feat: OIDC setting (#3245)

* feat: add oidc config struct

* feat: oidc config command side

* feat: oidc configuration query side

* feat: add translations

* feat: add tests

* feat: add translations

* feat: rename oidc config to oidc settings

* feat: rename oidc config to oidc settings

internal/query/oidc_settings.go

@@ -0,0 +1,115 @@
+package query
+
+import (
+	"context"
+	"database/sql"
+	errs "errors"
+	"time"
+
+	sq "github.com/Masterminds/squirrel"
+	"github.com/caos/zitadel/internal/errors"
+	"github.com/caos/zitadel/internal/query/projection"
+)
+
+var (
+	oidcSettingsTable = table{
+		name: projection.OIDCSettingsProjectionTable,
+	}
+	OIDCSettingsColumnAggregateID = Column{
+		name:  projection.OIDCSettingsColumnAggregateID,
+		table: oidcSettingsTable,
+	}
+	OIDCSettingsColumnCreationDate = Column{
+		name:  projection.OIDCSettingsColumnCreationDate,
+		table: oidcSettingsTable,
+	}
+	OIDCSettingsColumnChangeDate = Column{
+		name:  projection.OIDCSettingsColumnChangeDate,
+		table: oidcSettingsTable,
+	}
+	OIDCSettingsColumnResourceOwner = Column{
+		name:  projection.OIDCSettingsColumnResourceOwner,
+		table: oidcSettingsTable,
+	}
+	OIDCSettingsColumnSequence = Column{
+		name:  projection.OIDCSettingsColumnSequence,
+		table: oidcSettingsTable,
+	}
+	OIDCSettingsColumnAccessTokenLifetime = Column{
+		name:  projection.OIDCSettingsColumnAccessTokenLifetime,
+		table: oidcSettingsTable,
+	}
+	OIDCSettingsColumnIdTokenLifetime = Column{
+		name:  projection.OIDCSettingsColumnIdTokenLifetime,
+		table: oidcSettingsTable,
+	}
+	OIDCSettingsColumnRefreshTokenIdleExpiration = Column{
+		name:  projection.OIDCSettingsColumnRefreshTokenIdleExpiration,
+		table: oidcSettingsTable,
+	}
+	OIDCSettingsColumnRefreshTokenExpiration = Column{
+		name:  projection.OIDCSettingsColumnRefreshTokenExpiration,
+		table: oidcSettingsTable,
+	}
+)
+
+type OIDCSettings struct {
+	AggregateID   string
+	CreationDate  time.Time
+	ChangeDate    time.Time
+	ResourceOwner string
+	Sequence      uint64
+
+	AccessTokenLifetime        time.Duration
+	IdTokenLifetime            time.Duration
+	RefreshTokenIdleExpiration time.Duration
+	RefreshTokenExpiration     time.Duration
+}
+
+func (q *Queries) OIDCSettingsByAggID(ctx context.Context, aggregateID string) (*OIDCSettings, error) {
+	stmt, scan := prepareOIDCSettingsQuery()
+	query, args, err := stmt.Where(sq.Eq{
+		OIDCSettingsColumnAggregateID.identifier(): aggregateID,
+	}).ToSql()
+	if err != nil {
+		return nil, errors.ThrowInternal(err, "QUERY-s9nle", "Errors.Query.SQLStatment")
+	}
+
+	row := q.client.QueryRowContext(ctx, query, args...)
+	return scan(row)
+}
+
+func prepareOIDCSettingsQuery() (sq.SelectBuilder, func(*sql.Row) (*OIDCSettings, error)) {
+	return sq.Select(
+			OIDCSettingsColumnAggregateID.identifier(),
+			OIDCSettingsColumnCreationDate.identifier(),
+			OIDCSettingsColumnChangeDate.identifier(),
+			OIDCSettingsColumnResourceOwner.identifier(),
+			OIDCSettingsColumnSequence.identifier(),
+			OIDCSettingsColumnAccessTokenLifetime.identifier(),
+			OIDCSettingsColumnIdTokenLifetime.identifier(),
+			OIDCSettingsColumnRefreshTokenIdleExpiration.identifier(),
+			OIDCSettingsColumnRefreshTokenExpiration.identifier()).
+			From(oidcSettingsTable.identifier()).PlaceholderFormat(sq.Dollar),
+		func(row *sql.Row) (*OIDCSettings, error) {
+			oidcSettings := new(OIDCSettings)
+			err := row.Scan(
+				&oidcSettings.AggregateID,
+				&oidcSettings.CreationDate,
+				&oidcSettings.ChangeDate,
+				&oidcSettings.ResourceOwner,
+				&oidcSettings.Sequence,
+				&oidcSettings.AccessTokenLifetime,
+				&oidcSettings.IdTokenLifetime,
+				&oidcSettings.RefreshTokenIdleExpiration,
+				&oidcSettings.RefreshTokenExpiration,
+			)
+			if err != nil {
+				if errs.Is(err, sql.ErrNoRows) {
+					return nil, errors.ThrowNotFound(err, "QUERY-s9nlw", "Errors.OIDCSettings.NotFound")
+				}
+				return nil, errors.ThrowInternal(err, "QUERY-9bf8s", "Errors.Internal")
+			}
+			return oidcSettings, nil
+		}
+}

internal/query/oidc_settings_test.go

@@ -0,0 +1,136 @@
+package query
+
+import (
+	"database/sql"
+	"database/sql/driver"
+	"errors"
+	"fmt"
+	"regexp"
+	"testing"
+	"time"
+
+	errs "github.com/caos/zitadel/internal/errors"
+)
+
+func Test_OIDCConfigsPrepares(t *testing.T) {
+	type want struct {
+		sqlExpectations sqlExpectation
+		err             checkErr
+	}
+	tests := []struct {
+		name    string
+		prepare interface{}
+		want    want
+		object  interface{}
+	}{
+		{
+			name:    "prepareOIDCSettingsQuery no result",
+			prepare: prepareOIDCSettingsQuery,
+			want: want{
+				sqlExpectations: mockQueries(
+					`SELECT zitadel.projections.oidc_settings.aggregate_id,`+
+						` zitadel.projections.oidc_settings.creation_date,`+
+						` zitadel.projections.oidc_settings.change_date,`+
+						` zitadel.projections.oidc_settings.resource_owner,`+
+						` zitadel.projections.oidc_settings.sequence,`+
+						` zitadel.projections.oidc_settings.access_token_lifetime,`+
+						` zitadel.projections.oidc_settings.id_token_lifetime,`+
+						` zitadel.projections.oidc_settings.refresh_token_idle_expiration,`+
+						` zitadel.projections.oidc_settings.refresh_token_expiration`+
+						` FROM zitadel.projections.oidc_settings`,
+					nil,
+					nil,
+				),
+				err: func(err error) (error, bool) {
+					if !errs.IsNotFound(err) {
+						return fmt.Errorf("err should be zitadel.NotFoundError got: %w", err), false
+					}
+					return nil, true
+				},
+			},
+			object: (*OIDCSettings)(nil),
+		},
+		{
+			name:    "prepareOIDCSettingsQuery found",
+			prepare: prepareOIDCSettingsQuery,
+			want: want{
+				sqlExpectations: mockQuery(
+					regexp.QuoteMeta(`SELECT zitadel.projections.oidc_settings.aggregate_id,`+
+						` zitadel.projections.oidc_settings.creation_date,`+
+						` zitadel.projections.oidc_settings.change_date,`+
+						` zitadel.projections.oidc_settings.resource_owner,`+
+						` zitadel.projections.oidc_settings.sequence,`+
+						` zitadel.projections.oidc_settings.access_token_lifetime,`+
+						` zitadel.projections.oidc_settings.id_token_lifetime,`+
+						` zitadel.projections.oidc_settings.refresh_token_idle_expiration,`+
+						` zitadel.projections.oidc_settings.refresh_token_expiration`+
+						` FROM zitadel.projections.oidc_settings`),
+					[]string{
+						"aggregate_id",
+						"creation_date",
+						"change_date",
+						"resource_owner",
+						"sequence",
+						"access_token_lifetime",
+						"id_token_lifetime",
+						"refresh_token_idle_expiration",
+						"refresh_token_expiration",
+					},
+					[]driver.Value{
+						"agg-id",
+						testNow,
+						testNow,
+						"ro",
+						uint64(20211108),
+						time.Minute * 1,
+						time.Minute * 2,
+						time.Minute * 3,
+						time.Minute * 4,
+					},
+				),
+			},
+			object: &OIDCSettings{
+				AggregateID:                "agg-id",
+				CreationDate:               testNow,
+				ChangeDate:                 testNow,
+				ResourceOwner:              "ro",
+				Sequence:                   20211108,
+				AccessTokenLifetime:        time.Minute * 1,
+				IdTokenLifetime:            time.Minute * 2,
+				RefreshTokenIdleExpiration: time.Minute * 3,
+				RefreshTokenExpiration:     time.Minute * 4,
+			},
+		},
+		{
+			name:    "prepareOIDCSettingsQuery sql err",
+			prepare: prepareOIDCSettingsQuery,
+			want: want{
+				sqlExpectations: mockQueryErr(
+					regexp.QuoteMeta(`SELECT zitadel.projections.oidc_settings.aggregate_id,`+
+						` zitadel.projections.oidc_settings.creation_date,`+
+						` zitadel.projections.oidc_settings.change_date,`+
+						` zitadel.projections.oidc_settings.resource_owner,`+
+						` zitadel.projections.oidc_settings.sequence,`+
+						` zitadel.projections.oidc_settings.access_token_lifetime,`+
+						` zitadel.projections.oidc_settings.id_token_lifetime,`+
+						` zitadel.projections.oidc_settings.refresh_token_idle_expiration,`+
+						` zitadel.projections.oidc_settings.refresh_token_expiration`+
+						` FROM zitadel.projections.oidc_settings`),
+					sql.ErrConnDone,
+				),
+				err: func(err error) (error, bool) {
+					if !errors.Is(err, sql.ErrConnDone) {
+						return fmt.Errorf("err should be sql.ErrConnDone got: %w", err), false
+					}
+					return nil, true
+				},
+			},
+			object: nil,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assertPrepare(t, tt.prepare, tt.object, tt.want.sqlExpectations, tt.want.err)
+		})
+	}
+}

internal/query/projection/action.go

@@ -32,7 +32,7 @@ type ActionProjection struct {
 }
 
 func NewActionProjection(ctx context.Context, config crdb.StatementHandlerConfig) *ActionProjection {
-	p := &ActionProjection{}
+	p := new(ActionProjection)
 	config.ProjectionName = ActionTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/app.go

@@ -25,7 +25,7 @@ const (
 )
 
 func NewAppProjection(ctx context.Context, config crdb.StatementHandlerConfig) *AppProjection {
-	p := &AppProjection{}
+	p := new(AppProjection)
 	config.ProjectionName = AppProjectionTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/authn_key.go

@@ -35,7 +35,7 @@ type AuthNKeyProjection struct {
 }
 
 func NewAuthNKeyProjection(ctx context.Context, config crdb.StatementHandlerConfig) *AuthNKeyProjection {
-	p := &AuthNKeyProjection{}
+	p := new(AuthNKeyProjection)
 	config.ProjectionName = AuthNKeyTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/custom_text.go

@@ -33,7 +33,7 @@ const (
 )
 
 func NewCustomTextProjection(ctx context.Context, config crdb.StatementHandlerConfig) *CustomTextProjection {
-	p := &CustomTextProjection{}
+	p := new(CustomTextProjection)
 	config.ProjectionName = CustomTextTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/feature.go

@@ -25,7 +25,7 @@ const (
 )
 
 func NewFeatureProjection(ctx context.Context, config crdb.StatementHandlerConfig) *FeatureProjection {
-	p := &FeatureProjection{}
+	p := new(FeatureProjection)
 	config.ProjectionName = FeatureTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/flow.go

@@ -26,7 +26,7 @@ type FlowProjection struct {
 }
 
 func NewFlowProjection(ctx context.Context, config crdb.StatementHandlerConfig) *FlowProjection {
-	p := &FlowProjection{}
+	p := new(FlowProjection)
 	config.ProjectionName = FlowTriggerTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/iam.go

@@ -20,7 +20,7 @@ const (
 )
 
 func NewIAMProjection(ctx context.Context, config crdb.StatementHandlerConfig) *IAMProjection {
-	p := &IAMProjection{}
+	p := new(IAMProjection)
 	config.ProjectionName = IAMProjectionTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/iam_member.go

@@ -22,7 +22,7 @@ const (
 )
 
 func NewIAMMemberProjection(ctx context.Context, config crdb.StatementHandlerConfig) *IAMMemberProjection {
-	p := &IAMMemberProjection{}
+	p := new(IAMMemberProjection)
 	config.ProjectionName = IAMMemberProjectionTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/idp.go

@@ -26,7 +26,7 @@ const (
 )
 
 func NewIDPProjection(ctx context.Context, config crdb.StatementHandlerConfig) *IDPProjection {
-	p := &IDPProjection{}
+	p := new(IDPProjection)
 	config.ProjectionName = IDPTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/idp_login_policy_link.go

@@ -23,7 +23,7 @@ const (
 )
 
 func NewIDPLoginPolicyLinkProjection(ctx context.Context, config crdb.StatementHandlerConfig) *IDPLoginPolicyLinkProjection {
-	p := &IDPLoginPolicyLinkProjection{}
+	p := new(IDPLoginPolicyLinkProjection)
 	config.ProjectionName = IDPLoginPolicyLinkTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/idp_user_link.go

@@ -18,7 +18,7 @@ type IDPUserLinkProjection struct {
 }
 
 func NewIDPUserLinkProjection(ctx context.Context, config crdb.StatementHandlerConfig) *IDPUserLinkProjection {
-	p := &IDPUserLinkProjection{}
+	p := new(IDPUserLinkProjection)
 	config.ProjectionName = IDPUserLinkTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/key.go

@@ -27,7 +27,7 @@ const (
 )
 
 func NewKeyProjection(ctx context.Context, config crdb.StatementHandlerConfig, keyConfig *crypto.KeyConfig, keyChan chan<- interface{}) (_ *KeyProjection, err error) {
-	p := &KeyProjection{}
+	p := new(KeyProjection)
 	config.ProjectionName = KeyProjectionTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/label_policy.go

@@ -23,7 +23,7 @@ const (
 )
 
 func NewLabelPolicyProjection(ctx context.Context, config crdb.StatementHandlerConfig) *LabelPolicyProjection {
-	p := &LabelPolicyProjection{}
+	p := new(LabelPolicyProjection)
 	config.ProjectionName = LabelPolicyTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/lockout_policy.go

@@ -33,7 +33,7 @@ const (
 )
 
 func NewLockoutPolicyProjection(ctx context.Context, config crdb.StatementHandlerConfig) *LockoutPolicyProjection {
-	p := &LockoutPolicyProjection{}
+	p := new(LockoutPolicyProjection)
 	config.ProjectionName = LockoutPolicyTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/login_name.go

@@ -26,7 +26,7 @@ const (
 )
 
 func NewLoginNameProjection(ctx context.Context, config crdb.StatementHandlerConfig) *LoginNameProjection {
-	p := &LoginNameProjection{}
+	p := new(LoginNameProjection)
 	config.ProjectionName = LoginNameProjectionTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/login_policy.go

@@ -23,7 +23,7 @@ const (
 )
 
 func NewLoginPolicyProjection(ctx context.Context, config crdb.StatementHandlerConfig) *LoginPolicyProjection {
-	p := &LoginPolicyProjection{}
+	p := new(LoginPolicyProjection)
 	config.ProjectionName = LoginPolicyTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/mail_template.go

@@ -31,7 +31,7 @@ const (
 )
 
 func NewMailTemplateProjection(ctx context.Context, config crdb.StatementHandlerConfig) *MailTemplateProjection {
-	p := &MailTemplateProjection{}
+	p := new(MailTemplateProjection)
 	config.ProjectionName = MailTemplateTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/message_texts.go

@@ -39,7 +39,7 @@ const (
 )
 
 func NewMessageTextProjection(ctx context.Context, config crdb.StatementHandlerConfig) *MessageTextProjection {
-	p := &MessageTextProjection{}
+	p := new(MessageTextProjection)
 	config.ProjectionName = MessageTextTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/oidc_settings.go

@@ -0,0 +1,114 @@
+package projection
+
+import (
+	"context"
+
+	"github.com/caos/logging"
+	"github.com/caos/zitadel/internal/errors"
+	"github.com/caos/zitadel/internal/eventstore"
+	"github.com/caos/zitadel/internal/eventstore/handler"
+	"github.com/caos/zitadel/internal/eventstore/handler/crdb"
+	"github.com/caos/zitadel/internal/repository/iam"
+	"github.com/caos/zitadel/internal/repository/project"
+)
+
+type OIDCSettingsProjection struct {
+	crdb.StatementHandler
+}
+
+const (
+	OIDCSettingsProjectionTable = "zitadel.projections.oidc_settings"
+)
+
+func NewOIDCSettingsProjection(ctx context.Context, config crdb.StatementHandlerConfig) *OIDCSettingsProjection {
+	p := new(OIDCSettingsProjection)
+	config.ProjectionName = OIDCSettingsProjectionTable
+	config.Reducers = p.reducers()
+	p.StatementHandler = crdb.NewStatementHandler(ctx, config)
+	return p
+}
+
+func (p *OIDCSettingsProjection) reducers() []handler.AggregateReducer {
+	return []handler.AggregateReducer{
+		{
+			Aggregate: project.AggregateType,
+			EventRedusers: []handler.EventReducer{
+				{
+					Event:  iam.OIDCSettingsAddedEventType,
+					Reduce: p.reduceOIDCSettingsAdded,
+				},
+				{
+					Event:  iam.OIDCSettingsChangedEventType,
+					Reduce: p.reduceOIDCSettingsChanged,
+				},
+			},
+		},
+	}
+}
+
+const (
+	OIDCSettingsColumnAggregateID                = "aggregate_id"
+	OIDCSettingsColumnCreationDate               = "creation_date"
+	OIDCSettingsColumnChangeDate                 = "change_date"
+	OIDCSettingsColumnResourceOwner              = "resource_owner"
+	OIDCSettingsColumnSequence                   = "sequence"
+	OIDCSettingsColumnAccessTokenLifetime        = "access_token_lifetime"
+	OIDCSettingsColumnIdTokenLifetime            = "id_token_lifetime"
+	OIDCSettingsColumnRefreshTokenIdleExpiration = "refresh_token_idle_expiration"
+	OIDCSettingsColumnRefreshTokenExpiration     = "refresh_token_expiration"
+)
+
+func (p *OIDCSettingsProjection) reduceOIDCSettingsAdded(event eventstore.Event) (*handler.Statement, error) {
+	e, ok := event.(*iam.OIDCSettingsAddedEvent)
+	if !ok {
+		logging.WithFields("seq", event.Sequence(), "expectedType", iam.OIDCSettingsAddedEventType).Error("wrong event type")
+		return nil, errors.ThrowInvalidArgument(nil, "HANDL-f9nwf", "reduce.wrong.event.type")
+	}
+	return crdb.NewCreateStatement(
+		e,
+		[]handler.Column{
+			handler.NewCol(OIDCSettingsColumnAggregateID, e.Aggregate().ID),
+			handler.NewCol(OIDCSettingsColumnCreationDate, e.CreationDate()),
+			handler.NewCol(OIDCSettingsColumnChangeDate, e.CreationDate()),
+			handler.NewCol(OIDCSettingsColumnResourceOwner, e.Aggregate().ResourceOwner),
+			handler.NewCol(OIDCSettingsColumnSequence, e.Sequence()),
+			handler.NewCol(OIDCSettingsColumnAccessTokenLifetime, e.AccessTokenLifetime),
+			handler.NewCol(OIDCSettingsColumnIdTokenLifetime, e.IdTokenLifetime),
+			handler.NewCol(OIDCSettingsColumnRefreshTokenIdleExpiration, e.RefreshTokenIdleExpiration),
+			handler.NewCol(OIDCSettingsColumnRefreshTokenExpiration, e.RefreshTokenExpiration),
+		},
+	), nil
+}
+
+func (p *OIDCSettingsProjection) reduceOIDCSettingsChanged(event eventstore.Event) (*handler.Statement, error) {
+	e, ok := event.(*iam.OIDCSettingsChangedEvent)
+	if !ok {
+		logging.WithFields("seq", event.Sequence(), "expected", iam.OIDCSettingsChangedEventType).Error("wrong event type")
+		return nil, errors.ThrowInvalidArgument(nil, "HANDL-8JJ2d", "reduce.wrong.event.type")
+	}
+
+	columns := make([]handler.Column, 0, 6)
+	columns = append(columns,
+		handler.NewCol(OIDCSettingsColumnChangeDate, e.CreationDate()),
+		handler.NewCol(OIDCSettingsColumnSequence, e.Sequence()),
+	)
+	if e.AccessTokenLifetime != nil {
+		columns = append(columns, handler.NewCol(OIDCSettingsColumnAccessTokenLifetime, *e.AccessTokenLifetime))
+	}
+	if e.IdTokenLifetime != nil {
+		columns = append(columns, handler.NewCol(OIDCSettingsColumnIdTokenLifetime, *e.IdTokenLifetime))
+	}
+	if e.RefreshTokenIdleExpiration != nil {
+		columns = append(columns, handler.NewCol(OIDCSettingsColumnRefreshTokenIdleExpiration, *e.RefreshTokenIdleExpiration))
+	}
+	if e.RefreshTokenExpiration != nil {
+		columns = append(columns, handler.NewCol(OIDCSettingsColumnRefreshTokenExpiration, *e.RefreshTokenExpiration))
+	}
+	return crdb.NewUpdateStatement(
+		e,
+		columns,
+		[]handler.Condition{
+			handler.NewCond(OIDCSettingsColumnAggregateID, e.Aggregate().ID),
+		},
+	), nil
+}

internal/query/projection/oidc_settings_test.go

@@ -0,0 +1,106 @@
+package projection
+
+import (
+	"testing"
+	"time"
+
+	"github.com/caos/zitadel/internal/errors"
+	"github.com/caos/zitadel/internal/eventstore"
+	"github.com/caos/zitadel/internal/eventstore/handler"
+	"github.com/caos/zitadel/internal/eventstore/repository"
+	"github.com/caos/zitadel/internal/repository/iam"
+)
+
+func TestOIDCSettingsProjection_reduces(t *testing.T) {
+	type args struct {
+		event func(t *testing.T) eventstore.Event
+	}
+	tests := []struct {
+		name   string
+		args   args
+		reduce func(event eventstore.Event) (*handler.Statement, error)
+		want   wantReduce
+	}{
+		{
+			name: "reduceOIDCSettingsChanged",
+			args: args{
+				event: getEvent(testEvent(
+					repository.EventType(iam.OIDCSettingsChangedEventType),
+					iam.AggregateType,
+					[]byte(`{"accessTokenLifetime": 10000000, "idTokenLifetime": 10000000, "refreshTokenIdleExpiration": 10000000, "refreshTokenExpiration": 10000000}`),
+				), iam.OIDCSettingsChangedEventMapper),
+			},
+			reduce: (&OIDCSettingsProjection{}).reduceOIDCSettingsChanged,
+			want: wantReduce{
+				projection:       OIDCSettingsProjectionTable,
+				aggregateType:    eventstore.AggregateType("iam"),
+				sequence:         15,
+				previousSequence: 10,
+				executer: &testExecuter{
+					executions: []execution{
+						{
+							expectedStmt: "UPDATE zitadel.projections.oidc_settings SET (change_date, sequence, access_token_lifetime, id_token_lifetime, refresh_token_idle_expiration, refresh_token_expiration) = ($1, $2, $3, $4, $5, $6) WHERE (aggregate_id = $7)",
+							expectedArgs: []interface{}{
+								anyArg{},
+								uint64(15),
+								time.Millisecond * 10,
+								time.Millisecond * 10,
+								time.Millisecond * 10,
+								time.Millisecond * 10,
+								"agg-id",
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "reduceOIDCSettingsAdded",
+			args: args{
+				event: getEvent(testEvent(
+					repository.EventType(iam.OIDCSettingsAddedEventType),
+					iam.AggregateType,
+					[]byte(`{"accessTokenLifetime": 10000000, "idTokenLifetime": 10000000, "refreshTokenIdleExpiration": 10000000, "refreshTokenExpiration": 10000000}`),
+				), iam.OIDCSettingsAddedEventMapper),
+			},
+			reduce: (&OIDCSettingsProjection{}).reduceOIDCSettingsAdded,
+			want: wantReduce{
+				projection:       OIDCSettingsProjectionTable,
+				aggregateType:    eventstore.AggregateType("iam"),
+				sequence:         15,
+				previousSequence: 10,
+				executer: &testExecuter{
+					executions: []execution{
+						{
+							expectedStmt: "INSERT INTO zitadel.projections.oidc_settings (aggregate_id, creation_date, change_date, resource_owner, sequence, access_token_lifetime, id_token_lifetime, refresh_token_idle_expiration, refresh_token_expiration) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)",
+							expectedArgs: []interface{}{
+								"agg-id",
+								anyArg{},
+								anyArg{},
+								"ro-id",
+								uint64(15),
+								time.Millisecond * 10,
+								time.Millisecond * 10,
+								time.Millisecond * 10,
+								time.Millisecond * 10,
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			event := baseEvent(t)
+			got, err := tt.reduce(event)
+			if _, ok := err.(errors.InvalidArgument); !ok {
+				t.Errorf("no wrong event mapping: %v, got: %v", err, got)
+			}
+
+			event = tt.args.event(t)
+			got, err = tt.reduce(event)
+			assertReduce(t, got, err, tt.want)
+		})
+	}
+}

internal/query/projection/org.go

@@ -22,7 +22,7 @@ const (
 )
 
 func NewOrgProjection(ctx context.Context, config crdb.StatementHandlerConfig) *OrgProjection {
-	p := &OrgProjection{}
+	p := new(OrgProjection)
 	config.ProjectionName = OrgProjectionTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/org_domain.go

@@ -22,7 +22,7 @@ const (
 )
 
 func NewOrgDomainProjection(ctx context.Context, config crdb.StatementHandlerConfig) *OrgDomainProjection {
-	p := &OrgDomainProjection{}
+	p := new(OrgDomainProjection)
 	config.ProjectionName = OrgDomainTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/org_iam_policy.go

@@ -32,7 +32,7 @@ const (
 )
 
 func NewOrgIAMPolicyProjection(ctx context.Context, config crdb.StatementHandlerConfig) *OrgIAMPolicyProjection {
-	p := &OrgIAMPolicyProjection{}
+	p := new(OrgIAMPolicyProjection)
 	config.ProjectionName = OrgIAMPolicyTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/org_member.go

@@ -22,7 +22,7 @@ const (
 )
 
 func NewOrgMemberProjection(ctx context.Context, config crdb.StatementHandlerConfig) *OrgMemberProjection {
-	p := &OrgMemberProjection{}
+	p := new(OrgMemberProjection)
 	config.ProjectionName = OrgMemberProjectionTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/password_age_policy.go

@@ -23,7 +23,7 @@ const (
 )
 
 func NewPasswordAgeProjection(ctx context.Context, config crdb.StatementHandlerConfig) *PasswordAgeProjection {
-	p := &PasswordAgeProjection{}
+	p := new(PasswordAgeProjection)
 	config.ProjectionName = PasswordAgeTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/password_complexity_policy.go

@@ -23,7 +23,7 @@ const (
 )
 
 func NewPasswordComplexityProjection(ctx context.Context, config crdb.StatementHandlerConfig) *PasswordComplexityProjection {
-	p := &PasswordComplexityProjection{}
+	p := new(PasswordComplexityProjection)
 	config.ProjectionName = PasswordComplexityTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/privacy_policy.go

@@ -33,7 +33,7 @@ const (
 )
 
 func NewPrivacyPolicyProjection(ctx context.Context, config crdb.StatementHandlerConfig) *PrivacyPolicyProjection {
-	p := &PrivacyPolicyProjection{}
+	p := new(PrivacyPolicyProjection)
 	config.ProjectionName = PrivacyPolicyTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/project.go

@@ -21,7 +21,7 @@ const (
 )
 
 func NewProjectProjection(ctx context.Context, config crdb.StatementHandlerConfig) *ProjectProjection {
-	p := &ProjectProjection{}
+	p := new(ProjectProjection)
 	config.ProjectionName = ProjectProjectionTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/project_grant.go

@@ -20,7 +20,7 @@ type ProjectGrantProjection struct {
 const ProjectGrantProjectionTable = "zitadel.projections.project_grants"
 
 func NewProjectGrantProjection(ctx context.Context, config crdb.StatementHandlerConfig) *ProjectGrantProjection {
-	p := &ProjectGrantProjection{}
+	p := new(ProjectGrantProjection)
 	config.ProjectionName = ProjectGrantProjectionTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/project_grant_member.go

@@ -24,7 +24,7 @@ const (
 )
 
 func NewProjectGrantMemberProjection(ctx context.Context, config crdb.StatementHandlerConfig) *ProjectGrantMemberProjection {
-	p := &ProjectGrantMemberProjection{}
+	p := new(ProjectGrantMemberProjection)
 	config.ProjectionName = ProjectGrantMemberProjectionTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/project_member.go

@@ -24,7 +24,7 @@ const (
 )
 
 func NewProjectMemberProjection(ctx context.Context, config crdb.StatementHandlerConfig) *ProjectMemberProjection {
-	p := &ProjectMemberProjection{}
+	p := new(ProjectMemberProjection)
 	config.ProjectionName = ProjectMemberProjectionTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/project_role.go

@@ -18,7 +18,7 @@ type ProjectRoleProjection struct {
 const ProjectRoleProjectionTable = "zitadel.projections.project_roles"
 
 func NewProjectRoleProjection(ctx context.Context, config crdb.StatementHandlerConfig) *ProjectRoleProjection {
-	p := &ProjectRoleProjection{}
+	p := new(ProjectRoleProjection)
 	config.ProjectionName = ProjectRoleProjectionTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/projection.go

@@ -72,6 +72,7 @@ func Start(ctx context.Context, sqlClient *sql.DB, es *eventstore.Eventstore, co
 	NewSecretGeneratorProjection(ctx, applyCustomConfig(projectionConfig, config.Customizations["secret_generators"]))
 	NewSMTPConfigProjection(ctx, applyCustomConfig(projectionConfig, config.Customizations["smtp_configs"]))
 	NewSMSConfigProjection(ctx, applyCustomConfig(projectionConfig, config.Customizations["sms_config"]))
+	NewOIDCSettingsProjection(ctx, applyCustomConfig(projectionConfig, config.Customizations["oidc_settings"]))
 	_, err := NewKeyProjection(ctx, applyCustomConfig(projectionConfig, config.Customizations["keys"]), keyConfig, keyChan)
 
 	return err

internal/query/projection/secret_generator.go

@@ -21,7 +21,7 @@ const (
 )
 
 func NewSecretGeneratorProjection(ctx context.Context, config crdb.StatementHandlerConfig) *SecretGeneratorProjection {
-	p := &SecretGeneratorProjection{}
+	p := new(SecretGeneratorProjection)
 	config.ProjectionName = SecretGeneratorProjectionTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/sms.go

@@ -22,7 +22,7 @@ const (
 )
 
 func NewSMSConfigProjection(ctx context.Context, config crdb.StatementHandlerConfig) *SMSConfigProjection {
-	p := &SMSConfigProjection{}
+	p := new(SMSConfigProjection)
 	config.ProjectionName = SMSConfigProjectionTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/smtp.go

@@ -21,7 +21,7 @@ const (
 )
 
 func NewSMTPConfigProjection(ctx context.Context, config crdb.StatementHandlerConfig) *SMTPConfigProjection {
-	p := &SMTPConfigProjection{}
+	p := new(SMTPConfigProjection)
 	config.ProjectionName = SMTPConfigProjectionTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/user.go

@@ -25,7 +25,7 @@ const (
 )
 
 func NewUserProjection(ctx context.Context, config crdb.StatementHandlerConfig) *UserProjection {
-	p := &UserProjection{}
+	p := new(UserProjection)
 	config.ProjectionName = UserTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/user_auth_method.go

@@ -21,7 +21,7 @@ const (
 )
 
 func NewUserAuthMethodProjection(ctx context.Context, config crdb.StatementHandlerConfig) *UserAuthMethodProjection {
-	p := &UserAuthMethodProjection{}
+	p := new(UserAuthMethodProjection)
 	config.ProjectionName = UserAuthMethodTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/user_grant.go

@@ -25,7 +25,7 @@ const (
 )
 
 func NewUserGrantProjection(ctx context.Context, config crdb.StatementHandlerConfig) *UserGrantProjection {
-	p := &UserGrantProjection{}
+	p := new(UserGrantProjection)
 	config.ProjectionName = UserGrantProjectionTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/user_metadata.go

@@ -19,7 +19,7 @@ type UserMetadataProjection struct {
 const UserMetadataProjectionTable = "zitadel.projections.user_metadata"
 
 func NewUserMetadataProjection(ctx context.Context, config crdb.StatementHandlerConfig) *UserMetadataProjection {
-	p := &UserMetadataProjection{}
+	p := new(UserMetadataProjection)
 	config.ProjectionName = UserMetadataProjectionTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/user_personal_access_token.go

@@ -22,7 +22,7 @@ const (
 )
 
 func NewPersonalAccessTokenProjection(ctx context.Context, config crdb.StatementHandlerConfig) *PersonalAccessTokenProjection {
-	p := &PersonalAccessTokenProjection{}
+	p := new(PersonalAccessTokenProjection)
 	config.ProjectionName = PersonalAccessTokenProjectionTable
 	config.Reducers = p.reducers()
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)