feat: translate error messages (#254)

* feat: translate error messages in error interceptor

* fix: add statik import

* feat: user error msgs

* feat: add translations

* feat: add translations

* feat: add translations

* feat: add translations

* feat: add translations

* feat: add translations

* some fixes and improved error messages

Co-authored-by: Livio Amstutz <livio.a@gmail.com>

.github/workflows/release.yml

@@ -105,6 +105,8 @@ jobs:
     - run: cat internal/login/statik/statik.go
     - run: ./build/notification/generate-static.sh
     - run: cat internal/notification/statik/statik.go
+    - run: ./build/zitadel/generate-static.sh
+    - run: cat internal/statik/statik.go
     - run: CGO_ENABLED=0 GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} go build -a -installsuffix cgo -ldflags '-extldflags "-static"' -o zitadel-${{ matrix.goos }}-${{ matrix.goarch }} cmd/zitadel/main.go
     - uses: actions/upload-artifact@v1
       with:

build/zitadel/generate-static.sh

@@ -0,0 +1,5 @@
+#! /bin/sh
+
+set -eux
+
+go generate internal/statik/generate.go

cmd/zitadel/system-defaults.yaml

@@ -1,4 +1,5 @@
 SystemDefaults:
+  DefaultLanguage: 'de'
   UserVerificationKey:
     EncryptionKeyID: $ZITADEL_USER_VERIFICATION_KEY
   SecretGenerators:

internal/api/auth/context.go

@@ -17,10 +17,11 @@ const (
 )
 
 type CtxData struct {
-	UserID    string
+	UserID            string
-	OrgID     string
+	OrgID             string
-	ProjectID string
+	ProjectID         string
-	AgentID   string
+	AgentID           string
+	PreferredLanguage string
 }
 
 func (ctxData CtxData) IsZero() bool {
@@ -48,6 +49,7 @@ func VerifyTokenAndWriteCtxData(ctx context.Context, token, orgID string, t Toke
 		clientID = grpc_util.GetHeader(ctx, api.ZitadelClientID)
 		projectID, err = t.GetProjectIDByClientID(ctx, clientID)
 		agentID = grpc_util.GetHeader(ctx, api.ZitadelAgentID)
+
 	} else {
 		userID, clientID, agentID, err = verifyAccessToken(ctx, token, t)
 		if err != nil {

internal/api/grpc/caos_errors.go

@@ -1,13 +1,14 @@
 package grpc
 
 import (
+	"context"
+	caos_errs "github.com/caos/zitadel/internal/errors"
+	"github.com/caos/zitadel/internal/i18n"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
-
-	caos_errs "github.com/caos/zitadel/internal/errors"
 )
 
-func CaosToGRPCError(err error) error {
+func CaosToGRPCError(err error, ctx context.Context, translator *i18n.Translator) error {
 	if err == nil {
 		return nil
 	}
@@ -15,6 +16,10 @@ func CaosToGRPCError(err error) error {
 	if !ok {
 		return status.Convert(err).Err()
 	}
+	if translator != nil {
+		msg = translator.LocalizeFromCtx(ctx, msg, nil)
+
+	}
 	return status.Error(code, msg)
 }
 

internal/api/grpc/server/middleware/auth_interceptor.go

@@ -2,7 +2,6 @@ package middleware
 
 import (
 	"context"
-
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
@@ -20,7 +19,7 @@ func AuthorizationInterceptor(verifier auth.TokenVerifier, authConfig *auth.Conf
 		}
 
 		authToken := ""
-		//TODO: Remoce check internal as soon as authentification is implemented
+		//TODO: Remove check internal as soon as authentification is implemented
 		if !auth.CheckInternal(ctx) {
 			authToken = grpc_util.GetAuthorizationHeader(ctx)
 			if authToken == "" {

internal/api/grpc/server/middleware/error_interceptor.go

@@ -2,15 +2,28 @@ package middleware
 
 import (
 	"context"
+	"github.com/caos/logging"
+	"github.com/caos/zitadel/internal/i18n"
+	"github.com/rakyll/statik/fs"
+	"golang.org/x/text/language"
 
 	"google.golang.org/grpc"
 
 	grpc_util "github.com/caos/zitadel/internal/api/grpc"
+	_ "github.com/caos/zitadel/internal/statik"
 )
 
-func ErrorHandler() func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) {
+func ErrorHandler(defaultLanguage language.Tag) func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) {
+	dir, err := fs.NewWithNamespace("zitadel")
+	logging.Log("ERROR-7usEW").OnError(err).Panic("unable to get zitadel namespace")
+
+	i18n, err := i18n.NewTranslator(dir, i18n.TranslatorConfig{DefaultLanguage: defaultLanguage})
+	if err != nil {
+		logging.Log("ERROR-Sk8sf").OnError(err).Panic("unable to get i18n translator")
+	}
+
 	return func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) {
 		resp, err := handler(ctx, req)
-		return resp, grpc_util.CaosToGRPCError(err)
+		return resp, grpc_util.CaosToGRPCError(err, ctx, i18n)
 	}
 }

internal/api/grpc/server/server.go

@@ -2,6 +2,7 @@ package server
 
 import (
 	"context"
+	"github.com/caos/zitadel/internal/config/systemdefaults"
 	"net"
 
 	"github.com/caos/logging"
@@ -16,18 +17,18 @@ const (
 
 type Server interface {
 	GRPCPort() string
-	GRPCServer() (*grpc.Server, error)
+	GRPCServer(defaults systemdefaults.SystemDefaults) (*grpc.Server, error)
 }
 
-func StartServer(ctx context.Context, s Server) {
+func StartServer(ctx context.Context, s Server, defaults systemdefaults.SystemDefaults) {
 	port := grpcPort(s.GRPCPort())
 	listener := http.CreateListener(port)
-	server := createGrpcServer(s)
+	server := createGrpcServer(s, defaults)
 	serveServer(ctx, server, listener, port)
 }
 
-func createGrpcServer(s Server) *grpc.Server {
+func createGrpcServer(s Server, defaults systemdefaults.SystemDefaults) *grpc.Server {
-	grpcServer, err := s.GRPCServer()
+	grpcServer, err := s.GRPCServer(defaults)
 	logging.Log("SERVE-k280HZ").OnError(err).Panic("failed to create grpc server")
 	return grpcServer
 }

internal/config/systemdefaults/system_defaults.go

@@ -9,9 +9,11 @@ import (
 	"github.com/caos/zitadel/internal/notification/templates"
 	org_model "github.com/caos/zitadel/internal/org/model"
 	pol "github.com/caos/zitadel/internal/policy"
+	"golang.org/x/text/language"
 )
 
 type SystemDefaults struct {
+	DefaultLanguage       language.Tag
 	SecretGenerators      SecretGenerators
 	UserVerificationKey   *crypto.KeyConfig
 	Multifactors          MultifactorConfig

internal/eventstore/sdk/sdk.go

@@ -52,7 +52,7 @@ func Push(ctx context.Context, push pushFunc, appender appendFunc, aggregaters .
 
 func PushAggregates(ctx context.Context, push pushFunc, appender appendFunc, aggregates ...*models.Aggregate) (err error) {
 	if len(aggregates) < 1 {
-		return errors.ThrowPreconditionFailed(nil, "SDK-q9wjp", "no aggregaters passed")
+		return errors.ThrowPreconditionFailed(nil, "SDK-q9wjp", "Errors.Internal")
 	}
 
 	err = push(ctx, aggregates...)
@@ -70,7 +70,7 @@ func appendAggregates(appender appendFunc, aggregates []*models.Aggregate) error
 	for _, aggregate := range aggregates {
 		err := appender(aggregate.Events...)
 		if err != nil {
-			return ThrowAppendEventError(err, "SDK-o6kzK", "aggregator failed")
+			return ThrowAppendEventError(err, "SDK-o6kzK", "Errors.Internal")
 		}
 	}
 	return nil

internal/i18n/i18n.go

@@ -1,7 +1,9 @@
 package i18n
 
 import (
+	"context"
 	"encoding/json"
+	"github.com/grpc-ecosystem/go-grpc-middleware/util/metautils"
 	"io/ioutil"
 	"net/http"
 	"os"
@@ -89,6 +91,18 @@ func (t *Translator) LocalizeFromRequest(r *http.Request, id string, args map[st
 	return s
 }
 
+func (t *Translator) LocalizeFromCtx(ctx context.Context, id string, args map[string]interface{}) string {
+	s, err := t.localizerFromCtx(ctx).Localize(&i18n.LocalizeConfig{
+		MessageID:    id,
+		TemplateData: args,
+	})
+	if err != nil {
+		logging.Log("I18N-MsF5sx").WithError(err).Warnf("missing translation")
+		return id
+	}
+	return s
+}
+
 func (t *Translator) Localize(id string, args map[string]interface{}, langs ...string) string {
 	s, _ := t.localizer(langs...).Localize(&i18n.LocalizeConfig{
 		MessageID:    id,
@@ -111,6 +125,10 @@ func (t *Translator) localizerFromRequest(r *http.Request) *i18n.Localizer {
 	return t.localizer(t.langsFromRequest(r)...)
 }
 
+func (t *Translator) localizerFromCtx(ctx context.Context) *i18n.Localizer {
+	return t.localizer(t.langsFromCtx(ctx)...)
+}
+
 func (t *Translator) localizer(langs ...string) *i18n.Localizer {
 	return i18n.NewLocalizer(t.bundle, langs...)
 }
@@ -126,3 +144,15 @@ func (t *Translator) langsFromRequest(r *http.Request) []string {
 	}
 	return langs
 }
+
+func (t *Translator) langsFromCtx(ctx context.Context) []string {
+	langs := make([]string, 0)
+	if ctx != nil {
+		langs = append(langs, getAcceptLanguageHeader(ctx))
+	}
+	return langs
+}
+
+func getAcceptLanguageHeader(ctx context.Context) string {
+	return metautils.ExtractIncoming(ctx).Get("grpcgateway-accept-language")
+}

internal/iam/repository/eventsourcing/eventstore.go

@@ -120,14 +120,14 @@ func (es *IamEventstore) SetIamProject(ctx context.Context, iamID, iamProjectID
 
 func (es *IamEventstore) AddIamMember(ctx context.Context, member *iam_model.IamMember) (*iam_model.IamMember, error) {
 	if !member.IsValid() {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-89osr", "UserID and Roles are required")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-89osr", "Errors.Iam.MemberInvalid")
 	}
 	existing, err := es.IamByID(ctx, member.AggregateID)
 	if err != nil {
 		return nil, err
 	}
 	if _, m := existing.GetMember(member.UserID); m != nil {
-		return nil, caos_errs.ThrowAlreadyExists(nil, "EVENT-idke6", "User is already member of this Iam")
+		return nil, caos_errs.ThrowAlreadyExists(nil, "EVENT-idke6", "Errors.Iam.MemberAlreadyExisting")
 	}
 	repoIam := model.IamFromModel(existing)
 	repoMember := model.IamMemberFromModel(member)
@@ -142,19 +142,19 @@ func (es *IamEventstore) AddIamMember(ctx context.Context, member *iam_model.Iam
 	if _, m := model.GetIamMember(repoIam.Members, member.UserID); m != nil {
 		return model.IamMemberToModel(m), nil
 	}
-	return nil, caos_errs.ThrowInternal(nil, "EVENT-s90pw", "Could not find member in list")
+	return nil, caos_errs.ThrowInternal(nil, "EVENT-s90pw", "Errors.Internal")
 }
 
 func (es *IamEventstore) ChangeIamMember(ctx context.Context, member *iam_model.IamMember) (*iam_model.IamMember, error) {
 	if !member.IsValid() {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-s9ipe", "UserID and Roles are required")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-s9ipe", "Errors.Iam.MemberInvalid")
 	}
 	existing, err := es.IamByID(ctx, member.AggregateID)
 	if err != nil {
 		return nil, err
 	}
 	if _, m := existing.GetMember(member.UserID); m == nil {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-s7ucs", "User is not member of this project")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-s7ucs", "Errors.Iam.MemberNotExisting")
 	}
 	repoIam := model.IamFromModel(existing)
 	repoMember := model.IamMemberFromModel(member)
@@ -166,19 +166,19 @@ func (es *IamEventstore) ChangeIamMember(ctx context.Context, member *iam_model.
 	if _, m := model.GetIamMember(repoIam.Members, member.UserID); m != nil {
 		return model.IamMemberToModel(m), nil
 	}
-	return nil, caos_errs.ThrowInternal(nil, "EVENT-29cws", "Could not find member in list")
+	return nil, caos_errs.ThrowInternal(nil, "EVENT-29cws", "Errors.Internal")
 }
 
 func (es *IamEventstore) RemoveIamMember(ctx context.Context, member *iam_model.IamMember) error {
 	if member.UserID == "" {
-		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-0pors", "UserID and Roles are required")
+		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-0pors", "Errors.Iam.MemberInvalid")
 	}
 	existing, err := es.IamByID(ctx, member.AggregateID)
 	if err != nil {
 		return err
 	}
 	if _, m := existing.GetMember(member.UserID); m == nil {
-		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-29skr", "User is not member of this project")
+		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-29skr", "Errors.Iam.MemberNotExisting")
 	}
 	repoIam := model.IamFromModel(existing)
 	repoMember := model.IamMemberFromModel(member)

internal/iam/repository/eventsourcing/iam.go

@@ -9,7 +9,7 @@ import (
 
 func IamByIDQuery(id string, latestSequence uint64) (*es_models.SearchQuery, error) {
 	if id == "" {
-		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-0soe4", "id should be filled")
+		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-0soe4", "Errors.Iam.IDMissing")
 	}
 	return IamQuery(latestSequence).
 		AggregateIDFilter(id), nil
@@ -23,14 +23,14 @@ func IamQuery(latestSequence uint64) *es_models.SearchQuery {
 
 func IamAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, iam *model.Iam) (*es_models.Aggregate, error) {
 	if iam == nil {
-		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-lo04e", "existing iam should not be nil")
+		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-lo04e", "Errors.Internal")
 	}
 	return aggCreator.NewAggregate(ctx, iam.AggregateID, model.IamAggregate, model.IamVersion, iam.Sequence)
 }
 
 func IamAggregateOverwriteContext(ctx context.Context, aggCreator *es_models.AggregateCreator, iam *model.Iam, resourceOwnerID string, userID string) (*es_models.Aggregate, error) {
 	if iam == nil {
-		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dis83", "existing iam should not be nil")
+		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dis83", "Errors.Internal")
 	}
 
 	return aggCreator.NewAggregate(ctx, iam.AggregateID, model.IamAggregate, model.IamVersion, iam.Sequence, es_models.OverwriteResourceOwner(resourceOwnerID), es_models.OverwriteEditorUser(userID))
@@ -60,7 +60,7 @@ func IamSetupDoneAggregate(aggCreator *es_models.AggregateCreator, iam *model.Ia
 func IamSetGlobalOrgAggregate(aggCreator *es_models.AggregateCreator, iam *model.Iam, globalOrg string) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if globalOrg == "" {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-8siwa", "globalOrg must be set")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-8siwa", "Errors.Iam.GlobalOrgMissing")
 		}
 		agg, err := IamAggregate(ctx, aggCreator, iam)
 		if err != nil {
@@ -73,7 +73,7 @@ func IamSetGlobalOrgAggregate(aggCreator *es_models.AggregateCreator, iam *model
 func IamSetIamProjectAggregate(aggCreator *es_models.AggregateCreator, iam *model.Iam, projectID string) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if projectID == "" {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-sjuw3", "projectID must be set")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-sjuw3", "Errors.Iam.IamProjectIDMisisng")
 		}
 		agg, err := IamAggregate(ctx, aggCreator, iam)
 		if err != nil {
@@ -86,7 +86,7 @@ func IamSetIamProjectAggregate(aggCreator *es_models.AggregateCreator, iam *mode
 func IamMemberAddedAggregate(aggCreator *es_models.AggregateCreator, existing *model.Iam, member *model.IamMember) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if member == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-9sope", "member should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-9sope", "Errors.Internal")
 		}
 		agg, err := IamAggregate(ctx, aggCreator, existing)
 		if err != nil {
@@ -99,7 +99,7 @@ func IamMemberAddedAggregate(aggCreator *es_models.AggregateCreator, existing *m
 func IamMemberChangedAggregate(aggCreator *es_models.AggregateCreator, existing *model.Iam, member *model.IamMember) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if member == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-38skf", "member should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-38skf", "Errors.Internal")
 		}
 
 		agg, err := IamAggregate(ctx, aggCreator, existing)
@@ -113,7 +113,7 @@ func IamMemberChangedAggregate(aggCreator *es_models.AggregateCreator, existing
 func IamMemberRemovedAggregate(aggCreator *es_models.AggregateCreator, existing *model.Iam, member *model.IamMember) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if member == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-90lsw", "member should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-90lsw", "Errors.Internal")
 		}
 		agg, err := IamAggregate(ctx, aggCreator, existing)
 		if err != nil {

internal/login/static/i18n/de.yaml

@@ -125,7 +125,7 @@ Errors:
     NotFound: Benutzer konnte nicht gefunden werden
     NotMatchingUserID: User stimm nicht mit User in Auth Request überein
     UserIDMissing: UserID ist leer
-    InvalidData: Userdaten sind ungültig
+    Invalid: Userdaten sind ungültig
     Password:
       ConfirmationWrong: Passwort Bestätigung stimmt nicht überein
       Empty: Passwort ist leer

internal/login/static/i18n/en.yaml

@@ -126,7 +126,7 @@ Errors:
     NotFound: User could not be found
     NotMatchingUserID: User and user in authrequest don't match
     UserIDMissing: UserID is empty
-    InvalidData: Invalid userdata
+    Invalid: Invalid userdata
     Password:
       ConfirmationWrong: Passwordconfirmation is wrong
       Empty: Password is empty

internal/org/repository/eventsourcing/eventstore.go

@@ -42,13 +42,13 @@ func StartOrg(conf OrgConfig, defaults systemdefaults.SystemDefaults) *OrgEvents
 
 func (es *OrgEventstore) PrepareCreateOrg(ctx context.Context, orgModel *org_model.Org) (*model.Org, []*es_models.Aggregate, error) {
 	if orgModel == nil || !orgModel.IsValid() {
-		return nil, nil, errors.ThrowInvalidArgument(nil, "EVENT-OeLSk", "org not valid")
+		return nil, nil, errors.ThrowInvalidArgument(nil, "EVENT-OeLSk", "Errors.Org.Invalid")
 	}
 	orgModel.AddIAMDomain(es.IAMDomain)
 
 	id, err := es.idGenerator.Next()
 	if err != nil {
-		return nil, nil, errors.ThrowInternal(err, "EVENT-OwciI", "id gen failed")
+		return nil, nil, errors.ThrowInternal(err, "EVENT-OwciI", "Errors.Internal")
 	}
 	orgModel.AggregateID = id
 	org := model.OrgFromModel(orgModel)
@@ -70,7 +70,7 @@ func (es *OrgEventstore) CreateOrg(ctx context.Context, orgModel *org_model.Org)
 
 func (es *OrgEventstore) OrgByID(ctx context.Context, org *org_model.Org) (*org_model.Org, error) {
 	if org == nil {
-		return nil, errors.ThrowInvalidArgument(nil, "EVENT-gQTYP", "org not set")
+		return nil, errors.ThrowInvalidArgument(nil, "EVENT-gQTYP", "Errors.Org.Empty")
 	}
 	query, err := OrgByIDQuery(org.AggregateID, org.Sequence)
 	if err != nil {
@@ -83,7 +83,7 @@ func (es *OrgEventstore) OrgByID(ctx context.Context, org *org_model.Org) (*org_
 		return nil, err
 	}
 	if esOrg.Sequence == 0 {
-		return nil, errors.ThrowNotFound(nil, "EVENT-kVLb2", "org not found")
+		return nil, errors.ThrowNotFound(nil, "EVENT-kVLb2", "Errors.Org.NotFound")
 	}
 
 	return model.OrgToModel(esOrg), nil
@@ -118,7 +118,7 @@ func isUniqueValidation(unique *bool) func(events ...*es_models.Event) error {
 func (es *OrgEventstore) DeactivateOrg(ctx context.Context, orgID string) (*org_model.Org, error) {
 	existingOrg, err := es.OrgByID(ctx, org_model.NewOrg(orgID))
 	if err != nil {
-		return nil, errors.ThrowInvalidArgument(nil, "EVENT-oL9nT", "org not found")
+		return nil, errors.ThrowInvalidArgument(nil, "EVENT-oL9nT", "Errors.Org.NotFound")
 	}
 	org := model.OrgFromModel(existingOrg)
 
@@ -134,7 +134,7 @@ func (es *OrgEventstore) DeactivateOrg(ctx context.Context, orgID string) (*org_
 func (es *OrgEventstore) ReactivateOrg(ctx context.Context, orgID string) (*org_model.Org, error) {
 	existingOrg, err := es.OrgByID(ctx, org_model.NewOrg(orgID))
 	if err != nil {
-		return nil, errors.ThrowInvalidArgument(nil, "EVENT-oL9nT", "org not set")
+		return nil, errors.ThrowInvalidArgument(nil, "EVENT-oL9nT", "Errors.Org.Empty")
 	}
 	org := model.OrgFromModel(existingOrg)
 
@@ -149,7 +149,7 @@ func (es *OrgEventstore) ReactivateOrg(ctx context.Context, orgID string) (*org_
 
 func (es *OrgEventstore) AddOrgDomain(ctx context.Context, domain *org_model.OrgDomain) (*org_model.OrgDomain, error) {
 	if !domain.IsValid() {
-		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-8sFJW", "domain is invalid")
+		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-8sFJW", "Errors.Org.InvalidDomain")
 	}
 	existing, err := es.OrgByID(ctx, org_model.NewOrg(domain.AggregateID))
 	if err != nil {
@@ -167,19 +167,19 @@ func (es *OrgEventstore) AddOrgDomain(ctx context.Context, domain *org_model.Org
 	if _, d := model.GetDomain(repoOrg.Domains, domain.Domain); d != nil {
 		return model.OrgDomainToModel(d), nil
 	}
-	return nil, errors.ThrowInternal(nil, "EVENT-ISOP0", "Could not find org in list")
+	return nil, errors.ThrowInternal(nil, "EVENT-ISOP0", "Errors.Internal")
 }
 
 func (es *OrgEventstore) RemoveOrgDomain(ctx context.Context, domain *org_model.OrgDomain) error {
 	if domain.Domain == "" {
-		return errors.ThrowPreconditionFailed(nil, "EVENT-SJsK3", "Domain is required")
+		return errors.ThrowPreconditionFailed(nil, "EVENT-SJsK3", "Errors.Org.DomainMissing")
 	}
 	existing, err := es.OrgByID(ctx, org_model.NewOrg(domain.AggregateID))
 	if err != nil {
 		return err
 	}
 	if !existing.ContainsDomain(domain) {
-		return errors.ThrowPreconditionFailed(nil, "EVENT-Sjdi3", "Domain doesn't exist on project")
+		return errors.ThrowPreconditionFailed(nil, "EVENT-Sjdi3", "Errors.Org.DomainNotOnOrg")
 	}
 	repoOrg := model.OrgFromModel(existing)
 	repoDomain := model.OrgDomainFromModel(domain)
@@ -200,10 +200,10 @@ func (es *OrgEventstore) OrgChanges(ctx context.Context, id string, lastSequence
 	events, err := es.Eventstore.FilterEvents(context.Background(), query)
 	if err != nil {
 		logging.Log("EVENT-ZRffs").WithError(err).Warn("eventstore unavailable")
-		return nil, errors.ThrowInternal(err, "EVENT-328b1", "unable to get current user")
+		return nil, errors.ThrowInternal(err, "EVENT-328b1", "Errors.Org.NotFound")
 	}
 	if len(events) == 0 {
-		return nil, errors.ThrowNotFound(nil, "EVENT-FpQqK", "no objects found")
+		return nil, errors.ThrowNotFound(nil, "EVENT-FpQqK", "Errors.Changes.NotFound")
 	}
 
 	result := make([]*org_model.OrgChange, 0)
@@ -250,7 +250,7 @@ func ChangesQuery(orgID string, latestSequence uint64) *es_models.SearchQuery {
 
 func (es *OrgEventstore) OrgMemberByIDs(ctx context.Context, member *org_model.OrgMember) (*org_model.OrgMember, error) {
 	if member == nil || member.UserID == "" || member.AggregateID == "" {
-		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-ld93d", "member not set")
+		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-ld93d", "Errors.Org.MemberIDMissing")
 	}
 
 	org, err := es.OrgByID(ctx, &org_model.Org{ObjectRoot: member.ObjectRoot, Members: []*org_model.OrgMember{member}})
@@ -264,12 +264,12 @@ func (es *OrgEventstore) OrgMemberByIDs(ctx context.Context, member *org_model.O
 		}
 	}
 
-	return nil, errors.ThrowNotFound(nil, "EVENT-SXji6", "member not found")
+	return nil, errors.ThrowNotFound(nil, "EVENT-SXji6", "Errors.Org.MemberNotFound")
 }
 
 func (es *OrgEventstore) PrepareAddOrgMember(ctx context.Context, member *org_model.OrgMember, resourceOwner string) (*model.OrgMember, *es_models.Aggregate, error) {
 	if member == nil || !member.IsValid() {
-		return nil, nil, errors.ThrowPreconditionFailed(nil, "EVENT-9dk45", "UserID and Roles are required")
+		return nil, nil, errors.ThrowPreconditionFailed(nil, "EVENT-9dk45", "Errors.Org.InvalidMember")
 	}
 
 	repoMember := model.OrgMemberFromModel(member)
@@ -293,7 +293,7 @@ func (es *OrgEventstore) AddOrgMember(ctx context.Context, member *org_model.Org
 
 func (es *OrgEventstore) ChangeOrgMember(ctx context.Context, member *org_model.OrgMember) (*org_model.OrgMember, error) {
 	if member == nil || !member.IsValid() {
-		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-9dk45", "UserID and Roles are required")
+		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-9dk45", "Errors.Org.InvalidMember")
 	}
 
 	existingMember, err := es.OrgMemberByIDs(ctx, member)
@@ -316,7 +316,7 @@ func (es *OrgEventstore) ChangeOrgMember(ctx context.Context, member *org_model.
 
 func (es *OrgEventstore) RemoveOrgMember(ctx context.Context, member *org_model.OrgMember) error {
 	if member == nil || member.UserID == "" {
-		return errors.ThrowInvalidArgument(nil, "EVENT-d43fs", "UserID is required")
+		return errors.ThrowInvalidArgument(nil, "EVENT-d43fs", "Errors.Org.UserIDMissing")
 	}
 
 	existingMember, err := es.OrgMemberByIDs(ctx, member)
@@ -351,7 +351,7 @@ func (es *OrgEventstore) AddOrgIamPolicy(ctx context.Context, policy *org_model.
 		return nil, err
 	}
 	if existing.OrgIamPolicy != nil {
-		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-7Usj3", "Policy already exists")
+		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-7Usj3", "Errors.Org.PolicyAlreadyExists")
 	}
 	repoOrg := model.OrgFromModel(existing)
 	repoPolicy := model.OrgIamPolicyFromModel(policy)
@@ -373,7 +373,7 @@ func (es *OrgEventstore) ChangeOrgIamPolicy(ctx context.Context, policy *org_mod
 		return nil, err
 	}
 	if existing.OrgIamPolicy == nil {
-		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-8juSd", "Policy doesnt exist")
+		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-8juSd", "Errors.Org.PolicyNotExisting")
 	}
 	repoOrg := model.OrgFromModel(existing)
 	repoPolicy := model.OrgIamPolicyFromModel(policy)
@@ -395,7 +395,7 @@ func (es *OrgEventstore) RemoveOrgIamPolicy(ctx context.Context, orgID string) e
 		return err
 	}
 	if existing.OrgIamPolicy == nil {
-		return errors.ThrowPreconditionFailed(nil, "EVENT-z6Dse", "Policy doesnt exist")
+		return errors.ThrowPreconditionFailed(nil, "EVENT-z6Dse", "Errors.Org.PolicyNotExisting")
 	}
 	repoOrg := model.OrgFromModel(existing)
 	orgAggregate := OrgIamPolicyRemovedAggregate(es.Eventstore.AggregateCreator(), repoOrg)

internal/org/repository/eventsourcing/org.go

@@ -44,7 +44,7 @@ func OrgAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, i
 
 func orgCreatedAggregates(ctx context.Context, aggCreator *es_models.AggregateCreator, org *model.Org) (_ []*es_models.Aggregate, err error) {
 	if org == nil {
-		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-kdie7", "org should not be nil")
+		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-kdie7", "Errors.Internal")
 	}
 
 	agg, err := aggCreator.NewAggregate(ctx, org.AggregateID, model.OrgAggregate, model.OrgVersion, org.Sequence, es_models.OverwriteResourceOwner(org.AggregateID))
@@ -97,14 +97,14 @@ func addDomainAggregateAndEvents(ctx context.Context, aggCreator *es_models.Aggr
 
 func OrgUpdateAggregates(ctx context.Context, aggCreator *es_models.AggregateCreator, existing *model.Org, updated *model.Org) ([]*es_models.Aggregate, error) {
 	if existing == nil {
-		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dk83d", "existing org must not be nil")
+		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dk83d", "Errors.Internal")
 	}
 	if updated == nil {
-		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dhr74", "updated org must not be nil")
+		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dhr74", "Errors.Internal")
 	}
 	changes := existing.Changes(updated)
 	if len(changes) == 0 {
-		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-E0hc5", "no changes")
+		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-E0hc5", "Errors.NoChangesFound")
 	}
 
 	aggregates := make([]*es_models.Aggregate, 0, 3)
@@ -139,10 +139,10 @@ func OrgUpdateAggregates(ctx context.Context, aggCreator *es_models.AggregateCre
 func orgDeactivateAggregate(aggCreator *es_models.AggregateCreator, org *model.Org) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if org == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-R03z8", "existing org must not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-R03z8", "Errors.Internal")
 		}
 		if org.State == int32(org_model.ORGSTATE_INACTIVE) {
-			return nil, errors.ThrowInvalidArgument(nil, "EVENT-mcPH0", "org already inactive")
+			return nil, errors.ThrowInvalidArgument(nil, "EVENT-mcPH0", "Errors.Internal.AlreadyDeactivated")
 		}
 		agg, err := OrgAggregate(ctx, aggCreator, org.AggregateID, org.Sequence)
 		if err != nil {
@@ -156,10 +156,10 @@ func orgDeactivateAggregate(aggCreator *es_models.AggregateCreator, org *model.O
 func orgReactivateAggregate(aggCreator *es_models.AggregateCreator, org *model.Org) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if org == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-cTHLd", "existing org must not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-cTHLd", "Errors.Internal")
 		}
 		if org.State == int32(org_model.ORGSTATE_ACTIVE) {
-			return nil, errors.ThrowInvalidArgument(nil, "EVENT-pUSMs", "org already active")
+			return nil, errors.ThrowInvalidArgument(nil, "EVENT-pUSMs", "Errors.Org.AlreadyActive")
 		}
 		agg, err := OrgAggregate(ctx, aggCreator, org.AggregateID, org.Sequence)
 		if err != nil {
@@ -237,7 +237,7 @@ func releasedUniqueNameAggregate(ctx context.Context, aggCreator *es_models.Aggr
 func OrgDomainAddedAggregate(aggCreator *es_models.AggregateCreator, existing *model.Org, domain *model.OrgDomain) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if domain == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-OSid3", "domain should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-OSid3", "Errors.Internal")
 		}
 		agg, err := OrgAggregate(ctx, aggCreator, existing.AggregateID, existing.Sequence)
 		if err != nil {
@@ -250,7 +250,7 @@ func OrgDomainAddedAggregate(aggCreator *es_models.AggregateCreator, existing *m
 func OrgDomainVerifiedAggregate(aggCreator *es_models.AggregateCreator, existing *model.Org, domain *model.OrgDomain) func(ctx context.Context) ([]*es_models.Aggregate, error) {
 	return func(ctx context.Context) ([]*es_models.Aggregate, error) {
 		if domain == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-DHs7s", "domain should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-DHs7s", "Errors.Internal")
 		}
 		agg, err := OrgAggregate(ctx, aggCreator, existing.AggregateID, existing.Sequence)
 		if err != nil {
@@ -273,7 +273,7 @@ func OrgDomainVerifiedAggregate(aggCreator *es_models.AggregateCreator, existing
 func OrgDomainSetPrimaryAggregate(aggCreator *es_models.AggregateCreator, existing *model.Org, domain *model.OrgDomain) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if domain == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-PSw3j", "domain should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-PSw3j", "Errors.Internal")
 		}
 		agg, err := OrgAggregate(ctx, aggCreator, existing.AggregateID, existing.Sequence)
 		if err != nil {
@@ -285,7 +285,7 @@ func OrgDomainSetPrimaryAggregate(aggCreator *es_models.AggregateCreator, existi
 
 func OrgDomainRemovedAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, existing *model.Org, domain *model.OrgDomain) ([]*es_models.Aggregate, error) {
 	if domain == nil {
-		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-si8dW", "domain should not be nil")
+		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-si8dW", "Errors.Internal")
 	}
 	aggregates := make([]*es_models.Aggregate, 0, 2)
 	agg, err := OrgAggregate(ctx, aggCreator, existing.AggregateID, existing.Sequence)

internal/org/repository/eventsourcing/org_iam_policy.go

@@ -10,7 +10,7 @@ import (
 func OrgIamPolicyAddedAggregate(aggCreator *es_models.AggregateCreator, existing *model.Org, policy *model.OrgIamPolicy) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if policy == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-i9sJS", "policy should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-i9sJS", "Errors.Internal")
 		}
 		agg, err := OrgAggregate(ctx, aggCreator, existing.AggregateID, existing.Sequence)
 		if err != nil {
@@ -23,7 +23,7 @@ func OrgIamPolicyAddedAggregate(aggCreator *es_models.AggregateCreator, existing
 func OrgIamPolicyChangedAggregate(aggCreator *es_models.AggregateCreator, existing *model.Org, policy *model.OrgIamPolicy) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if policy == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-9Ksie", "policy should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-9Ksie", "Errors.Internal")
 		}
 		agg, err := OrgAggregate(ctx, aggCreator, existing.AggregateID, existing.Sequence)
 		if err != nil {
@@ -31,7 +31,7 @@ func OrgIamPolicyChangedAggregate(aggCreator *es_models.AggregateCreator, existi
 		}
 		changes := existing.OrgIamPolicy.Changes(policy)
 		if len(changes) == 0 {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-Js6Vs", "no changes")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-Js6Vs", "Errors.NoChangesFound")
 		}
 		return agg.AppendEvent(model.OrgIamPolicyChanged, changes)
 	}

internal/org/repository/eventsourcing/org_member.go

@@ -11,7 +11,7 @@ import (
 
 func orgMemberAddedAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, member *model.OrgMember, resourceOwner string) (agg *es_models.Aggregate, err error) {
 	if member == nil {
-		return nil, errors.ThrowInvalidArgument(nil, "EVENT-c63Ap", "member must not be nil")
+		return nil, errors.ThrowInvalidArgument(nil, "EVENT-c63Ap", "Errors.Internal")
 	}
 
 	if resourceOwner != "" {
@@ -34,12 +34,12 @@ func orgMemberAddedAggregate(ctx context.Context, aggCreator *es_models.Aggregat
 func orgMemberChangedAggregate(aggCreator *es_models.AggregateCreator, existingMember *model.OrgMember, member *model.OrgMember) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if member == nil || existingMember == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-d34fs", "member must not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-d34fs", "Errors.Internal")
 		}
 
 		changes := existingMember.Changes(member)
 		if len(changes) == 0 {
-			return nil, errors.ThrowInvalidArgument(nil, "EVENT-VLMGn", "nothing changed")
+			return nil, errors.ThrowInvalidArgument(nil, "EVENT-VLMGn", "Errors.NoChangesFound")
 		}
 
 		agg, err := OrgAggregate(ctx, aggCreator, existingMember.AggregateID, existingMember.Sequence)

internal/policy/model/policy_age.go

@@ -12,7 +12,3 @@ type PasswordAgePolicy struct {
 	MaxAgeDays     uint64
 	ExpireWarnDays uint64
 }
-
-func (p *PasswordAgePolicy) IsValid() bool {
-	return p.Description != ""
-}

internal/policy/model/policy_complexity.go

@@ -25,10 +25,6 @@ type PasswordComplexityPolicy struct {
 	HasSymbol    bool
 }
 
-func (p *PasswordComplexityPolicy) IsValid() bool {
-	return p.Description != ""
-}
-
 func (p *PasswordComplexityPolicy) Check(password string) error {
 	if p.MinLength != 0 && uint64(len(password)) < p.MinLength {
 		return caos_errs.ThrowInvalidArgument(nil, "MODEL-HuJf6", "Errors.User.PasswordComplexityPolicy.MinLength")

internal/policy/model/policy_lockout.go

@@ -10,7 +10,3 @@ type PasswordLockoutPolicy struct {
 	MaxAttempts         uint64
 	ShowLockOutFailures bool
 }
-
-func (p *PasswordLockoutPolicy) IsValid() bool {
-	return p.Description != ""
-}

internal/policy/repository/eventsourcing/eventstore_age.go

@@ -25,16 +25,13 @@ func (es *PolicyEventstore) GetPasswordAgePolicy(ctx context.Context, id string)
 }
 
 func (es *PolicyEventstore) CreatePasswordAgePolicy(ctx context.Context, policy *pol_model.PasswordAgePolicy) (*pol_model.PasswordAgePolicy, error) {
-	if !policy.IsValid() {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-fbX5K", "Description is required")
-	}
 	ctxData := auth.GetCtxData(ctx)
 	existingPolicy, err := es.GetPasswordAgePolicy(ctx, ctxData.OrgID)
 	if err != nil && !caos_errs.IsNotFound(err) {
 		return nil, err
 	}
 	if existingPolicy != nil && existingPolicy.Sequence > 0 {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-yDJ5I", "Policy allready exists")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-yDJ5I", "Errors.Policy.AlreadyExists")
 	}
 
 	id, err := es.idGenerator.Next()
@@ -56,9 +53,6 @@ func (es *PolicyEventstore) CreatePasswordAgePolicy(ctx context.Context, policy
 }
 
 func (es *PolicyEventstore) UpdatePasswordAgePolicy(ctx context.Context, policy *pol_model.PasswordAgePolicy) (*pol_model.PasswordAgePolicy, error) {
-	if !policy.IsValid() {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-44jB3", "Description is required")
-	}
 	ctxData := auth.GetCtxData(ctx)
 	existingPolicy, err := es.GetPasswordAgePolicy(ctx, ctxData.OrgID)
 	if err != nil {

internal/policy/repository/eventsourcing/eventstore_age_test.go

@@ -91,18 +91,6 @@ func TestCreatePasswordAgePolicy(t *testing.T) {
 				policy: &model.PasswordAgePolicy{ObjectRoot: es_models.ObjectRoot{AggregateID: "AggregateID1", Sequence: 2}, Description: "Name"},
 			},
 		},
-		{
-			name: "create policy no name",
-			args: args{
-				es:     GetMockPasswordAgePolicyNoEvents(ctrl),
-				ctx:    auth.NewMockContext("orgID", "userID"),
-				policy: &model.PasswordAgePolicy{ObjectRoot: es_models.ObjectRoot{AggregateID: "AggregateID", Sequence: 1}},
-			},
-			res: res{
-				wantErr: true,
-				errFunc: caos_errs.IsPreconditionFailed,
-			},
-		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -149,18 +137,6 @@ func TestUpdatePasswordAgePolicy(t *testing.T) {
 				policy: &model.PasswordAgePolicy{ObjectRoot: es_models.ObjectRoot{AggregateID: "AggregateID", Sequence: 1}, Description: "NameNew"},
 			},
 		},
-		{
-			name: "update policy no name",
-			args: args{
-				es:  GetMockPasswordAgePolicy(ctrl),
-				ctx: auth.NewMockContext("orgID", "userID"),
-				new: &model.PasswordAgePolicy{ObjectRoot: es_models.ObjectRoot{AggregateID: "AggregateID", Sequence: 1}, Description: ""},
-			},
-			res: res{
-				wantErr: true,
-				errFunc: caos_errs.IsPreconditionFailed,
-			},
-		},
 		{
 			name: "existing policy not found",
 			args: args{

internal/policy/repository/eventsourcing/eventstore_complexity.go

@@ -28,16 +28,13 @@ func (es *PolicyEventstore) GetPasswordComplexityPolicy(ctx context.Context, id
 }
 
 func (es *PolicyEventstore) CreatePasswordComplexityPolicy(ctx context.Context, policy *pol_model.PasswordComplexityPolicy) (*pol_model.PasswordComplexityPolicy, error) {
-	if !policy.IsValid() {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-9dk45", "Description is required")
-	}
 	ctxData := auth.GetCtxData(ctx)
 	existingPolicy, err := es.GetPasswordComplexityPolicy(ctx, ctxData.OrgID)
 	if err != nil && !caos_errs.IsNotFound(err) {
 		return nil, err
 	}
 	if existingPolicy != nil && existingPolicy.Sequence > 0 {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-yDJ5I", "Policy allready exists")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-yDJ5I", "Errors.Policy.AlreadyExists")
 	}
 
 	id, err := es.idGenerator.Next()
@@ -59,9 +56,6 @@ func (es *PolicyEventstore) CreatePasswordComplexityPolicy(ctx context.Context,
 }
 
 func (es *PolicyEventstore) UpdatePasswordComplexityPolicy(ctx context.Context, policy *pol_model.PasswordComplexityPolicy) (*pol_model.PasswordComplexityPolicy, error) {
-	if !policy.IsValid() {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-9dk45", "Description is required")
-	}
 	ctxData := auth.GetCtxData(ctx)
 	existingPolicy, err := es.GetPasswordComplexityPolicy(ctx, ctxData.OrgID)
 	if err != nil {

internal/policy/repository/eventsourcing/eventstore_complexity_test.go

@@ -91,18 +91,6 @@ func TestCreatePasswordComplexityPolicy(t *testing.T) {
 				policy: &model.PasswordComplexityPolicy{ObjectRoot: es_models.ObjectRoot{AggregateID: "AggregateID1", Sequence: 2}, Description: "Name"},
 			},
 		},
-		{
-			name: "create policy no name",
-			args: args{
-				es:     GetMockPasswordComplexityPolicyNoEvents(ctrl),
-				ctx:    auth.NewMockContext("orgID", "userID"),
-				policy: &model.PasswordComplexityPolicy{ObjectRoot: es_models.ObjectRoot{AggregateID: "AggregateID", Sequence: 1}},
-			},
-			res: res{
-				wantErr: true,
-				errFunc: caos_errs.IsPreconditionFailed,
-			},
-		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -149,18 +137,6 @@ func TestUpdatePasswordComplexityPolicy(t *testing.T) {
 				policy: &model.PasswordComplexityPolicy{ObjectRoot: es_models.ObjectRoot{AggregateID: "AggregateID", Sequence: 1}, Description: "NameNew"},
 			},
 		},
-		{
-			name: "update policy no name",
-			args: args{
-				es:  GetMockPasswordComplexityPolicy(ctrl),
-				ctx: auth.NewMockContext("orgID", "userID"),
-				new: &model.PasswordComplexityPolicy{ObjectRoot: es_models.ObjectRoot{AggregateID: "AggregateID", Sequence: 1}, Description: ""},
-			},
-			res: res{
-				wantErr: true,
-				errFunc: caos_errs.IsPreconditionFailed,
-			},
-		},
 		{
 			name: "existing policy not found",
 			args: args{

internal/policy/repository/eventsourcing/eventstore_lockout.go

@@ -25,16 +25,13 @@ func (es *PolicyEventstore) GetPasswordLockoutPolicy(ctx context.Context, id str
 }
 
 func (es *PolicyEventstore) CreatePasswordLockoutPolicy(ctx context.Context, policy *pol_model.PasswordLockoutPolicy) (*pol_model.PasswordLockoutPolicy, error) {
-	if !policy.IsValid() {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-9dk45", "Description is required")
-	}
 	ctxData := auth.GetCtxData(ctx)
 	existingPolicy, err := es.GetPasswordLockoutPolicy(ctx, ctxData.OrgID)
 	if err != nil && !caos_errs.IsNotFound(err) {
 		return nil, err
 	}
 	if existingPolicy != nil && existingPolicy.Sequence > 0 {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-yDJ5I", "Policy allready exists")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-yDJ5I", "Errors.Policy.AlreadyExists")
 	}
 
 	id, err := es.idGenerator.Next()
@@ -56,9 +53,6 @@ func (es *PolicyEventstore) CreatePasswordLockoutPolicy(ctx context.Context, pol
 }
 
 func (es *PolicyEventstore) UpdatePasswordLockoutPolicy(ctx context.Context, policy *pol_model.PasswordLockoutPolicy) (*pol_model.PasswordLockoutPolicy, error) {
-	if !policy.IsValid() {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-9dk45", "Description is required")
-	}
 	ctxData := auth.GetCtxData(ctx)
 	existingPolicy, err := es.GetPasswordLockoutPolicy(ctx, ctxData.OrgID)
 	if err != nil {

internal/policy/repository/eventsourcing/eventstore_lockout_test.go

@@ -91,18 +91,6 @@ func TestCreatePasswordLockoutPolicy(t *testing.T) {
 				policy: &model.PasswordLockoutPolicy{ObjectRoot: es_models.ObjectRoot{AggregateID: "AggregateID1", Sequence: 2}, Description: "Name"},
 			},
 		},
-		{
-			name: "create policy no name",
-			args: args{
-				es:     GetMockPasswordLockoutPolicyNoEvents(ctrl),
-				ctx:    auth.NewMockContext("orgID", "userID"),
-				policy: &model.PasswordLockoutPolicy{ObjectRoot: es_models.ObjectRoot{AggregateID: "AggregateID", Sequence: 1}},
-			},
-			res: res{
-				wantErr: true,
-				errFunc: caos_errs.IsPreconditionFailed,
-			},
-		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -149,18 +137,6 @@ func TestUpdatePasswordLockoutPolicy(t *testing.T) {
 				policy: &model.PasswordLockoutPolicy{ObjectRoot: es_models.ObjectRoot{AggregateID: "AggregateID", Sequence: 1}, Description: "NameNew"},
 			},
 		},
-		{
-			name: "update policy no name",
-			args: args{
-				es:  GetMockPasswordLockoutPolicy(ctrl),
-				ctx: auth.NewMockContext("orgID", "userID"),
-				new: &model.PasswordLockoutPolicy{ObjectRoot: es_models.ObjectRoot{AggregateID: "AggregateID", Sequence: 1}, Description: ""},
-			},
-			res: res{
-				wantErr: true,
-				errFunc: caos_errs.IsPreconditionFailed,
-			},
-		},
 		{
 			name: "existing policy not found",
 			args: args{

internal/policy/repository/eventsourcing/policy_age.go

@@ -17,7 +17,7 @@ func PasswordAgePolicyQuery(recourceOwner string, latestSequence uint64) *es_mod
 
 func PasswordAgePolicyAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, policy *PasswordAgePolicy) (*es_models.Aggregate, error) {
 	if policy == nil {
-		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-1T05i", "existing policy should not be nil")
+		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-1T05i", "Errors.Internal")
 	}
 	return aggCreator.NewAggregate(ctx, policy.AggregateID, model.PasswordAgePolicyAggregate, policyAgeVersion, policy.Sequence)
 }
@@ -25,7 +25,7 @@ func PasswordAgePolicyAggregate(ctx context.Context, aggCreator *es_models.Aggre
 func PasswordAgePolicyCreateAggregate(aggCreator *es_models.AggregateCreator, policy *PasswordAgePolicy) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if policy == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-kdie6", "policy should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-kdie6", "Errors.Internal")
 		}
 		agg, err := PasswordAgePolicyAggregate(ctx, aggCreator, policy)
 		if err != nil {
@@ -39,7 +39,7 @@ func PasswordAgePolicyCreateAggregate(aggCreator *es_models.AggregateCreator, po
 func PasswordAgePolicyUpdateAggregate(aggCreator *es_models.AggregateCreator, existing *PasswordAgePolicy, new *PasswordAgePolicy) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if new == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dhr74", "new policy should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dhr74", "Errors.Internal")
 		}
 		agg, err := PasswordAgePolicyAggregate(ctx, aggCreator, existing)
 		if err != nil {

internal/policy/repository/eventsourcing/policy_complexity.go

@@ -18,7 +18,7 @@ func PasswordComplexityPolicyQuery(recourceOwner string, latestSequence uint64)
 
 func PasswordComplexityPolicyAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, policy *PasswordComplexityPolicy) (*es_models.Aggregate, error) {
 	if policy == nil {
-		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-fRVr9", "existing policy should not be nil")
+		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-fRVr9", "Errors.Internal")
 	}
 	return aggCreator.NewAggregate(ctx, policy.AggregateID, model.PasswordComplexityPolicyAggregate, policyComplexityVersion, policy.Sequence)
 }
@@ -26,7 +26,7 @@ func PasswordComplexityPolicyAggregate(ctx context.Context, aggCreator *es_model
 func PasswordComplexityPolicyCreateAggregate(aggCreator *es_models.AggregateCreator, policy *PasswordComplexityPolicy) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if policy == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-kdie6", "policy should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-kdie6", "Errors.Internal")
 		}
 		agg, err := PasswordComplexityPolicyAggregate(ctx, aggCreator, policy)
 		if err != nil {
@@ -40,7 +40,7 @@ func PasswordComplexityPolicyCreateAggregate(aggCreator *es_models.AggregateCrea
 func PasswordComplexityPolicyUpdateAggregate(aggCreator *es_models.AggregateCreator, existing *PasswordComplexityPolicy, new *PasswordComplexityPolicy) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if new == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dhr74", "new policy should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dhr74", "Errors.Internal")
 		}
 		agg, err := PasswordComplexityPolicyAggregate(ctx, aggCreator, existing)
 		if err != nil {

internal/policy/repository/eventsourcing/policy_lockout.go

@@ -18,7 +18,7 @@ func PasswordLockoutPolicyQuery(recourceOwner string, latestSequence uint64) *es
 
 func PasswordLockoutPolicyAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, policy *PasswordLockoutPolicy) (*es_models.Aggregate, error) {
 	if policy == nil {
-		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-aTRlj", "existing policy should not be nil")
+		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-aTRlj", "Errors.Internal")
 	}
 	return aggCreator.NewAggregate(ctx, policy.AggregateID, model.PasswordLockoutPolicyAggregate, policyLockoutVersion, policy.Sequence)
 }
@@ -26,7 +26,7 @@ func PasswordLockoutPolicyAggregate(ctx context.Context, aggCreator *es_models.A
 func PasswordLockoutPolicyCreateAggregate(aggCreator *es_models.AggregateCreator, policy *PasswordLockoutPolicy) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if policy == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-kdie6", "policy should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-kdie6", "Errors.Internal")
 		}
 
 		agg, err := PasswordLockoutPolicyAggregate(ctx, aggCreator, policy)
@@ -41,7 +41,7 @@ func PasswordLockoutPolicyCreateAggregate(aggCreator *es_models.AggregateCreator
 func PasswordLockoutPolicyUpdateAggregate(aggCreator *es_models.AggregateCreator, existing *PasswordLockoutPolicy, new *PasswordLockoutPolicy) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if new == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dhr74", "new policy should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dhr74", "Errors.Internal")
 		}
 		agg, err := PasswordLockoutPolicyAggregate(ctx, aggCreator, existing)
 		if err != nil {

internal/project/repository/eventsourcing/eventstore.go

@@ -73,7 +73,7 @@ func (es *ProjectEventstore) ProjectByID(ctx context.Context, id string) (*proj_
 
 func (es *ProjectEventstore) CreateProject(ctx context.Context, project *proj_model.Project) (*proj_model.Project, error) {
 	if !project.IsValid() {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-9dk45", "Name is required")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-9dk45", "Errors.Project.Invalid")
 	}
 	id, err := es.idGenerator.Next()
 	if err != nil {
@@ -99,7 +99,7 @@ func (es *ProjectEventstore) CreateProject(ctx context.Context, project *proj_mo
 
 func (es *ProjectEventstore) UpdateProject(ctx context.Context, project *proj_model.Project) (*proj_model.Project, error) {
 	if !project.IsValid() {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-9dk45", "Name is required")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-9dk45", "Errors.Project.Invalid")
 	}
 	existingProject, err := es.ProjectByID(ctx, project.AggregateID)
 	if err != nil {
@@ -124,7 +124,7 @@ func (es *ProjectEventstore) DeactivateProject(ctx context.Context, id string) (
 		return nil, err
 	}
 	if !existing.IsActive() {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-die45", "project must be active")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-die45", "Errors.Project.NotActive")
 	}
 
 	repoExisting := model.ProjectFromModel(existing)
@@ -143,7 +143,7 @@ func (es *ProjectEventstore) ReactivateProject(ctx context.Context, id string) (
 		return nil, err
 	}
 	if existing.IsActive() {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-die45", "project must be inactive")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-die45", "Errors.Project.NotInactive")
 	}
 
 	repoExisting := model.ProjectFromModel(existing)
@@ -158,7 +158,7 @@ func (es *ProjectEventstore) ReactivateProject(ctx context.Context, id string) (
 
 func (es *ProjectEventstore) ProjectMemberByIDs(ctx context.Context, member *proj_model.ProjectMember) (*proj_model.ProjectMember, error) {
 	if member.UserID == "" {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-ld93d", "userID missing")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-ld93d", "Errors.Project.UserIDMissing")
 	}
 	project, err := es.ProjectByID(ctx, member.AggregateID)
 	if err != nil {
@@ -168,19 +168,19 @@ func (es *ProjectEventstore) ProjectMemberByIDs(ctx context.Context, member *pro
 	if _, m := project.GetMember(member.UserID); m != nil {
 		return m, nil
 	}
-	return nil, caos_errs.ThrowNotFound(nil, "EVENT-3udjs", "member not found")
+	return nil, caos_errs.ThrowNotFound(nil, "EVENT-3udjs", "Errors.Project.MemberNotFound")
 }
 
 func (es *ProjectEventstore) AddProjectMember(ctx context.Context, member *proj_model.ProjectMember) (*proj_model.ProjectMember, error) {
 	if !member.IsValid() {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-9dk45", "UserID and Roles are required")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-9dk45", "Errors.Project.MemberInvalid")
 	}
 	existing, err := es.ProjectByID(ctx, member.AggregateID)
 	if err != nil {
 		return nil, err
 	}
 	if _, m := existing.GetMember(member.UserID); m != nil {
-		return nil, caos_errs.ThrowAlreadyExists(nil, "EVENT-idke6", "User is already member of this Project")
+		return nil, caos_errs.ThrowAlreadyExists(nil, "EVENT-idke6", "Errors.Project.MemberAlreadyExists")
 	}
 	repoProject := model.ProjectFromModel(existing)
 	repoMember := model.ProjectMemberFromModel(member)
@@ -195,19 +195,19 @@ func (es *ProjectEventstore) AddProjectMember(ctx context.Context, member *proj_
 	if _, m := model.GetProjectMember(repoProject.Members, member.UserID); m != nil {
 		return model.ProjectMemberToModel(m), nil
 	}
-	return nil, caos_errs.ThrowInternal(nil, "EVENT-3udjs", "Could not find member in list")
+	return nil, caos_errs.ThrowInternal(nil, "EVENT-3udjs", "Errors.Internal")
 }
 
 func (es *ProjectEventstore) ChangeProjectMember(ctx context.Context, member *proj_model.ProjectMember) (*proj_model.ProjectMember, error) {
 	if !member.IsValid() {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-9dk45", "UserID and Roles are required")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-9dk45", "Errors.Project.MemberInvalid")
 	}
 	existing, err := es.ProjectByID(ctx, member.AggregateID)
 	if err != nil {
 		return nil, err
 	}
 	if _, m := existing.GetMember(member.UserID); m == nil {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-oe39f", "User is not member of this project")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-oe39f", "Errors.Project.MemberNotExisting")
 	}
 	repoProject := model.ProjectFromModel(existing)
 	repoMember := model.ProjectMemberFromModel(member)
@@ -222,19 +222,19 @@ func (es *ProjectEventstore) ChangeProjectMember(ctx context.Context, member *pr
 	if _, m := model.GetProjectMember(repoProject.Members, member.UserID); m != nil {
 		return model.ProjectMemberToModel(m), nil
 	}
-	return nil, caos_errs.ThrowInternal(nil, "EVENT-3udjs", "Could not find member in list")
+	return nil, caos_errs.ThrowInternal(nil, "EVENT-3udjs", "Errors.Internal")
 }
 
 func (es *ProjectEventstore) RemoveProjectMember(ctx context.Context, member *proj_model.ProjectMember) error {
 	if member.UserID == "" {
-		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-d43fs", "UserID and Roles are required")
+		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-d43fs", "Errors.Project.MemberInvalid")
 	}
 	existing, err := es.ProjectByID(ctx, member.AggregateID)
 	if err != nil {
 		return err
 	}
 	if _, m := existing.GetMember(member.UserID); m == nil {
-		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-swf34", "User is not member of this project")
+		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-swf34", "Errors.Project.MemberNotExisting")
 	}
 	repoProject := model.ProjectFromModel(existing)
 	repoMember := model.ProjectMemberFromModel(member)
@@ -250,11 +250,11 @@ func (es *ProjectEventstore) RemoveProjectMember(ctx context.Context, member *pr
 
 func (es *ProjectEventstore) AddProjectRoles(ctx context.Context, roles ...*proj_model.ProjectRole) (*proj_model.ProjectRole, error) {
 	if roles == nil || len(roles) == 0 {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-idue3", "must be at least one role")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-idue3", "Errors.Project.MinimumOneRoleNeeded")
 	}
 	for _, role := range roles {
 		if !role.IsValid() {
-			return nil, caos_errs.ThrowPreconditionFailedf(nil, "EVENT-idue3", "role is invalid %v", role)
+			return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-idue3", "Errors.Project.MemberInvalid")
 		}
 	}
 	existing, err := es.ProjectByID(ctx, roles[0].AggregateID)
@@ -263,7 +263,7 @@ func (es *ProjectEventstore) AddProjectRoles(ctx context.Context, roles ...*proj
 	}
 	for _, role := range roles {
 		if existing.ContainsRole(role) {
-			return nil, caos_errs.ThrowAlreadyExists(nil, "EVENT-sk35t", "Project contains role with same key")
+			return nil, caos_errs.ThrowAlreadyExists(nil, "EVENT-sk35t", "Errors.Project.RoleAlreadyExists")
 		}
 	}
 
@@ -281,19 +281,19 @@ func (es *ProjectEventstore) AddProjectRoles(ctx context.Context, roles ...*proj
 	if _, r := model.GetProjectRole(repoProject.Roles, repoRoles[0].Key); r != nil {
 		return model.ProjectRoleToModel(r), nil
 	}
-	return nil, caos_errs.ThrowInternal(nil, "EVENT-sie83", "Could not find role in list")
+	return nil, caos_errs.ThrowInternal(nil, "EVENT-sie83", "Errors.Internal")
 }
 
 func (es *ProjectEventstore) ChangeProjectRole(ctx context.Context, role *proj_model.ProjectRole) (*proj_model.ProjectRole, error) {
 	if !role.IsValid() {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-9die3", "Key is required")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-9die3", "Errors.Project.RoleInvalid")
 	}
 	existing, err := es.ProjectByID(ctx, role.AggregateID)
 	if err != nil {
 		return nil, err
 	}
 	if !existing.ContainsRole(role) {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-die34", "Role doesn't exist on this project")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-die34", "Errors.Project.RoleNotExisting")
 	}
 	repoProject := model.ProjectFromModel(existing)
 	repoRole := model.ProjectRoleFromModel(role)
@@ -308,19 +308,19 @@ func (es *ProjectEventstore) ChangeProjectRole(ctx context.Context, role *proj_m
 	if _, r := model.GetProjectRole(repoProject.Roles, role.Key); r != nil {
 		return model.ProjectRoleToModel(r), nil
 	}
-	return nil, caos_errs.ThrowInternal(nil, "EVENT-sl1or", "Could not find role in list")
+	return nil, caos_errs.ThrowInternal(nil, "EVENT-sl1or", "Errors.Internal")
 }
 
 func (es *ProjectEventstore) PrepareRemoveProjectRole(ctx context.Context, role *proj_model.ProjectRole) (*model.Project, *es_models.Aggregate, error) {
 	if role.Key == "" {
-		return nil, nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-id823", "Key is required")
+		return nil, nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-id823", "Errors.Project.RoleInvalid")
 	}
 	existing, err := es.ProjectByID(ctx, role.AggregateID)
 	if err != nil {
 		return nil, nil, err
 	}
 	if !existing.ContainsRole(role) {
-		return nil, nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-oe823", "Role doesn't exist on project")
+		return nil, nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-oe823", "Errors.Project.RoleNotExisting")
 	}
 	repoProject := model.ProjectFromModel(existing)
 	repoRole := model.ProjectRoleFromModel(role)
@@ -366,10 +366,10 @@ func (es *ProjectEventstore) ProjectChanges(ctx context.Context, id string, last
 	events, err := es.Eventstore.FilterEvents(context.Background(), query)
 	if err != nil {
 		logging.Log("EVENT-ZRffs").WithError(err).Warn("eventstore unavailable")
-		return nil, errors.ThrowInternal(err, "EVENT-328b1", "unable to get current user")
+		return nil, errors.ThrowInternal(err, "EVENT-328b1", "Errors.Internal")
 	}
 	if len(events) == 0 {
-		return nil, caos_errs.ThrowNotFound(nil, "EVENT-FpQqK", "no objects found")
+		return nil, caos_errs.ThrowNotFound(nil, "EVENT-FpQqK", "Errors.Changes.NotFound")
 	}
 
 	result := make([]*proj_model.ProjectChange, 0)
@@ -426,7 +426,7 @@ func ChangesQuery(projID string, latestSequence uint64) *es_models.SearchQuery {
 
 func (es *ProjectEventstore) ApplicationByIDs(ctx context.Context, projectID, appID string) (*proj_model.Application, error) {
 	if projectID == "" || appID == "" {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-ld93d", "project oder app AggregateID missing")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-ld93d", "Errors.Project.IDMissing")
 	}
 	project, err := es.ProjectByID(ctx, projectID)
 	if err != nil {
@@ -436,12 +436,12 @@ func (es *ProjectEventstore) ApplicationByIDs(ctx context.Context, projectID, ap
 	if _, a := project.GetApp(appID); a != nil {
 		return a, nil
 	}
-	return nil, caos_errs.ThrowNotFound(nil, "EVENT-8ei2s", "Could not find app")
+	return nil, caos_errs.ThrowNotFound(nil, "EVENT-8ei2s", "Errors.Project.AppNotFound")
 }
 
 func (es *ProjectEventstore) AddApplication(ctx context.Context, app *proj_model.Application) (*proj_model.Application, error) {
 	if app == nil || !app.IsValid(true) {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-9eidw", "Some required fields are missing")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-9eidw", "Errors.Project.AppInvalid")
 	}
 	existing, err := es.ProjectByID(ctx, app.AggregateID)
 	if err != nil {
@@ -482,19 +482,19 @@ func (es *ProjectEventstore) AddApplication(ctx context.Context, app *proj_model
 		converted.OIDCConfig.ClientSecretString = stringPw
 		return converted, nil
 	}
-	return nil, caos_errs.ThrowInternal(nil, "EVENT-3udjs", "Could not find member in list")
+	return nil, caos_errs.ThrowInternal(nil, "EVENT-3udjs", "Errors.Internal")
 }
 
 func (es *ProjectEventstore) ChangeApplication(ctx context.Context, app *proj_model.Application) (*proj_model.Application, error) {
 	if app == nil || !app.IsValid(false) {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-dieuw", "some required fields missing")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-dieuw", "Errors.Project.AppInvalid")
 	}
 	existing, err := es.ProjectByID(ctx, app.AggregateID)
 	if err != nil {
 		return nil, err
 	}
 	if _, app := existing.GetApp(app.AppID); app == nil {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-die83", "App is not in this project")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-die83", "Errors.Project.AppNotExisting")
 	}
 	repoProject := model.ProjectFromModel(existing)
 	repoApp := model.AppFromModel(app)
@@ -508,19 +508,19 @@ func (es *ProjectEventstore) ChangeApplication(ctx context.Context, app *proj_mo
 	if _, a := model.GetApplication(repoProject.Applications, app.AppID); a != nil {
 		return model.AppToModel(a), nil
 	}
-	return nil, caos_errs.ThrowInternal(nil, "EVENT-dksi8", "Could not find app in list")
+	return nil, caos_errs.ThrowInternal(nil, "EVENT-dksi8", "Errors.Internal")
 }
 
 func (es *ProjectEventstore) RemoveApplication(ctx context.Context, app *proj_model.Application) error {
 	if app.AppID == "" {
-		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-id832", "AppID is required")
+		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-id832", "Errors.Project.IDMissing")
 	}
 	existing, err := es.ProjectByID(ctx, app.AggregateID)
 	if err != nil {
 		return err
 	}
 	if _, app := existing.GetApp(app.AppID); app == nil {
-		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-di83s", "Application doesn't exist on project")
+		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-di83s", "Errors.Project.AppNotExisting")
 	}
 	repoProject := model.ProjectFromModel(existing)
 	appRepo := model.AppFromModel(app)
@@ -539,10 +539,10 @@ func (es *ProjectEventstore) ApplicationChanges(ctx context.Context, id string,
 	events, err := es.Eventstore.FilterEvents(context.Background(), query)
 	if err != nil {
 		logging.Log("EVENT-ZRffs").WithError(err).Warn("eventstore unavailable")
-		return nil, errors.ThrowInternal(err, "EVENT-sw6Ku", "unable to get current user")
+		return nil, errors.ThrowInternal(err, "EVENT-sw6Ku", "Errors.Internal")
 	}
 	if len(events) == 0 {
-		return nil, caos_errs.ThrowNotFound(nil, "EVENT-9IHLP", "no objects found")
+		return nil, caos_errs.ThrowNotFound(nil, "EVENT-9IHLP", "Errors.Changes.NotFound")
 	}
 
 	result := make([]*proj_model.ApplicationChange, 0)
@@ -557,10 +557,6 @@ func (es *ProjectEventstore) ApplicationChanges(ctx context.Context, id string,
 			Sequence:   u.Sequence,
 		}
 		appendChanges := true
-		// if change.EventType == "project.application.added" ||
-		// 	change.EventType == "project.application.changed" ||
-		// 	change.EventType == "project.application.config.oidc.added" ||
-		// 	change.EventType == "project.application.config.oidc.changed" {
 
 		if change.EventType == model.ApplicationAdded.String() ||
 			change.EventType == model.ApplicationChanged.String() ||
@@ -598,7 +594,7 @@ func (es *ProjectEventstore) ApplicationChanges(ctx context.Context, id string,
 
 func (es *ProjectEventstore) DeactivateApplication(ctx context.Context, projectID, appID string) (*proj_model.Application, error) {
 	if appID == "" {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-dlp9e", "appID missing")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-dlp9e", "Errors.Project.IDMissing")
 	}
 	existing, err := es.ProjectByID(ctx, projectID)
 	if err != nil {
@@ -606,7 +602,7 @@ func (es *ProjectEventstore) DeactivateApplication(ctx context.Context, projectI
 	}
 	app := &proj_model.Application{AppID: appID}
 	if _, app := existing.GetApp(app.AppID); app == nil {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-slpe9", "App is not in this project")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-slpe9", "Errors.Project.AppNotExisting")
 	}
 	repoProject := model.ProjectFromModel(existing)
 	repoApp := model.AppFromModel(app)
@@ -620,12 +616,12 @@ func (es *ProjectEventstore) DeactivateApplication(ctx context.Context, projectI
 	if _, a := model.GetApplication(repoProject.Applications, app.AppID); a != nil {
 		return model.AppToModel(a), nil
 	}
-	return nil, caos_errs.ThrowInternal(nil, "EVENT-sie83", "Could not find app in list")
+	return nil, caos_errs.ThrowInternal(nil, "EVENT-sie83", "Errors.Internal")
 }
 
 func (es *ProjectEventstore) ReactivateApplication(ctx context.Context, projectID, appID string) (*proj_model.Application, error) {
 	if appID == "" {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-0odi2", "appID missing")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-0odi2", "Errors.Project.IDMissing")
 	}
 	existing, err := es.ProjectByID(ctx, projectID)
 	if err != nil {
@@ -633,7 +629,7 @@ func (es *ProjectEventstore) ReactivateApplication(ctx context.Context, projectI
 	}
 	app := &proj_model.Application{AppID: appID}
 	if _, app := existing.GetApp(app.AppID); app == nil {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-ld92d", "App is not in this project")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-ld92d", "Errors.Project.AppNotExisting")
 	}
 	repoProject := model.ProjectFromModel(existing)
 	repoApp := model.AppFromModel(app)
@@ -647,12 +643,12 @@ func (es *ProjectEventstore) ReactivateApplication(ctx context.Context, projectI
 	if _, a := model.GetApplication(repoProject.Applications, app.AppID); a != nil {
 		return model.AppToModel(a), nil
 	}
-	return nil, caos_errs.ThrowInternal(nil, "EVENT-sld93", "Could not find app in list")
+	return nil, caos_errs.ThrowInternal(nil, "EVENT-sld93", "Errors.Internal")
 }
 
 func (es *ProjectEventstore) ChangeOIDCConfig(ctx context.Context, config *proj_model.OIDCConfig) (*proj_model.OIDCConfig, error) {
 	if config == nil || !config.IsValid() {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-du834", "invalid oidc config")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-du834", "Errors.Project.OIDCConfigInvalid")
 	}
 	existing, err := es.ProjectByID(ctx, config.AggregateID)
 	if err != nil {
@@ -660,10 +656,10 @@ func (es *ProjectEventstore) ChangeOIDCConfig(ctx context.Context, config *proj_
 	}
 	var app *proj_model.Application
 	if _, app = existing.GetApp(config.AppID); app == nil {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-dkso8", "App is not in this project")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-dkso8", "Errors.Project.AppNoExisting")
 	}
 	if app.Type != proj_model.APPTYPE_OIDC {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-98uje", "App is not an oidc application")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-98uje", "Errors.Project.AppIsNotOIDC")
 	}
 	repoProject := model.ProjectFromModel(existing)
 	repoConfig := model.OIDCConfigFromModel(config)
@@ -677,12 +673,12 @@ func (es *ProjectEventstore) ChangeOIDCConfig(ctx context.Context, config *proj_
 	if _, a := model.GetApplication(repoProject.Applications, app.AppID); a != nil {
 		return model.OIDCConfigToModel(a.OIDCConfig), nil
 	}
-	return nil, caos_errs.ThrowInternal(nil, "EVENT-dk87s", "Could not find app in list")
+	return nil, caos_errs.ThrowInternal(nil, "EVENT-dk87s", "Errors.Internal")
 }
 
 func (es *ProjectEventstore) ChangeOIDCConfigSecret(ctx context.Context, projectID, appID string) (*proj_model.OIDCConfig, error) {
 	if appID == "" {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-7ue34", "some required fields missing")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-7ue34", "Errors.Project.OIDCConfigInvalid")
 	}
 	existing, err := es.ProjectByID(ctx, projectID)
 	if err != nil {
@@ -690,10 +686,10 @@ func (es *ProjectEventstore) ChangeOIDCConfigSecret(ctx context.Context, project
 	}
 	var app *proj_model.Application
 	if _, app = existing.GetApp(appID); app == nil {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-9odi4", "App is not in this project")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-9odi4", "Errors.Project.AppNotExisting")
 	}
 	if app.Type != proj_model.APPTYPE_OIDC {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-dile4", "App is not an oidc application")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-dile4", "Errors.Project.AppIsNotOIDC")
 	}
 	repoProject := model.ProjectFromModel(existing)
 
@@ -715,12 +711,12 @@ func (es *ProjectEventstore) ChangeOIDCConfigSecret(ctx context.Context, project
 		return config, nil
 	}
 
-	return nil, caos_errs.ThrowInternal(nil, "EVENT-dk87s", "Could not find app in list")
+	return nil, caos_errs.ThrowInternal(nil, "EVENT-dk87s", "Errors.Internal")
 }
 
 func (es *ProjectEventstore) VerifyOIDCClientSecret(ctx context.Context, projectID, appID string, secret string) error {
 	if appID == "" {
-		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-H3RT2", "some required fields missing")
+		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-H3RT2", "Errors.Project.RequiredFieldsMissing")
 	}
 	existing, err := es.ProjectByID(ctx, projectID)
 	if err != nil {
@@ -728,10 +724,10 @@ func (es *ProjectEventstore) VerifyOIDCClientSecret(ctx context.Context, project
 	}
 	var app *proj_model.Application
 	if _, app = existing.GetApp(appID); app == nil {
-		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-D6hba", "App is not in this project")
+		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-D6hba", "Errors.Project.AppNoExisting")
 	}
 	if app.Type != proj_model.APPTYPE_OIDC {
-		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-huywq", "App is not an oidc application")
+		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-huywq", "Errors.Project.AppIsNotOIDC")
 	}
 
 	if err := crypto.CompareHash(app.OIDCConfig.ClientSecret, []byte(secret), es.passwordAlg); err == nil {
@@ -740,7 +736,7 @@ func (es *ProjectEventstore) VerifyOIDCClientSecret(ctx context.Context, project
 	if err := es.setOIDCClientSecretCheckResult(ctx, existing, app.AppID, OIDCClientSecretCheckFailedAggregate); err != nil {
 		return err
 	}
-	return caos_errs.ThrowInvalidArgument(nil, "EVENT-wg24q", "invalid client secret")
+	return caos_errs.ThrowInvalidArgument(nil, "EVENT-wg24q", "Errors.Internal")
 }
 
 func (es *ProjectEventstore) setOIDCClientSecretCheckResult(ctx context.Context, project *proj_model.Project, appID string, check func(*es_models.AggregateCreator, *model.Project, string) es_sdk.AggregateFunc) error {
@@ -756,7 +752,7 @@ func (es *ProjectEventstore) setOIDCClientSecretCheckResult(ctx context.Context,
 
 func (es *ProjectEventstore) ProjectGrantByIDs(ctx context.Context, projectID, grantID string) (*proj_model.ProjectGrant, error) {
 	if grantID == "" {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-e8die", "grantID missing")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-e8die", "Errors.Project.IDMissing")
 	}
 	project, err := es.ProjectByID(ctx, projectID)
 	if err != nil {
@@ -765,22 +761,22 @@ func (es *ProjectEventstore) ProjectGrantByIDs(ctx context.Context, projectID, g
 	if _, g := project.GetGrant(grantID); g != nil {
 		return g, nil
 	}
-	return nil, caos_errs.ThrowNotFound(nil, "EVENT-slo45", "grant not found")
+	return nil, caos_errs.ThrowNotFound(nil, "EVENT-slo45", "Errors.Project.GrantNotFound")
 }
 
 func (es *ProjectEventstore) AddProjectGrant(ctx context.Context, grant *proj_model.ProjectGrant) (*proj_model.ProjectGrant, error) {
 	if grant == nil || !grant.IsValid() {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-37dhs", "Project grant invalid")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-37dhs", "Errors.Project.GrantInvalid")
 	}
 	existing, err := es.ProjectByID(ctx, grant.AggregateID)
 	if err != nil {
 		return nil, err
 	}
 	if existing.ContainsGrantForOrg(grant.GrantedOrgID) {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-7ug4g", "Grant for org already exists")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-7ug4g", "Errors.Project.GrantAlreadyExists")
 	}
 	if !existing.ContainsRoles(grant.RoleKeys) {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-di83d", "One role doesnt exist in Project")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-di83d", "Errors.Project.GrantHasNotExistingRole")
 	}
 	id, err := es.idGenerator.Next()
 	if err != nil {
@@ -799,12 +795,12 @@ func (es *ProjectEventstore) AddProjectGrant(ctx context.Context, grant *proj_mo
 	if _, g := model.GetProjectGrant(repoProject.Grants, grant.GrantID); g != nil {
 		return model.GrantToModel(g), nil
 	}
-	return nil, caos_errs.ThrowInternal(nil, "EVENT-sk3t5", "Could not find grant in list")
+	return nil, caos_errs.ThrowInternal(nil, "EVENT-sk3t5", "Errors.Internal")
 }
 
 func (es *ProjectEventstore) PrepareChangeProjectGrant(ctx context.Context, grant *proj_model.ProjectGrant) (*model.Project, func(ctx context.Context) (*es_models.Aggregate, error), []string, error) {
 	if grant == nil && grant.GrantID == "" {
-		return nil, nil, nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-8sie3", "invalid grant")
+		return nil, nil, nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-8sie3", "Errors.Project.GrantInvalid")
 	}
 	existing, err := es.ProjectByID(ctx, grant.AggregateID)
 	if err != nil {
@@ -812,10 +808,10 @@ func (es *ProjectEventstore) PrepareChangeProjectGrant(ctx context.Context, gran
 	}
 	_, existingGrant := existing.GetGrant(grant.GrantID)
 	if existingGrant == nil {
-		return nil, nil, nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-die83", "Grant not existing on project")
+		return nil, nil, nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-die83", "Errors.Project.GrantNotExisting")
 	}
 	if !existing.ContainsRoles(grant.RoleKeys) {
-		return nil, nil, nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-di83d", "One role doesnt exist in Project")
+		return nil, nil, nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-di83d", "Error.Project.GrantHasNotExistingRole")
 	}
 	removedRoles := existingGrant.GetRemovedRoles(grant.RoleKeys)
 	repoProject := model.ProjectFromModel(existing)
@@ -856,14 +852,14 @@ func (es *ProjectEventstore) RemoveProjectGrants(ctx context.Context, grants ...
 
 func (es *ProjectEventstore) PrepareRemoveProjectGrant(ctx context.Context, grant *proj_model.ProjectGrant) (*model.Project, func(ctx context.Context) (*es_models.Aggregate, error), error) {
 	if grant.GrantID == "" {
-		return nil, nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-8eud6", "GrantId is required")
+		return nil, nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-8eud6", "Errors.Project.IDMissing")
 	}
 	existing, err := es.ProjectByID(ctx, grant.AggregateID)
 	if err != nil {
 		return nil, nil, err
 	}
 	if _, g := existing.GetGrant(grant.GrantID); g == nil {
-		return nil, nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-9ie3s", "Grant doesn't exist on project")
+		return nil, nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-9ie3s", "Errors.Project.GrantNotExisting")
 	}
 	repoProject := model.ProjectFromModel(existing)
 	grantRepo := model.GrantFromModel(grant)
@@ -873,7 +869,7 @@ func (es *ProjectEventstore) PrepareRemoveProjectGrant(ctx context.Context, gran
 
 func (es *ProjectEventstore) DeactivateProjectGrant(ctx context.Context, projectID, grantID string) (*proj_model.ProjectGrant, error) {
 	if grantID == "" {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-7due2", "grantID missing")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-7due2", "Errors.Project.IDMissing")
 	}
 	existing, err := es.ProjectByID(ctx, projectID)
 	if err != nil {
@@ -881,7 +877,7 @@ func (es *ProjectEventstore) DeactivateProjectGrant(ctx context.Context, project
 	}
 	grant := &proj_model.ProjectGrant{GrantID: grantID}
 	if _, g := existing.GetGrant(grant.GrantID); g == nil {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-slpe9", "Grant is not in this project")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-slpe9", "Errors.Project.GrantNotExisting")
 	}
 	repoProject := model.ProjectFromModel(existing)
 	repoGrant := model.GrantFromModel(grant)
@@ -895,12 +891,12 @@ func (es *ProjectEventstore) DeactivateProjectGrant(ctx context.Context, project
 	if _, g := model.GetProjectGrant(repoProject.Grants, grant.GrantID); g != nil {
 		return model.GrantToModel(g), nil
 	}
-	return nil, caos_errs.ThrowInternal(nil, "EVENT-sie83", "Could not find grant in list")
+	return nil, caos_errs.ThrowInternal(nil, "EVENT-sie83", "Errors.Internal")
 }
 
 func (es *ProjectEventstore) ReactivateProjectGrant(ctx context.Context, projectID, grantID string) (*proj_model.ProjectGrant, error) {
 	if grantID == "" {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-d7suw", "grantID missing")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-d7suw", "Errors.Project.IDMissing")
 	}
 	existing, err := es.ProjectByID(ctx, projectID)
 	if err != nil {
@@ -908,7 +904,7 @@ func (es *ProjectEventstore) ReactivateProjectGrant(ctx context.Context, project
 	}
 	grant := &proj_model.ProjectGrant{GrantID: grantID}
 	if _, g := existing.GetGrant(grant.GrantID); g == nil {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-0spew", "Grant is not in this project")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-0spew", "Errors.Project.GrantNotExisting")
 	}
 	repoProject := model.ProjectFromModel(existing)
 	repoGrant := model.GrantFromModel(grant)
@@ -923,12 +919,12 @@ func (es *ProjectEventstore) ReactivateProjectGrant(ctx context.Context, project
 	if _, g := model.GetProjectGrant(repoProject.Grants, grant.GrantID); g != nil {
 		return model.GrantToModel(g), nil
 	}
-	return nil, caos_errs.ThrowInternal(nil, "EVENT-9osjw", "Could not find grant in list")
+	return nil, caos_errs.ThrowInternal(nil, "EVENT-9osjw", "Errors.Internal")
 }
 
 func (es *ProjectEventstore) ProjectGrantMemberByIDs(ctx context.Context, member *proj_model.ProjectGrantMember) (*proj_model.ProjectGrantMember, error) {
 	if member.GrantID == "" || member.UserID == "" {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-8diw2", "userID missing")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-8diw2", "Errors.Project.UserIDMissing")
 	}
 	project, err := es.ProjectByID(ctx, member.AggregateID)
 	if err != nil {
@@ -939,19 +935,19 @@ func (es *ProjectEventstore) ProjectGrantMemberByIDs(ctx context.Context, member
 			return m, nil
 		}
 	}
-	return nil, caos_errs.ThrowNotFound(nil, "EVENT-3udjs", "member not found")
+	return nil, caos_errs.ThrowNotFound(nil, "EVENT-3udjs", "Errors.Project.MemberNotFound")
 }
 
 func (es *ProjectEventstore) AddProjectGrantMember(ctx context.Context, member *proj_model.ProjectGrantMember) (*proj_model.ProjectGrantMember, error) {
 	if !member.IsValid() {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-0dor4", "invalid member")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-0dor4", "Errors.Project.MemberInvalid")
 	}
 	existing, err := es.ProjectByID(ctx, member.AggregateID)
 	if err != nil {
 		return nil, err
 	}
 	if existing.ContainsGrantMember(member) {
-		return nil, caos_errs.ThrowAlreadyExists(nil, "EVENT-8die3", "User is already member of this ProjectGrant")
+		return nil, caos_errs.ThrowAlreadyExists(nil, "EVENT-8die3", "Errors.Project.MemberAlreadyExists")
 	}
 	repoProject := model.ProjectFromModel(existing)
 	repoMember := model.GrantMemberFromModel(member)
@@ -967,19 +963,19 @@ func (es *ProjectEventstore) AddProjectGrantMember(ctx context.Context, member *
 			return model.GrantMemberToModel(m), nil
 		}
 	}
-	return nil, caos_errs.ThrowInternal(nil, "EVENT-3udjs", "Could not find member in list")
+	return nil, caos_errs.ThrowInternal(nil, "EVENT-3udjs", "Errors.Internal")
 }
 
 func (es *ProjectEventstore) ChangeProjectGrantMember(ctx context.Context, member *proj_model.ProjectGrantMember) (*proj_model.ProjectGrantMember, error) {
 	if !member.IsValid() {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-dkw35", "member is not valid")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-dkw35", "Errors.Project.MemberInvalid")
 	}
 	existing, err := es.ProjectByID(ctx, member.AggregateID)
 	if err != nil {
 		return nil, err
 	}
 	if !existing.ContainsGrantMember(member) {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-8dj4s", "User is not member of this grant")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-8dj4s", "Errors.Project.MemberNotExisting")
 	}
 	repoProject := model.ProjectFromModel(existing)
 	repoMember := model.GrantMemberFromModel(member)
@@ -995,19 +991,19 @@ func (es *ProjectEventstore) ChangeProjectGrantMember(ctx context.Context, membe
 			return model.GrantMemberToModel(m), nil
 		}
 	}
-	return nil, caos_errs.ThrowInternal(nil, "EVENT-s8ur3", "Could not find member in list")
+	return nil, caos_errs.ThrowInternal(nil, "EVENT-s8ur3", "Errors.Internal")
 }
 
 func (es *ProjectEventstore) RemoveProjectGrantMember(ctx context.Context, member *proj_model.ProjectGrantMember) error {
 	if member.UserID == "" {
-		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-8su4r", "member is not valid")
+		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-8su4r", "Errors.Project.MemberInvalid")
 	}
 	existing, err := es.ProjectByID(ctx, member.AggregateID)
 	if err != nil {
 		return err
 	}
 	if !existing.ContainsGrantMember(member) {
-		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-9ode4", "User is not member of this grant")
+		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-9ode4", "Errors.Project.MemberNotExisting")
 	}
 	repoProject := model.ProjectFromModel(existing)
 	repoMember := model.GrantMemberFromModel(member)

internal/project/repository/eventsourcing/oidc.go

@@ -24,7 +24,7 @@ func generateNewClientSecret(pwGenerator crypto.Generator) (string, *crypto.Cryp
 	cryptoValue, stringSecret, err := crypto.NewCode(pwGenerator)
 	if err != nil {
 		logging.Log("APP-UpnTI").OnError(err).Error("unable to create client secret")
-		return "", nil, errors.ThrowInternal(err, "APP-gH2Wl", "unable to create password")
+		return "", nil, errors.ThrowInternal(err, "APP-gH2Wl", "Errors.Project.CouldNotGenerateClientSecret")
 	}
 	return stringSecret, cryptoValue, nil
 }

internal/project/repository/eventsourcing/project.go

@@ -14,7 +14,7 @@ import (
 
 func ProjectByIDQuery(id string, latestSequence uint64) (*es_models.SearchQuery, error) {
 	if id == "" {
-		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dke74", "id should be filled")
+		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dke74", "Errors.Project.ProjectIDMissing")
 	}
 	return ProjectQuery(latestSequence).
 		AggregateIDFilter(id), nil
@@ -28,7 +28,7 @@ func ProjectQuery(latestSequence uint64) *es_models.SearchQuery {
 
 func ProjectAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, project *model.Project) (*es_models.Aggregate, error) {
 	if project == nil {
-		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-doe93", "existing project should not be nil")
+		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-doe93", "Errors.Internal")
 	}
 	return aggCreator.NewAggregate(ctx, project.AggregateID, model.ProjectAggregate, model.ProjectVersion, project.Sequence)
 }
@@ -36,7 +36,7 @@ func ProjectAggregate(ctx context.Context, aggCreator *es_models.AggregateCreato
 func ProjectCreateAggregate(aggCreator *es_models.AggregateCreator, project *model.Project, member *model.ProjectMember) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if project == nil || member == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-kdie6", "project and member should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-kdie6", "Errors.Internal")
 		}
 
 		agg, err := ProjectAggregate(ctx, aggCreator, project)
@@ -59,7 +59,7 @@ func ProjectCreateAggregate(aggCreator *es_models.AggregateCreator, project *mod
 func ProjectUpdateAggregate(aggCreator *es_models.AggregateCreator, existing *model.Project, new *model.Project) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if new == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dhr74", "new project should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dhr74", "Errors.Internal")
 		}
 		agg, err := ProjectAggregate(ctx, aggCreator, existing)
 		if err != nil {
@@ -67,7 +67,7 @@ func ProjectUpdateAggregate(aggCreator *es_models.AggregateCreator, existing *mo
 		}
 		changes := existing.Changes(new)
 		if len(changes) == 0 {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-9soPE", "no changes found")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-9soPE", "Errors.NoChangesFound")
 		}
 		if existing.Name != new.Name {
 			validationQuery := es_models.NewSearchQuery().
@@ -102,7 +102,7 @@ func projectStateAggregate(aggCreator *es_models.AggregateCreator, project *mode
 func ProjectMemberAddedAggregate(aggCreator *es_models.AggregateCreator, existing *model.Project, member *model.ProjectMember) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if member == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-ie34f", "member should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-ie34f", "Errors.Internal")
 		}
 		agg, err := ProjectAggregate(ctx, aggCreator, existing)
 		if err != nil {
@@ -120,7 +120,7 @@ func ProjectMemberAddedAggregate(aggCreator *es_models.AggregateCreator, existin
 func ProjectMemberChangedAggregate(aggCreator *es_models.AggregateCreator, existing *model.Project, member *model.ProjectMember) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if member == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-d34fs", "member should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-d34fs", "Errors.Internal")
 		}
 
 		agg, err := ProjectAggregate(ctx, aggCreator, existing)
@@ -134,7 +134,7 @@ func ProjectMemberChangedAggregate(aggCreator *es_models.AggregateCreator, exist
 func ProjectMemberRemovedAggregate(aggCreator *es_models.AggregateCreator, existing *model.Project, member *model.ProjectMember) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if member == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dieu7", "member should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dieu7", "Errors.Internal")
 		}
 		agg, err := ProjectAggregate(ctx, aggCreator, existing)
 		if err != nil {
@@ -147,7 +147,7 @@ func ProjectMemberRemovedAggregate(aggCreator *es_models.AggregateCreator, exist
 func ProjectRoleAddedAggregate(aggCreator *es_models.AggregateCreator, existing *model.Project, roles ...*model.ProjectRole) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if roles == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-sleo9", "roles should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-sleo9", "Errors.Internal")
 		}
 		agg, err := ProjectAggregate(ctx, aggCreator, existing)
 		if err != nil {
@@ -166,7 +166,7 @@ func ProjectRoleAddedAggregate(aggCreator *es_models.AggregateCreator, existing
 func ProjectRoleChangedAggregate(aggCreator *es_models.AggregateCreator, existing *model.Project, role *model.ProjectRole) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if role == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-oe8sf", "member should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-oe8sf", "Errors.Internal")
 		}
 		agg, err := ProjectAggregate(ctx, aggCreator, existing)
 		if err != nil {
@@ -178,7 +178,7 @@ func ProjectRoleChangedAggregate(aggCreator *es_models.AggregateCreator, existin
 
 func ProjectRoleRemovedAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, existing *model.Project, role *model.ProjectRole, grants []*model.ProjectGrant) (*es_models.Aggregate, error) {
 	if role == nil {
-		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-d8eis", "member should not be nil")
+		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-d8eis", "Errors.Internal")
 	}
 	agg, err := ProjectAggregate(ctx, aggCreator, existing)
 	if err != nil {
@@ -204,7 +204,7 @@ func ProjectRoleRemovedAggregate(ctx context.Context, aggCreator *es_models.Aggr
 func ApplicationAddedAggregate(aggCreator *es_models.AggregateCreator, existing *model.Project, app *model.Application) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if app == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-09du7", "app should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-09du7", "Errors.Internal")
 		}
 		agg, err := ProjectAggregate(ctx, aggCreator, existing)
 		if err != nil {
@@ -221,7 +221,7 @@ func ApplicationAddedAggregate(aggCreator *es_models.AggregateCreator, existing
 func ApplicationChangedAggregate(aggCreator *es_models.AggregateCreator, existing *model.Project, app *model.Application) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if app == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-sleo9", "app should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-sleo9", "Errors.Internal")
 		}
 		agg, err := ProjectAggregate(ctx, aggCreator, existing)
 		if err != nil {
@@ -242,7 +242,7 @@ func ApplicationChangedAggregate(aggCreator *es_models.AggregateCreator, existin
 func ApplicationRemovedAggregate(aggCreator *es_models.AggregateCreator, existing *model.Project, app *model.Application) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if app == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-se23g", "app should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-se23g", "Errors.Internal")
 		}
 		agg, err := ProjectAggregate(ctx, aggCreator, existing)
 		if err != nil {
@@ -257,7 +257,7 @@ func ApplicationRemovedAggregate(aggCreator *es_models.AggregateCreator, existin
 func ApplicationDeactivatedAggregate(aggCreator *es_models.AggregateCreator, existing *model.Project, app *model.Application) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if app == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-slfi3", "app should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-slfi3", "Errors.Internal")
 		}
 		agg, err := ProjectAggregate(ctx, aggCreator, existing)
 		if err != nil {
@@ -272,7 +272,7 @@ func ApplicationDeactivatedAggregate(aggCreator *es_models.AggregateCreator, exi
 func ApplicationReactivatedAggregate(aggCreator *es_models.AggregateCreator, existing *model.Project, app *model.Application) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if app == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-slf32", "app should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-slf32", "Errors.Internal")
 		}
 		agg, err := ProjectAggregate(ctx, aggCreator, existing)
 		if err != nil {
@@ -287,7 +287,7 @@ func ApplicationReactivatedAggregate(aggCreator *es_models.AggregateCreator, exi
 func OIDCConfigChangedAggregate(aggCreator *es_models.AggregateCreator, existing *model.Project, config *model.OIDCConfig) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if config == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-slf32", "config should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-slf32", "Errors.Internal")
 		}
 		agg, err := ProjectAggregate(ctx, aggCreator, existing)
 		if err != nil {
@@ -356,7 +356,7 @@ func OIDCClientSecretCheckFailedAggregate(aggCreator *es_models.AggregateCreator
 func ProjectGrantAddedAggregate(aggCreator *es_models.AggregateCreator, existing *model.Project, grant *model.ProjectGrant) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if grant == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-kd89w", "grant should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-kd89w", "Errors.Internal")
 		}
 		agg, err := ProjectAggregate(ctx, aggCreator, existing)
 		if err != nil {
@@ -375,7 +375,7 @@ func ProjectGrantAddedAggregate(aggCreator *es_models.AggregateCreator, existing
 func ProjectGrantChangedAggregate(aggCreator *es_models.AggregateCreator, existing *model.Project, grant *model.ProjectGrant) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if grant == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-d9ie2", "grant should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-d9ie2", "Errors.Internal")
 		}
 		agg, err := ProjectAggregate(ctx, aggCreator, existing)
 		if err != nil {
@@ -396,7 +396,7 @@ func ProjectGrantChangedAggregate(aggCreator *es_models.AggregateCreator, existi
 func ProjectGrantRemovedAggregate(aggCreator *es_models.AggregateCreator, existing *model.Project, grant *model.ProjectGrant) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if grant == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-kci8d", "grant should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-kci8d", "Errors.Internal")
 		}
 		agg, err := ProjectAggregate(ctx, aggCreator, existing)
 		if err != nil {
@@ -411,7 +411,7 @@ func ProjectGrantRemovedAggregate(aggCreator *es_models.AggregateCreator, existi
 func ProjectGrantDeactivatedAggregate(aggCreator *es_models.AggregateCreator, existing *model.Project, grant *model.ProjectGrant) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if grant == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-id832", "grant should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-id832", "Errors.Internal")
 		}
 		agg, err := ProjectAggregate(ctx, aggCreator, existing)
 		if err != nil {
@@ -426,7 +426,7 @@ func ProjectGrantDeactivatedAggregate(aggCreator *es_models.AggregateCreator, ex
 func ProjectGrantReactivatedAggregate(aggCreator *es_models.AggregateCreator, existing *model.Project, grant *model.ProjectGrant) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if grant == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-8diw2", "grant should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-8diw2", "Errors.Internal")
 		}
 		agg, err := ProjectAggregate(ctx, aggCreator, existing)
 		if err != nil {
@@ -439,7 +439,7 @@ func ProjectGrantReactivatedAggregate(aggCreator *es_models.AggregateCreator, ex
 func ProjectGrantMemberAddedAggregate(aggCreator *es_models.AggregateCreator, existing *model.Project, member *model.ProjectGrantMember) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if member == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-4ufh6", "grant should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-4ufh6", "Errors.Internal")
 		}
 		agg, err := ProjectAggregate(ctx, aggCreator, existing)
 		if err != nil {
@@ -457,7 +457,7 @@ func ProjectGrantMemberAddedAggregate(aggCreator *es_models.AggregateCreator, ex
 func ProjectGrantMemberChangedAggregate(aggCreator *es_models.AggregateCreator, existing *model.Project, member *model.ProjectGrantMember) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if member == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-d8i4h", "member should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-d8i4h", "Errors.Internal")
 		}
 
 		agg, err := ProjectAggregate(ctx, aggCreator, existing)
@@ -476,7 +476,7 @@ func ProjectGrantMemberChangedAggregate(aggCreator *es_models.AggregateCreator,
 func ProjectGrantMemberRemovedAggregate(aggCreator *es_models.AggregateCreator, existing *model.Project, member *model.ProjectGrantMember) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if member == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-slp0r", "member should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-slp0r", "Errors.Internal")
 		}
 		agg, err := ProjectAggregate(ctx, aggCreator, existing)
 		if err != nil {
@@ -510,7 +510,7 @@ func addProjectValidation(projectName string) func(...*es_models.Event) error {
 		}
 		for _, p := range projects {
 			if p.Name == projectName {
-				return errors.ThrowPreconditionFailed(nil, "EVENT-s9oPw", "project already exists on resourceowner")
+				return errors.ThrowPreconditionFailed(nil, "EVENT-s9oPw", "Errors.Project.AlreadyExists")
 			}
 		}
 		return nil
@@ -540,7 +540,7 @@ func addProjectGrantValidation() func(...*es_models.Event) error {
 		if existsOrg {
 			return nil
 		}
-		return errors.ThrowPreconditionFailed(nil, "EVENT-3OfIm", "conditions not met")
+		return errors.ThrowPreconditionFailed(nil, "EVENT-3OfIm", "Errors.Project.OrgNotExisting")
 	}
 }
 
@@ -566,5 +566,5 @@ func checkExistsUser(events ...*es_models.Event) error {
 	if existsUser {
 		return nil
 	}
-	return errors.ThrowPreconditionFailed(nil, "EVENT-3OfIm", "conditions not met")
+	return errors.ThrowPreconditionFailed(nil, "EVENT-3OfIm", "Errors.Project.UserNotExisting")
 }

internal/static/i18n/de.yaml

@@ -0,0 +1,110 @@
+Errors:
+  Internal: Es ist ein interner Fehler aufgetreten
+  NoChangesFound: Keine Änderungen gefunden
+  User:
+    NotFound: Benutzer konnte nicht gefunden werden
+    UserIDMissing: User ID fehlt
+    OrgIamPolicyNil: Organisations Policy ist leer
+    EmailAsUsernameNotAllowed: Benutzername darf keine E-Mail Adresse sein
+    Invalid: Benutzerdaten sind ungültig
+    DomainNotAllowedAsUsername: Domäne ist bereits reserviert und kann nicht verwendet werden
+    AlreadyInactive: Benutzer ist bereits deaktiviert
+    NotInactive: Benutzer ist nicht inaktiv
+    ShouldBeActiveOrInitial: Benutzer ist nicht aktiv oder initialisiert
+    NotLocked: Benutzer ist nicht gesperrt
+    NoChanges: Keine Änderungen gefunden
+    InitCodeNotFound: Kein Initialisierungs Code gefunden
+    ProfileNotFound: Profil nicht gefunden
+    ProfileInvalid: Profildaten sind ungültig
+    EmailNotFound: Email nicht gefunden
+    EmailInvalid: Email ist ungültig
+    EmailAlreadyVerified: Email ist bereits verifiziert
+    PhoneNotFound: Telfonnummer nicht gefunden
+    PhoneInvalid: Telefonnummer ist ungültig
+    PhoneAlreadyVerified: Telefonnummer bereits verifiziert
+    AddressNotFound: Addresse nicht gefunden
+    Code:
+      Empty: Code ist leer
+      NotFound: Code konnte nicht gefunden werden
+      Expired: Code ist abgelaufen
+      GeneratorAlgNotSupported: Generator Algorithums wird nicht unterstützt
+    Password:
+      NotFound: Password nicht gefunden
+      Empty: Passwort ist leer
+      Invalid: Passwort ungültig
+    PasswordComplexityPolicy:
+      NotFound: Passwort Policy konnte nicht gefunden werden
+      MinLength: Passwort ist zu kurz
+      HasLower: Passwort beinhaltet keinen Kleinbuchstaben
+      HasUpper: Passwort beinhaltet keinen Grossbuchstaben
+      HasNumber: Passwort beinhaltet keine Nummer
+      HasSymbol: Passwort beinhaltet kein Symbol
+    Mfa:
+      Otp:
+        AlreadyReady: Multifaktor OTP (OneTimePassword) ist bereits eingerichtet
+        NotExisting: Multifaktor OTP (OneTimePassword) existiert nicht
+        NotReady: Multifaktor OTP (OneTimePassword) ist nicht bereit
+        InvalidCode: Code ist ungültig
+  Org:
+    Invalid: Organisation ist ungültig
+    AlreadyDeactivated: Organisation ist bereits deaktiviert
+    AlreadyActive: Organisation ist bereits aktiv
+    Empty: Organisation ist leer
+    NotFound: Organisation konnte nicht gefunden werden
+    InvalidDomain: Domäne ist ungültig
+    DomainMissing: Domäne fehlt
+    DomainNotOnOrg: Domäne fehlt auf Organisation
+    MemberIDMissing: Member ID fehlt
+    MemberNotFound: Organisations Member konnte nicht gefunden werden
+    InvalidMember: Organisations Member ist ungültig
+    UserIDMissing: User ID fehlt
+    PolicyAlreadyExists: Policy existiert bereits
+    PolicyNotExisting: Policy existiert nicht
+  Project:
+    ProjectIDMissing: Project Id fehlt
+    AlreadyExists: Project existiert bereits auf der Organisation
+    OrgNotExisting: Organisation existiert nicht
+    UserNotExisting: User existiert nicht
+    CouldNotGenerateClientSecret: Client Secret konnte nicht generiert werden
+    Invalid: Projekt ist ungültig
+    NotActive: Projekt ist nicht aktiv
+    NotInactive: Projekt ist nicht deaktiviert
+    UserIDMissing: User ID fehlt
+    MemberNotFound: Member konnte nicht gefunden werden
+    MemberInvalid: Member ist ungültig
+    MemberAlreadyExists: Member existiert bereits
+    MemberNotExisting: Member existiert nicht
+    MinimumOneRoleNeeded: Es muss mindestend eine Rolle hinzugefügt werden
+    RoleAlreadyExists: Rolle existiert bereits
+    RoleInvalid: Rolle ist ungültig
+    RoleNotExisting: Rolle existiert nicht
+    IDMissing: ID fehlt
+    AppNotFound: Applikation nicht gefunden
+    AppInvalid: Applikation ist ungültig
+    AppNotExisting: Applikation exisitert nicht
+    OIDCConfigInvalid: OIDC Konfiguration ist ungültig
+    AppIsNotOIDC: Applikation ist nicht vom Typ OIDC
+    RequiredFieldsMissing: Benötigte Felder fehlen
+    GrantNotFound: Grant konnte nicht gefunden werden
+    GrantInvalid: Projekt Grant ist ungültig
+    GrantAlreadyExists: Projekt Grant existiert bereits
+    GrantNotExists: Projekt Grant existiert nicht
+    GrantHasNotExistingRole: Eine der Rollen existiert nicht auf dem Projekt
+    UserIDMisisng: User ID fehlt
+  Iam:
+    MemberInvalid: Member ist ungültig
+    MemberAlreadyExisting: Member existiert bereits
+    MemberNotExisting: Member existiert nicht
+    IDMissing: Id fehlt
+    GlobalOrgMissing: Globale Organisation fehlt
+    IamProjectIDMisisng: Iam Project ID fehlt
+  Policy:
+    AlreadyExists: Policy existiert bereits
+  UserGrant:
+    NotFound: Benutzer Berechtigung konnte nicht gefunden werden
+    Invalid: Benutzer Berechtigung ist ungültig
+    IDMissing: Id fehlt
+    NotActive: Benutzer Berechtigung ist nicht aktiv
+    NotInactive: Benutzer Berechtigung ist nicht deaktiviert
+  Changes:
+    NotFound: Es konnte kein Änderungsverlauf gefunden werden

internal/static/i18n/en.yaml

@@ -0,0 +1,110 @@
+Errors:
+  Internal: An internal error occured
+  NoChangesFound: No changes found
+  User:
+    NotFound: User could not be found
+    UserIDMissing: User ID missing
+    OrgIamPolicyNil: Organisation Policy is empty
+    EmailAsUsernameNotAllowed: Email is not allowed as username
+    Invalid: Userdata is invalid
+    DomainNotAllowedAsUsername: Domain is already reserved
+    AlreadyInactive: User already inactive
+    NotInactive: User is not inactive
+    ShouldBeActiveOrInitial: User is not active or inital
+    NotLocked: User is not locked
+    NoChanges: No changes found
+    InitCodeNotFound: Initialization Code not found
+    ProfileNotFound: Profile not found
+    ProfileInvalid: Profildata invalid
+    EmailNotFound: Email not found
+    EmailInvalid: Email is invalid
+    EmailAlreadyVerified: Email is alredy verified
+    PhoneNotFound: Phone not found
+    PhoneInvalid: Phone is invalid
+    PhoneAlreadyVerified: Phone already verified
+    AddressNotFound: Address not found
+    Code:
+      Empty: Code is empty
+      NotFound: Code not found
+      Expired: Code is expired
+      GeneratorAlgNotSupported: Unsupported generator algorithm
+    Password:
+      NotFound: Passoword not found
+      Empty: Password is empty
+      Invalid: Passwort is invalid
+    PasswordComplexityPolicy:
+      NotFound: Password policy not found
+      MinLength: Password is to short
+      HasLower: Password must contain lower case
+      HasUpper: Password must contain upper case
+      HasNumber: Password must contain number
+      HasSymbol: Password must contain symbol
+    Mfa:
+      Otp:
+        AlreadyReady: Multifactor OTP (OneTimePassword) is already set up
+        NotExisting: Multifactor OTP (OneTimePassword) doesn't exist
+        NotReady: Multifactor OTP (OneTimePassword) isn't ready
+        InvalidCode: Invalid code
+  Org:
+    Invalid: Organisation is invalid
+    AlreadyDeactivated: Organisation is already deactivated
+    AlreadyActive: Organisation is already ative
+    Empty: Organisation is empty
+    NotFound: Organisation not found
+    InvalidDomain: Invalid domain
+    DomainMissing: Domain missing
+    DomainNotOnOrg: Domain doesn't exist on organisation
+    MemberIDMissing: Member ID missing
+    MemberNotFound: Organisations member not found
+    InvalidMember: Organisation member is invalid
+    UserIDMissing: User ID missing
+    PolicyAlreadyExists: Policy alredy exists
+    PolicyNotExisting: Policy doesn't exist
+  Project:
+    ProjectIDMissing: Project Id missing
+    AlreadyExists: Project already exists on organisation
+    OrgNotExisting: Organisation doesn't exist
+    UserNotExisting: User doesn't exist
+    CouldNotGenerateClientSecret: Could not generate client secret
+    Invalid: Project is invalid
+    NotActive: Project is not active
+    NotInactive: Projekt is not deactivated
+    UserIDMissing: User ID missing
+    MemberNotFound: Project member not found
+    MemberInvalid: Project member is invalid
+    MemberAlreadyExists: Project member already exists
+    MemberNotExisting: Projekt member doesn't exist
+    MinimumOneRoleNeeded: At least one role should be added
+    RoleAlreadyExists: Role already exists
+    RoleInvalid: Role is invalid
+    RoleNotExisting: Role doesn't exist
+    IDMissing: ID missing
+    AppNotFound: Application not found
+    AppInvalid: Application invalid
+    AppNotExisting: Application doesn't exist
+    OIDCConfigInvalid: OIDC configuration is invalid
+    AppIsNotOIDC: Application is not type oidc
+    RequiredFieldsMissing: Some required fields are missing
+    GrantNotFound: Grant not found
+    GrantInvalid: Project grant is invalid
+    GrantAlreadyExists: Project grant already exists
+    GrantNotExists: Project grant doesn't exist
+    GrantHasNotExistingRole: One role doesn't exist on project
+    UserIDMisisng: User ID missing
+  Iam:
+    MemberInvalid: Member is invalid
+    MemberAlreadyExisting: Member already exists
+    MemberNotExisting: Member does not exist
+    IDMissing: Id missing
+    GlobalOrgMissing: Global organisation missing
+    IamProjectIDMisisng: Iam project id missing
+  Policy:
+    AlreadyExists: Policy already exists
+  UserGrant:
+    NotFound: User grant not found
+    Invalid: User grant is invalid
+    IDMissing: Id missing
+    NotActive: User grant is not active
+    NotInactive: User grant is not deactivated
+  Changes:
+    NotFound: No history found

internal/statik/generate.go

@@ -0,0 +1,3 @@
+package statik
+
+//go:generate statik -src=../static -dest=.. -ns=zitadel

internal/user/model/user.go

@@ -4,9 +4,9 @@ import (
 	caos_errors "github.com/caos/zitadel/internal/errors"
 	org_model "github.com/caos/zitadel/internal/org/model"
 	policy_model "github.com/caos/zitadel/internal/policy/model"
+	"github.com/golang/protobuf/ptypes/timestamp"
 	"strings"
 	"time"
-	"github.com/golang/protobuf/ptypes/timestamp"
 
 	"github.com/caos/zitadel/internal/crypto"
 	es_models "github.com/caos/zitadel/internal/eventstore/models"
@@ -70,10 +70,10 @@ const (
 
 func (u *User) CheckOrgIamPolicy(policy *org_model.OrgIamPolicy) error {
 	if policy == nil {
-		return caos_errors.ThrowPreconditionFailed(nil, "MODEL-zSH7j", "Org Iam Policy should not be nil")
+		return caos_errors.ThrowPreconditionFailed(nil, "MODEL-zSH7j", "Errors.Users.OrgIamPolicyNil")
 	}
 	if policy.UserLoginMustBeDomain && strings.Contains(u.UserName, "@") {
-		return caos_errors.ThrowPreconditionFailed(nil, "MODEL-se4sJ", "Username should not be email address")
+		return caos_errors.ThrowPreconditionFailed(nil, "MODEL-se4sJ", "Errors.User.EmailAsUsernameNotAllowed")
 	}
 	if !policy.UserLoginMustBeDomain && u.Profile != nil && u.UserName == "" && u.Email != nil {
 		u.UserName = u.EmailAddress

internal/user/repository/eventsourcing/eventstore.go

@@ -111,7 +111,7 @@ func (es *UserEventstore) PrepareCreateUser(ctx context.Context, user *usr_model
 	}
 	user.SetNamesAsDisplayname()
 	if !user.IsValid() {
-		return nil, nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-9dk45", "User is invalid")
+		return nil, nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-9dk45", "Errors.User.Invalid")
 	}
 
 	id, err := es.idGenerator.Next()
@@ -164,7 +164,7 @@ func (es *UserEventstore) PrepareRegisterUser(ctx context.Context, user *usr_mod
 	}
 	user.SetNamesAsDisplayname()
 	if !user.IsValid() || user.Password == nil || user.SecretString == "" {
-		return nil, nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-9dk45", "Errors.User.InvalidData")
+		return nil, nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-9dk45", "Errors.User.Invalid")
 	}
 	id, err := es.idGenerator.Next()
 	if err != nil {
@@ -209,7 +209,7 @@ func (es *UserEventstore) DeactivateUser(ctx context.Context, id string) (*usr_m
 		return nil, err
 	}
 	if existing.IsInactive() {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-die45", "cant deactivate inactive user")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-die45", "Errors.User.AlreadyInactive")
 	}
 
 	repoExisting := model.UserFromModel(existing)
@@ -228,7 +228,7 @@ func (es *UserEventstore) ReactivateUser(ctx context.Context, id string) (*usr_m
 		return nil, err
 	}
 	if !existing.IsInactive() {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-do94s", "user must be inactive")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-do94s", "Errors.User.NotInactive")
 	}
 
 	repoExisting := model.UserFromModel(existing)
@@ -247,7 +247,7 @@ func (es *UserEventstore) LockUser(ctx context.Context, id string) (*usr_model.U
 		return nil, err
 	}
 	if !existing.IsActive() && !existing.IsInitial() {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-di83s", "user must be active or initial")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-di83s", "Errors.User.ShouldBeActiveOrInitial")
 	}
 
 	repoExisting := model.UserFromModel(existing)
@@ -266,7 +266,7 @@ func (es *UserEventstore) UnlockUser(ctx context.Context, id string) (*usr_model
 		return nil, err
 	}
 	if !existing.IsLocked() {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-dks83", "user must be locked")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-dks83", "Errors.User.NotLocked")
 	}
 
 	repoExisting := model.UserFromModel(existing)
@@ -285,10 +285,10 @@ func (es *UserEventstore) UserChanges(ctx context.Context, id string, lastSequen
 	events, err := es.Eventstore.FilterEvents(context.Background(), query)
 	if err != nil {
 		logging.Log("EVENT-g9HCv").WithError(err).Warn("eventstore unavailable")
-		return nil, errors.ThrowInternal(err, "EVENT-htuG9", "unable to get current user")
+		return nil, errors.ThrowInternal(err, "EVENT-htuG9", "Errors.Internal")
 	}
 	if len(events) == 0 {
-		return nil, caos_errs.ThrowNotFound(nil, "EVENT-6cAxe", "no objects found")
+		return nil, caos_errs.ThrowNotFound(nil, "EVENT-6cAxe", "Errors.User.NoChanges")
 	}
 
 	result := make([]*usr_model.UserChange, 0)
@@ -335,7 +335,7 @@ func ChangesQuery(userID string, latestSequence uint64) *es_models.SearchQuery {
 
 func (es *UserEventstore) InitializeUserCodeByID(ctx context.Context, userID string) (*usr_model.InitUserCode, error) {
 	if userID == "" {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-d8diw", "userID missing")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-d8diw", "Errors.User.UserIDMissing")
 	}
 	user, err := es.UserByID(ctx, userID)
 	if err != nil {
@@ -345,12 +345,12 @@ func (es *UserEventstore) InitializeUserCodeByID(ctx context.Context, userID str
 	if user.InitCode != nil {
 		return user.InitCode, nil
 	}
-	return nil, caos_errs.ThrowNotFound(nil, "EVENT-d8e2", "init code not found")
+	return nil, caos_errs.ThrowNotFound(nil, "EVENT-d8e2", "Erorrs.User.InitCodeNotFound")
 }
 
 func (es *UserEventstore) CreateInitializeUserCodeByID(ctx context.Context, userID string) (*usr_model.InitUserCode, error) {
 	if userID == "" {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-dic8s", "userID missing")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-dic8s", "Errors.User.UserIDMissing")
 	}
 	user, err := es.UserByID(ctx, userID)
 	if err != nil {
@@ -377,7 +377,7 @@ func (es *UserEventstore) CreateInitializeUserCodeByID(ctx context.Context, user
 
 func (es *UserEventstore) InitCodeSent(ctx context.Context, userID string) error {
 	if userID == "" {
-		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-0posw", "userID missing")
+		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-0posw", "Errors.User.UserIDMissing")
 	}
 	user, err := es.UserByID(ctx, userID)
 	if err != nil {
@@ -453,7 +453,7 @@ func (es *UserEventstore) SkipMfaInit(ctx context.Context, userID string) error
 
 func (es *UserEventstore) UserPasswordByID(ctx context.Context, userID string) (*usr_model.Password, error) {
 	if userID == "" {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-di834", "userID missing")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-di834", "Errors.User.UserIDMissing")
 	}
 	user, err := es.UserByID(ctx, userID)
 	if err != nil {
@@ -463,7 +463,7 @@ func (es *UserEventstore) UserPasswordByID(ctx context.Context, userID string) (
 	if user.Password != nil {
 		return user.Password, nil
 	}
-	return nil, caos_errs.ThrowNotFound(nil, "EVENT-d8e2", "password not found")
+	return nil, caos_errs.ThrowNotFound(nil, "EVENT-d8e2", "Errors.User.Password.NotFound")
 }
 
 func (es *UserEventstore) CheckPassword(ctx context.Context, userID, password string, authRequest *req_model.AuthRequest) error {
@@ -596,7 +596,7 @@ func (es *UserEventstore) PasswordCodeSent(ctx context.Context, userID string) e
 
 func (es *UserEventstore) ProfileByID(ctx context.Context, userID string) (*usr_model.Profile, error) {
 	if userID == "" {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-di834", "userID missing")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-di834", "Errors.User.UserIDMissing")
 	}
 	user, err := es.UserByID(ctx, userID)
 	if err != nil {
@@ -606,12 +606,12 @@ func (es *UserEventstore) ProfileByID(ctx context.Context, userID string) (*usr_
 	if user.Profile != nil {
 		return user.Profile, nil
 	}
-	return nil, caos_errs.ThrowNotFound(nil, "EVENT-dk23f", "profile not found")
+	return nil, caos_errs.ThrowNotFound(nil, "EVENT-dk23f", "Errors.User.ProfileNotFound")
 }
 
 func (es *UserEventstore) ChangeProfile(ctx context.Context, profile *usr_model.Profile) (*usr_model.Profile, error) {
 	if !profile.IsValid() {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-d82i3", "profile is invalid")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-d82i3", "Errors.User.ProfileInvalid")
 	}
 	existing, err := es.UserByID(ctx, profile.AggregateID)
 	if err != nil {
@@ -632,7 +632,7 @@ func (es *UserEventstore) ChangeProfile(ctx context.Context, profile *usr_model.
 
 func (es *UserEventstore) EmailByID(ctx context.Context, userID string) (*usr_model.Email, error) {
 	if userID == "" {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-di834", "userID missing")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-di834", "Errors.User.UserIDMissing")
 	}
 	user, err := es.UserByID(ctx, userID)
 	if err != nil {
@@ -642,12 +642,12 @@ func (es *UserEventstore) EmailByID(ctx context.Context, userID string) (*usr_mo
 	if user.Email != nil {
 		return user.Email, nil
 	}
-	return nil, caos_errs.ThrowNotFound(nil, "EVENT-dki89", "email not found")
+	return nil, caos_errs.ThrowNotFound(nil, "EVENT-dki89", "Errors.User.EmailNotFound")
 }
 
 func (es *UserEventstore) ChangeEmail(ctx context.Context, email *usr_model.Email) (*usr_model.Email, error) {
 	if !email.IsValid() {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-lco09", "email is invalid")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-lco09", "Errors.User.EmailInvalid")
 	}
 	existing, err := es.UserByID(ctx, email.AggregateID)
 	if err != nil {
@@ -713,17 +713,17 @@ func (es *UserEventstore) setEmailVerifyResult(ctx context.Context, existing *us
 
 func (es *UserEventstore) CreateEmailVerificationCode(ctx context.Context, userID string) error {
 	if userID == "" {
-		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-lco09", "userID missing")
+		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-lco09", "Errors.User.UserIDMissing")
 	}
 	existing, err := es.UserByID(ctx, userID)
 	if err != nil {
 		return err
 	}
 	if existing.Email == nil {
-		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-pdo9s", "no email existing")
+		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-pdo9s", "Errors.User.EmailNotFound")
 	}
 	if existing.IsEmailVerified {
-		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-pdo9s", "email already verified")
+		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-pdo9s", "Errors.User.EmailAlreadyVerified")
 	}
 
 	emailCode := new(usr_model.EmailCode)
@@ -746,7 +746,7 @@ func (es *UserEventstore) CreateEmailVerificationCode(ctx context.Context, userI
 
 func (es *UserEventstore) EmailVerificationCodeSent(ctx context.Context, userID string) error {
 	if userID == "" {
-		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-spo0w", "userID missing")
+		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-spo0w", "Errors.User.UserIDMissing")
 	}
 	user, err := es.UserByID(ctx, userID)
 	if err != nil {
@@ -765,7 +765,7 @@ func (es *UserEventstore) EmailVerificationCodeSent(ctx context.Context, userID
 
 func (es *UserEventstore) PhoneByID(ctx context.Context, userID string) (*usr_model.Phone, error) {
 	if userID == "" {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-do9se", "userID missing")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-do9se", "Errors.User.UserIDMissing")
 	}
 	user, err := es.UserByID(ctx, userID)
 	if err != nil {
@@ -775,12 +775,12 @@ func (es *UserEventstore) PhoneByID(ctx context.Context, userID string) (*usr_mo
 	if user.Phone != nil {
 		return user.Phone, nil
 	}
-	return nil, caos_errs.ThrowNotFound(nil, "EVENT-pos9e", "phone not found")
+	return nil, caos_errs.ThrowNotFound(nil, "EVENT-pos9e", "Errors.User.PhoneNotFound")
 }
 
 func (es *UserEventstore) ChangePhone(ctx context.Context, phone *usr_model.Phone) (*usr_model.Phone, error) {
 	if !phone.IsValid() {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-do9s4", "phone is invalid")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-do9s4", "Errors.User.PhoneInvalid")
 	}
 	existing, err := es.UserByID(ctx, phone.AggregateID)
 	if err != nil {
@@ -808,14 +808,14 @@ func (es *UserEventstore) ChangePhone(ctx context.Context, phone *usr_model.Phon
 
 func (es *UserEventstore) VerifyPhone(ctx context.Context, userID, verificationCode string) error {
 	if userID == "" || verificationCode == "" {
-		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-dsi8s", "userId or Code empty")
+		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-dsi8s", "Errors.User.UserIDMissing")
 	}
 	existing, err := es.UserByID(ctx, userID)
 	if err != nil {
 		return err
 	}
 	if existing.PhoneCode == nil {
-		return caos_errs.ThrowNotFound(nil, "EVENT-slp0s", "code not found")
+		return caos_errs.ThrowNotFound(nil, "EVENT-slp0s", "Errors.User.Code.NotFound")
 	}
 
 	err = crypto.VerifyCode(existing.PhoneCode.CreationDate, existing.PhoneCode.Expiry, existing.PhoneCode.Code, verificationCode, es.PhoneVerificationCode)
@@ -825,7 +825,7 @@ func (es *UserEventstore) VerifyPhone(ctx context.Context, userID, verificationC
 	if err := es.setPhoneVerifyResult(ctx, existing, PhoneVerificationFailedAggregate); err != nil {
 		return err
 	}
-	return caos_errs.ThrowInvalidArgument(err, "EVENT-dsf4G", "invalid code")
+	return caos_errs.ThrowInvalidArgument(err, "EVENT-dsf4G", "Errors.User.Code.Invalid")
 }
 
 func (es *UserEventstore) setPhoneVerifyResult(ctx context.Context, existing *usr_model.User, check func(aggCreator *es_models.AggregateCreator, existing *model.User) es_sdk.AggregateFunc) error {
@@ -840,17 +840,17 @@ func (es *UserEventstore) setPhoneVerifyResult(ctx context.Context, existing *us
 
 func (es *UserEventstore) CreatePhoneVerificationCode(ctx context.Context, userID string) error {
 	if userID == "" {
-		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-do9sw", "userID missing")
+		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-do9sw", "Errors.User.UserIDMissing")
 	}
 	existing, err := es.UserByID(ctx, userID)
 	if err != nil {
 		return err
 	}
 	if existing.Phone == nil {
-		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-sp9fs", "no phone existing")
+		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-sp9fs", "Errors.User.PhoneNotFound")
 	}
 	if existing.IsPhoneVerified {
-		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-sleis", "phone already verified")
+		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-sleis", "Errors.User.PhoneAlreadyVerified")
 	}
 
 	phoneCode := new(usr_model.PhoneCode)
@@ -873,7 +873,7 @@ func (es *UserEventstore) CreatePhoneVerificationCode(ctx context.Context, userI
 
 func (es *UserEventstore) PhoneVerificationCodeSent(ctx context.Context, userID string) error {
 	if userID == "" {
-		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-sp0wa", "userID missing")
+		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-sp0wa", "Errors.User.UserIDMissing")
 	}
 	user, err := es.UserByID(ctx, userID)
 	if err != nil {
@@ -892,7 +892,7 @@ func (es *UserEventstore) PhoneVerificationCodeSent(ctx context.Context, userID
 
 func (es *UserEventstore) AddressByID(ctx context.Context, userID string) (*usr_model.Address, error) {
 	if userID == "" {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-di8ws", "userID missing")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-di8ws", "Errors.User.UserIDMissing")
 	}
 	user, err := es.UserByID(ctx, userID)
 	if err != nil {
@@ -902,7 +902,7 @@ func (es *UserEventstore) AddressByID(ctx context.Context, userID string) (*usr_
 	if user.Address != nil {
 		return user.Address, nil
 	}
-	return nil, caos_errs.ThrowNotFound(nil, "EVENT-so9wa", "address not found")
+	return nil, caos_errs.ThrowNotFound(nil, "EVENT-so9wa", "Errors.User.AddressNotFound")
 }
 
 func (es *UserEventstore) ChangeAddress(ctx context.Context, address *usr_model.Address) (*usr_model.Address, error) {
@@ -960,7 +960,7 @@ func (es *UserEventstore) RemoveOTP(ctx context.Context, userID string) error {
 		return err
 	}
 	if existing.OTP == nil {
-		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-sp0de", "no otp existing")
+		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-sp0de", "Errors.User.Mfa.Otp.NotExisting")
 	}
 	repoExisting := model.UserFromModel(existing)
 	updateAggregate := MfaOTPRemoveAggregate(es.AggregateCreator(), repoExisting)

internal/user/repository/eventsourcing/user.go

@@ -12,7 +12,7 @@ import (
 
 func UserByIDQuery(id string, latestSequence uint64) (*es_models.SearchQuery, error) {
 	if id == "" {
-		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-d8isw", "id should be filled")
+		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-d8isw", "Errors.User.UserIDMissing")
 	}
 	return UserQuery(latestSequence).
 		AggregateIDFilter(id), nil
@@ -42,14 +42,14 @@ func UserEmailUniqueQuery(email string) *es_models.SearchQuery {
 
 func UserAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, user *model.User) (*es_models.Aggregate, error) {
 	if user == nil {
-		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dis83", "existing user should not be nil")
+		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dis83", "Errors.Internal")
 	}
 	return aggCreator.NewAggregate(ctx, user.AggregateID, model.UserAggregate, model.UserVersion, user.Sequence)
 }
 
 func UserAggregateOverwriteContext(ctx context.Context, aggCreator *es_models.AggregateCreator, user *model.User, resourceOwnerID string, userID string) (*es_models.Aggregate, error) {
 	if user == nil {
-		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dis83", "existing user should not be nil")
+		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dis83", "Errors.Internal")
 	}
 
 	return aggCreator.NewAggregate(ctx, user.AggregateID, model.UserAggregate, model.UserVersion, user.Sequence, es_models.OverwriteResourceOwner(resourceOwnerID), es_models.OverwriteEditorUser(userID))
@@ -57,7 +57,7 @@ func UserAggregateOverwriteContext(ctx context.Context, aggCreator *es_models.Ag
 
 func UserCreateAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, user *model.User, initCode *model.InitUserCode, phoneCode *model.PhoneCode, resourceOwner string, userLoginMustBeDomain bool) (_ []*es_models.Aggregate, err error) {
 	if user == nil {
-		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-duxk2", "user should not be nil")
+		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-duxk2", "Errors.Internal")
 	}
 
 	var agg *es_models.Aggregate
@@ -311,7 +311,7 @@ func SkipMfaAggregate(aggCreator *es_models.AggregateCreator, existing *model.Us
 func PasswordChangeAggregate(aggCreator *es_models.AggregateCreator, existing *model.User, password *model.Password) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if password == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-d9832", "password should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-d9832", "Errors.Internal")
 		}
 		agg, err := UserAggregate(ctx, aggCreator, existing)
 		if err != nil {
@@ -343,7 +343,7 @@ func PasswordCheckFailedAggregate(aggCreator *es_models.AggregateCreator, existi
 func RequestSetPassword(aggCreator *es_models.AggregateCreator, existing *model.User, request *model.PasswordCode) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if request == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-d8ei2", "password set request should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-d8ei2", "Errors.Internal")
 		}
 		agg, err := UserAggregate(ctx, aggCreator, existing)
 		if err != nil {
@@ -366,7 +366,7 @@ func PasswordCodeSentAggregate(aggCreator *es_models.AggregateCreator, existing
 func ProfileChangeAggregate(aggCreator *es_models.AggregateCreator, existing *model.User, profile *model.Profile) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if profile == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dhr74", "profile should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dhr74", "Errors.Internal")
 		}
 		agg, err := UserAggregate(ctx, aggCreator, existing)
 		if err != nil {
@@ -374,7 +374,7 @@ func ProfileChangeAggregate(aggCreator *es_models.AggregateCreator, existing *mo
 		}
 		changes := existing.Profile.Changes(profile)
 		if len(changes) == 0 {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-0spow", "no changes found")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-0spow", "Errors.NoChangesFound")
 		}
 		return agg.AppendEvent(model.UserProfileChanged, changes)
 	}
@@ -382,14 +382,14 @@ func ProfileChangeAggregate(aggCreator *es_models.AggregateCreator, existing *mo
 
 func EmailChangeAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, existing *model.User, email *model.Email, code *model.EmailCode) ([]*es_models.Aggregate, error) {
 	if email == nil {
-		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dki8s", "email should not be nil")
+		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dki8s", "Errors.Internal")
 	}
 	if (!email.IsEmailVerified && code == nil) || (email.IsEmailVerified && code != nil) {
-		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-id934", "email has to be verified or code must be sent")
+		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-id934", "Errors.Internal")
 	}
 	changes := existing.Email.Changes(email)
 	if len(changes) == 0 {
-		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-s90pw", "no changes found")
+		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-s90pw", "Errors.NoChangesFound")
 	}
 	aggregates := make([]*es_models.Aggregate, 0, 4)
 	reserveEmailAggregate, err := reservedUniqueEmailAggregate(ctx, aggCreator, "", email.EmailAddress)
@@ -451,7 +451,7 @@ func EmailVerificationFailedAggregate(aggCreator *es_models.AggregateCreator, ex
 func EmailVerificationCodeAggregate(aggCreator *es_models.AggregateCreator, existing *model.User, code *model.EmailCode) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if code == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dki8s", "code should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dki8s", "Errors.Internal")
 		}
 		agg, err := UserAggregate(ctx, aggCreator, existing)
 		if err != nil {
@@ -474,10 +474,10 @@ func EmailCodeSentAggregate(aggCreator *es_models.AggregateCreator, existing *mo
 func PhoneChangeAggregate(aggCreator *es_models.AggregateCreator, existing *model.User, phone *model.Phone, code *model.PhoneCode) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if phone == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dkso3", "phone should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dkso3", "Errors.Internal")
 		}
 		if (!phone.IsPhoneVerified && code == nil) || (phone.IsPhoneVerified && code != nil) {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dksi8", "phone has to be verified or code must be sent")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dksi8", "Errors.Internal")
 		}
 		agg, err := UserAggregate(ctx, aggCreator, existing)
 		if err != nil {
@@ -488,7 +488,7 @@ func PhoneChangeAggregate(aggCreator *es_models.AggregateCreator, existing *mode
 		}
 		changes := existing.Phone.Changes(phone)
 		if len(changes) == 0 {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-sp0oc", "no changes found")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-sp0oc", "Errors.NoChangesFound")
 		}
 		agg, err = agg.AppendEvent(model.UserPhoneChanged, changes)
 		if err != nil {
@@ -527,7 +527,7 @@ func PhoneVerificationFailedAggregate(aggCreator *es_models.AggregateCreator, ex
 func PhoneVerificationCodeAggregate(aggCreator *es_models.AggregateCreator, existing *model.User, code *model.PhoneCode) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if code == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dsue2", "code should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dsue2", "Errors.Internal")
 		}
 		agg, err := UserAggregate(ctx, aggCreator, existing)
 		if err != nil {
@@ -550,7 +550,7 @@ func PhoneCodeSentAggregate(aggCreator *es_models.AggregateCreator, existing *mo
 func AddressChangeAggregate(aggCreator *es_models.AggregateCreator, existing *model.User, address *model.Address) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if address == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dkx9s", "address should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dkx9s", "Errors.Internal")
 		}
 		agg, err := UserAggregate(ctx, aggCreator, existing)
 		if err != nil {
@@ -561,7 +561,7 @@ func AddressChangeAggregate(aggCreator *es_models.AggregateCreator, existing *mo
 		}
 		changes := existing.Address.Changes(address)
 		if len(changes) == 0 {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-2tszw", "no changes found")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-2tszw", "Errors.NoChangesFound")
 		}
 		return agg.AppendEvent(model.UserAddressChanged, changes)
 	}
@@ -570,7 +570,7 @@ func AddressChangeAggregate(aggCreator *es_models.AggregateCreator, existing *mo
 func MfaOTPAddAggregate(aggCreator *es_models.AggregateCreator, existing *model.User, otp *model.OTP) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if otp == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dkx9s", "otp should not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dkx9s", "Errors.Internal")
 		}
 		agg, err := UserAggregate(ctx, aggCreator, existing)
 		if err != nil {
@@ -593,7 +593,7 @@ func MfaOTPVerifyAggregate(aggCreator *es_models.AggregateCreator, existing *mod
 func MfaOTPCheckSucceededAggregate(aggCreator *es_models.AggregateCreator, existing *model.User, authReq *model.AuthRequest) es_sdk.AggregateFunc {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if authReq == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-sd5DA", "authReq must not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-sd5DA", "Errors.Internal")
 		}
 		agg, err := UserAggregate(ctx, aggCreator, existing)
 		if err != nil {
@@ -606,7 +606,7 @@ func MfaOTPCheckSucceededAggregate(aggCreator *es_models.AggregateCreator, exist
 func MfaOTPCheckFailedAggregate(aggCreator *es_models.AggregateCreator, existing *model.User, authReq *model.AuthRequest) es_sdk.AggregateFunc {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if authReq == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-64sd6", "authReq must not be nil")
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-64sd6", "Errors.Internal")
 		}
 		agg, err := UserAggregate(ctx, aggCreator, existing)
 		if err != nil {
@@ -684,7 +684,7 @@ func addUserNameValidation(userName string) func(...*es_models.Event) error {
 		}
 		for _, d := range domains {
 			if d.Verified && d.Domain == split[1] {
-				return errors.ThrowPreconditionFailed(nil, "EVENT-us5Zw", "domain already reserved")
+				return errors.ThrowPreconditionFailed(nil, "EVENT-us5Zw", "Errors.User.DomainNotAllowedAsUsername")
 			}
 		}
 		return nil

internal/usergrant/repository/eventsourcing/eventstore.go

@@ -49,7 +49,7 @@ func (es *UserGrantEventStore) UserGrantByID(ctx context.Context, id string) (*g
 	}
 	es.userGrantCache.cacheUserGrant(grant)
 	if grant.State == int32(grant_model.USERGRANTSTATE_REMOVED) {
-		return nil, caos_errs.ThrowNotFound(nil, "EVENT-2ks8d", "UserGrant not found")
+		return nil, caos_errs.ThrowNotFound(nil, "EVENT-2ks8d", "Errors.UserGrant.NotFound")
 	}
 	return model.UserGrantToModel(grant), nil
 }
@@ -82,7 +82,7 @@ func (es *UserGrantEventStore) AddUserGrants(ctx context.Context, grants ...*gra
 
 func (es *UserGrantEventStore) PrepareAddUserGrant(ctx context.Context, grant *grant_model.UserGrant) (*model.UserGrant, []*es_models.Aggregate, error) {
 	if grant == nil || !grant.IsValid() {
-		return nil, nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-sdiw3", "User grant invalid")
+		return nil, nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-sdiw3", "Errors.UserGrant.Invalid")
 	}
 	id, err := es.idGenerator.Next()
 	if err != nil {
@@ -101,7 +101,7 @@ func (es *UserGrantEventStore) PrepareAddUserGrant(ctx context.Context, grant *g
 
 func (es *UserGrantEventStore) PrepareChangeUserGrant(ctx context.Context, grant *grant_model.UserGrant, cascade bool) (*model.UserGrant, *es_models.Aggregate, error) {
 	if grant == nil {
-		return nil, nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-lo0s9", "invalid grant")
+		return nil, nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-lo0s9", "Errors.UserGrant.Invalid")
 	}
 	existing, err := es.UserGrantByID(ctx, grant.AggregateID)
 	if err != nil {
@@ -187,14 +187,14 @@ func (es *UserGrantEventStore) PrepareRemoveUserGrant(ctx context.Context, grant
 
 func (es *UserGrantEventStore) DeactivateUserGrant(ctx context.Context, grantID string) (*grant_model.UserGrant, error) {
 	if grantID == "" {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-8si34", "grantID missing")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-8si34", "Errors.UserGrant.IDMissing")
 	}
 	existing, err := es.UserGrantByID(ctx, grantID)
 	if err != nil {
 		return nil, err
 	}
 	if !existing.IsActive() {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-lo9sw", "deactivate only possible for active grant")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-lo9sw", "Errors.UserGrant.NotActive")
 	}
 	repoExisting := model.UserGrantFromModel(existing)
 	repoGrant := &model.UserGrant{ObjectRoot: models.ObjectRoot{AggregateID: grantID}}
@@ -210,14 +210,14 @@ func (es *UserGrantEventStore) DeactivateUserGrant(ctx context.Context, grantID
 
 func (es *UserGrantEventStore) ReactivateUserGrant(ctx context.Context, grantID string) (*grant_model.UserGrant, error) {
 	if grantID == "" {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-sksiw", "grantID missing")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-sksiw", "Errors.UserGrant.IDMissing")
 	}
 	existing, err := es.UserGrantByID(ctx, grantID)
 	if err != nil {
 		return nil, err
 	}
 	if !existing.IsInactive() {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-lo9sw", "reactivate only possible for inactive grant")
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-lo9sw", "Errors.UserGrant.NotInactive")
 	}
 	repoExisting := model.UserGrantFromModel(existing)
 	repoGrant := &model.UserGrant{ObjectRoot: models.ObjectRoot{AggregateID: grantID}}

pkg/admin/admin.go

@@ -20,5 +20,5 @@ func Start(ctx context.Context, config Config, authZRepo *authz_repo.EsRepositor
 	repo, err := eventsourcing.Start(ctx, config.Repository, systemDefaults)
 	logging.Log("MAIN-9uBxp").OnError(err).Panic("unable to start app")
 
-	api.Start(ctx, config.API, authZRepo, authZ, repo)
+	api.Start(ctx, config.API, authZRepo, authZ, systemDefaults, repo)
 }

pkg/admin/api/api.go

@@ -3,6 +3,7 @@ package api
 import (
 	"context"
 	authz_repo "github.com/caos/zitadel/internal/authz/repository/eventsourcing"
+	"github.com/caos/zitadel/internal/config/systemdefaults"
 
 	"github.com/caos/zitadel/internal/admin/repository"
 	"github.com/caos/zitadel/internal/api/auth"
@@ -15,10 +16,10 @@ type Config struct {
 	GRPC grpc_util.Config
 }
 
-func Start(ctx context.Context, conf Config, authZRepo *authz_repo.EsRepository, authZ auth.Config, repo repository.Repository) {
+func Start(ctx context.Context, conf Config, authZRepo *authz_repo.EsRepository, authZ auth.Config, defaults systemdefaults.SystemDefaults, repo repository.Repository) {
 	grpcServer := grpc.StartServer(conf.GRPC.ToServerConfig(), authZRepo, authZ, repo)
 	grpcGateway := grpc.StartGateway(conf.GRPC.ToGatewayConfig())
 
-	server.StartServer(ctx, grpcServer)
+	server.StartServer(ctx, grpcServer, defaults)
 	server.StartGateway(ctx, grpcGateway)
 }

pkg/admin/api/grpc/gateway.go

@@ -41,7 +41,7 @@ func (gw *Gateway) GatewayServeMuxOptions() []runtime.ServeMuxOption {
 					return header, true
 				}
 			}
-			return header, false
+			return runtime.DefaultHeaderMatcher(header)
 		}),
 	}
 }

pkg/admin/api/grpc/server.go

@@ -7,6 +7,7 @@ import (
 	grpc_util "github.com/caos/zitadel/internal/api/grpc"
 	"github.com/caos/zitadel/internal/api/grpc/server/middleware"
 	authz_repo "github.com/caos/zitadel/internal/authz/repository/eventsourcing"
+	"github.com/caos/zitadel/internal/config/systemdefaults"
 	grpc_middleware "github.com/grpc-ecosystem/go-grpc-middleware"
 	"google.golang.org/grpc"
 )
@@ -35,12 +36,12 @@ func (s *Server) GRPCPort() string {
 	return s.port
 }
 
-func (s *Server) GRPCServer() (*grpc.Server, error) {
+func (s *Server) GRPCServer(defaults systemdefaults.SystemDefaults) (*grpc.Server, error) {
 	gs := grpc.NewServer(
 		middleware.TracingStatsServer("/Healthz", "/Ready", "/Validate"),
 		grpc.UnaryInterceptor(
 			grpc_middleware.ChainUnaryServer(
-				middleware.ErrorHandler(),
+				middleware.ErrorHandler(defaults.DefaultLanguage),
 				AdminService_Authorization_Interceptor(s.verifier, &s.authZ),
 			),
 		),

pkg/auth/api/api.go

@@ -3,6 +3,7 @@ package api
 import (
 	"context"
 	authz_repo "github.com/caos/zitadel/internal/authz/repository/eventsourcing"
+	"github.com/caos/zitadel/internal/config/systemdefaults"
 
 	"github.com/caos/oidc/pkg/op"
 
@@ -19,12 +20,12 @@ type Config struct {
 	OIDC oidc.OPHandlerConfig
 }
 
-func Start(ctx context.Context, conf Config, authZRepo *authz_repo.EsRepository, authZ auth_util.Config, authRepo repository.Repository) {
+func Start(ctx context.Context, conf Config, authZRepo *authz_repo.EsRepository, authZ auth_util.Config, defaults systemdefaults.SystemDefaults, authRepo repository.Repository) {
 	grpcServer := grpc.StartServer(conf.GRPC.ToServerConfig(), authZRepo, authZ, authRepo)
 	grpcGateway := grpc.StartGateway(conf.GRPC.ToGatewayConfig())
 	oidcHandler := oidc.NewProvider(ctx, conf.OIDC, authRepo)
 
-	server.StartServer(ctx, grpcServer)
+	server.StartServer(ctx, grpcServer, defaults)
 	server.StartGateway(ctx, grpcGateway)
 	op.Start(ctx, oidcHandler)
 }

pkg/auth/api/grpc/gateway.go

@@ -43,7 +43,7 @@ func (gw *Gateway) GatewayServeMuxOptions() []runtime.ServeMuxOption {
 					return header, true
 				}
 			}
-			return header, false
+			return runtime.DefaultHeaderMatcher(header)
 		}),
 	}
 }

pkg/auth/api/grpc/server.go

@@ -2,6 +2,7 @@ package grpc
 
 import (
 	authz_repo "github.com/caos/zitadel/internal/authz/repository/eventsourcing"
+	"github.com/caos/zitadel/internal/config/systemdefaults"
 	grpc_middleware "github.com/grpc-ecosystem/go-grpc-middleware"
 	"google.golang.org/grpc"
 
@@ -34,12 +35,12 @@ func (s *Server) GRPCPort() string {
 	return s.port
 }
 
-func (s *Server) GRPCServer() (*grpc.Server, error) {
+func (s *Server) GRPCServer(defaults systemdefaults.SystemDefaults) (*grpc.Server, error) {
 	gs := grpc.NewServer(
 		middleware.TracingStatsServer("/Healthz", "/Ready", "/Validate"),
 		grpc.UnaryInterceptor(
 			grpc_middleware.ChainUnaryServer(
-				middleware.ErrorHandler(),
+				middleware.ErrorHandler(defaults.DefaultLanguage),
 				AuthService_Authorization_Interceptor(s.verifier, &s.authZ),
 			),
 		),

pkg/auth/auth.go

@@ -16,5 +16,5 @@ type Config struct {
 }
 
 func Start(ctx context.Context, config Config, authZRepo *authz_repo.EsRepository, authZ auth.Config, systemDefaults sd.SystemDefaults, authRepo *eventsourcing.EsRepository) {
-	api.Start(ctx, config.API, authZRepo, authZ, authRepo)
+	api.Start(ctx, config.API, authZRepo, authZ, systemDefaults, authRepo)
 }

pkg/management/api/api.go

@@ -16,10 +16,10 @@ type Config struct {
 	GRPC grpc_util.Config
 }
 
-func Start(ctx context.Context, conf Config, authZRepo *authz_repo.EsRepository, authZ auth.Config, sd systemdefaults.SystemDefaults, repo repository.Repository) {
+func Start(ctx context.Context, conf Config, authZRepo *authz_repo.EsRepository, authZ auth.Config, defaults systemdefaults.SystemDefaults, repo repository.Repository) {
-	grpcServer := grpc.StartServer(conf.GRPC.ToServerConfig(), authZRepo, authZ, sd, repo)
+	grpcServer := grpc.StartServer(conf.GRPC.ToServerConfig(), authZRepo, authZ, defaults, repo)
 	grpcGateway := grpc.StartGateway(conf.GRPC.ToGatewayConfig())
 
-	server.StartServer(ctx, grpcServer)
+	server.StartServer(ctx, grpcServer, defaults)
 	server.StartGateway(ctx, grpcGateway)
 }

pkg/management/api/grpc/gateway.go

@@ -41,7 +41,7 @@ func (gw *Gateway) GatewayServeMuxOptions() []runtime.ServeMuxOption {
 					return header, true
 				}
 			}
-			return header, false
+			return runtime.DefaultHeaderMatcher(header)
 		}),
 	}
 }

pkg/management/api/grpc/server.go

@@ -46,12 +46,12 @@ func (s *Server) GRPCPort() string {
 	return s.port
 }
 
-func (s *Server) GRPCServer() (*grpc.Server, error) {
+func (s *Server) GRPCServer(defaults systemdefaults.SystemDefaults) (*grpc.Server, error) {
 	gs := grpc.NewServer(
 		middleware.TracingStatsServer("/Healthz", "/Ready", "/Validate"),
 		grpc.UnaryInterceptor(
 			grpc_middleware.ChainUnaryServer(
-				middleware.ErrorHandler(),
+				middleware.ErrorHandler(defaults.DefaultLanguage),
 				ManagementService_Authorization_Interceptor(s.verifier, &s.authZ),
 			),
 		),