feat: split users into human and machine (#470)

* feat(management): service accounts * chore: current go version * init * refactor: apis * feat(internal): start impl of service account * chore: start impl of machine/human users * code compiles * fix: tests * fix: tests * fix: add new event types to switches * chore: add cases to event types * fix(management): definitive proto messages * fix: machine/human * fix: add missing tables as todos * fix: remove unused permissions * fix: refactoring * fix: refactor * fix: human registered * fix: user id * fix: logid * fix: proto remove //equal * chore(management): remove no comment * fix: human mfas * fix: user subobjects * chore: rename existing to better name * fix: username in user (#634) * fix: username in user * fix: username * fix remove unused code * fix add validations * fix: use new user in all apis * fix: regexp for username in api * fix: fill user data for human and machine (#638) * fix: fill Display name grant/member handlers fix: add description to grant/member objects in api fix: check if user is human in login * fix: remove description from member and grant * chore: remove todos * feat: machine keys * fix: implement missing parts * feat: machine key management view * fix: remove keys from machine view * fix: set default expiration date * fix: get key by ids * feat: add machine keys in proto * feat: machine keys * fix: add migration * fix: mig * fix: correct method name * feat: user search * feat: user search * fix: log ids * fix partial authconfig prompt, domain c perm * membership read check * contributor refresh trigger, observe org write * fix: migrations * fix(console): machine build (#660) * frontend 1 * fix html bindings * trailing comma * user permissions, project deactivate * fix(console): human view (#661) * fix search user view, user detail form * rm log * feat(console): user services list and create (#663) * fix search user view, user detail form * rm log * machine list * generic table component * create user service * proove table for undefined values * tmp disable user link if machine * lint * lint styles * user table lint * Update console/src/assets/i18n/de.json Co-authored-by: Florian Forster <florian@caos.ch> * feat(console): service user detail view, keys cr_d, fix search user autocomplete (#664) * service users for sidenav, routing * i18n * back routes * machine detail form * update machine detail, fix svc user grants * keys table * add key dialog, timestamp creation * check permission on create, delete, fix selection * lint ts, scss * Update console/src/assets/i18n/de.json * Apply suggestions from code review Co-authored-by: Florian Forster <florian@caos.ch> * allow user grants for project.write * management service * fix mgmt service * feat: Machine keys (#655) * fix: memberships (#633) * feat: add iam members to memberships * fix: search project grants * fix: rename * feat: idp and login policy configurations (#619) * feat: oidc config * fix: oidc configurations * feat: oidc idp config * feat: add oidc config test * fix: tests * fix: tests * feat: translate new events * feat: idp eventstore * feat: idp eventstore * fix: tests * feat: command side idp * feat: query side idp * feat: idp config on org * fix: tests * feat: authz idp on org * feat: org idps * feat: login policy * feat: login policy * feat: login policy * feat: add idp func on login policy * feat: add validation to loginpolicy and idp provider * feat: add default login policy * feat: login policy on org * feat: login policy on org * fix: id config handlers * fix: id config handlers * fix: create idp on org * fix: create idp on org * fix: not existing idp config * fix: default login policy * fix: add login policy on org * fix: idp provider search on org * fix: test * fix: remove idp on org * fix: test * fix: test * fix: remove admin idp * fix: logo src as byte * fix: migration * fix: tests * Update internal/iam/repository/eventsourcing/iam.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * Update internal/iam/repository/eventsourcing/iam_test.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * Update internal/iam/repository/eventsourcing/iam_test.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * Update internal/iam/repository/eventsourcing/model/login_policy.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * Update internal/iam/repository/eventsourcing/model/login_policy.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * Update internal/org/repository/eventsourcing/org_test.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * Update internal/iam/repository/eventsourcing/model/login_policy_test.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * Update internal/iam/repository/eventsourcing/model/login_policy_test.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * fix: pr comments * fix: tests * Update types.go * fix: merge request changes * fix: reduce optimization Co-authored-by: Silvan <silvan.reusser@gmail.com> Co-authored-by: Livio Amstutz <livio.a@gmail.com> * fix: reread user mfas, preferred loginname as otp account name (#636) * fix: reread user mfas * fix: use preferred login name as otp account name * fix: tests * fix: reduce (#635) * fix: management reduce optimization * fix: reduce optimization * fix: reduce optimization * fix: merge master * chore(deps): bump github.com/gorilla/schema from 1.1.0 to 1.2.0 (#627) Bumps [github.com/gorilla/schema](https://github.com/gorilla/schema) from 1.1.0 to 1.2.0. - [Release notes](https://github.com/gorilla/schema/releases) - [Commits](https://github.com/gorilla/schema/compare/v1.1.0...v1.2.0) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump github.com/gorilla/mux from 1.7.4 to 1.8.0 (#624) Bumps [github.com/gorilla/mux](https://github.com/gorilla/mux) from 1.7.4 to 1.8.0. - [Release notes](https://github.com/gorilla/mux/releases) - [Commits](https://github.com/gorilla/mux/compare/v1.7.4...v1.8.0) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump github.com/DATA-DOG/go-sqlmock from 1.4.1 to 1.5.0 (#591) Bumps [github.com/DATA-DOG/go-sqlmock](https://github.com/DATA-DOG/go-sqlmock) from 1.4.1 to 1.5.0. - [Release notes](https://github.com/DATA-DOG/go-sqlmock/releases) - [Commits](https://github.com/DATA-DOG/go-sqlmock/compare/v1.4.1...v1.5.0) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: auto assign issues and PR to ZTIADEL project board (#643) * Create main.yml * Update main.yml Co-authored-by: Livio Amstutz <livio.a@gmail.com> * fix(console): project grant members, update deps (#645) * fix: searchprojectgrantmembers * chore(deps-dev): bump @angular/cli from 10.0.6 to 10.0.7 in /console (#622) Bumps [@angular/cli](https://github.com/angular/angular-cli) from 10.0.6 to 10.0.7. - [Release notes](https://github.com/angular/angular-cli/releases) - [Commits](https://github.com/angular/angular-cli/compare/v10.0.6...v10.0.7) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump @angular-devkit/build-angular in /console (#626) Bumps [@angular-devkit/build-angular](https://github.com/angular/angular-cli) from 0.1000.6 to 0.1000.7. - [Release notes](https://github.com/angular/angular-cli/releases) - [Commits](https://github.com/angular/angular-cli/commits) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Max Peintner <max@caos.ch> * chore(deps-dev): bump @types/jasmine from 3.5.12 to 3.5.13 in /console (#623) Bumps [@types/jasmine](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/jasmine) from 3.5.12 to 3.5.13. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/jasmine) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump ts-node from 8.10.2 to 9.0.0 in /console (#629) Bumps [ts-node](https://github.com/TypeStrong/ts-node) from 8.10.2 to 9.0.0. - [Release notes](https://github.com/TypeStrong/ts-node/releases) - [Commits](https://github.com/TypeStrong/ts-node/compare/v8.10.2...v9.0.0) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * update packlock Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: delete main.yml (#648) * fix: usergrant (#650) * fix(console): mfa refresh after verification, member eventemitter (#651) * refresh mfa * fix: detail link from contributors * lint * feat: add domain verification notification (#649) * fix: dont (re)generate client secret with auth type none * fix(cors): allow Origin from request * feat: add origin allow list and fix some core issues * rename migration * fix UserIDsByDomain * feat: send email to users after domain claim * username * check origin on userinfo * update oidc pkg * fix: add migration 1.6 * change username * change username * remove unique email aggregate * change username in mgmt * search global user by login name * fix test * change user search in angular * fix tests * merge * userview in angular * fix merge * Update pkg/grpc/management/proto/management.proto Co-authored-by: Fabi <38692350+fgerschwiler@users.noreply.github.com> * Update internal/notification/static/i18n/de.yaml Co-authored-by: Fabi <38692350+fgerschwiler@users.noreply.github.com> * fix Co-authored-by: Fabi <38692350+fgerschwiler@users.noreply.github.com> * fix: translation (#647) * fix: translation * fix: translation * fix: translation * fix: remove unused code * fix: log err * fix: migration numbers (#652) * chore: issue / feature templates (#642) * feat: machine keys * fix: implement missing parts * feat: machine key management view * fix: remove keys from machine view * feat: global org read (#657) * fix: set default expiration date * fix: get key by ids * feat: add machine keys in proto * feat: machine keys * fix: add migration * fix: mig * fix: correct method name * feat: user search * feat: user search * fix: log ids * fix: migrations * fix(console): machine build (#660) * frontend 1 * fix html bindings * trailing comma * fix(console): human view (#661) * fix search user view, user detail form * rm log * feat(console): user services list and create (#663) * fix search user view, user detail form * rm log * machine list * generic table component * create user service * proove table for undefined values * tmp disable user link if machine * lint * lint styles * user table lint * Update console/src/assets/i18n/de.json Co-authored-by: Florian Forster <florian@caos.ch> * feat(console): service user detail view, keys cr_d, fix search user autocomplete (#664) * service users for sidenav, routing * i18n * back routes * machine detail form * update machine detail, fix svc user grants * keys table * add key dialog, timestamp creation * check permission on create, delete, fix selection * lint ts, scss * Update console/src/assets/i18n/de.json * Apply suggestions from code review Co-authored-by: Florian Forster <florian@caos.ch> * refactor: protos * fix(management): key expiration date * fix: check if user is human * fix: marshal key details * fix: correct generate login names * fix: logid Co-authored-by: Fabi <38692350+fgerschwiler@users.noreply.github.com> Co-authored-by: Livio Amstutz <livio.a@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Max Peintner <max@caos.ch> Co-authored-by: Fabiennne <fabienne.gerschwiler@gmail.com> Co-authored-by: Florian Forster <florian@caos.ch> * fix: naming * refactor: findings * fix: username * fix: mfa upper case * fix: tests * fix: add translations * reactivatemyorg req typeö * fix: projectType for console * fix: user changes * fix: translate events * fix: event type translation * fix: remove unused types Co-authored-by: Fabiennne <fabienne.gerschwiler@gmail.com> Co-authored-by: Max Peintner <max@caos.ch> Co-authored-by: Florian Forster <florian@caos.ch> Co-authored-by: Fabi <38692350+fgerschwiler@users.noreply.github.com> Co-authored-by: Livio Amstutz <livio.a@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-12 08:07:32 +00:00 · 2020-08-31 17:48:01 +02:00
parent c1c85e632b
commit 5abd5b0505
207 changed files with 52837 additions and 26745 deletions
--- a/internal/user/repository/view/machine_key_view.go
+++ b/internal/user/repository/view/machine_key_view.go
@@ -0,0 +1,65 @@
+package view
+
+import (
+	caos_errs "github.com/caos/zitadel/internal/errors"
+	global_model "github.com/caos/zitadel/internal/model"
+	usr_model "github.com/caos/zitadel/internal/user/model"
+	"github.com/caos/zitadel/internal/user/repository/view/model"
+	"github.com/caos/zitadel/internal/view/repository"
+	"github.com/jinzhu/gorm"
+)
+
+func MachineKeyByIDs(db *gorm.DB, table, userID, keyID string) (*model.MachineKeyView, error) {
+	key := new(model.MachineKeyView)
+	query := repository.PrepareGetByQuery(table,
+		model.MachineKeySearchQuery{Key: usr_model.MachineKeyKeyUserID, Method: global_model.SearchMethodEquals, Value: userID},
+		model.MachineKeySearchQuery{Key: usr_model.MachineKeyKeyID, Method: global_model.SearchMethodEquals, Value: keyID},
+	)
+	err := query(db, key)
+	if caos_errs.IsNotFound(err) {
+		return nil, caos_errs.ThrowNotFound(nil, "VIEW-3Dk9s", "Errors.User.KeyNotFound")
+	}
+	return key, err
+}
+
+func SearchMachineKeys(db *gorm.DB, table string, req *usr_model.MachineKeySearchRequest) ([]*model.MachineKeyView, uint64, error) {
+	members := make([]*model.MachineKeyView, 0)
+	query := repository.PrepareSearchQuery(table, model.MachineKeySearchRequest{Limit: req.Limit, Offset: req.Offset, Queries: req.Queries})
+	count, err := query(db, &members)
+	if err != nil {
+		return nil, 0, err
+	}
+	return members, count, nil
+}
+
+func MachineKeysByUserID(db *gorm.DB, table string, userID string) ([]*model.MachineKeyView, error) {
+	keys := make([]*model.MachineKeyView, 0)
+	queries := []*usr_model.MachineKeySearchQuery{
+		{
+			Key:    usr_model.MachineKeyKeyUserID,
+			Value:  userID,
+			Method: global_model.SearchMethodEquals,
+		},
+	}
+	query := repository.PrepareSearchQuery(table, model.MachineKeySearchRequest{Queries: queries})
+	_, err := query(db, &keys)
+	if err != nil {
+		return nil, err
+	}
+	return keys, nil
+}
+
+func PutMachineKey(db *gorm.DB, table string, role *model.MachineKeyView) error {
+	save := repository.PrepareSave(table)
+	return save(db, role)
+}
+
+func DeleteMachineKey(db *gorm.DB, table, keyID string) error {
+	delete := repository.PrepareDeleteByKey(table, model.MachineKeySearchKey(usr_model.MachineKeyKeyID), keyID)
+	return delete(db)
+}
+
+func DeleteMachineKeysByUserID(db *gorm.DB, table, userID string) error {
+	delete := repository.PrepareDeleteByKey(table, model.MachineKeySearchKey(usr_model.MachineKeyKeyUserID), userID)
+	return delete(db)
+}
--- a/internal/user/repository/view/model/machine_key.go
+++ b/internal/user/repository/view/model/machine_key.go
@@ -0,0 +1,81 @@
+package model
+
+import (
+	"encoding/json"
+	"time"
+
+	"github.com/caos/logging"
+
+	caos_errs "github.com/caos/zitadel/internal/errors"
+	"github.com/caos/zitadel/internal/eventstore/models"
+	"github.com/caos/zitadel/internal/user/model"
+	es_model "github.com/caos/zitadel/internal/user/repository/eventsourcing/model"
+)
+
+const (
+	MachineKeyKeyID     = "id"
+	MachineKeyKeyUserID = "user_id"
+)
+
+type MachineKeyView struct {
+	ID             string    `json:"keyId" gorm:"column:id;primary_key"`
+	UserID         string    `json:"-" gorm:"column:user_id;primary_key"`
+	Type           int32     `json:"type" gorm:"column:machine_type"`
+	ExpirationDate time.Time `json:"expirationDate" gorm:"column:expiration_date"`
+	Sequence       uint64    `json:"-" gorm:"column:sequence"`
+
+	CreationDate time.Time `json:"-" gorm:"column:creation_date"`
+}
+
+func MachineKeyViewFromModel(key *model.MachineKeyView) *MachineKeyView {
+	return &MachineKeyView{
+		ID:             key.ID,
+		UserID:         key.UserID,
+		Type:           int32(key.Type),
+		ExpirationDate: key.ExpirationDate,
+		Sequence:       key.Sequence,
+		CreationDate:   key.CreationDate,
+	}
+}
+
+func MachineKeyToModel(key *MachineKeyView) *model.MachineKeyView {
+	return &model.MachineKeyView{
+		ID:             key.ID,
+		UserID:         key.UserID,
+		Type:           model.MachineKeyType(key.Type),
+		ExpirationDate: key.ExpirationDate,
+		Sequence:       key.Sequence,
+		CreationDate:   key.CreationDate,
+	}
+}
+
+func MachineKeysToModel(keys []*MachineKeyView) []*model.MachineKeyView {
+	result := make([]*model.MachineKeyView, len(keys))
+	for i, key := range keys {
+		result[i] = MachineKeyToModel(key)
+	}
+	return result
+}
+
+func (k *MachineKeyView) AppendEvent(event *models.Event) (err error) {
+	k.Sequence = event.Sequence
+	switch event.Type {
+	case es_model.MachineKeyAdded:
+		k.setRootData(event)
+		k.CreationDate = event.CreationDate
+		err = k.SetData(event)
+	}
+	return err
+}
+
+func (k *MachineKeyView) setRootData(event *models.Event) {
+	k.UserID = event.AggregateID
+}
+
+func (r *MachineKeyView) SetData(event *models.Event) error {
+	if err := json.Unmarshal(event.Data, r); err != nil {
+		logging.Log("EVEN-Sj90d").WithError(err).Error("could not unmarshal event data")
+		return caos_errs.ThrowInternal(err, "MODEL-lub6s", "Could not unmarshal data")
+	}
+	return nil
+}
--- a/internal/user/repository/view/model/machine_key_query.go
+++ b/internal/user/repository/view/model/machine_key_query.go
@@ -0,0 +1,61 @@
+package model
+
+import (
+	global_model "github.com/caos/zitadel/internal/model"
+	usr_model "github.com/caos/zitadel/internal/user/model"
+	"github.com/caos/zitadel/internal/view/repository"
+)
+
+type MachineKeySearchRequest usr_model.MachineKeySearchRequest
+type MachineKeySearchQuery usr_model.MachineKeySearchQuery
+type MachineKeySearchKey usr_model.MachineKeySearchKey
+
+func (req MachineKeySearchRequest) GetLimit() uint64 {
+	return req.Limit
+}
+
+func (req MachineKeySearchRequest) GetOffset() uint64 {
+	return req.Offset
+}
+
+func (req MachineKeySearchRequest) GetSortingColumn() repository.ColumnKey {
+	if req.SortingColumn == usr_model.MachineKeyKeyUnspecified {
+		return nil
+	}
+	return MachineKeySearchKey(req.SortingColumn)
+}
+
+func (req MachineKeySearchRequest) GetAsc() bool {
+	return req.Asc
+}
+
+func (req MachineKeySearchRequest) GetQueries() []repository.SearchQuery {
+	result := make([]repository.SearchQuery, len(req.Queries))
+	for i, q := range req.Queries {
+		result[i] = MachineKeySearchQuery{Key: q.Key, Value: q.Value, Method: q.Method}
+	}
+	return result
+}
+
+func (req MachineKeySearchQuery) GetKey() repository.ColumnKey {
+	return MachineKeySearchKey(req.Key)
+}
+
+func (req MachineKeySearchQuery) GetMethod() global_model.SearchMethod {
+	return req.Method
+}
+
+func (req MachineKeySearchQuery) GetValue() interface{} {
+	return req.Value
+}
+
+func (key MachineKeySearchKey) ToColumnName() string {
+	switch usr_model.MachineKeySearchKey(key) {
+	case usr_model.MachineKeyKeyID:
+		return MachineKeyKeyID
+	case usr_model.MachineKeyKeyUserID:
+		return MachineKeyKeyUserID
+	default:
+		return ""
+	}
+}
--- a/internal/user/repository/view/model/notify_user.go
+++ b/internal/user/repository/view/model/notify_user.go
@@ -2,6 +2,8 @@ package model

 import (
 	"encoding/json"
+	"time"
+
 	"github.com/caos/logging"
 	caos_errs "github.com/caos/zitadel/internal/errors"
 	"github.com/caos/zitadel/internal/eventstore/models"
@@ -9,7 +11,6 @@ import (
 	"github.com/caos/zitadel/internal/user/model"
 	es_model "github.com/caos/zitadel/internal/user/repository/eventsourcing/model"
 	"github.com/lib/pq"
-	"time"
 )

 const (
@@ -112,7 +113,9 @@ func (u *NotifyUser) AppendEvent(event *models.Event) (err error) {
 	u.Sequence = event.Sequence
 	switch event.Type {
 	case es_model.UserAdded,
-		es_model.UserRegistered:
+		es_model.UserRegistered,
+		es_model.HumanRegistered,
+		es_model.HumanAdded:
 		u.CreationDate = event.CreationDate
 		u.setRootData(event)
 		err = u.setData(event)
@@ -120,20 +123,25 @@ func (u *NotifyUser) AppendEvent(event *models.Event) (err error) {
 			return err
 		}
 		err = u.setPasswordData(event)
-	case es_model.UserProfileChanged:
+	case es_model.UserProfileChanged,
+		es_model.UserEmailChanged,
+		es_model.UserPhoneChanged,
+		es_model.HumanProfileChanged,
+		es_model.HumanEmailChanged,
+		es_model.HumanPhoneChanged:
 		err = u.setData(event)
-	case es_model.UserEmailChanged:
-		err = u.setData(event)
-	case es_model.UserEmailVerified:
+	case es_model.UserEmailVerified,
+		es_model.HumanEmailVerified:
 		u.VerifiedEmail = u.LastEmail
-	case es_model.UserPhoneChanged:
-		err = u.setData(event)
-	case es_model.UserPhoneRemoved:
+	case es_model.UserPhoneRemoved,
+		es_model.HumanPhoneRemoved:
 		u.VerifiedPhone = ""
 		u.LastPhone = ""
-	case es_model.UserPhoneVerified:
+	case es_model.UserPhoneVerified,
+		es_model.HumanPhoneVerified:
 		u.VerifiedPhone = u.LastPhone
-	case es_model.UserPasswordChanged:
+	case es_model.UserPasswordChanged,
+		es_model.HumanPasswordChanged:
 		err = u.setPasswordData(event)
 	}
 	return err
--- a/internal/user/repository/view/model/user.go
+++ b/internal/user/repository/view/model/user.go
@@ -2,9 +2,10 @@ package model

 import (
 	"encoding/json"
+	"time"
+
 	org_model "github.com/caos/zitadel/internal/org/model"
 	"github.com/lib/pq"
-	"time"

 	"github.com/caos/logging"

@@ -26,118 +27,131 @@ const (
 	UserKeyState         = "user_state"
 	UserKeyResourceOwner = "resource_owner"
 	UserKeyLoginNames    = "login_names"
+	UserKeyType          = "user_type"
+)
+
+type userType string
+
+const (
+	userTypeHuman   = "human"
+	userTypeMachine = "machine"
 )

 type UserView struct {
-	ID                     string         `json:"-" gorm:"column:id;primary_key"`
-	CreationDate           time.Time      `json:"-" gorm:"column:creation_date"`
-	ChangeDate             time.Time      `json:"-" gorm:"column:change_date"`
-	ResourceOwner          string         `json:"-" gorm:"column:resource_owner"`
-	State                  int32          `json:"-" gorm:"column:user_state"`
-	PasswordSet            bool           `json:"-" gorm:"column:password_set"`
-	PasswordChangeRequired bool           `json:"-" gorm:"column:password_change_required"`
-	UsernameChangeRequired bool           `json:"-" gorm:"column:username_change_required"`
-	PasswordChanged        time.Time      `json:"-" gorm:"column:password_change"`
-	LastLogin              time.Time      `json:"-" gorm:"column:last_login"`
-	UserName               string         `json:"userName" gorm:"column:user_name"`
-	LoginNames             pq.StringArray `json:"-" gorm:"column:login_names"`
-	PreferredLoginName     string         `json:"-" gorm:"column:preferred_login_name"`
-	FirstName              string         `json:"firstName" gorm:"column:first_name"`
-	LastName               string         `json:"lastName" gorm:"column:last_name"`
-	NickName               string         `json:"nickName" gorm:"column:nick_name"`
-	DisplayName            string         `json:"displayName" gorm:"column:display_name"`
-	PreferredLanguage      string         `json:"preferredLanguage" gorm:"column:preferred_language"`
-	Gender                 int32          `json:"gender" gorm:"column:gender"`
-	Email                  string         `json:"email" gorm:"column:email"`
-	IsEmailVerified        bool           `json:"-" gorm:"column:is_email_verified"`
-	Phone                  string         `json:"phone" gorm:"column:phone"`
-	IsPhoneVerified        bool           `json:"-" gorm:"column:is_phone_verified"`
-	Country                string         `json:"country" gorm:"column:country"`
-	Locality               string         `json:"locality" gorm:"column:locality"`
-	PostalCode             string         `json:"postalCode" gorm:"column:postal_code"`
-	Region                 string         `json:"region" gorm:"column:region"`
-	StreetAddress          string         `json:"streetAddress" gorm:"column:street_address"`
-	OTPState               int32          `json:"-" gorm:"column:otp_state"`
-	MfaMaxSetUp            int32          `json:"-" gorm:"column:mfa_max_set_up"`
-	MfaInitSkipped         time.Time      `json:"-" gorm:"column:mfa_init_skipped"`
-	InitRequired           bool           `json:"-" gorm:"column:init_required"`
-	Sequence               uint64         `json:"-" gorm:"column:sequence"`
+	ID                 string         `json:"-" gorm:"column:id;primary_key"`
+	CreationDate       time.Time      `json:"-" gorm:"column:creation_date"`
+	ChangeDate         time.Time      `json:"-" gorm:"column:change_date"`
+	ResourceOwner      string         `json:"-" gorm:"column:resource_owner"`
+	State              int32          `json:"-" gorm:"column:user_state"`
+	LastLogin          time.Time      `json:"-" gorm:"column:last_login"`
+	LoginNames         pq.StringArray `json:"-" gorm:"column:login_names"`
+	PreferredLoginName string         `json:"-" gorm:"column:preferred_login_name"`
+	Sequence           uint64         `json:"-" gorm:"column:sequence"`
+	Type               userType       `json:"-" gorm:"column:user_type"`
+	UserName           string         `json:"userName" gorm:"column:user_name"`
+	*MachineView
+	*HumanView
 }

-func UserFromModel(user *model.UserView) *UserView {
-	return &UserView{
-		ID:                     user.ID,
-		ChangeDate:             user.ChangeDate,
-		CreationDate:           user.CreationDate,
-		ResourceOwner:          user.ResourceOwner,
-		State:                  int32(user.State),
-		PasswordSet:            user.PasswordSet,
-		PasswordChangeRequired: user.PasswordChangeRequired,
-		UsernameChangeRequired: user.UsernameChangeRequired,
-		PasswordChanged:        user.PasswordChanged,
-		LastLogin:              user.LastLogin,
-		UserName:               user.UserName,
-		LoginNames:             user.LoginNames,
-		PreferredLoginName:     user.PreferredLoginName,
-		FirstName:              user.FirstName,
-		LastName:               user.LastName,
-		NickName:               user.NickName,
-		DisplayName:            user.DisplayName,
-		PreferredLanguage:      user.PreferredLanguage,
-		Gender:                 int32(user.Gender),
-		Email:                  user.Email,
-		IsEmailVerified:        user.IsEmailVerified,
-		Phone:                  user.Phone,
-		IsPhoneVerified:        user.IsPhoneVerified,
-		Country:                user.Country,
-		Locality:               user.Locality,
-		PostalCode:             user.PostalCode,
-		Region:                 user.Region,
-		StreetAddress:          user.StreetAddress,
-		OTPState:               int32(user.OTPState),
-		MfaMaxSetUp:            int32(user.MfaMaxSetUp),
-		MfaInitSkipped:         user.MfaInitSkipped,
-		InitRequired:           user.InitRequired,
-		Sequence:               user.Sequence,
-	}
+type UserState int32
+
+const (
+	UserStateUnspecified UserState = iota
+	UserStateActive
+	UserStateInactive
+	UserStateDeleted
+	UserStateLocked
+	UserStateSuspend
+	UserStateInitial
+)
+
+type HumanView struct {
+	FirstName         string    `json:"firstName" gorm:"column:first_name"`
+	LastName          string    `json:"lastName" gorm:"column:last_name"`
+	NickName          string    `json:"nickName" gorm:"column:nick_name"`
+	DisplayName       string    `json:"displayName" gorm:"column:display_name"`
+	PreferredLanguage string    `json:"preferredLanguage" gorm:"column:preferred_language"`
+	Gender            int32     `json:"gender" gorm:"column:gender"`
+	Email             string    `json:"email" gorm:"column:email"`
+	IsEmailVerified   bool      `json:"-" gorm:"column:is_email_verified"`
+	Phone             string    `json:"phone" gorm:"column:phone"`
+	IsPhoneVerified   bool      `json:"-" gorm:"column:is_phone_verified"`
+	Country           string    `json:"country" gorm:"column:country"`
+	Locality          string    `json:"locality" gorm:"column:locality"`
+	PostalCode        string    `json:"postalCode" gorm:"column:postal_code"`
+	Region            string    `json:"region" gorm:"column:region"`
+	StreetAddress     string    `json:"streetAddress" gorm:"column:street_address"`
+	OTPState          int32     `json:"-" gorm:"column:otp_state"`
+	MfaMaxSetUp       int32     `json:"-" gorm:"column:mfa_max_set_up"`
+	MfaInitSkipped    time.Time `json:"-" gorm:"column:mfa_init_skipped"`
+	InitRequired      bool      `json:"-" gorm:"column:init_required"`
+
+	PasswordSet            bool      `json:"-" gorm:"column:password_set"`
+	PasswordChangeRequired bool      `json:"-" gorm:"column:password_change_required"`
+	UsernameChangeRequired bool      `json:"-" gorm:"column:username_change_required"`
+	PasswordChanged        time.Time `json:"-" gorm:"column:password_change"`
+}
+
+func (h *HumanView) IsZero() bool {
+	return h == nil || h.FirstName == ""
+}
+
+type MachineView struct {
+	Name        string `json:"name" gorm:"column:machine_name"`
+	Description string `json:"description" gorm:"column:machine_description"`
+}
+
+func (m *MachineView) IsZero() bool {
+	return m == nil || m.Name == ""
 }

 func UserToModel(user *UserView) *model.UserView {
-	return &model.UserView{
-		ID:                     user.ID,
-		ChangeDate:             user.ChangeDate,
-		CreationDate:           user.CreationDate,
-		ResourceOwner:          user.ResourceOwner,
-		State:                  model.UserState(user.State),
-		PasswordSet:            user.PasswordSet,
-		PasswordChangeRequired: user.PasswordChangeRequired,
-		UsernameChangeRequired: user.UsernameChangeRequired,
-		PasswordChanged:        user.PasswordChanged,
-		LastLogin:              user.LastLogin,
-		PreferredLoginName:     user.PreferredLoginName,
-		LoginNames:             user.LoginNames,
-		UserName:               user.UserName,
-		FirstName:              user.FirstName,
-		LastName:               user.LastName,
-		NickName:               user.NickName,
-		DisplayName:            user.DisplayName,
-		PreferredLanguage:      user.PreferredLanguage,
-		Gender:                 model.Gender(user.Gender),
-		Email:                  user.Email,
-		IsEmailVerified:        user.IsEmailVerified,
-		Phone:                  user.Phone,
-		IsPhoneVerified:        user.IsPhoneVerified,
-		Country:                user.Country,
-		Locality:               user.Locality,
-		PostalCode:             user.PostalCode,
-		Region:                 user.Region,
-		StreetAddress:          user.StreetAddress,
-		OTPState:               model.MfaState(user.OTPState),
-		MfaMaxSetUp:            req_model.MfaLevel(user.MfaMaxSetUp),
-		MfaInitSkipped:         user.MfaInitSkipped,
-		InitRequired:           user.InitRequired,
-		Sequence:               user.Sequence,
+	userView := &model.UserView{
+		ID:                 user.ID,
+		UserName:           user.UserName,
+		ChangeDate:         user.ChangeDate,
+		CreationDate:       user.CreationDate,
+		ResourceOwner:      user.ResourceOwner,
+		State:              model.UserState(user.State),
+		LastLogin:          user.LastLogin,
+		PreferredLoginName: user.PreferredLoginName,
+		LoginNames:         user.LoginNames,
+		Sequence:           user.Sequence,
 	}
+	if !user.HumanView.IsZero() {
+		userView.HumanView = &model.HumanView{
+			PasswordSet:            user.PasswordSet,
+			PasswordChangeRequired: user.PasswordChangeRequired,
+			PasswordChanged:        user.PasswordChanged,
+			FirstName:              user.FirstName,
+			LastName:               user.LastName,
+			NickName:               user.NickName,
+			DisplayName:            user.DisplayName,
+			PreferredLanguage:      user.PreferredLanguage,
+			Gender:                 model.Gender(user.Gender),
+			Email:                  user.Email,
+			IsEmailVerified:        user.IsEmailVerified,
+			Phone:                  user.Phone,
+			IsPhoneVerified:        user.IsPhoneVerified,
+			Country:                user.Country,
+			Locality:               user.Locality,
+			PostalCode:             user.PostalCode,
+			Region:                 user.Region,
+			StreetAddress:          user.StreetAddress,
+			OTPState:               model.MfaState(user.OTPState),
+			MfaMaxSetUp:            req_model.MfaLevel(user.MfaMaxSetUp),
+			MfaInitSkipped:         user.MfaInitSkipped,
+			InitRequired:           user.InitRequired,
+		}
+	}
+
+	if !user.MachineView.IsZero() {
+		userView.MachineView = &model.MachineView{
+			Description: user.MachineView.Description,
+			Name:        user.MachineView.Name,
+		}
+	}
+	return userView
 }

 func UsersToModel(users []*UserView) []*model.UserView {
@@ -172,19 +186,34 @@ func (u *UserView) AppendEvent(event *models.Event) (err error) {
 	u.ChangeDate = event.CreationDate
 	u.Sequence = event.Sequence
 	switch event.Type {
-	case es_model.UserAdded,
-		es_model.UserRegistered:
+	case es_model.MachineAdded:
 		u.CreationDate = event.CreationDate
 		u.setRootData(event)
+		u.Type = userTypeMachine
+		err = u.setData(event)
+		if err != nil {
+			return err
+		}
+	case es_model.UserAdded,
+		es_model.UserRegistered,
+		es_model.HumanRegistered,
+		es_model.HumanAdded:
+		u.CreationDate = event.CreationDate
+		u.setRootData(event)
+		u.Type = userTypeHuman
 		err = u.setData(event)
 		if err != nil {
 			return err
 		}
 		err = u.setPasswordData(event)
-	case es_model.UserPasswordChanged:
+	case es_model.UserPasswordChanged,
+		es_model.HumanPasswordChanged:
 		err = u.setPasswordData(event)
 	case es_model.UserProfileChanged,
-		es_model.UserAddressChanged:
+		es_model.HumanProfileChanged,
+		es_model.UserAddressChanged,
+		es_model.HumanAddressChanged,
+		es_model.MachineChanged:
 		err = u.setData(event)
 	case es_model.DomainClaimed:
 		u.UsernameChangeRequired = true
@@ -192,17 +221,22 @@ func (u *UserView) AppendEvent(event *models.Event) (err error) {
 	case es_model.UserUserNameChanged:
 		u.UsernameChangeRequired = false
 		err = u.setData(event)
-	case es_model.UserEmailChanged:
+	case es_model.UserEmailChanged,
+		es_model.HumanEmailChanged:
 		u.IsEmailVerified = false
 		err = u.setData(event)
-	case es_model.UserEmailVerified:
+	case es_model.UserEmailVerified,
+		es_model.HumanEmailVerified:
 		u.IsEmailVerified = true
-	case es_model.UserPhoneChanged:
+	case es_model.UserPhoneChanged,
+		es_model.HumanPhoneChanged:
 		u.IsPhoneVerified = false
 		err = u.setData(event)
-	case es_model.UserPhoneVerified:
+	case es_model.UserPhoneVerified,
+		es_model.HumanPhoneVerified:
 		u.IsPhoneVerified = true
-	case es_model.UserPhoneRemoved:
+	case es_model.UserPhoneRemoved,
+		es_model.HumanPhoneRemoved:
 		u.Phone = ""
 		u.IsPhoneVerified = false
 	case es_model.UserDeactivated:
@@ -212,18 +246,24 @@ func (u *UserView) AppendEvent(event *models.Event) (err error) {
 		u.State = int32(model.UserStateActive)
 	case es_model.UserLocked:
 		u.State = int32(model.UserStateLocked)
-	case es_model.MfaOtpAdded:
+	case es_model.MFAOTPAdded,
+		es_model.HumanMFAOTPAdded:
 		u.OTPState = int32(model.MfaStateNotReady)
-	case es_model.MfaOtpVerified:
+	case es_model.MFAOTPVerified,
+		es_model.HumanMFAOTPVerified:
 		u.OTPState = int32(model.MfaStateReady)
 		u.MfaInitSkipped = time.Time{}
-	case es_model.MfaOtpRemoved:
+	case es_model.MFAOTPRemoved,
+		es_model.HumanMFAOTPRemoved:
 		u.OTPState = int32(model.MfaStateUnspecified)
-	case es_model.MfaInitSkipped:
+	case es_model.MFAInitSkipped,
+		es_model.HumanMfaInitSkipped:
 		u.MfaInitSkipped = event.CreationDate
-	case es_model.InitializedUserCodeAdded:
+	case es_model.InitializedUserCodeAdded,
+		es_model.InitializedHumanCodeAdded:
 		u.InitRequired = true
-	case es_model.InitializedUserCheckSucceeded:
+	case es_model.InitializedUserCheckSucceeded,
+		es_model.InitializedHumanCheckSucceeded:
 		u.InitRequired = false
 	}
 	u.ComputeObject()
@@ -256,6 +296,12 @@ func (u *UserView) setPasswordData(event *models.Event) error {
 }

 func (u *UserView) ComputeObject() {
+	if u.MachineView != nil {
+		if u.State == int32(model.UserStateUnspecified) {
+			u.State = int32(model.UserStateActive)
+		}
+		return
+	}
 	if u.State == int32(model.UserStateUnspecified) || u.State == int32(model.UserStateInitial) {
 		if u.IsEmailVerified {
 			u.State = int32(model.UserStateActive)
--- a/internal/user/repository/view/model/user_membership.go
+++ b/internal/user/repository/view/model/user_membership.go
@@ -2,6 +2,8 @@ package model

 import (
 	"encoding/json"
+	"time"
+
 	"github.com/caos/logging"
 	caos_errs "github.com/caos/zitadel/internal/errors"
 	"github.com/caos/zitadel/internal/eventstore/models"
@@ -10,7 +12,6 @@ import (
 	proj_es_model "github.com/caos/zitadel/internal/project/repository/eventsourcing/model"
 	"github.com/caos/zitadel/internal/user/model"
 	"github.com/lib/pq"
-	"time"
 )

 const (
--- a/internal/user/repository/view/model/user_query.go
+++ b/internal/user/repository/view/model/user_query.go
@@ -71,6 +71,8 @@ func (key UserSearchKey) ToColumnName() string {
 		return UserKeyResourceOwner
 	case usr_model.UserSearchKeyLoginNames:
 		return UserKeyLoginNames
+	case usr_model.UserSearchKeyType:
+		return UserKeyType
 	default:
 		return ""
 	}
--- a/internal/user/repository/view/model/user_session.go
+++ b/internal/user/repository/view/model/user_session.go
@@ -79,20 +79,27 @@ func (v *UserSessionView) AppendEvent(event *models.Event) {
 	v.Sequence = event.Sequence
 	v.ChangeDate = event.CreationDate
 	switch event.Type {
-	case es_model.UserPasswordCheckSucceeded:
+	case es_model.UserPasswordCheckSucceeded,
+		es_model.HumanPasswordCheckSucceeded:
 		v.PasswordVerification = event.CreationDate
 		v.State = int32(req_model.UserSessionStateActive)
 	case es_model.UserPasswordCheckFailed,
-		es_model.UserPasswordChanged:
+		es_model.UserPasswordChanged,
+		es_model.HumanPasswordCheckFailed,
+		es_model.HumanPasswordChanged:
 		v.PasswordVerification = time.Time{}
-	case es_model.MfaOtpCheckSucceeded:
+	case es_model.MfaOtpCheckSucceeded,
+		es_model.HumanMfaOtpCheckSucceeded:
 		v.MfaSoftwareVerification = event.CreationDate
 		v.MfaSoftwareVerificationType = int32(req_model.MfaTypeOTP)
 		v.State = int32(req_model.UserSessionStateActive)
 	case es_model.MfaOtpCheckFailed,
-		es_model.MfaOtpRemoved:
+		es_model.MFAOTPRemoved,
+		es_model.HumanMfaOtpCheckFailed,
+		es_model.HumanMFAOTPRemoved:
 		v.MfaSoftwareVerification = time.Time{}
 	case es_model.SignedOut,
+		es_model.HumanSignedOut,
 		es_model.UserLocked,
 		es_model.UserDeactivated:
 		v.PasswordVerification = time.Time{}
--- a/internal/user/repository/view/model/user_test.go
+++ b/internal/user/repository/view/model/user_test.go
@@ -11,7 +11,7 @@ import (
 	es_model "github.com/caos/zitadel/internal/user/repository/eventsourcing/model"
 )

-func mockUserData(user *es_model.User) []byte {
+func mockUserData(user *es_model.Human) []byte {
 	data, _ := json.Marshal(user)
 	return data
 }
@@ -41,10 +41,9 @@ func mockAddressData(address *es_model.Address) []byte {
 	return data
 }

-func getFullUser(password *es_model.Password) *es_model.User {
-	return &es_model.User{
+func getFullUser(password *es_model.Password) *es_model.Human {
+	return &es_model.Human{
 		Profile: &es_model.Profile{
-			UserName:  "UserName",
 			FirstName: "FirstName",
 			LastName:  "LastName",
 		},
@@ -77,7 +76,7 @@ func TestUserAppendEvent(t *testing.T) {
 				event: &es_models.Event{AggregateID: "AggregateID", Sequence: 1, Type: es_model.UserAdded, ResourceOwner: "OrgID", Data: mockUserData(getFullUser(nil))},
 				user:  &UserView{},
 			},
-			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country", State: int32(model.UserStateInitial)},
+			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", HumanView: &HumanView{FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country"}, State: int32(model.UserStateInitial)},
 		},
 		{
 			name: "append added user with password event",
@@ -85,7 +84,7 @@ func TestUserAppendEvent(t *testing.T) {
 				event: &es_models.Event{AggregateID: "AggregateID", Sequence: 1, Type: es_model.UserAdded, ResourceOwner: "OrgID", Data: mockUserData(getFullUser(&es_model.Password{Secret: &crypto.CryptoValue{}}))},
 				user:  &UserView{},
 			},
-			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country", State: int32(model.UserStateInitial), PasswordSet: true},
+			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", HumanView: &HumanView{FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country", PasswordSet: true}, State: int32(model.UserStateInitial)},
 		},
 		{
 			name: "append added user with password but change required event",
@@ -93,135 +92,135 @@ func TestUserAppendEvent(t *testing.T) {
 				event: &es_models.Event{AggregateID: "AggregateID", Sequence: 1, Type: es_model.UserAdded, ResourceOwner: "OrgID", Data: mockUserData(getFullUser(&es_model.Password{ChangeRequired: true, Secret: &crypto.CryptoValue{}}))},
 				user:  &UserView{},
 			},
-			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country", State: int32(model.UserStateInitial), PasswordSet: true, PasswordChangeRequired: true},
+			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", HumanView: &HumanView{FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country", PasswordSet: true, PasswordChangeRequired: true}, State: int32(model.UserStateInitial)},
 		},
 		{
 			name: "append password change event",
 			args: args{
 				event: &es_models.Event{AggregateID: "AggregateID", Sequence: 1, Type: es_model.UserPasswordChanged, ResourceOwner: "OrgID", Data: mockPasswordData(&es_model.Password{Secret: &crypto.CryptoValue{}})},
-				user:  &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", FirstName: "FirstName", LastName: "LastName", Email: "Email", IsEmailVerified: true, Phone: "Phone", Country: "Country", State: int32(model.UserStateActive)},
+				user:  &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", HumanView: &HumanView{FirstName: "FirstName", LastName: "LastName", Email: "Email", IsEmailVerified: true, Phone: "Phone", Country: "Country"}, State: int32(model.UserStateActive)},
 			},
-			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", FirstName: "FirstName", LastName: "LastName", Email: "Email", IsEmailVerified: true, Phone: "Phone", Country: "Country", State: int32(model.UserStateActive), PasswordSet: true},
+			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", HumanView: &HumanView{FirstName: "FirstName", LastName: "LastName", Email: "Email", IsEmailVerified: true, Phone: "Phone", Country: "Country", PasswordSet: true}, State: int32(model.UserStateActive)},
 		},
 		{
 			name: "append password change with change required event",
 			args: args{
 				event: &es_models.Event{AggregateID: "AggregateID", Sequence: 1, Type: es_model.UserPasswordChanged, ResourceOwner: "OrgID", Data: mockPasswordData(&es_model.Password{ChangeRequired: true, Secret: &crypto.CryptoValue{}})},
-				user:  &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", FirstName: "FirstName", LastName: "LastName", Email: "Email", IsEmailVerified: true, Phone: "Phone", Country: "Country", State: int32(model.UserStateActive)},
+				user:  &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", HumanView: &HumanView{FirstName: "FirstName", LastName: "LastName", Email: "Email", IsEmailVerified: true, Phone: "Phone", Country: "Country"}, State: int32(model.UserStateActive)},
 			},
-			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", FirstName: "FirstName", LastName: "LastName", Email: "Email", IsEmailVerified: true, Phone: "Phone", Country: "Country", State: int32(model.UserStateActive), PasswordSet: true, PasswordChangeRequired: true},
+			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", HumanView: &HumanView{FirstName: "FirstName", LastName: "LastName", Email: "Email", IsEmailVerified: true, Phone: "Phone", Country: "Country", PasswordSet: true, PasswordChangeRequired: true}, State: int32(model.UserStateActive)},
 		},
 		{
 			name: "append change user profile event",
 			args: args{
 				event: &es_models.Event{AggregateID: "AggregateID", Sequence: 1, Type: es_model.UserProfileChanged, ResourceOwner: "OrgID", Data: mockProfileData(&es_model.Profile{FirstName: "FirstNameChanged"})},
-				user:  &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country", State: int32(model.UserStateInitial)},
+				user:  &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", HumanView: &HumanView{FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country"}, State: int32(model.UserStateInitial)},
 			},
-			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", FirstName: "FirstNameChanged", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country", State: int32(model.UserStateInitial)},
+			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", HumanView: &HumanView{FirstName: "FirstNameChanged", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country"}, State: int32(model.UserStateInitial)},
 		},
 		{
 			name: "append change user email event",
 			args: args{
 				event: &es_models.Event{AggregateID: "AggregateID", Sequence: 1, Type: es_model.UserEmailChanged, ResourceOwner: "OrgID", Data: mockEmailData(&es_model.Email{EmailAddress: "EmailChanged"})},
-				user:  &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", FirstName: "FirstName", LastName: "LastName", Email: "Email", IsEmailVerified: true, Phone: "Phone", Country: "Country", State: int32(model.UserStateActive)},
+				user:  &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", HumanView: &HumanView{FirstName: "FirstName", LastName: "LastName", Email: "Email", IsEmailVerified: true, Phone: "Phone", Country: "Country"}, State: int32(model.UserStateActive)},
 			},
-			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", FirstName: "FirstName", LastName: "LastName", Email: "EmailChanged", Phone: "Phone", Country: "Country", State: int32(model.UserStateActive)},
+			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", HumanView: &HumanView{FirstName: "FirstName", LastName: "LastName", Email: "EmailChanged", Phone: "Phone", Country: "Country"}, State: int32(model.UserStateActive)},
 		},
 		{
 			name: "append verify user email event",
 			args: args{
 				event: &es_models.Event{AggregateID: "AggregateID", Sequence: 1, Type: es_model.UserEmailVerified, ResourceOwner: "OrgID"},
-				user:  &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country", State: int32(model.UserStateInitial)},
+				user:  &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", HumanView: &HumanView{FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country"}, State: int32(model.UserStateInitial)},
 			},
-			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", FirstName: "FirstName", LastName: "LastName", Email: "Email", IsEmailVerified: true, Phone: "Phone", Country: "Country", State: int32(model.UserStateActive)},
+			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", HumanView: &HumanView{FirstName: "FirstName", LastName: "LastName", Email: "Email", IsEmailVerified: true, Phone: "Phone", Country: "Country"}, State: int32(model.UserStateActive)},
 		},
 		{
 			name: "append change user phone event",
 			args: args{
 				event: &es_models.Event{AggregateID: "AggregateID", Sequence: 1, Type: es_model.UserPhoneChanged, ResourceOwner: "OrgID", Data: mockPhoneData(&es_model.Phone{PhoneNumber: "PhoneChanged"})},
-				user:  &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", FirstName: "FirstName", LastName: "LastName", Email: "Email", IsEmailVerified: true, Phone: "Phone", Country: "Country", State: int32(model.UserStateActive)},
+				user:  &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", HumanView: &HumanView{FirstName: "FirstName", LastName: "LastName", Email: "Email", IsEmailVerified: true, Phone: "Phone", Country: "Country"}, State: int32(model.UserStateActive)},
 			},
-			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", FirstName: "FirstName", LastName: "LastName", Email: "Email", IsEmailVerified: true, Phone: "PhoneChanged", Country: "Country", State: int32(model.UserStateActive)},
+			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", HumanView: &HumanView{FirstName: "FirstName", LastName: "LastName", Email: "Email", IsEmailVerified: true, Phone: "PhoneChanged", Country: "Country"}, State: int32(model.UserStateActive)},
 		},
 		{
 			name: "append verify user phone event",
 			args: args{
 				event: &es_models.Event{AggregateID: "AggregateID", Sequence: 1, Type: es_model.UserPhoneVerified, ResourceOwner: "OrgID"},
-				user:  &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country", State: int32(model.UserStateActive)},
+				user:  &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", HumanView: &HumanView{FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country"}, State: int32(model.UserStateActive)},
 			},
-			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", IsPhoneVerified: true, Country: "Country", State: int32(model.UserStateActive)},
+			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", HumanView: &HumanView{FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", IsPhoneVerified: true, Country: "Country"}, State: int32(model.UserStateActive)},
 		},
 		{
 			name: "append change user address event",
 			args: args{
 				event: &es_models.Event{AggregateID: "AggregateID", Sequence: 1, Type: es_model.UserAddressChanged, ResourceOwner: "OrgID", Data: mockAddressData(&es_model.Address{Country: "CountryChanged"})},
-				user:  &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", FirstName: "FirstName", LastName: "LastName", Email: "Email", IsEmailVerified: true, Phone: "Phone", Country: "Country", State: int32(model.UserStateActive)},
+				user:  &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", HumanView: &HumanView{FirstName: "FirstName", LastName: "LastName", Email: "Email", IsEmailVerified: true, Phone: "Phone", Country: "Country"}, State: int32(model.UserStateActive)},
 			},
-			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", FirstName: "FirstName", LastName: "LastName", Email: "Email", IsEmailVerified: true, Phone: "Phone", Country: "CountryChanged", State: int32(model.UserStateActive)},
+			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", HumanView: &HumanView{FirstName: "FirstName", LastName: "LastName", Email: "Email", IsEmailVerified: true, Phone: "Phone", Country: "CountryChanged"}, State: int32(model.UserStateActive)},
 		},
 		{
 			name: "append user deactivate event",
 			args: args{
 				event: &es_models.Event{AggregateID: "AggregateID", Sequence: 1, Type: es_model.UserDeactivated, ResourceOwner: "OrgID"},
-				user:  &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country", State: int32(model.UserStateActive)},
+				user:  &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", HumanView: &HumanView{FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country"}, State: int32(model.UserStateActive)},
 			},
-			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country", State: int32(model.UserStateInactive)},
+			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", HumanView: &HumanView{FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country"}, State: int32(model.UserStateInactive)},
 		},
 		{
 			name: "append user reactivate event",
 			args: args{
 				event: &es_models.Event{AggregateID: "AggregateID", Sequence: 1, Type: es_model.UserReactivated, ResourceOwner: "OrgID"},
-				user:  &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country", State: int32(model.UserStateInactive)},
+				user:  &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", HumanView: &HumanView{FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country"}, State: int32(model.UserStateInactive)},
 			},
-			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country", State: int32(model.UserStateActive)},
+			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", HumanView: &HumanView{FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country"}, State: int32(model.UserStateActive)},
 		},
 		{
 			name: "append user lock event",
 			args: args{
 				event: &es_models.Event{AggregateID: "AggregateID", Sequence: 1, Type: es_model.UserLocked, ResourceOwner: "OrgID"},
-				user:  &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country", State: int32(model.UserStateActive)},
+				user:  &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", HumanView: &HumanView{FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country"}, State: int32(model.UserStateActive)},
 			},
-			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country", State: int32(model.UserStateLocked)},
+			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", HumanView: &HumanView{FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country"}, State: int32(model.UserStateLocked)},
 		},
 		{
 			name: "append user unlock event",
 			args: args{
 				event: &es_models.Event{AggregateID: "AggregateID", Sequence: 1, Type: es_model.UserUnlocked, ResourceOwner: "OrgID"},
-				user:  &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country", State: int32(model.UserStateLocked)},
+				user:  &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", HumanView: &HumanView{FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country"}, State: int32(model.UserStateLocked)},
 			},
-			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country", State: int32(model.UserStateActive)},
+			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", HumanView: &HumanView{FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country"}, State: int32(model.UserStateActive)},
 		},
 		{
 			name: "append user add otp event",
 			args: args{
-				event: &es_models.Event{AggregateID: "AggregateID", Sequence: 1, Type: es_model.MfaOtpAdded, ResourceOwner: "OrgID"},
-				user:  &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country", State: int32(model.UserStateActive)},
+				event: &es_models.Event{AggregateID: "AggregateID", Sequence: 1, Type: es_model.MFAOTPAdded, ResourceOwner: "OrgID"},
+				user:  &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", HumanView: &HumanView{FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country"}, State: int32(model.UserStateActive)},
 			},
-			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country", State: int32(model.UserStateActive), OTPState: int32(model.MfaStateNotReady)},
+			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", HumanView: &HumanView{FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country", OTPState: int32(model.MfaStateNotReady)}, State: int32(model.UserStateActive)},
 		},
 		{
 			name: "append user verify otp event",
 			args: args{
-				event: &es_models.Event{AggregateID: "AggregateID", Sequence: 1, Type: es_model.MfaOtpVerified, ResourceOwner: "OrgID"},
-				user:  &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country", State: int32(model.UserStateActive), OTPState: int32(model.MfaStateNotReady)},
+				event: &es_models.Event{AggregateID: "AggregateID", Sequence: 1, Type: es_model.MFAOTPVerified, ResourceOwner: "OrgID"},
+				user:  &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", HumanView: &HumanView{FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country", OTPState: int32(model.MfaStateNotReady)}, State: int32(model.UserStateActive)},
 			},
-			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country", State: int32(model.UserStateActive), OTPState: int32(model.MfaStateReady)},
+			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", HumanView: &HumanView{FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country", OTPState: int32(model.MfaStateReady)}, State: int32(model.UserStateActive)},
 		},
 		{
 			name: "append user remove otp event",
 			args: args{
-				event: &es_models.Event{AggregateID: "AggregateID", Sequence: 1, Type: es_model.MfaOtpRemoved, ResourceOwner: "OrgID"},
-				user:  &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country", State: int32(model.UserStateActive), OTPState: int32(model.MfaStateReady)},
+				event: &es_models.Event{AggregateID: "AggregateID", Sequence: 1, Type: es_model.MFAOTPRemoved, ResourceOwner: "OrgID"},
+				user:  &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", HumanView: &HumanView{FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country", OTPState: int32(model.MfaStateReady)}, State: int32(model.UserStateActive)},
 			},
-			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country", State: int32(model.UserStateActive), OTPState: int32(model.MfaStateUnspecified)},
+			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", HumanView: &HumanView{FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country", OTPState: int32(model.MfaStateUnspecified)}, State: int32(model.UserStateActive)},
 		},
 		{
 			name: "append mfa init skipped event",
 			args: args{
-				event: &es_models.Event{Sequence: 1, CreationDate: time.Now().UTC(), Type: es_model.MfaInitSkipped, AggregateID: "AggregateID", ResourceOwner: "OrgID"},
-				user:  &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country", State: int32(model.UserStateActive)},
+				event: &es_models.Event{Sequence: 1, CreationDate: time.Now().UTC(), Type: es_model.MFAInitSkipped, AggregateID: "AggregateID", ResourceOwner: "OrgID"},
+				user:  &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", HumanView: &HumanView{FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country"}, State: int32(model.UserStateActive)},
 			},
-			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country", State: int32(model.UserStateActive), MfaInitSkipped: time.Now().UTC()},
+			result: &UserView{ID: "AggregateID", ResourceOwner: "OrgID", UserName: "UserName", HumanView: &HumanView{FirstName: "FirstName", LastName: "LastName", Email: "Email", Phone: "Phone", Country: "Country", MfaInitSkipped: time.Now().UTC()}, State: int32(model.UserStateActive)},
 		},
 	}
 	for _, tt := range tests {
--- a/internal/user/repository/view/user_view.go
+++ b/internal/user/repository/view/user_view.go
@@ -111,15 +111,15 @@ func IsUserUnique(db *gorm.DB, table, userName, email string) (bool, error) {
 	if err != nil && !caos_errs.IsNotFound(err) {
 		return false, err
 	}
-	if user != nil {
+	if user.UserName != "" {
 		return false, nil
 	}
-	query = repository.PrepareGetByKey(table, model.UserSearchKey(usr_model.UserSearchKeyUserName), email)
+	query = repository.PrepareGetByKey(table, model.UserSearchKey(usr_model.UserSearchKeyUserName), userName)
 	err = query(db, user)
 	if err != nil && !caos_errs.IsNotFound(err) {
 		return false, err
 	}
-	return user == nil, nil
+	return user.UserName == "", nil
 }

 func UserMfas(db *gorm.DB, table, userID string) ([]*usr_model.MultiFactor, error) {