New eventstore policies (#1084)

* feat: login policy

* feat: password complexity policy

* feat: org iam policy

* feat: label policy

* feat: add and change policies

* feat: second factors

* feat: second and multi factors

* feat: better naming

* feat: better naming

internal/v2/repository/policy/label.go

@@ -1,160 +0,0 @@
-package policy
-
-import (
-	"encoding/json"
-
-	"github.com/caos/zitadel/internal/errors"
-	"github.com/caos/zitadel/internal/eventstore/v2"
-	"github.com/caos/zitadel/internal/eventstore/v2/repository"
-)
-
-const (
-	LabelPolicyAddedEventType   = "policy.label.added"
-	LabelPolicyChangedEventType = "policy.label.changed"
-	LabelPolicyRemovedEventType = "policy.label.removed"
-)
-
-type LabelPolicyReadModel struct {
-	eventstore.ReadModel
-
-	PrimaryColor   string
-	SecondaryColor string
-}
-
-func (rm *LabelPolicyReadModel) Reduce() error {
-	for _, event := range rm.Events {
-		switch e := event.(type) {
-		case *LabelPolicyAddedEvent:
-			rm.PrimaryColor = e.PrimaryColor
-			rm.SecondaryColor = e.SecondaryColor
-		case *LabelPolicyChangedEvent:
-			rm.PrimaryColor = e.PrimaryColor
-			rm.SecondaryColor = e.SecondaryColor
-		}
-	}
-	return rm.ReadModel.Reduce()
-}
-
-type LabelPolicyWriteModel struct {
-	eventstore.WriteModel
-
-	PrimaryColor   string
-	SecondaryColor string
-}
-
-func (wm *LabelPolicyWriteModel) Reduce() error {
-	return errors.ThrowUnimplemented(nil, "POLIC-xJjvN", "reduce unimpelemnted")
-}
-
-type LabelPolicyAddedEvent struct {
-	eventstore.BaseEvent `json:"-"`
-
-	PrimaryColor   string `json:"primaryColor,omitempty"`
-	SecondaryColor string `json:"secondaryColor,omitempty"`
-}
-
-func (e *LabelPolicyAddedEvent) CheckPrevious() bool {
-	return true
-}
-
-func (e *LabelPolicyAddedEvent) Data() interface{} {
-	return e
-}
-
-func NewLabelPolicyAddedEvent(
-	base *eventstore.BaseEvent,
-	primaryColor,
-	secondaryColor string,
-) *LabelPolicyAddedEvent {
-
-	return &LabelPolicyAddedEvent{
-		BaseEvent:      *base,
-		PrimaryColor:   primaryColor,
-		SecondaryColor: secondaryColor,
-	}
-}
-
-func LabelPolicyAddedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
-	e := &LabelPolicyAddedEvent{
-		BaseEvent: *eventstore.BaseEventFromRepo(event),
-	}
-
-	err := json.Unmarshal(event.Data, e)
-	if err != nil {
-		return nil, errors.ThrowInternal(err, "POLIC-puqv4", "unable to unmarshal label policy")
-	}
-
-	return e, nil
-}
-
-type LabelPolicyChangedEvent struct {
-	eventstore.BaseEvent `json:"-"`
-
-	PrimaryColor   string `json:"primaryColor,omitempty"`
-	SecondaryColor string `json:"secondaryColor,omitempty"`
-}
-
-func (e *LabelPolicyChangedEvent) CheckPrevious() bool {
-	return true
-}
-
-func (e *LabelPolicyChangedEvent) Data() interface{} {
-	return e
-}
-
-func NewLabelPolicyChangedEvent(
-	base *eventstore.BaseEvent,
-	current *LabelPolicyWriteModel,
-	primaryColor,
-	secondaryColor string,
-) *LabelPolicyChangedEvent {
-
-	e := &LabelPolicyChangedEvent{
-		BaseEvent: *base,
-	}
-	if primaryColor != "" && current.PrimaryColor != primaryColor {
-		e.PrimaryColor = primaryColor
-	}
-	if secondaryColor != "" && current.SecondaryColor != secondaryColor {
-		e.SecondaryColor = secondaryColor
-	}
-
-	return e
-}
-
-func LabelPolicyChangedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
-	e := &LabelPolicyChangedEvent{
-		BaseEvent: *eventstore.BaseEventFromRepo(event),
-	}
-
-	err := json.Unmarshal(event.Data, e)
-	if err != nil {
-		return nil, errors.ThrowInternal(err, "POLIC-qhfFb", "unable to unmarshal label policy")
-	}
-
-	return e, nil
-}
-
-type LabelPolicyRemovedEvent struct {
-	eventstore.BaseEvent `json:"-"`
-}
-
-func (e *LabelPolicyRemovedEvent) CheckPrevious() bool {
-	return true
-}
-
-func (e *LabelPolicyRemovedEvent) Data() interface{} {
-	return nil
-}
-
-func NewLabelPolicyRemovedEvent(base *eventstore.BaseEvent) *LabelPolicyRemovedEvent {
-	return &LabelPolicyRemovedEvent{
-		BaseEvent: *base,
-	}
-}
-
-func LabelPolicyRemovedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
-	return &LabelPolicyRemovedEvent{
-		BaseEvent: *eventstore.BaseEventFromRepo(event),
-	}, nil
-}

internal/v2/repository/policy/label/events.go

@@ -0,0 +1,127 @@
+package label
+
+import (
+	"encoding/json"
+	"github.com/caos/zitadel/internal/errors"
+	"github.com/caos/zitadel/internal/eventstore/v2"
+	"github.com/caos/zitadel/internal/eventstore/v2/repository"
+)
+
+const (
+	LabelPolicyAddedEventType   = "policy.label.added"
+	LabelPolicyChangedEventType = "policy.label.changed"
+	LabelPolicyRemovedEventType = "policy.label.removed"
+)
+
+type AddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	PrimaryColor   string `json:"primaryColor,omitempty"`
+	SecondaryColor string `json:"secondaryColor,omitempty"`
+}
+
+func (e *AddedEvent) CheckPrevious() bool {
+	return true
+}
+
+func (e *AddedEvent) Data() interface{} {
+	return e
+}
+
+func NewAddedEvent(
+	base *eventstore.BaseEvent,
+	primaryColor,
+	secondaryColor string,
+) *AddedEvent {
+
+	return &AddedEvent{
+		BaseEvent:      *base,
+		PrimaryColor:   primaryColor,
+		SecondaryColor: secondaryColor,
+	}
+}
+
+func AddedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
+	e := &AddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := json.Unmarshal(event.Data, e)
+	if err != nil {
+		return nil, errors.ThrowInternal(err, "POLIC-puqv4", "unable to unmarshal label policy")
+	}
+
+	return e, nil
+}
+
+type ChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	PrimaryColor   string `json:"primaryColor,omitempty"`
+	SecondaryColor string `json:"secondaryColor,omitempty"`
+}
+
+func (e *ChangedEvent) CheckPrevious() bool {
+	return true
+}
+
+func (e *ChangedEvent) Data() interface{} {
+	return e
+}
+
+func NewChangedEvent(
+	base *eventstore.BaseEvent,
+	current *WriteModel,
+	primaryColor,
+	secondaryColor string,
+) *ChangedEvent {
+
+	e := &ChangedEvent{
+		BaseEvent: *base,
+	}
+	if primaryColor != "" && current.PrimaryColor != primaryColor {
+		e.PrimaryColor = primaryColor
+	}
+	if secondaryColor != "" && current.SecondaryColor != secondaryColor {
+		e.SecondaryColor = secondaryColor
+	}
+
+	return e
+}
+
+func ChangedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
+	e := &ChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := json.Unmarshal(event.Data, e)
+	if err != nil {
+		return nil, errors.ThrowInternal(err, "POLIC-qhfFb", "unable to unmarshal label policy")
+	}
+
+	return e, nil
+}
+
+type RemovedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+}
+
+func (e *RemovedEvent) CheckPrevious() bool {
+	return true
+}
+
+func (e *RemovedEvent) Data() interface{} {
+	return nil
+}
+
+func NewRemovedEvent(base *eventstore.BaseEvent) *RemovedEvent {
+	return &RemovedEvent{
+		BaseEvent: *base,
+	}
+}
+
+func RemovedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
+	return &RemovedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}, nil
+}

internal/v2/repository/policy/label/read_model.go

@@ -0,0 +1,24 @@
+package label
+
+import "github.com/caos/zitadel/internal/eventstore/v2"
+
+type ReadModel struct {
+	eventstore.ReadModel
+
+	PrimaryColor   string
+	SecondaryColor string
+}
+
+func (rm *ReadModel) Reduce() error {
+	for _, event := range rm.Events {
+		switch e := event.(type) {
+		case *AddedEvent:
+			rm.PrimaryColor = e.PrimaryColor
+			rm.SecondaryColor = e.SecondaryColor
+		case *ChangedEvent:
+			rm.PrimaryColor = e.PrimaryColor
+			rm.SecondaryColor = e.SecondaryColor
+		}
+	}
+	return rm.ReadModel.Reduce()
+}

internal/v2/repository/policy/label/write_model.go

@@ -0,0 +1,26 @@
+package label
+
+import (
+	"github.com/caos/zitadel/internal/eventstore/v2"
+)
+
+type WriteModel struct {
+	eventstore.WriteModel
+
+	PrimaryColor   string
+	SecondaryColor string
+}
+
+func (wm *WriteModel) Reduce() error {
+	for _, event := range wm.Events {
+		switch e := event.(type) {
+		case *AddedEvent:
+			wm.PrimaryColor = e.PrimaryColor
+			wm.SecondaryColor = e.SecondaryColor
+		case *ChangedEvent:
+			wm.PrimaryColor = e.PrimaryColor
+			wm.SecondaryColor = e.SecondaryColor
+		}
+	}
+	return wm.WriteModel.Reduce()
+}

internal/v2/repository/policy/login.go

@@ -1,243 +0,0 @@
-package policy
-
-import (
-	"encoding/json"
-
-	"github.com/caos/zitadel/internal/errors"
-	"github.com/caos/zitadel/internal/eventstore/v2"
-	"github.com/caos/zitadel/internal/eventstore/v2/repository"
-	"github.com/caos/zitadel/internal/v2/repository/idp/provider"
-)
-
-const (
-	LoginPolicyAddedEventType              = "policy.login.added"
-	LoginPolicyChangedEventType            = "policy.login.changed"
-	LoginPolicyRemovedEventType            = "policy.login.removed"
-	LoginPolicyIDPProviderAddedEventType   = "policy.login." + provider.AddedEventType
-	LoginPolicyIDPProviderRemovedEventType = "policy.login." + provider.RemovedEventType
-)
-
-type LoginPolicyReadModel struct {
-	eventstore.ReadModel
-
-	AllowUserNamePassword bool
-	AllowRegister         bool
-	AllowExternalIDP      bool
-}
-
-func (rm *LoginPolicyReadModel) Reduce() error {
-	for _, event := range rm.Events {
-		switch e := event.(type) {
-		case *LoginPolicyAddedEvent:
-			rm.AllowUserNamePassword = e.AllowUserNamePassword
-			rm.AllowExternalIDP = e.AllowExternalIDP
-			rm.AllowRegister = e.AllowRegister
-		case *LoginPolicyChangedEvent:
-			rm.AllowUserNamePassword = e.AllowUserNamePassword
-			rm.AllowExternalIDP = e.AllowExternalIDP
-			rm.AllowRegister = e.AllowRegister
-		}
-	}
-	return rm.ReadModel.Reduce()
-}
-
-type LoginPolicyWriteModel struct {
-	eventstore.WriteModel
-
-	AllowUserNamePassword bool
-	AllowRegister         bool
-	AllowExternalIDP      bool
-}
-
-func (wm *LoginPolicyWriteModel) Reduce() error {
-	return errors.ThrowUnimplemented(nil, "POLIC-xJjvN", "reduce unimpelemnted")
-}
-
-type LoginPolicyAddedEvent struct {
-	eventstore.BaseEvent `json:"-"`
-
-	AllowUserNamePassword bool `json:"allowUsernamePassword"`
-	AllowRegister         bool `json:"allowRegister"`
-	AllowExternalIDP      bool `json:"allowExternalIdp"`
-}
-
-func (e *LoginPolicyAddedEvent) CheckPrevious() bool {
-	return true
-}
-
-func (e *LoginPolicyAddedEvent) Data() interface{} {
-	return e
-}
-
-func NewLoginPolicyAddedEvent(
-	base *eventstore.BaseEvent,
-	allowUserNamePassword,
-	allowRegister,
-	allowExternalIDP bool,
-) *LoginPolicyAddedEvent {
-
-	return &LoginPolicyAddedEvent{
-		BaseEvent:             *base,
-		AllowExternalIDP:      allowExternalIDP,
-		AllowRegister:         allowRegister,
-		AllowUserNamePassword: allowUserNamePassword,
-	}
-}
-
-func LoginPolicyAddedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
-	e := &LoginPolicyAddedEvent{
-		BaseEvent: *eventstore.BaseEventFromRepo(event),
-	}
-
-	err := json.Unmarshal(event.Data, e)
-	if err != nil {
-		return nil, errors.ThrowInternal(err, "POLIC-nWndT", "unable to unmarshal policy")
-	}
-
-	return e, nil
-}
-
-type LoginPolicyChangedEvent struct {
-	eventstore.BaseEvent `json:"-"`
-
-	AllowUserNamePassword bool `json:"allowUsernamePassword,omitempty"`
-	AllowRegister         bool `json:"allowRegister"`
-	AllowExternalIDP      bool `json:"allowExternalIdp"`
-}
-
-func (e *LoginPolicyChangedEvent) CheckPrevious() bool {
-	return true
-}
-
-func (e *LoginPolicyChangedEvent) Data() interface{} {
-	return e
-}
-
-func NewLoginPolicyChangedEvent(
-	base *eventstore.BaseEvent,
-	current *LoginPolicyWriteModel,
-	allowUserNamePassword,
-	allowRegister,
-	allowExternalIDP bool,
-) *LoginPolicyChangedEvent {
-
-	e := &LoginPolicyChangedEvent{
-		BaseEvent: *base,
-	}
-
-	if current.AllowUserNamePassword != allowUserNamePassword {
-		e.AllowUserNamePassword = allowUserNamePassword
-	}
-	if current.AllowRegister != allowRegister {
-		e.AllowRegister = allowRegister
-	}
-	if current.AllowExternalIDP != allowExternalIDP {
-		e.AllowExternalIDP = allowExternalIDP
-	}
-
-	return e
-}
-
-func LoginPolicyChangedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
-	e := &LoginPolicyChangedEvent{
-		BaseEvent: *eventstore.BaseEventFromRepo(event),
-	}
-
-	err := json.Unmarshal(event.Data, e)
-	if err != nil {
-		return nil, errors.ThrowInternal(err, "POLIC-ehssl", "unable to unmarshal policy")
-	}
-
-	return e, nil
-}
-
-type LoginPolicyRemovedEvent struct {
-	eventstore.BaseEvent `json:"-"`
-}
-
-func (e *LoginPolicyRemovedEvent) CheckPrevious() bool {
-	return true
-}
-
-func (e *LoginPolicyRemovedEvent) Data() interface{} {
-	return nil
-}
-
-func NewLoginPolicyRemovedEvent(base *eventstore.BaseEvent) *LoginPolicyRemovedEvent {
-	return &LoginPolicyRemovedEvent{
-		BaseEvent: *base,
-	}
-}
-
-func LoginPolicyRemovedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
-	return &LoginPolicyRemovedEvent{
-		BaseEvent: *eventstore.BaseEventFromRepo(event),
-	}, nil
-}
-
-type IDPProviderWriteModel struct {
-	provider.WriteModel
-}
-
-func (wm *IDPProviderWriteModel) AppendEvents(events ...eventstore.EventReader) {
-	for _, event := range events {
-		switch e := event.(type) {
-		case *IDPProviderAddedEvent:
-			wm.WriteModel.AppendEvents(&e.AddedEvent)
-		}
-	}
-}
-
-type IDPProviderAddedEvent struct {
-	provider.AddedEvent
-}
-
-func NewIDPProviderAddedEvent(
-	base *eventstore.BaseEvent,
-	idpConfigID string,
-	idpProviderType provider.Type,
-) *IDPProviderAddedEvent {
-
-	return &IDPProviderAddedEvent{
-		AddedEvent: *provider.NewAddedEvent(
-			base,
-			idpConfigID,
-			idpProviderType),
-	}
-}
-
-func IDPProviderAddedEventEventMapper(event *repository.Event) (eventstore.EventReader, error) {
-	e, err := provider.AddedEventEventMapper(event)
-	if err != nil {
-		return nil, err
-	}
-
-	return &IDPProviderAddedEvent{
-		AddedEvent: *e.(*provider.AddedEvent),
-	}, nil
-}
-
-type IDPProviderRemovedEvent struct {
-	provider.RemovedEvent
-}
-
-func NewIDPProviderRemovedEvent(
-	base *eventstore.BaseEvent,
-	idpConfigID string,
-) *IDPProviderRemovedEvent {
-
-	return &IDPProviderRemovedEvent{
-		RemovedEvent: *provider.NewRemovedEvent(base, idpConfigID),
-	}
-}
-
-func IDPProviderRemovedEventEventMapper(event *repository.Event) (eventstore.EventReader, error) {
-	e, err := provider.RemovedEventEventMapper(event)
-	if err != nil {
-		return nil, err
-	}
-
-	return &IDPProviderRemovedEvent{
-		RemovedEvent: *e.(*provider.RemovedEvent),
-	}, nil
-}

internal/v2/repository/policy/login/events.go

@@ -0,0 +1,155 @@
+package login
+
+import (
+	"encoding/json"
+	"github.com/caos/zitadel/internal/errors"
+	"github.com/caos/zitadel/internal/eventstore/v2"
+	"github.com/caos/zitadel/internal/eventstore/v2/repository"
+	"github.com/caos/zitadel/internal/v2/repository/idp/provider"
+)
+
+const (
+	loginPolicyPrefix                      = "policy.login."
+	LoginPolicyAddedEventType              = loginPolicyPrefix + "added"
+	LoginPolicyChangedEventType            = loginPolicyPrefix + "changed"
+	LoginPolicyRemovedEventType            = loginPolicyPrefix + "removed"
+	LoginPolicyIDPProviderAddedEventType   = loginPolicyPrefix + provider.AddedEventType
+	LoginPolicyIDPProviderRemovedEventType = loginPolicyPrefix + provider.RemovedEventType
+)
+
+type AddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	AllowUserNamePassword bool             `json:"allowUsernamePassword"`
+	AllowRegister         bool             `json:"allowRegister"`
+	AllowExternalIDP      bool             `json:"allowExternalIdp"`
+	ForceMFA              bool             `json:"forceMFA"`
+	PasswordlessType      PasswordlessType `json:"passwordlessType"`
+}
+
+func (e *AddedEvent) CheckPrevious() bool {
+	return true
+}
+
+func (e *AddedEvent) Data() interface{} {
+	return e
+}
+
+func NewAddedEvent(
+	base *eventstore.BaseEvent,
+	allowUserNamePassword,
+	allowRegister,
+	allowExternalIDP,
+	forceMFA bool,
+	passwordlessType PasswordlessType,
+) *AddedEvent {
+	return &AddedEvent{
+		BaseEvent:             *base,
+		AllowExternalIDP:      allowExternalIDP,
+		AllowRegister:         allowRegister,
+		AllowUserNamePassword: allowUserNamePassword,
+		ForceMFA:              forceMFA,
+		PasswordlessType:      passwordlessType,
+	}
+}
+
+func AddedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
+	e := &AddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := json.Unmarshal(event.Data, e)
+	if err != nil {
+		return nil, errors.ThrowInternal(err, "POLIC-nWndT", "unable to unmarshal policy")
+	}
+
+	return e, nil
+}
+
+type ChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	AllowUserNamePassword bool             `json:"allowUsernamePassword,omitempty"`
+	AllowRegister         bool             `json:"allowRegister"`
+	AllowExternalIDP      bool             `json:"allowExternalIdp"`
+	ForceMFA              bool             `json:"forceMFA"`
+	PasswordlessType      PasswordlessType `json:"passwordlessType"`
+}
+
+func (e *ChangedEvent) CheckPrevious() bool {
+	return true
+}
+
+func (e *ChangedEvent) Data() interface{} {
+	return e
+}
+
+func NewChangedEvent(
+	base *eventstore.BaseEvent,
+	current *WriteModel,
+	allowUserNamePassword,
+	allowRegister,
+	allowExternalIDP,
+	forceMFA bool,
+	passwordlessType PasswordlessType,
+) *ChangedEvent {
+
+	e := &ChangedEvent{
+		BaseEvent: *base,
+	}
+
+	if current.AllowUserNamePassword != allowUserNamePassword {
+		e.AllowUserNamePassword = allowUserNamePassword
+	}
+	if current.AllowRegister != allowRegister {
+		e.AllowRegister = allowRegister
+	}
+	if current.AllowExternalIDP != allowExternalIDP {
+		e.AllowExternalIDP = allowExternalIDP
+	}
+	if current.ForceMFA != forceMFA {
+		e.ForceMFA = forceMFA
+	}
+	if current.PasswordlessType != passwordlessType {
+		e.PasswordlessType = passwordlessType
+	}
+
+	return e
+}
+
+func ChangedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
+	e := &ChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := json.Unmarshal(event.Data, e)
+	if err != nil {
+		return nil, errors.ThrowInternal(err, "POLIC-ehssl", "unable to unmarshal policy")
+	}
+
+	return e, nil
+}
+
+type RemovedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+}
+
+func (e *RemovedEvent) CheckPrevious() bool {
+	return true
+}
+
+func (e *RemovedEvent) Data() interface{} {
+	return nil
+}
+
+func NewRemovedEvent(base *eventstore.BaseEvent) *RemovedEvent {
+	return &RemovedEvent{
+		BaseEvent: *base,
+	}
+}
+
+func RemovedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
+	return &RemovedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}, nil
+}

internal/v2/repository/policy/login/factors/events.go

@@ -0,0 +1,164 @@
+package factors
+
+import (
+	"encoding/json"
+	"github.com/caos/zitadel/internal/errors"
+	"github.com/caos/zitadel/internal/eventstore/v2"
+	"github.com/caos/zitadel/internal/eventstore/v2/repository"
+)
+
+const (
+	loginPolicySecondFactorPrefix           = "policy.login.secondfactor."
+	LoginPolicySecondFactorAddedEventType   = loginPolicySecondFactorPrefix + "added"
+	LoginPolicySecondFactorRemovedEventType = loginPolicySecondFactorPrefix + "removed"
+
+	loginPolicyMultiFactorPrefix           = "policy.login.multifactor."
+	LoginPolicyMultiFactorAddedEventType   = loginPolicyMultiFactorPrefix + "added"
+	LoginPolicyMultiFactorRemovedEventType = loginPolicyMultiFactorPrefix + "removed"
+)
+
+type SecondFactorAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	MFAType SecondFactorType `json:"mfaType"`
+}
+
+func NewSecondFactorAddedEvent(
+	base *eventstore.BaseEvent,
+	mfaType SecondFactorType,
+) *SecondFactorAddedEvent {
+	return &SecondFactorAddedEvent{
+		BaseEvent: *base,
+		MFAType:   mfaType,
+	}
+}
+
+func SecondFactorAddedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
+	e := &SecondFactorAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := json.Unmarshal(event.Data, e)
+	if err != nil {
+		return nil, errors.ThrowInternal(err, "POLIC-Lp0dE", "unable to unmarshal policy")
+	}
+
+	return e, nil
+}
+
+func (e *SecondFactorAddedEvent) CheckPrevious() bool {
+	return true
+}
+
+func (e *SecondFactorAddedEvent) Data() interface{} {
+	return e
+}
+
+type SecondFactorRemovedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+	MFAType              SecondFactorType `json:"mfaType"`
+}
+
+func NewSecondFactorRemovedEvent(
+	base *eventstore.BaseEvent,
+	mfaType SecondFactorType,
+) *SecondFactorRemovedEvent {
+	return &SecondFactorRemovedEvent{
+		BaseEvent: *base,
+		MFAType:   mfaType,
+	}
+}
+
+func SecondFactorRemovedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
+	e := &SecondFactorRemovedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := json.Unmarshal(event.Data, e)
+	if err != nil {
+		return nil, errors.ThrowInternal(err, "POLIC-5M9gd", "unable to unmarshal policy")
+	}
+
+	return e, nil
+}
+
+func (e *SecondFactorRemovedEvent) CheckPrevious() bool {
+	return true
+}
+
+func (e *SecondFactorRemovedEvent) Data() interface{} {
+	return e
+}
+
+type MultiFactorAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	MFAType MultiFactorType `json:"mfaType"`
+}
+
+func NewMultiFactorAddedEvent(
+	base *eventstore.BaseEvent,
+	mfaType MultiFactorType,
+) *MultiFactorAddedEvent {
+	return &MultiFactorAddedEvent{
+		BaseEvent: *base,
+		MFAType:   mfaType,
+	}
+}
+
+func MultiFactorAddedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
+	e := &MultiFactorAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := json.Unmarshal(event.Data, e)
+	if err != nil {
+		return nil, errors.ThrowInternal(err, "POLIC-5Ms90", "unable to unmarshal policy")
+	}
+
+	return e, nil
+}
+
+func (e *MultiFactorAddedEvent) CheckPrevious() bool {
+	return true
+}
+
+func (e *MultiFactorAddedEvent) Data() interface{} {
+	return e
+}
+
+type MultiFactorRemovedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+	MFAType              MultiFactorType `json:"mfaType"`
+}
+
+func NewMultiFactorRemovedEvent(
+	base *eventstore.BaseEvent,
+	mfaType MultiFactorType,
+) *MultiFactorRemovedEvent {
+	return &MultiFactorRemovedEvent{
+		BaseEvent: *base,
+		MFAType:   mfaType,
+	}
+}
+
+func MultiFactorRemovedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
+	e := &MultiFactorRemovedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := json.Unmarshal(event.Data, e)
+	if err != nil {
+		return nil, errors.ThrowInternal(err, "POLIC-1N8sd", "unable to unmarshal policy")
+	}
+
+	return e, nil
+}
+
+func (e *MultiFactorRemovedEvent) CheckPrevious() bool {
+	return true
+}
+
+func (e *MultiFactorRemovedEvent) Data() interface{} {
+	return e
+}

internal/v2/repository/policy/login/factors/factors.go

@@ -0,0 +1,16 @@
+package factors
+
+type SecondFactorType int32
+
+const (
+	SecondFactorTypeUnspecified SecondFactorType = iota
+	SecondFactorTypeOTP
+	SecondFactorTypeU2F
+)
+
+type MultiFactorType int32
+
+const (
+	MultiFactorTypeUnspecified MultiFactorType = iota
+	MultiFactorTypeU2FWithPIN
+)

internal/v2/repository/policy/login/factors/write_model.go

@@ -0,0 +1,37 @@
+package factors
+
+import "github.com/caos/zitadel/internal/eventstore/v2"
+
+type SecondFactoryWriteModel struct {
+	eventstore.WriteModel
+	MFAType SecondFactorType
+}
+
+func (wm *SecondFactoryWriteModel) Reduce() error {
+	for _, event := range wm.Events {
+		switch e := event.(type) {
+		case *SecondFactorAddedEvent:
+			wm.MFAType = e.MFAType
+		case *SecondFactorRemovedEvent:
+			wm.MFAType = e.MFAType
+		}
+	}
+	return wm.WriteModel.Reduce()
+}
+
+type MultiFactoryWriteModel struct {
+	eventstore.WriteModel
+	MFAType MultiFactorType
+}
+
+func (wm *MultiFactoryWriteModel) Reduce() error {
+	for _, event := range wm.Events {
+		switch e := event.(type) {
+		case *MultiFactorAddedEvent:
+			wm.MFAType = e.MFAType
+		case *MultiFactorRemovedEvent:
+			wm.MFAType = e.MFAType
+		}
+	}
+	return wm.WriteModel.Reduce()
+}

internal/v2/repository/policy/login/idpprovider/events.go

@@ -0,0 +1,60 @@
+package idpprovider
+
+import (
+	"github.com/caos/zitadel/internal/eventstore/v2"
+	"github.com/caos/zitadel/internal/eventstore/v2/repository"
+	"github.com/caos/zitadel/internal/v2/repository/idp/provider"
+)
+
+type AddedEvent struct {
+	provider.AddedEvent
+}
+
+func NewAddedEvent(
+	base *eventstore.BaseEvent,
+	idpConfigID string,
+	idpProviderType provider.Type,
+) *AddedEvent {
+
+	return &AddedEvent{
+		AddedEvent: *provider.NewAddedEvent(
+			base,
+			idpConfigID,
+			idpProviderType),
+	}
+}
+
+func AddedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
+	e, err := provider.AddedEventEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &AddedEvent{
+		AddedEvent: *e.(*provider.AddedEvent),
+	}, nil
+}
+
+type RemovedEvent struct {
+	provider.RemovedEvent
+}
+
+func NewRemovedEvent(
+	base *eventstore.BaseEvent,
+	idpConfigID string,
+) *RemovedEvent {
+	return &RemovedEvent{
+		RemovedEvent: *provider.NewRemovedEvent(base, idpConfigID),
+	}
+}
+
+func RemovedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
+	e, err := provider.RemovedEventEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &RemovedEvent{
+		RemovedEvent: *e.(*provider.RemovedEvent),
+	}, nil
+}

internal/v2/repository/policy/login/idpprovider/write_model.go

@@ -0,0 +1,19 @@
+package idpprovider
+
+import (
+	"github.com/caos/zitadel/internal/eventstore/v2"
+	"github.com/caos/zitadel/internal/v2/repository/idp/provider"
+)
+
+type WriteModel struct {
+	provider.WriteModel
+}
+
+func (wm *WriteModel) AppendEvents(events ...eventstore.EventReader) {
+	for _, event := range events {
+		switch e := event.(type) {
+		case *AddedEvent:
+			wm.WriteModel.AppendEvents(&e.AddedEvent)
+		}
+	}
+}

internal/v2/repository/policy/login/login.go

@@ -0,0 +1,8 @@
+package login
+
+type PasswordlessType int32
+
+const (
+	PasswordlessTypeNotAllowed PasswordlessType = iota
+	PasswordlessTypeAllowed
+)

internal/v2/repository/policy/login/read_model.go

@@ -0,0 +1,35 @@
+package login
+
+import (
+	"github.com/caos/zitadel/internal/eventstore/v2"
+)
+
+type ReadModel struct {
+	eventstore.ReadModel
+
+	AllowUserNamePassword bool
+	AllowRegister         bool
+	AllowExternalIDP      bool
+	ForceMFA              bool
+	PasswordlessType      PasswordlessType
+}
+
+func (rm *ReadModel) Reduce() error {
+	for _, event := range rm.Events {
+		switch e := event.(type) {
+		case *AddedEvent:
+			rm.AllowUserNamePassword = e.AllowUserNamePassword
+			rm.AllowExternalIDP = e.AllowExternalIDP
+			rm.AllowRegister = e.AllowRegister
+			rm.ForceMFA = e.ForceMFA
+			rm.PasswordlessType = e.PasswordlessType
+		case *ChangedEvent:
+			rm.AllowUserNamePassword = e.AllowUserNamePassword
+			rm.AllowExternalIDP = e.AllowExternalIDP
+			rm.AllowRegister = e.AllowRegister
+			rm.ForceMFA = e.ForceMFA
+			rm.PasswordlessType = e.PasswordlessType
+		}
+	}
+	return rm.ReadModel.Reduce()
+}

internal/v2/repository/policy/login/write_model.go

@@ -0,0 +1,35 @@
+package login
+
+import (
+	"github.com/caos/zitadel/internal/eventstore/v2"
+)
+
+type WriteModel struct {
+	eventstore.WriteModel
+
+	AllowUserNamePassword bool
+	AllowRegister         bool
+	AllowExternalIDP      bool
+	ForceMFA              bool
+	PasswordlessType      PasswordlessType
+}
+
+func (wm *WriteModel) Reduce() error {
+	for _, event := range wm.Events {
+		switch e := event.(type) {
+		case *AddedEvent:
+			wm.AllowRegister = e.AllowRegister
+			wm.AllowUserNamePassword = e.AllowUserNamePassword
+			wm.AllowExternalIDP = e.AllowExternalIDP
+			wm.ForceMFA = e.ForceMFA
+			wm.PasswordlessType = e.PasswordlessType
+		case *ChangedEvent:
+			wm.AllowRegister = e.AllowRegister
+			wm.AllowUserNamePassword = e.AllowUserNamePassword
+			wm.AllowExternalIDP = e.AllowExternalIDP
+			wm.ForceMFA = e.ForceMFA
+			wm.PasswordlessType = e.PasswordlessType
+		}
+	}
+	return wm.WriteModel.Reduce()
+}

internal/v2/repository/policy/org_iam.go

@@ -1,81 +0,0 @@
-package policy
-
-import (
-	"encoding/json"
-
-	"github.com/caos/zitadel/internal/errors"
-	"github.com/caos/zitadel/internal/eventstore/v2"
-	"github.com/caos/zitadel/internal/eventstore/v2/repository"
-)
-
-const (
-	OrgIAMPolicyAddedEventType = "policy.org.iam.added"
-)
-
-type OrgIAMPolicyAggregate struct {
-	eventstore.Aggregate
-}
-
-type OrgIAMPolicyReadModel struct {
-	eventstore.ReadModel
-
-	UserLoginMustBeDomain bool
-}
-
-func (rm *OrgIAMPolicyReadModel) Reduce() error {
-	for _, event := range rm.Events {
-		switch e := event.(type) {
-		case *OrgIAMPolicyAddedEvent:
-			rm.UserLoginMustBeDomain = e.UserLoginMustBeDomain
-		}
-	}
-	return rm.ReadModel.Reduce()
-}
-
-type OrgIAMPolicyWriteModel struct {
-	eventstore.WriteModel
-
-	UserLoginMustBeDomain bool
-}
-
-func (wm *OrgIAMPolicyWriteModel) Reduce() error {
-	return errors.ThrowUnimplemented(nil, "POLIC-xJjvN", "reduce unimpelemnted")
-}
-
-type OrgIAMPolicyAddedEvent struct {
-	eventstore.BaseEvent `json:"-"`
-
-	UserLoginMustBeDomain bool `json:"allowUsernamePassword"`
-}
-
-func (e *OrgIAMPolicyAddedEvent) CheckPrevious() bool {
-	return true
-}
-
-func (e *OrgIAMPolicyAddedEvent) Data() interface{} {
-	return e
-}
-
-func NewOrgIAMPolicyAddedEvent(
-	base *eventstore.BaseEvent,
-	userLoginMustBeDomain bool,
-) *OrgIAMPolicyAddedEvent {
-
-	return &OrgIAMPolicyAddedEvent{
-		BaseEvent:             *base,
-		UserLoginMustBeDomain: userLoginMustBeDomain,
-	}
-}
-
-func OrgIAMPolicyAddedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
-	e := &OrgIAMPolicyAddedEvent{
-		BaseEvent: *eventstore.BaseEventFromRepo(event),
-	}
-
-	err := json.Unmarshal(event.Data, e)
-	if err != nil {
-		return nil, errors.ThrowInternal(err, "POLIC-TvSmA", "unable to unmarshal policy")
-	}
-
-	return e, nil
-}

internal/v2/repository/policy/org_iam/events.go

@@ -0,0 +1,92 @@
+package org_iam
+
+import (
+	"encoding/json"
+	"github.com/caos/zitadel/internal/errors"
+	"github.com/caos/zitadel/internal/eventstore/v2"
+	"github.com/caos/zitadel/internal/eventstore/v2/repository"
+)
+
+const (
+	OrgIAMPolicyAddedEventType   = "policy.org.iam.added"
+	OrgIAMPolicyChangedEventType = "policy.org.iam.changed"
+)
+
+type AddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	UserLoginMustBeDomain bool `json:"userLoginMustBeDomain"`
+}
+
+func (e *AddedEvent) CheckPrevious() bool {
+	return true
+}
+
+func (e *AddedEvent) Data() interface{} {
+	return e
+}
+
+func NewAddedEvent(
+	base *eventstore.BaseEvent,
+	userLoginMustBeDomain bool,
+) *AddedEvent {
+
+	return &AddedEvent{
+		BaseEvent:             *base,
+		UserLoginMustBeDomain: userLoginMustBeDomain,
+	}
+}
+
+func AddedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
+	e := &AddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := json.Unmarshal(event.Data, e)
+	if err != nil {
+		return nil, errors.ThrowInternal(err, "POLIC-TvSmA", "unable to unmarshal policy")
+	}
+
+	return e, nil
+}
+
+type ChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	UserLoginMustBeDomain bool `json:"userLoginMustBeDomain"`
+}
+
+func (e *ChangedEvent) CheckPrevious() bool {
+	return true
+}
+
+func (e *ChangedEvent) Data() interface{} {
+	return e
+}
+
+func NewChangedEvent(
+	base *eventstore.BaseEvent,
+	current *WriteModel,
+	userLoginMustBeDomain bool,
+) *ChangedEvent {
+	e := &ChangedEvent{
+		BaseEvent: *base,
+	}
+	if current.UserLoginMustBeDomain != userLoginMustBeDomain {
+		e.UserLoginMustBeDomain = userLoginMustBeDomain
+	}
+	return e
+}
+
+func ChangedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
+	e := &ChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := json.Unmarshal(event.Data, e)
+	if err != nil {
+		return nil, errors.ThrowInternal(err, "POLIC-0Pl9d", "unable to unmarshal policy")
+	}
+
+	return e, nil
+}

internal/v2/repository/policy/org_iam/read_model.go

@@ -0,0 +1,21 @@
+package org_iam
+
+import "github.com/caos/zitadel/internal/eventstore/v2"
+
+type ReadModel struct {
+	eventstore.ReadModel
+
+	UserLoginMustBeDomain bool
+}
+
+func (rm *ReadModel) Reduce() error {
+	for _, event := range rm.Events {
+		switch e := event.(type) {
+		case *AddedEvent:
+			rm.UserLoginMustBeDomain = e.UserLoginMustBeDomain
+		case *ChangedEvent:
+			rm.UserLoginMustBeDomain = e.UserLoginMustBeDomain
+		}
+	}
+	return rm.ReadModel.Reduce()
+}

internal/v2/repository/policy/org_iam/write_model.go

@@ -0,0 +1,21 @@
+package org_iam
+
+import "github.com/caos/zitadel/internal/eventstore/v2"
+
+type WriteModel struct {
+	eventstore.WriteModel
+
+	UserLoginMustBeDomain bool
+}
+
+func (wm *WriteModel) Reduce() error {
+	for _, event := range wm.Events {
+		switch e := event.(type) {
+		case *AddedEvent:
+			wm.UserLoginMustBeDomain = e.UserLoginMustBeDomain
+		case *ChangedEvent:
+			wm.UserLoginMustBeDomain = e.UserLoginMustBeDomain
+		}
+	}
+	return wm.WriteModel.Reduce()
+}

internal/v2/repository/policy/password_age.go

@@ -1,177 +0,0 @@
-package policy
-
-import (
-	"encoding/json"
-
-	"github.com/caos/zitadel/internal/errors"
-	"github.com/caos/zitadel/internal/eventstore/v2"
-	"github.com/caos/zitadel/internal/eventstore/v2/repository"
-)
-
-const (
-	PasswordAgePolicyAddedEventType   = "policy.password.age.added"
-	PasswordAgePolicyChangedEventType = "policy.password.age.changed"
-	PasswordAgePolicyRemovedEventType = "policy.password.age.removed"
-)
-
-type PasswordAgePolicyAggregate struct {
-	eventstore.Aggregate
-}
-
-type PasswordAgePolicyReadModel struct {
-	eventstore.ReadModel
-
-	ExpireWarnDays uint16
-	MaxAgeDays     uint16
-}
-
-func (rm *PasswordAgePolicyReadModel) Reduce() error {
-	for _, event := range rm.Events {
-		switch e := event.(type) {
-		case *PasswordAgePolicyAddedEvent:
-			rm.ExpireWarnDays = e.ExpireWarnDays
-			rm.MaxAgeDays = e.MaxAgeDays
-		case *PasswordAgePolicyChangedEvent:
-			rm.ExpireWarnDays = e.ExpireWarnDays
-			rm.MaxAgeDays = e.MaxAgeDays
-		}
-	}
-	return rm.ReadModel.Reduce()
-}
-
-type PasswordAgePolicyWriteModel struct {
-	eventstore.WriteModel
-
-	ExpireWarnDays uint16
-	MaxAgeDays     uint16
-}
-
-func (wm *PasswordAgePolicyWriteModel) Reduce() error {
-	return errors.ThrowUnimplemented(nil, "POLIC-xJjvN", "reduce unimpelemnted")
-}
-
-type PasswordAgePolicyAddedEvent struct {
-	eventstore.BaseEvent `json:"-"`
-
-	ExpireWarnDays uint16 `json:"expireWarnDays"`
-	MaxAgeDays     uint16 `json:"maxAgeDays"`
-}
-
-func (e *PasswordAgePolicyAddedEvent) CheckPrevious() bool {
-	return true
-}
-
-func (e *PasswordAgePolicyAddedEvent) Data() interface{} {
-	return e
-}
-
-func NewPasswordAgePolicyAddedEvent(
-	base *eventstore.BaseEvent,
-	expireWarnDays,
-	maxAgeDays uint16,
-) *PasswordAgePolicyAddedEvent {
-
-	return &PasswordAgePolicyAddedEvent{
-		BaseEvent:      *base,
-		ExpireWarnDays: expireWarnDays,
-		MaxAgeDays:     maxAgeDays,
-	}
-}
-
-func PasswordAgePolicyAddedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
-	e := &PasswordAgePolicyAddedEvent{
-		BaseEvent: *eventstore.BaseEventFromRepo(event),
-	}
-
-	err := json.Unmarshal(event.Data, e)
-	if err != nil {
-		return nil, errors.ThrowInternal(err, "POLIC-T3mGp", "unable to unmarshal policy")
-	}
-
-	return e, nil
-}
-
-type PasswordAgePolicyChangedEvent struct {
-	eventstore.BaseEvent `json:"-"`
-
-	ExpireWarnDays uint16 `json:"expireWarnDays,omitempty"`
-	MaxAgeDays     uint16 `json:"maxAgeDays,omitempty"`
-}
-
-func (e *PasswordAgePolicyChangedEvent) CheckPrevious() bool {
-	return true
-}
-
-func (e *PasswordAgePolicyChangedEvent) Data() interface{} {
-	return e
-}
-
-func NewPasswordAgePolicyChangedEvent(
-	base *eventstore.BaseEvent,
-	current *PasswordAgePolicyWriteModel,
-	expireWarnDays,
-	maxAgeDays uint16,
-) *PasswordAgePolicyChangedEvent {
-
-	e := &PasswordAgePolicyChangedEvent{
-		BaseEvent: *base,
-	}
-
-	if current.ExpireWarnDays != expireWarnDays {
-		e.ExpireWarnDays = expireWarnDays
-	}
-	if current.MaxAgeDays != maxAgeDays {
-		e.MaxAgeDays = maxAgeDays
-	}
-
-	return e
-}
-
-func PasswordAgePolicyChangedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
-	e := &PasswordAgePolicyChangedEvent{
-		BaseEvent: *eventstore.BaseEventFromRepo(event),
-	}
-
-	err := json.Unmarshal(event.Data, e)
-	if err != nil {
-		return nil, errors.ThrowInternal(err, "POLIC-PqaVq", "unable to unmarshal policy")
-	}
-
-	return e, nil
-}
-
-type PasswordAgePolicyRemovedEvent struct {
-	eventstore.BaseEvent `json:"-"`
-}
-
-func (e *PasswordAgePolicyRemovedEvent) CheckPrevious() bool {
-	return true
-}
-
-func (e *PasswordAgePolicyRemovedEvent) Data() interface{} {
-	return nil
-}
-
-func NewPasswordAgePolicyRemovedEvent(
-	base *eventstore.BaseEvent,
-	current,
-	changed *PasswordAgePolicyRemovedEvent,
-) *PasswordAgePolicyChangedEvent {
-
-	return &PasswordAgePolicyChangedEvent{
-		BaseEvent: *base,
-	}
-}
-
-func PasswordAgePolicyRemovedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
-	e := &PasswordAgePolicyRemovedEvent{
-		BaseEvent: *eventstore.BaseEventFromRepo(event),
-	}
-
-	err := json.Unmarshal(event.Data, e)
-	if err != nil {
-		return nil, errors.ThrowInternal(err, "POLIC-02878", "unable to unmarshal policy")
-	}
-
-	return e, nil
-}

internal/v2/repository/policy/password_age/events.go

@@ -0,0 +1,137 @@
+package password_age
+
+import (
+	"encoding/json"
+	"github.com/caos/zitadel/internal/errors"
+	"github.com/caos/zitadel/internal/eventstore/v2"
+	"github.com/caos/zitadel/internal/eventstore/v2/repository"
+)
+
+const (
+	PasswordAgePolicyAddedEventType   = "policy.password.age.added"
+	PasswordAgePolicyChangedEventType = "policy.password.age.changed"
+	PasswordAgePolicyRemovedEventType = "policy.password.age.removed"
+)
+
+type AddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ExpireWarnDays uint64 `json:"expireWarnDays"`
+	MaxAgeDays     uint64 `json:"maxAgeDays"`
+}
+
+func (e *AddedEvent) CheckPrevious() bool {
+	return true
+}
+
+func (e *AddedEvent) Data() interface{} {
+	return e
+}
+
+func NewAddedEvent(
+	base *eventstore.BaseEvent,
+	expireWarnDays,
+	maxAgeDays uint64,
+) *AddedEvent {
+
+	return &AddedEvent{
+		BaseEvent:      *base,
+		ExpireWarnDays: expireWarnDays,
+		MaxAgeDays:     maxAgeDays,
+	}
+}
+
+func AddedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
+	e := &AddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := json.Unmarshal(event.Data, e)
+	if err != nil {
+		return nil, errors.ThrowInternal(err, "POLIC-T3mGp", "unable to unmarshal policy")
+	}
+
+	return e, nil
+}
+
+type ChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ExpireWarnDays uint64 `json:"expireWarnDays,omitempty"`
+	MaxAgeDays     uint64 `json:"maxAgeDays,omitempty"`
+}
+
+func (e *ChangedEvent) CheckPrevious() bool {
+	return true
+}
+
+func (e *ChangedEvent) Data() interface{} {
+	return e
+}
+
+func NewChangedEvent(
+	base *eventstore.BaseEvent,
+	current *WriteModel,
+	expireWarnDays,
+	maxAgeDays uint64,
+) *ChangedEvent {
+
+	e := &ChangedEvent{
+		BaseEvent: *base,
+	}
+
+	if current.ExpireWarnDays != expireWarnDays {
+		e.ExpireWarnDays = expireWarnDays
+	}
+	if current.MaxAgeDays != maxAgeDays {
+		e.MaxAgeDays = maxAgeDays
+	}
+
+	return e
+}
+
+func ChangedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
+	e := &ChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := json.Unmarshal(event.Data, e)
+	if err != nil {
+		return nil, errors.ThrowInternal(err, "POLIC-PqaVq", "unable to unmarshal policy")
+	}
+
+	return e, nil
+}
+
+type RemovedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+}
+
+func (e *RemovedEvent) CheckPrevious() bool {
+	return true
+}
+
+func (e *RemovedEvent) Data() interface{} {
+	return nil
+}
+
+func NewRemovedEvent(
+	base *eventstore.BaseEvent,
+) *RemovedEvent {
+	return &RemovedEvent{
+		BaseEvent: *base,
+	}
+}
+
+func RemovedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
+	e := &RemovedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := json.Unmarshal(event.Data, e)
+	if err != nil {
+		return nil, errors.ThrowInternal(err, "POLIC-02878", "unable to unmarshal policy")
+	}
+
+	return e, nil
+}

internal/v2/repository/policy/password_age/read_model.go

@@ -0,0 +1,24 @@
+package password_age
+
+import "github.com/caos/zitadel/internal/eventstore/v2"
+
+type ReadModel struct {
+	eventstore.ReadModel
+
+	ExpireWarnDays uint64
+	MaxAgeDays     uint64
+}
+
+func (rm *ReadModel) Reduce() error {
+	for _, event := range rm.Events {
+		switch e := event.(type) {
+		case *AddedEvent:
+			rm.ExpireWarnDays = e.ExpireWarnDays
+			rm.MaxAgeDays = e.MaxAgeDays
+		case *ChangedEvent:
+			rm.ExpireWarnDays = e.ExpireWarnDays
+			rm.MaxAgeDays = e.MaxAgeDays
+		}
+	}
+	return rm.ReadModel.Reduce()
+}

internal/v2/repository/policy/password_age/write_model.go

@@ -0,0 +1,26 @@
+package password_age
+
+import (
+	"github.com/caos/zitadel/internal/eventstore/v2"
+)
+
+type WriteModel struct {
+	eventstore.WriteModel
+
+	ExpireWarnDays uint64
+	MaxAgeDays     uint64
+}
+
+func (wm *WriteModel) Reduce() error {
+	for _, event := range wm.Events {
+		switch e := event.(type) {
+		case *AddedEvent:
+			wm.ExpireWarnDays = e.ExpireWarnDays
+			wm.MaxAgeDays = e.MaxAgeDays
+		case *ChangedEvent:
+			wm.ExpireWarnDays = e.ExpireWarnDays
+			wm.MaxAgeDays = e.MaxAgeDays
+		}
+	}
+	return wm.WriteModel.Reduce()
+}

internal/v2/repository/policy/password_complexity.go

@@ -1,201 +0,0 @@
-package policy
-
-import (
-	"encoding/json"
-
-	"github.com/caos/zitadel/internal/errors"
-	"github.com/caos/zitadel/internal/eventstore/v2"
-	"github.com/caos/zitadel/internal/eventstore/v2/repository"
-)
-
-const (
-	PasswordComplexityPolicyAddedEventType   = "policy.password.complexity.added"
-	PasswordComplexityPolicyChangedEventType = "policy.password.complexity.changed"
-	PasswordComplexityPolicyRemovedEventType = "policy.password.complexity.removed"
-)
-
-type PasswordComplexityPolicyAggregate struct {
-	eventstore.Aggregate
-}
-
-type PasswordComplexityPolicyReadModel struct {
-	eventstore.ReadModel
-
-	MinLength    uint8
-	HasLowercase bool
-	HasUpperCase bool
-	HasNumber    bool
-	HasSymbol    bool
-}
-
-func (rm *PasswordComplexityPolicyReadModel) Reduce() error {
-	for _, event := range rm.Events {
-		switch e := event.(type) {
-		case *PasswordComplexityPolicyAddedEvent:
-			rm.MinLength = e.MinLength
-			rm.HasLowercase = e.HasLowercase
-			rm.HasUpperCase = e.HasUpperCase
-			rm.HasNumber = e.HasNumber
-			rm.HasSymbol = e.HasSymbol
-		case *PasswordComplexityPolicyChangedEvent:
-			rm.MinLength = e.MinLength
-			rm.HasLowercase = e.HasLowercase
-			rm.HasUpperCase = e.HasUpperCase
-			rm.HasNumber = e.HasNumber
-			rm.HasSymbol = e.HasSymbol
-		}
-	}
-	return rm.ReadModel.Reduce()
-}
-
-type PasswordComplexityPolicyWriteModel struct {
-	eventstore.WriteModel
-
-	MinLength    uint8
-	HasLowercase bool
-	HasUpperCase bool
-	HasNumber    bool
-	HasSymbol    bool
-}
-
-func (wm *PasswordComplexityPolicyWriteModel) Reduce() error {
-	return errors.ThrowUnimplemented(nil, "POLIC-xJjvN", "reduce unimpelemnted")
-}
-
-type PasswordComplexityPolicyAddedEvent struct {
-	eventstore.BaseEvent `json:"-"`
-
-	MinLength    uint8 `json:"minLength,omitempty"`
-	HasLowercase bool  `json:"hasLowercase"`
-	HasUpperCase bool  `json:"hasUppercase"`
-	HasNumber    bool  `json:"hasNumber"`
-	HasSymbol    bool  `json:"hasSymbol"`
-}
-
-func (e *PasswordComplexityPolicyAddedEvent) CheckPrevious() bool {
-	return true
-}
-
-func (e *PasswordComplexityPolicyAddedEvent) Data() interface{} {
-	return e
-}
-
-func NewPasswordComplexityPolicyAddedEvent(
-	base *eventstore.BaseEvent,
-	hasLowerCase,
-	hasUpperCase,
-	hasNumber,
-	hasSymbol bool,
-	minLength uint8,
-) *PasswordComplexityPolicyAddedEvent {
-
-	return &PasswordComplexityPolicyAddedEvent{
-		BaseEvent:    *base,
-		HasLowercase: hasLowerCase,
-		HasNumber:    hasNumber,
-		HasSymbol:    hasSymbol,
-		HasUpperCase: hasUpperCase,
-		MinLength:    minLength,
-	}
-}
-
-func PasswordComplexityPolicyAddedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
-	e := &PasswordComplexityPolicyAddedEvent{
-		BaseEvent: *eventstore.BaseEventFromRepo(event),
-	}
-
-	err := json.Unmarshal(event.Data, e)
-	if err != nil {
-		return nil, errors.ThrowInternal(err, "POLIC-wYxlM", "unable to unmarshal policy")
-	}
-
-	return e, nil
-}
-
-type PasswordComplexityPolicyChangedEvent struct {
-	eventstore.BaseEvent `json:"-"`
-
-	MinLength    uint8 `json:"minLength"`
-	HasLowercase bool  `json:"hasLowercase"`
-	HasUpperCase bool  `json:"hasUppercase"`
-	HasNumber    bool  `json:"hasNumber"`
-	HasSymbol    bool  `json:"hasSymbol"`
-}
-
-func (e *PasswordComplexityPolicyChangedEvent) CheckPrevious() bool {
-	return true
-}
-
-func (e *PasswordComplexityPolicyChangedEvent) Data() interface{} {
-	return e
-}
-
-func NewPasswordComplexityPolicyChangedEvent(
-	base *eventstore.BaseEvent,
-	current *PasswordComplexityPolicyWriteModel,
-	minLength uint8,
-	hasLowerCase,
-	hasUpperCase,
-	hasNumber,
-	hasSymbol bool,
-) *PasswordComplexityPolicyChangedEvent {
-
-	e := &PasswordComplexityPolicyChangedEvent{
-		BaseEvent: *base,
-	}
-
-	if current.MinLength != minLength {
-		e.MinLength = minLength
-	}
-	if current.HasLowercase != hasLowerCase {
-		e.HasLowercase = hasLowerCase
-	}
-	if current.HasUpperCase != hasUpperCase {
-		e.HasUpperCase = hasUpperCase
-	}
-	if current.HasNumber != hasNumber {
-		e.HasNumber = hasNumber
-	}
-	if current.HasSymbol != hasSymbol {
-		e.HasSymbol = hasSymbol
-	}
-
-	return e
-}
-
-func PasswordComplexityPolicyChangedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
-	e := &PasswordComplexityPolicyChangedEvent{
-		BaseEvent: *eventstore.BaseEventFromRepo(event),
-	}
-
-	err := json.Unmarshal(event.Data, e)
-	if err != nil {
-		return nil, errors.ThrowInternal(err, "POLIC-zBGB0", "unable to unmarshal policy")
-	}
-
-	return e, nil
-}
-
-type PasswordComplexityPolicyRemovedEvent struct {
-	eventstore.BaseEvent `json:"-"`
-}
-
-func (e *PasswordComplexityPolicyRemovedEvent) CheckPrevious() bool {
-	return true
-}
-
-func (e *PasswordComplexityPolicyRemovedEvent) Data() interface{} {
-	return nil
-}
-
-func NewPasswordComplexityPolicyRemovedEvent(base *eventstore.BaseEvent) *PasswordComplexityPolicyRemovedEvent {
-	return &PasswordComplexityPolicyRemovedEvent{
-		BaseEvent: *base,
-	}
-}
-
-func PasswordComplexityPolicyRemovedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
-	return &PasswordComplexityPolicyRemovedEvent{
-		BaseEvent: *eventstore.BaseEventFromRepo(event),
-	}, nil
-}

internal/v2/repository/policy/password_complexity/events.go

@@ -0,0 +1,151 @@
+package password_complexity
+
+import (
+	"encoding/json"
+	"github.com/caos/zitadel/internal/errors"
+	"github.com/caos/zitadel/internal/eventstore/v2"
+	"github.com/caos/zitadel/internal/eventstore/v2/repository"
+)
+
+const (
+	PasswordComplexityPolicyAddedEventType   = "policy.password.complexity.added"
+	PasswordComplexityPolicyChangedEventType = "policy.password.complexity.changed"
+	PasswordComplexityPolicyRemovedEventType = "policy.password.complexity.removed"
+)
+
+type AddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	MinLength    uint64 `json:"minLength,omitempty"`
+	HasLowercase bool   `json:"hasLowercase"`
+	HasUpperCase bool   `json:"hasUppercase"`
+	HasNumber    bool   `json:"hasNumber"`
+	HasSymbol    bool   `json:"hasSymbol"`
+}
+
+func (e *AddedEvent) CheckPrevious() bool {
+	return true
+}
+
+func (e *AddedEvent) Data() interface{} {
+	return e
+}
+
+func NewAddedEvent(
+	base *eventstore.BaseEvent,
+	minLength uint64,
+	hasLowerCase,
+	hasUpperCase,
+	hasNumber,
+	hasSymbol bool,
+) *AddedEvent {
+	return &AddedEvent{
+		BaseEvent:    *base,
+		MinLength:    minLength,
+		HasLowercase: hasLowerCase,
+		HasNumber:    hasNumber,
+		HasSymbol:    hasSymbol,
+		HasUpperCase: hasUpperCase,
+	}
+}
+
+func AddedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
+	e := &AddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := json.Unmarshal(event.Data, e)
+	if err != nil {
+		return nil, errors.ThrowInternal(err, "POLIC-wYxlM", "unable to unmarshal policy")
+	}
+
+	return e, nil
+}
+
+type ChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	MinLength    uint64 `json:"minLength"`
+	HasLowercase bool   `json:"hasLowercase"`
+	HasUpperCase bool   `json:"hasUppercase"`
+	HasNumber    bool   `json:"hasNumber"`
+	HasSymbol    bool   `json:"hasSymbol"`
+}
+
+func (e *ChangedEvent) CheckPrevious() bool {
+	return true
+}
+
+func (e *ChangedEvent) Data() interface{} {
+	return e
+}
+
+func NewChangedEvent(
+	base *eventstore.BaseEvent,
+	current *WriteModel,
+	minLength uint64,
+	hasLowerCase,
+	hasUpperCase,
+	hasNumber,
+	hasSymbol bool,
+) *ChangedEvent {
+
+	e := &ChangedEvent{
+		BaseEvent: *base,
+	}
+
+	if current.MinLength != minLength {
+		e.MinLength = minLength
+	}
+	if current.HasLowercase != hasLowerCase {
+		e.HasLowercase = hasLowerCase
+	}
+	if current.HasUpperCase != hasUpperCase {
+		e.HasUpperCase = hasUpperCase
+	}
+	if current.HasNumber != hasNumber {
+		e.HasNumber = hasNumber
+	}
+	if current.HasSymbol != hasSymbol {
+		e.HasSymbol = hasSymbol
+	}
+
+	return e
+}
+
+func ChangedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
+	e := &ChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := json.Unmarshal(event.Data, e)
+	if err != nil {
+		return nil, errors.ThrowInternal(err, "POLIC-zBGB0", "unable to unmarshal policy")
+	}
+
+	return e, nil
+}
+
+type RemovedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+}
+
+func (e *RemovedEvent) CheckPrevious() bool {
+	return true
+}
+
+func (e *RemovedEvent) Data() interface{} {
+	return nil
+}
+
+func NewRemovedEvent(base *eventstore.BaseEvent) *RemovedEvent {
+	return &RemovedEvent{
+		BaseEvent: *base,
+	}
+}
+
+func RemovedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
+	return &RemovedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}, nil
+}

internal/v2/repository/policy/password_complexity/read_model.go

@@ -0,0 +1,33 @@
+package password_complexity
+
+import "github.com/caos/zitadel/internal/eventstore/v2"
+
+type ReadModel struct {
+	eventstore.ReadModel
+
+	MinLength    uint64
+	HasLowercase bool
+	HasUpperCase bool
+	HasNumber    bool
+	HasSymbol    bool
+}
+
+func (rm *ReadModel) Reduce() error {
+	for _, event := range rm.Events {
+		switch e := event.(type) {
+		case *AddedEvent:
+			rm.MinLength = e.MinLength
+			rm.HasLowercase = e.HasLowercase
+			rm.HasUpperCase = e.HasUpperCase
+			rm.HasNumber = e.HasNumber
+			rm.HasSymbol = e.HasSymbol
+		case *ChangedEvent:
+			rm.MinLength = e.MinLength
+			rm.HasLowercase = e.HasLowercase
+			rm.HasUpperCase = e.HasUpperCase
+			rm.HasNumber = e.HasNumber
+			rm.HasSymbol = e.HasSymbol
+		}
+	}
+	return rm.ReadModel.Reduce()
+}

internal/v2/repository/policy/password_complexity/write_model.go

@@ -0,0 +1,35 @@
+package password_complexity
+
+import (
+	"github.com/caos/zitadel/internal/eventstore/v2"
+)
+
+type WriteModel struct {
+	eventstore.WriteModel
+
+	MinLength    uint64
+	HasLowercase bool
+	HasUpperCase bool
+	HasNumber    bool
+	HasSymbol    bool
+}
+
+func (wm *WriteModel) Reduce() error {
+	for _, event := range wm.Events {
+		switch e := event.(type) {
+		case *AddedEvent:
+			wm.MinLength = e.MinLength
+			wm.HasLowercase = e.HasLowercase
+			wm.HasUpperCase = e.HasUpperCase
+			wm.HasNumber = e.HasNumber
+			wm.HasSymbol = e.HasSymbol
+		case *ChangedEvent:
+			wm.MinLength = e.MinLength
+			wm.HasLowercase = e.HasLowercase
+			wm.HasUpperCase = e.HasUpperCase
+			wm.HasNumber = e.HasNumber
+			wm.HasSymbol = e.HasSymbol
+		}
+	}
+	return wm.WriteModel.Reduce()
+}

internal/v2/repository/policy/password_lockout.go

@@ -1,168 +0,0 @@
-package policy
-
-import (
-	"encoding/json"
-
-	"github.com/caos/zitadel/internal/errors"
-	"github.com/caos/zitadel/internal/eventstore/v2"
-	"github.com/caos/zitadel/internal/eventstore/v2/repository"
-)
-
-const (
-	PasswordLockoutPolicyAddedEventType   = "policy.password.lockout.added"
-	PasswordLockoutPolicyChangedEventType = "policy.password.lockout.changed"
-	PasswordLockoutPolicyRemovedEventType = "policy.password.lockout.removed"
-)
-
-type PasswordLockoutPolicyAggregate struct {
-	eventstore.Aggregate
-}
-
-type PasswordLockoutPolicyReadModel struct {
-	eventstore.ReadModel
-
-	MaxAttempts         uint8
-	ShowLockOutFailures bool
-}
-
-func (rm *PasswordLockoutPolicyReadModel) Reduce() error {
-	for _, event := range rm.Events {
-		switch e := event.(type) {
-		case *PasswordLockoutPolicyAddedEvent:
-			rm.MaxAttempts = e.MaxAttempts
-			rm.ShowLockOutFailures = e.ShowLockOutFailures
-		case *PasswordLockoutPolicyChangedEvent:
-			rm.MaxAttempts = e.MaxAttempts
-			rm.ShowLockOutFailures = e.ShowLockOutFailures
-		}
-	}
-	return rm.ReadModel.Reduce()
-}
-
-type PasswordLockoutPolicyWriteModel struct {
-	eventstore.WriteModel
-
-	MaxAttempts         uint8
-	ShowLockOutFailures bool
-}
-
-func (wm *PasswordLockoutPolicyWriteModel) Reduce() error {
-	return errors.ThrowUnimplemented(nil, "POLIC-xJjvN", "reduce unimpelemnted")
-}
-
-type PasswordLockoutPolicyAddedEvent struct {
-	eventstore.BaseEvent `json:"-"`
-
-	MaxAttempts         uint8 `json:"maxAttempts,omitempty"`
-	ShowLockOutFailures bool  `json:"showLockOutFailures"`
-}
-
-func (e *PasswordLockoutPolicyAddedEvent) CheckPrevious() bool {
-	return true
-}
-
-func (e *PasswordLockoutPolicyAddedEvent) Data() interface{} {
-	return e
-}
-
-func NewPasswordLockoutPolicyAddedEvent(
-	base *eventstore.BaseEvent,
-	maxAttempts uint8,
-	showLockOutFailures bool,
-) *PasswordLockoutPolicyAddedEvent {
-
-	return &PasswordLockoutPolicyAddedEvent{
-		BaseEvent:           *base,
-		MaxAttempts:         maxAttempts,
-		ShowLockOutFailures: showLockOutFailures,
-	}
-}
-
-func PasswordLockoutPolicyAddedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
-	e := &PasswordLockoutPolicyAddedEvent{
-		BaseEvent: *eventstore.BaseEventFromRepo(event),
-	}
-
-	err := json.Unmarshal(event.Data, e)
-	if err != nil {
-		return nil, errors.ThrowInternal(err, "POLIC-8XiVd", "unable to unmarshal policy")
-	}
-
-	return e, nil
-}
-
-type PasswordLockoutPolicyChangedEvent struct {
-	eventstore.BaseEvent `json:"-"`
-
-	MaxAttempts         uint8 `json:"maxAttempts,omitempty"`
-	ShowLockOutFailures bool  `json:"showLockOutFailures,omitempty"`
-}
-
-func (e *PasswordLockoutPolicyChangedEvent) CheckPrevious() bool {
-	return true
-}
-
-func (e *PasswordLockoutPolicyChangedEvent) Data() interface{} {
-	return e
-}
-
-func NewPasswordLockoutPolicyChangedEvent(
-	base *eventstore.BaseEvent,
-	current *PasswordLockoutPolicyWriteModel,
-	maxAttempts uint8,
-	showLockOutFailures bool,
-) *PasswordLockoutPolicyChangedEvent {
-
-	e := &PasswordLockoutPolicyChangedEvent{
-		BaseEvent: *base,
-	}
-
-	if current.MaxAttempts != maxAttempts {
-		e.MaxAttempts = maxAttempts
-	}
-	if current.ShowLockOutFailures != showLockOutFailures {
-		e.ShowLockOutFailures = showLockOutFailures
-	}
-
-	return e
-}
-
-func PasswordLockoutPolicyChangedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
-	e := &PasswordLockoutPolicyChangedEvent{
-		BaseEvent: *eventstore.BaseEventFromRepo(event),
-	}
-
-	err := json.Unmarshal(event.Data, e)
-	if err != nil {
-		return nil, errors.ThrowInternal(err, "POLIC-lWGRc", "unable to unmarshal policy")
-	}
-
-	return e, nil
-}
-
-type PasswordLockoutPolicyRemovedEvent struct {
-	eventstore.BaseEvent `json:"-"`
-}
-
-func (e *PasswordLockoutPolicyRemovedEvent) CheckPrevious() bool {
-	return true
-}
-
-func (e *PasswordLockoutPolicyRemovedEvent) Data() interface{} {
-	return nil
-}
-
-func NewPasswordLockoutPolicyRemovedEvent(
-	base *eventstore.BaseEvent,
-) *PasswordLockoutPolicyRemovedEvent {
-
-	return &PasswordLockoutPolicyRemovedEvent{
-		BaseEvent: *base,
-	}
-}
-
-func PasswordLockoutPolicyRemovedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
-	return &PasswordLockoutPolicyRemovedEvent{
-		BaseEvent: *eventstore.BaseEventFromRepo(event),
-	}, nil
-}

internal/v2/repository/policy/password_lockout/events.go

@@ -0,0 +1,131 @@
+package password_lockout
+
+import (
+	"encoding/json"
+	"github.com/caos/zitadel/internal/errors"
+	"github.com/caos/zitadel/internal/eventstore/v2"
+	"github.com/caos/zitadel/internal/eventstore/v2/repository"
+)
+
+const (
+	PasswordLockoutPolicyAddedEventType   = "policy.password.lockout.added"
+	PasswordLockoutPolicyChangedEventType = "policy.password.lockout.changed"
+	PasswordLockoutPolicyRemovedEventType = "policy.password.lockout.removed"
+)
+
+type AddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	MaxAttempts         uint64 `json:"maxAttempts,omitempty"`
+	ShowLockOutFailures bool   `json:"showLockOutFailures"`
+}
+
+func (e *AddedEvent) CheckPrevious() bool {
+	return true
+}
+
+func (e *AddedEvent) Data() interface{} {
+	return e
+}
+
+func NewAddedEvent(
+	base *eventstore.BaseEvent,
+	maxAttempts uint64,
+	showLockOutFailures bool,
+) *AddedEvent {
+
+	return &AddedEvent{
+		BaseEvent:           *base,
+		MaxAttempts:         maxAttempts,
+		ShowLockOutFailures: showLockOutFailures,
+	}
+}
+
+func AddedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
+	e := &AddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := json.Unmarshal(event.Data, e)
+	if err != nil {
+		return nil, errors.ThrowInternal(err, "POLIC-8XiVd", "unable to unmarshal policy")
+	}
+
+	return e, nil
+}
+
+type ChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	MaxAttempts         uint64 `json:"maxAttempts,omitempty"`
+	ShowLockOutFailures bool   `json:"showLockOutFailures,omitempty"`
+}
+
+func (e *ChangedEvent) CheckPrevious() bool {
+	return true
+}
+
+func (e *ChangedEvent) Data() interface{} {
+	return e
+}
+
+func NewChangedEvent(
+	base *eventstore.BaseEvent,
+	current *WriteModel,
+	maxAttempts uint64,
+	showLockOutFailures bool,
+) *ChangedEvent {
+
+	e := &ChangedEvent{
+		BaseEvent: *base,
+	}
+
+	if current.MaxAttempts != maxAttempts {
+		e.MaxAttempts = maxAttempts
+	}
+	if current.ShowLockOutFailures != showLockOutFailures {
+		e.ShowLockOutFailures = showLockOutFailures
+	}
+
+	return e
+}
+
+func ChangedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
+	e := &ChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := json.Unmarshal(event.Data, e)
+	if err != nil {
+		return nil, errors.ThrowInternal(err, "POLIC-lWGRc", "unable to unmarshal policy")
+	}
+
+	return e, nil
+}
+
+type RemovedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+}
+
+func (e *RemovedEvent) CheckPrevious() bool {
+	return true
+}
+
+func (e *RemovedEvent) Data() interface{} {
+	return nil
+}
+
+func NewRemovedEvent(
+	base *eventstore.BaseEvent,
+) *RemovedEvent {
+
+	return &RemovedEvent{
+		BaseEvent: *base,
+	}
+}
+
+func RemovedEventMapper(event *repository.Event) (eventstore.EventReader, error) {
+	return &RemovedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}, nil
+}

internal/v2/repository/policy/password_lockout/read_model.go

@@ -0,0 +1,24 @@
+package password_lockout
+
+import "github.com/caos/zitadel/internal/eventstore/v2"
+
+type ReadModel struct {
+	eventstore.ReadModel
+
+	MaxAttempts         uint64
+	ShowLockOutFailures bool
+}
+
+func (rm *ReadModel) Reduce() error {
+	for _, event := range rm.Events {
+		switch e := event.(type) {
+		case *AddedEvent:
+			rm.MaxAttempts = e.MaxAttempts
+			rm.ShowLockOutFailures = e.ShowLockOutFailures
+		case *ChangedEvent:
+			rm.MaxAttempts = e.MaxAttempts
+			rm.ShowLockOutFailures = e.ShowLockOutFailures
+		}
+	}
+	return rm.ReadModel.Reduce()
+}

internal/v2/repository/policy/password_lockout/write_model.go

@@ -0,0 +1,26 @@
+package password_lockout
+
+import (
+	"github.com/caos/zitadel/internal/eventstore/v2"
+)
+
+type WriteModel struct {
+	eventstore.WriteModel
+
+	MaxAttempts         uint64
+	ShowLockOutFailures bool
+}
+
+func (wm *WriteModel) Reduce() error {
+	for _, event := range wm.Events {
+		switch e := event.(type) {
+		case *AddedEvent:
+			wm.MaxAttempts = e.MaxAttempts
+			wm.ShowLockOutFailures = e.ShowLockOutFailures
+		case *ChangedEvent:
+			wm.MaxAttempts = e.MaxAttempts
+			wm.ShowLockOutFailures = e.ShowLockOutFailures
+		}
+	}
+	return wm.WriteModel.Reduce()
+}