		` projections.users4_machines.description,` +
 		` COUNT(*) OVER ()` +
 		` FROM projections.users4` +
-		` LEFT JOIN projections.users4_humans ON projections.users4.id = projections.users4_humans.user_id` +
+		` LEFT JOIN projections.users4_humans ON projections.users4.id = projections.users4_humans.user_id AND projections.users4.instance_id = projections.users4_humans.instance_id` +
-		` LEFT JOIN projections.users4_machines ON projections.users4.id = projections.users4_machines.user_id` +
+		` LEFT JOIN projections.users4_machines ON projections.users4.id = projections.users4_machines.user_id AND projections.users4.instance_id = projections.users4_machines.instance_id` +
 		` LEFT JOIN` +
 		` (SELECT login_names.user_id, ARRAY_AGG(login_names.login_name) AS loginnames` +
 		` FROM projections.login_names AS login_names` +