fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! added first event

everything upto google done for org + instance

backend/v3/storage/database/events_testing/events_test.go

@@ -15,6 +15,7 @@ import (
 	"github.com/zitadel/zitadel/backend/v3/storage/database/dialect/postgres"
 	"github.com/zitadel/zitadel/internal/integration"
 	"github.com/zitadel/zitadel/pkg/grpc/admin"
+	mgmt "github.com/zitadel/zitadel/pkg/grpc/management"
 	v2beta_org "github.com/zitadel/zitadel/pkg/grpc/org/v2beta"
 	"github.com/zitadel/zitadel/pkg/grpc/system"
 )
@@ -28,6 +29,7 @@ var (
 	SystemClient system.SystemServiceClient
 	OrgClient    v2beta_org.OrganizationServiceClient
 	AdminClient  admin.AdminServiceClient
+	MgmtClient           mgmt.ManagementServiceClient
 )
 
 var pool database.Pool
@@ -43,6 +45,7 @@ func TestMain(m *testing.M) {
 		SystemClient = integration.SystemClient()
 		OrgClient = Instance.Client.OrgV2beta
 		AdminClient = Instance.Client.Admin
+		MgmtClient = Instance.Client.Mgmt
 
 		var err error
 		dbConfig, err := pgxpool.ParseConfig(ConnString)

backend/v3/storage/database/events_testing/id_provider_test.go

@@ -258,7 +258,7 @@ func TestServer_TestIDProviderReduces(t *testing.T) {
 		}, retryDuration, tick)
 	})
 
-	t.Run("test iam idp oidc addded reduces", func(t *testing.T) {
+	t.Run("test iam idp oidc added reduces", func(t *testing.T) {
 		name := gofakeit.Name()
 
 		// add oidc
@@ -390,7 +390,7 @@ func TestServer_TestIDProviderReduces(t *testing.T) {
 		}, retryDuration, tick)
 	})
 
-	t.Run("test iam idp jwt addded reduces", func(t *testing.T) {
+	t.Run("test iam idp jwt added reduces", func(t *testing.T) {
 		name := gofakeit.Name()
 
 		// add jwt

backend/v3/storage/database/repository/id_provider.go

@@ -395,7 +395,7 @@ func (i idProvider) InstanceIDCondition(id string) database.Condition {
 
 func (i idProvider) OrgIDCondition(id *string) database.Condition {
 	if id == nil {
-		return nil
+		return database.IsNull(i.OrgIDColumn())
 	}
 	return database.NewTextCondition(i.OrgIDColumn(), database.TextOperationEqual, *id)
 }

internal/eventstore/handler/v2/statement.go

@@ -425,10 +425,9 @@ func NewArrayRemoveCol(column string, value interface{}) Column {
 func NewArrayIntersectCol(column string, value interface{}) Column {
 	var arrayType string
 	switch value.(type) {
-
 	case []string, database.TextArray[string]:
 		arrayType = "TEXT"
-		//TODO: handle more types if necessary
+		// TODO: handle more types if necessary
 	}
 	return Column{
 		Name:  column,
@@ -598,6 +597,10 @@ type NamespacedCondition func(namespace string) Condition
 
 func NewCond(name string, value interface{}) Condition {
 	return func(param string) (string, []any) {
+		nilStrPtr, ok := value.(*string)
+		if ok && nilStrPtr == nil {
+			return name + " IS NULL", nil
+		}
 		return name + " = " + param, []any{value}
 	}
 }
@@ -659,13 +662,15 @@ type Executer interface {
 	Exec(string, ...interface{}) (sql.Result, error)
 }
 
-type execOption func(*execConfig)
+type (
-type execConfig struct {
+	execOption func(*execConfig)
-	tableName string
+	execConfig struct {
+		tableName string
 
-	args []interface{}
+		args []interface{}
-	err  error
+		err  error
-}
+	}
+)
 
 type query func(config execConfig) string
 

internal/query/projection/idp_relational.go

@@ -3,12 +3,14 @@ package projection
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 
 	"github.com/zitadel/zitadel/backend/v3/domain"
 	"github.com/zitadel/zitadel/backend/v3/storage/database/dialect/postgres"
 	"github.com/zitadel/zitadel/backend/v3/storage/database/repository"
 	"github.com/zitadel/zitadel/internal/eventstore"
 	"github.com/zitadel/zitadel/internal/eventstore/handler/v2"
+	"github.com/zitadel/zitadel/internal/repository/idpconfig"
 	"github.com/zitadel/zitadel/internal/repository/instance"
 	"github.com/zitadel/zitadel/internal/repository/org"
 	"github.com/zitadel/zitadel/internal/zerrors"
@@ -77,7 +79,7 @@ func (p *idpRelationalProjection) Reducers() []handler.AggregateReducer {
 				},
 				{
 					Event:  instance.IDPJWTConfigChangedEventType,
-					Reduce: p.reduceJWTConfigChanged,
+					Reduce: p.reduceJWTRelationalConfigChanged,
 				},
 				// {
 				// 	Event:  instance.InstanceRemovedEventType,
@@ -85,251 +87,402 @@ func (p *idpRelationalProjection) Reducers() []handler.AggregateReducer {
 				// },
 			},
 		},
+		{
+			Aggregate: org.AggregateType,
+			EventReducers: []handler.EventReducer{
+				{
+					Event:  org.IDPConfigAddedEventType,
+					Reduce: p.reduceIDPRelationalAdded,
+				},
+				{
+					Event:  org.IDPConfigChangedEventType,
+					Reduce: p.reduceIDPRelationalChanged,
+				},
+				{
+					Event:  org.IDPConfigDeactivatedEventType,
+					Reduce: p.reduceIDRelationalPDeactivated,
+				},
+				{
+					Event:  org.IDPConfigReactivatedEventType,
+					Reduce: p.reduceIDPRelationalReactivated,
+				},
+				{
+					Event:  org.IDPConfigRemovedEventType,
+					Reduce: p.reduceIDPRelationalRemoved,
+				},
+				{
+					Event:  org.IDPOIDCConfigAddedEventType,
+					Reduce: p.reduceOIDCRelationalConfigAdded,
+				},
+				{
+					Event:  org.IDPOIDCConfigChangedEventType,
+					Reduce: p.reduceOIDCRelationalConfigChanged,
+				},
+				{
+					Event:  org.IDPJWTConfigAddedEventType,
+					Reduce: p.reduceJWTRelationalConfigAdded,
+				},
+				{
+					Event:  org.IDPJWTConfigChangedEventType,
+					Reduce: p.reduceJWTRelationalConfigChanged,
+				},
+				// {
+				// 	Event:  org.OrgRemovedEventType,
+				// 	Reduce: p.reduceOwnerRemoved,
+				// },
+			},
+		},
 	}
 }
 
 func (p *idpRelationalProjection) reduceIDPRelationalAdded(event eventstore.Event) (*handler.Statement, error) {
-	e, ok := event.(*instance.IDPConfigAddedEvent)
+	var idpEvent idpconfig.IDPConfigAddedEvent
-	if !ok {
+	switch e := event.(type) {
-		return nil, zerrors.ThrowInvalidArgumentf(nil, "HANDL-fcUdQ", "reduce.wrong.event.type %v", []eventstore.EventType{org.IDPConfigAddedEventType, instance.IDPConfigAddedEventType})
+	case *org.IDPConfigAddedEvent:
+		idpEvent = e.IDPConfigAddedEvent
+	case *instance.IDPConfigAddedEvent:
+		idpEvent = e.IDPConfigAddedEvent
+	default:
+		return nil, zerrors.ThrowInvalidArgumentf(nil, "HANDL-YcUdQ", "reduce.wrong.event.type %v", []eventstore.EventType{org.IDPConfigAddedEventType, instance.IDPConfigAddedEventType})
 	}
 
+	var orgId *string
+	if idpEvent.Aggregate().ResourceOwner != idpEvent.Agg.InstanceID {
+		orgId = &idpEvent.Aggregate().ResourceOwner
+	}
+	fmt.Printf("@@ >>>>>>>>>>>>>>>>>>>>>>>>>>>> idpEvent.Aggregate().InstanceID = %+v\n", idpEvent.Aggregate().InstanceID)
+	fmt.Printf("@@ >>>>>>>>>>>>>>>>>>>>>>>>>>>> idpEvent.Aggregate().ResourceOwner = %+v\n", idpEvent.Aggregate().ResourceOwner)
+	fmt.Printf("@@ >>>>>>>>>>>>>>>>>>>>>>>>>>>> idpEvent.Aggregate() = %+v\n", idpEvent.Aggregate())
+	fmt.Printf("@@ >>>>>>>>>>>>>>>>>>>>>>>>>>>> REDUCE ADD orgId = %+v\n", orgId)
+
 	return handler.NewCreateStatement(
-		e,
+		&idpEvent,
 		[]handler.Column{
-			handler.NewCol(IDPInstanceIDCol, e.Aggregate().InstanceID),
+			handler.NewCol(IDPInstanceIDCol, idpEvent.Aggregate().InstanceID),
-			handler.NewCol(IDPRelationalOrgIdCol, nil),
+			handler.NewCol(IDPRelationalOrgIdCol, orgId),
-			handler.NewCol(IDPIDCol, e.ConfigID),
+			handler.NewCol(IDPIDCol, idpEvent.ConfigID),
 			handler.NewCol(IDPStateCol, domain.IDPStateActive.String()),
-			handler.NewCol(IDPNameCol, e.Name),
+			handler.NewCol(IDPNameCol, idpEvent.Name),
 			handler.NewCol(IDPTemplateTypeCol, domain.IDPTypeUnspecified.String()),
-			handler.NewCol(IDPRelationalAutoRegisterCol, e.AutoRegister),
+			handler.NewCol(IDPRelationalAutoRegisterCol, idpEvent.AutoRegister),
 			handler.NewCol(IDPRelationalAllowCreationCol, true),
 			handler.NewCol(IDPRelationalAllowAutoUpdateCol, false),
 			handler.NewCol(IDPRelationalAllowLinkingCol, true),
 			handler.NewCol(IDPRelationalAllowAutoLinkingCol, domain.IDPAutoLinkingOptionUnspecified.String()),
-			handler.NewCol(IDPStylingTypeCol, e.StylingType),
+			handler.NewCol(IDPStylingTypeCol, idpEvent.StylingType),
-			handler.NewCol(CreatedAt, e.CreationDate()),
+			handler.NewCol(CreatedAt, idpEvent.CreationDate()),
 		},
 	), nil
 }
 
 func (p *idpRelationalProjection) reduceIDPRelationalChanged(event eventstore.Event) (*handler.Statement, error) {
-	e, ok := event.(*instance.IDPConfigChangedEvent)
+	var idpEvent idpconfig.IDPConfigChangedEvent
-	if !ok {
+	switch e := event.(type) {
-		return nil, zerrors.ThrowInvalidArgumentf(nil, "HANDL-NVvJD", "reduce.wrong.event.type %v", []eventstore.EventType{org.IDPConfigChangedEventType, instance.IDPConfigChangedEventType})
+	case *org.IDPConfigChangedEvent:
+		idpEvent = e.IDPConfigChangedEvent
+	case *instance.IDPConfigChangedEvent:
+		idpEvent = e.IDPConfigChangedEvent
+	default:
+		return nil, zerrors.ThrowInvalidArgumentf(nil, "HANDL-YVvJD", "reduce.wrong.event.type %v", []eventstore.EventType{org.IDPConfigChangedEventType, instance.IDPConfigChangedEventType})
+	}
+
+	var orgId *string
+	if idpEvent.Aggregate().ResourceOwner != idpEvent.Agg.InstanceID {
+		orgId = &idpEvent.Aggregate().ResourceOwner
 	}
 
 	cols := make([]handler.Column, 0, 5)
-	if e.Name != nil {
+	if idpEvent.Name != nil {
-		cols = append(cols, handler.NewCol(IDPNameCol, *e.Name))
+		cols = append(cols, handler.NewCol(IDPNameCol, *idpEvent.Name))
 	}
-	if e.StylingType != nil {
+	if idpEvent.StylingType != nil {
-		cols = append(cols, handler.NewCol(IDPStylingTypeCol, *e.StylingType))
+		cols = append(cols, handler.NewCol(IDPStylingTypeCol, *idpEvent.StylingType))
 	}
-	if e.AutoRegister != nil {
+	if idpEvent.AutoRegister != nil {
-		cols = append(cols, handler.NewCol(IDPRelationalAutoRegisterCol, *e.AutoRegister))
+		cols = append(cols, handler.NewCol(IDPRelationalAutoRegisterCol, *idpEvent.AutoRegister))
 	}
 	if len(cols) == 0 {
-		return handler.NewNoOpStatement(e), nil
+		return handler.NewNoOpStatement(&idpEvent), nil
 	}
 
 	return handler.NewUpdateStatement(
-		e,
+		&idpEvent,
 		cols,
 		[]handler.Condition{
-			handler.NewCond(IDPIDCol, e.ConfigID),
+			handler.NewCond(IDPIDCol, idpEvent.ConfigID),
-			handler.NewCond(IDPInstanceIDCol, e.Aggregate().InstanceID),
+			handler.NewCond(IDPInstanceIDCol, idpEvent.Aggregate().InstanceID),
+			handler.NewCond(IDPRelationalOrgId, orgId),
 		},
 	), nil
 }
 
 func (p *idpRelationalProjection) reduceIDRelationalPDeactivated(event eventstore.Event) (*handler.Statement, error) {
-	e, ok := event.(*instance.IDPConfigDeactivatedEvent)
+	var idpEvent idpconfig.IDPConfigDeactivatedEvent
-	if !ok {
+	switch e := event.(type) {
-		return nil, zerrors.ThrowInvalidArgumentf(nil, "HANDL-94O5l", "reduce.wrong.event.type %v", []eventstore.EventType{org.IDPConfigDeactivatedEventType, instance.IDPConfigDeactivatedEventType})
+	case *org.IDPConfigDeactivatedEvent:
+		idpEvent = e.IDPConfigDeactivatedEvent
+	case *instance.IDPConfigDeactivatedEvent:
+		idpEvent = e.IDPConfigDeactivatedEvent
+	default:
+		return nil, zerrors.ThrowInvalidArgumentf(nil, "HANDL-Y4O5l", "reduce.wrong.event.type %v", []eventstore.EventType{org.IDPConfigDeactivatedEventType, instance.IDPConfigDeactivatedEventType})
+	}
+
+	var orgId *string
+	if idpEvent.Aggregate().ResourceOwner != idpEvent.Agg.InstanceID {
+		orgId = &idpEvent.Aggregate().ResourceOwner
 	}
 
 	return handler.NewUpdateStatement(
-		e,
+		&idpEvent,
 		[]handler.Column{
 			handler.NewCol(IDPStateCol, domain.IDPStateInactive.String()),
 		},
 		[]handler.Condition{
-			handler.NewCond(IDPIDCol, e.ConfigID),
+			handler.NewCond(IDPIDCol, idpEvent.ConfigID),
-			handler.NewCond(IDPInstanceIDCol, e.Aggregate().InstanceID),
+			handler.NewCond(IDPInstanceIDCol, idpEvent.Aggregate().InstanceID),
+			handler.NewCond(IDPRelationalOrgId, orgId),
 		},
 	), nil
 }
 
 func (p *idpRelationalProjection) reduceIDPRelationalReactivated(event eventstore.Event) (*handler.Statement, error) {
-	e, ok := event.(*instance.IDPConfigReactivatedEvent)
+	var idpEvent idpconfig.IDPConfigReactivatedEvent
-	if !ok {
+	switch e := event.(type) {
-		return nil, zerrors.ThrowInvalidArgumentf(nil, "HANDL-I8QyS", "reduce.wrong.event.type %v", []eventstore.EventType{org.IDPConfigReactivatedEventType, instance.IDPConfigReactivatedEventType})
+	case *org.IDPConfigReactivatedEvent:
+		idpEvent = e.IDPConfigReactivatedEvent
+	case *instance.IDPConfigReactivatedEvent:
+		idpEvent = e.IDPConfigReactivatedEvent
+	default:
+		return nil, zerrors.ThrowInvalidArgumentf(nil, "HANDL-Y8QyS", "reduce.wrong.event.type %v", []eventstore.EventType{org.IDPConfigReactivatedEventType, instance.IDPConfigReactivatedEventType})
+	}
+
+	var orgId *string
+	if idpEvent.Aggregate().ResourceOwner != idpEvent.Agg.InstanceID {
+		orgId = &idpEvent.Aggregate().ResourceOwner
 	}
 
 	return handler.NewUpdateStatement(
-		e,
+		&idpEvent,
 		[]handler.Column{
 			handler.NewCol(IDPStateCol, domain.IDPStateActive.String()),
 		},
 		[]handler.Condition{
-			handler.NewCond(IDPIDCol, e.ConfigID),
+			handler.NewCond(IDPIDCol, idpEvent.ConfigID),
-			handler.NewCond(IDPInstanceIDCol, e.Aggregate().InstanceID),
+			handler.NewCond(IDPInstanceIDCol, idpEvent.Aggregate().InstanceID),
+			handler.NewCond(IDPRelationalOrgId, orgId),
 		},
 	), nil
 }
 
 func (p *idpRelationalProjection) reduceIDPRelationalRemoved(event eventstore.Event) (*handler.Statement, error) {
-	e, ok := event.(*instance.IDPConfigRemovedEvent)
+	var idpEvent idpconfig.IDPConfigRemovedEvent
-	if !ok {
+	switch e := event.(type) {
-		return nil, zerrors.ThrowInvalidArgumentf(nil, "HANDL-B4zy8", "reduce.wrong.event.type %v", []eventstore.EventType{org.IDPConfigRemovedEventType, instance.IDPConfigRemovedEventType})
+	case *org.IDPConfigRemovedEvent:
+		idpEvent = e.IDPConfigRemovedEvent
+	case *instance.IDPConfigRemovedEvent:
+		idpEvent = e.IDPConfigRemovedEvent
+	default:
+		return nil, zerrors.ThrowInvalidArgumentf(nil, "HANDL-Y4zy8", "reduce.wrong.event.type %v", []eventstore.EventType{org.IDPConfigRemovedEventType, instance.IDPConfigRemovedEventType})
+	}
+	var orgId *string
+	if idpEvent.Aggregate().ResourceOwner != idpEvent.Agg.InstanceID {
+		orgId = &idpEvent.Aggregate().ResourceOwner
 	}
 
 	return handler.NewDeleteStatement(
-		e,
+		&idpEvent,
 		[]handler.Condition{
-			handler.NewCond(IDPIDCol, e.ConfigID),
+			handler.NewCond(IDPIDCol, idpEvent.ConfigID),
-			handler.NewCond(IDPInstanceIDCol, e.Aggregate().InstanceID),
+			handler.NewCond(IDPInstanceIDCol, idpEvent.Aggregate().InstanceID),
+			handler.NewCond(IDPRelationalOrgId, orgId),
 		},
 	), nil
 }
 
 func (p *idpRelationalProjection) reduceOIDCRelationalConfigAdded(event eventstore.Event) (*handler.Statement, error) {
-	e, ok := event.(*instance.IDPOIDCConfigAddedEvent)
+	var idpEvent idpconfig.OIDCConfigAddedEvent
-	if !ok {
+	switch e := event.(type) {
-		return nil, zerrors.ThrowInvalidArgumentf(nil, "HANDL-2FuAA", "reduce.wrong.event.type %v", []eventstore.EventType{org.IDPOIDCConfigAddedEventType, instance.IDPOIDCConfigAddedEventType})
+	case *org.IDPOIDCConfigAddedEvent:
+		idpEvent = e.OIDCConfigAddedEvent
+	case *instance.IDPOIDCConfigAddedEvent:
+		idpEvent = e.OIDCConfigAddedEvent
+	default:
+		return nil, zerrors.ThrowInvalidArgumentf(nil, "HANDL-YFuAA", "reduce.wrong.event.type %v", []eventstore.EventType{org.IDPOIDCConfigAddedEventType, instance.IDPOIDCConfigAddedEventType})
 	}
 
-	payload, err := json.Marshal(e)
+	payload, err := json.Marshal(idpEvent)
 	if err != nil {
 		return nil, err
 	}
 
+	var orgId *string
+	if idpEvent.Aggregate().ResourceOwner != idpEvent.Agg.InstanceID {
+		orgId = &idpEvent.Aggregate().ResourceOwner
+	}
+
 	return handler.NewUpdateStatement(
-		e,
+		&idpEvent,
 		[]handler.Column{
 			handler.NewCol(IDPRelationalPayloadCol, payload),
 			handler.NewCol(IDPTypeCol, domain.IDPTypeOIDC.String()),
 		},
 		[]handler.Condition{
-			handler.NewCond(IDPIDCol, e.IDPConfigID),
+			handler.NewCond(IDPIDCol, idpEvent.IDPConfigID),
+			handler.NewCond(IDPInstanceIDCol, idpEvent.Aggregate().InstanceID),
+			handler.NewCond(IDPRelationalOrgId, orgId),
 		},
 	), nil
 }
 
 func (p *idpRelationalProjection) reduceOIDCRelationalConfigChanged(event eventstore.Event) (*handler.Statement, error) {
-	e, ok := event.(*instance.IDPOIDCConfigChangedEvent)
+	var idpEvent idpconfig.OIDCConfigChangedEvent
-	if !ok {
+	switch e := event.(type) {
-		return nil, zerrors.ThrowInvalidArgumentf(nil, "HANDL-x2IBI", "reduce.wrong.event.type %v", []eventstore.EventType{org.IDPOIDCConfigChangedEventType, instance.IDPOIDCConfigChangedEventType})
+	case *org.IDPOIDCConfigChangedEvent:
+		idpEvent = e.OIDCConfigChangedEvent
+	case *instance.IDPOIDCConfigChangedEvent:
+		idpEvent = e.OIDCConfigChangedEvent
+	default:
+		return nil, zerrors.ThrowInvalidArgumentf(nil, "HANDL-Y2IVI", "reduce.wrong.event.type %v", []eventstore.EventType{org.IDPOIDCConfigChangedEventType, instance.IDPOIDCConfigChangedEventType})
 	}
 
-	oidc, err := p.idpRepo.GetOIDC(context.Background(), p.idpRepo.IDCondition(e.IDPConfigID), e.Agg.InstanceID, nil)
+	var orgId *string
+	if idpEvent.Aggregate().ResourceOwner != idpEvent.Agg.InstanceID {
+		orgId = &idpEvent.Aggregate().ResourceOwner
+	}
+
+	oidc, err := p.idpRepo.GetOIDC(context.Background(), p.idpRepo.IDCondition(idpEvent.IDPConfigID), idpEvent.Agg.InstanceID, orgId)
 	if err != nil {
 		return nil, err
 	}
 
-	if e.ClientID != nil {
+	if idpEvent.ClientID != nil {
-		oidc.ClientID = *e.ClientID
+		oidc.ClientID = *idpEvent.ClientID
 	}
-	if e.ClientSecret != nil {
+	if idpEvent.ClientSecret != nil {
-		oidc.ClientSecret = *e.ClientSecret
+		oidc.ClientSecret = *idpEvent.ClientSecret
 	}
-	if e.Issuer != nil {
+	if idpEvent.Issuer != nil {
-		oidc.Issuer = *e.Issuer
+		oidc.Issuer = *idpEvent.Issuer
 	}
-	if e.AuthorizationEndpoint != nil {
+	if idpEvent.AuthorizationEndpoint != nil {
-		oidc.AuthorizationEndpoint = *e.AuthorizationEndpoint
+		oidc.AuthorizationEndpoint = *idpEvent.AuthorizationEndpoint
 	}
-	if e.TokenEndpoint != nil {
+	if idpEvent.TokenEndpoint != nil {
-		oidc.TokenEndpoint = *e.TokenEndpoint
+		oidc.TokenEndpoint = *idpEvent.TokenEndpoint
 	}
-	if e.Scopes != nil {
+	if idpEvent.Scopes != nil {
-		oidc.Scopes = e.Scopes
+		oidc.Scopes = idpEvent.Scopes
 	}
-	if e.IDPDisplayNameMapping != nil {
+	if idpEvent.IDPDisplayNameMapping != nil {
-		oidc.IDPDisplayNameMapping = domain.OIDCMappingField(*e.IDPDisplayNameMapping)
+		oidc.IDPDisplayNameMapping = domain.OIDCMappingField(*idpEvent.IDPDisplayNameMapping)
 	}
-	if e.UserNameMapping != nil {
+	if idpEvent.UserNameMapping != nil {
-		oidc.UserNameMapping = domain.OIDCMappingField(*e.UserNameMapping)
+		oidc.UserNameMapping = domain.OIDCMappingField(*idpEvent.UserNameMapping)
 	}
 
-	payload, err := json.Marshal(e)
+	payload, err := json.Marshal(idpEvent)
 	if err != nil {
 		return nil, err
 	}
 
 	return handler.NewUpdateStatement(
-		e,
+		&idpEvent,
 		[]handler.Column{
 			handler.NewCol(IDPRelationalPayloadCol, payload),
 			handler.NewCol(IDPTypeCol, domain.IDPTypeOIDC.String()),
 		},
 		[]handler.Condition{
-			handler.NewCond(IDPIDCol, e.IDPConfigID),
+			handler.NewCond(IDPIDCol, idpEvent.IDPConfigID),
+			handler.NewCond(IDPInstanceIDCol, idpEvent.Aggregate().InstanceID),
+			handler.NewCond(IDPRelationalOrgId, orgId),
 		},
 	), nil
 }
 
 func (p *idpRelationalProjection) reduceJWTRelationalConfigAdded(event eventstore.Event) (*handler.Statement, error) {
-	e, ok := event.(*instance.IDPJWTConfigAddedEvent)
+	var idpEvent idpconfig.JWTConfigAddedEvent
-	if !ok {
+	switch e := event.(type) {
-		return nil, zerrors.ThrowInvalidArgumentf(nil, "HANDL-qvPdb", "reduce.wrong.event.type %v", []eventstore.EventType{org.IDPJWTConfigAddedEventType, instance.IDPJWTConfigAddedEventType})
+	case *org.IDPJWTConfigAddedEvent:
+		idpEvent = e.JWTConfigAddedEvent
+	case *instance.IDPJWTConfigAddedEvent:
+		idpEvent = e.JWTConfigAddedEvent
+	default:
+		return nil, zerrors.ThrowInvalidArgumentf(nil, "HANDL-YvPdb", "reduce.wrong.event.type %v", []eventstore.EventType{org.IDPJWTConfigAddedEventType, instance.IDPJWTConfigAddedEventType})
 	}
-	payload, err := json.Marshal(e)
+
+	payload, err := json.Marshal(idpEvent)
 	if err != nil {
 		return nil, err
 	}
 
+	var orgId *string
+	if idpEvent.Aggregate().ResourceOwner != idpEvent.Agg.InstanceID {
+		orgId = &idpEvent.Aggregate().ResourceOwner
+	}
+
 	return handler.NewUpdateStatement(
-		e,
+		&idpEvent,
 		[]handler.Column{
 			handler.NewCol(IDPRelationalPayloadCol, payload),
 			handler.NewCol(IDPTypeCol, domain.IDPTypeJWT.String()),
 		},
 		[]handler.Condition{
-			handler.NewCond(IDPIDCol, e.IDPConfigID),
+			handler.NewCond(IDPIDCol, idpEvent.IDPConfigID),
+			handler.NewCond(IDPInstanceIDCol, idpEvent.Aggregate().InstanceID),
+			handler.NewCond(IDPRelationalOrgId, orgId),
 		},
 	), nil
 }
 
-func (p *idpRelationalProjection) reduceJWTConfigChanged(event eventstore.Event) (*handler.Statement, error) {
+func (p *idpRelationalProjection) reduceJWTRelationalConfigChanged(event eventstore.Event) (*handler.Statement, error) {
-	e, ok := event.(*instance.IDPJWTConfigChangedEvent)
+	var idpEvent idpconfig.JWTConfigChangedEvent
-	if !ok {
+	switch e := event.(type) {
-		return nil, zerrors.ThrowInvalidArgumentf(nil, "HANDL-P2I9I", "reduce.wrong.event.type %v", []eventstore.EventType{org.IDPJWTConfigChangedEventType, instance.IDPJWTConfigChangedEventType})
+	case *org.IDPJWTConfigChangedEvent:
+		idpEvent = e.JWTConfigChangedEvent
+	case *instance.IDPJWTConfigChangedEvent:
+		idpEvent = e.JWTConfigChangedEvent
+	default:
+		return nil, zerrors.ThrowInvalidArgumentf(nil, "HANDL-Y2IVI", "reduce.wrong.event.type %v", []eventstore.EventType{org.IDPJWTConfigChangedEventType, instance.IDPJWTConfigChangedEventType})
 	}
 
-	jwt, err := p.idpRepo.GetJWT(context.Background(), p.idpRepo.IDCondition(e.IDPConfigID), e.Agg.InstanceID, nil)
+	var orgId *string
+	if idpEvent.Aggregate().ResourceOwner != idpEvent.Agg.InstanceID {
+		orgId = &idpEvent.Aggregate().ResourceOwner
+	}
+
+	jwt, err := p.idpRepo.GetJWT(context.Background(), p.idpRepo.IDCondition(idpEvent.IDPConfigID), idpEvent.Agg.InstanceID, orgId)
 	if err != nil {
 		return nil, err
 	}
 
-	if e.JWTEndpoint != nil {
+	if idpEvent.JWTEndpoint != nil {
-		jwt.JWTEndpoint = *e.JWTEndpoint
+		jwt.JWTEndpoint = *idpEvent.JWTEndpoint
 	}
-	if e.Issuer != nil {
+	if idpEvent.Issuer != nil {
-		jwt.Issuer = *e.Issuer
+		jwt.Issuer = *idpEvent.Issuer
 	}
-	if e.KeysEndpoint != nil {
+	if idpEvent.KeysEndpoint != nil {
-		jwt.KeysEndpoint = *e.KeysEndpoint
+		jwt.KeysEndpoint = *idpEvent.KeysEndpoint
 	}
-	if e.HeaderName != nil {
+	if idpEvent.HeaderName != nil {
-		jwt.HeaderName = *e.HeaderName
+		jwt.HeaderName = *idpEvent.HeaderName
 	}
 
-	payload, err := json.Marshal(e)
+	payload, err := json.Marshal(idpEvent)
 	if err != nil {
 		return nil, err
 	}
 
 	return handler.NewUpdateStatement(
-		e,
+		&idpEvent,
 		[]handler.Column{
 			handler.NewCol(IDPRelationalPayloadCol, payload),
 			handler.NewCol(IDPTypeCol, domain.IDPTypeJWT.String()),
 		},
 		[]handler.Condition{
-			handler.NewCond(IDPIDCol, e.IDPConfigID),
+			handler.NewCond(IDPIDCol, idpEvent.IDPConfigID),
+			handler.NewCond(IDPInstanceIDCol, idpEvent.Aggregate().InstanceID),
+			handler.NewCond(IDPRelationalOrgId, orgId),
 		},
 	), nil
 }

internal/query/projection/idp_template_relational.go

@@ -17,6 +17,7 @@ import (
 )
 
 const (
+	IDPRelationalOrgId                = "org_id"
 	IDPRelationalAllowCreationCol     = "allow_creation"
 	IDPRelationalAllowLinkingCol      = "allow_linking"
 	IDPRelationalAllowAutoCreationCol = "allow_auto_creation"
@@ -101,7 +102,7 @@ func (p *idpTemplateRelationalProjection) Reducers() []handler.AggregateReducer
 				},
 				{
 					Event:  instance.JWTIDPAddedEventType,
-					Reduce: p.reduceJWTIDPReducedAdded,
+					Reduce: p.reduceJWTIDPRelationalAdded,
 				},
 				{
 					Event:  instance.JWTIDPChangedEventType,
@@ -191,51 +192,51 @@ func (p *idpTemplateRelationalProjection) Reducers() []handler.AggregateReducer
 				// 			Event:  instance.InstanceRemovedEventType,
 				// 			Reduce: reduceInstanceRemovedHelper(IDPTemplateInstanceIDCol),
 				// 		},
-				// 	},
+			},
+		},
+		{
+			Aggregate: org.AggregateType,
+			EventReducers: []handler.EventReducer{
+				{
+					Event:  org.OAuthIDPAddedEventType,
+					Reduce: p.reduceOAuthIDPRelationalAdded,
+				},
+				{
+					Event:  org.OAuthIDPChangedEventType,
+					Reduce: p.reduceOAuthIDPRelationalChanged,
+				},
+				{
+					Event:  org.OIDCIDPAddedEventType,
+					Reduce: p.reduceOIDCIDPRelationalAdded,
+				},
+				{
+					Event:  org.OIDCIDPChangedEventType,
+					Reduce: p.reduceOIDCIDPRelationalChanged,
+				},
+				{
+					Event:  org.OIDCIDPMigratedAzureADEventType,
+					Reduce: p.reduceOIDCIDPRelationalMigratedAzureAD,
+				},
+				{
+					Event:  org.OIDCIDPMigratedGoogleEventType,
+					Reduce: p.reduceOIDCIDPRelationalMigratedGoogle,
+				},
+				{
+					Event:  org.JWTIDPAddedEventType,
+					Reduce: p.reduceJWTIDPRelationalAdded,
+				},
+				{
+					Event:  org.JWTIDPChangedEventType,
+					Reduce: p.reduceJWTIDPRelationalChanged,
+				},
+				// {
+				// 	Event:  org.IDPConfigAddedEventType,
+				// 	Reduce: p.reduceOldConfigAdded,
 				// },
 				// {
-				// 	Aggregate: org.AggregateType,
+				// 	Event:  org.IDPConfigChangedEventType,
-				// 	EventReducers: []handler.EventReducer{
+				// 	Reduce: p.reduceOldConfigChanged,
-				// 		{
+				// },
-				// 			Event:  org.OAuthIDPAddedEventType,
-				// 			Reduce: p.reduceOAuthIDPAdded,
-				// 		},
-				// 		{
-				// 			Event:  org.OAuthIDPChangedEventType,
-				// 			Reduce: p.reduceOAuthIDPChanged,
-				// 		},
-				// 		{
-				// 			Event:  org.OIDCIDPAddedEventType,
-				// 			Reduce: p.reduceOIDCIDPAdded,
-				// 		},
-				// 		{
-				// 			Event:  org.OIDCIDPChangedEventType,
-				// 			Reduce: p.reduceOIDCIDPChanged,
-				// 		},
-				// 		{
-				// 			Event:  org.OIDCIDPMigratedAzureADEventType,
-				// 			Reduce: p.reduceOIDCIDPMigratedAzureAD,
-				// 		},
-				// 		{
-				// 			Event:  org.OIDCIDPMigratedGoogleEventType,
-				// 			Reduce: p.reduceOIDCIDPMigratedGoogle,
-				// 		},
-				// 		{
-				// 			Event:  org.JWTIDPAddedEventType,
-				// 			Reduce: p.reduceJWTIDPAdded,
-				// 		},
-				// 		{
-				// 			Event:  org.JWTIDPChangedEventType,
-				// 			Reduce: p.reduceJWTIDPChanged,
-				// 		},
-				// 		{
-				// 			Event:  org.IDPConfigAddedEventType,
-				// 			Reduce: p.reduceOldConfigAdded,
-				// 		},
-				// 		{
-				// 			Event:  org.IDPConfigChangedEventType,
-				// 			Reduce: p.reduceOldConfigChanged,
-				// 		},
 				// 		{
 				// 			Event:  org.IDPOIDCConfigAddedEventType,
 				// 			Reduce: p.reduceOldOIDCConfigAdded,
@@ -252,58 +253,58 @@ func (p *idpTemplateRelationalProjection) Reducers() []handler.AggregateReducer
 				// 			Event:  org.IDPJWTConfigChangedEventType,
 				// 			Reduce: p.reduceOldJWTConfigChanged,
 				// 		},
-				// 		{
+				{
-				// 			Event:  org.AzureADIDPAddedEventType,
+					Event:  org.AzureADIDPAddedEventType,
-				// 			Reduce: p.reduceAzureADIDPAdded,
+					Reduce: p.reduceAzureADIDPRelationalAdded,
-				// 		},
+				},
-				// 		{
+				{
-				// 			Event:  org.AzureADIDPChangedEventType,
+					Event:  org.AzureADIDPChangedEventType,
-				// 			Reduce: p.reduceAzureADIDPChanged,
+					Reduce: p.reduceAzureADIDPRelationalChanged,
-				// 		},
+				},
-				// 		{
+				{
-				// 			Event:  org.GitHubIDPAddedEventType,
+					Event:  org.GitHubIDPAddedEventType,
-				// 			Reduce: p.reduceGitHubIDPAdded,
+					Reduce: p.reduceGitHubIDPRelationalAdded,
-				// 		},
+				},
-				// 		{
+				{
-				// 			Event:  org.GitHubIDPChangedEventType,
+					Event:  org.GitHubIDPChangedEventType,
-				// 			Reduce: p.reduceGitHubIDPChanged,
+					Reduce: p.reduceGitHubIDPRelationalChanged,
-				// 		},
+				},
-				// 		{
+				{
-				// 			Event:  org.GitHubEnterpriseIDPAddedEventType,
+					Event:  org.GitHubEnterpriseIDPAddedEventType,
-				// 			Reduce: p.reduceGitHubEnterpriseIDPAdded,
+					Reduce: p.reduceGitHubEnterpriseIDPRelationalAdded,
-				// 		},
+				},
-				// 		{
+				{
-				// 			Event:  org.GitHubEnterpriseIDPChangedEventType,
+					Event:  org.GitHubEnterpriseIDPChangedEventType,
-				// 			Reduce: p.reduceGitHubEnterpriseIDPChanged,
+					Reduce: p.reduceGitHubEnterpriseIDPRelationalChanged,
-				// 		},
+				},
-				// 		{
+				{
-				// 			Event:  org.GitLabIDPAddedEventType,
+					Event:  org.GitLabIDPAddedEventType,
-				// 			Reduce: p.reduceGitLabIDPAdded,
+					Reduce: p.reduceGitLabIDPRelationalAdded,
-				// 		},
+				},
-				// 		{
+				{
-				// 			Event:  org.GitLabIDPChangedEventType,
+					Event:  org.GitLabIDPChangedEventType,
-				// 			Reduce: p.reduceGitLabIDPChanged,
+					Reduce: p.reduceGitLabIDPRelationalChanged,
-				// 		},
+				},
-				// 		{
+				{
-				// 			Event:  org.GitLabSelfHostedIDPAddedEventType,
+					Event:  org.GitLabSelfHostedIDPAddedEventType,
-				// 			Reduce: p.reduceGitLabSelfHostedIDPAdded,
+					Reduce: p.reduceGitLabSelfHostedIDPRelationalAdded,
-				// 		},
+				},
-				// 		{
+				{
-				// 			Event:  org.GitLabSelfHostedIDPChangedEventType,
+					Event:  org.GitLabSelfHostedIDPChangedEventType,
-				// 			Reduce: p.reduceGitLabSelfHostedIDPChanged,
+					Reduce: p.reduceGitLabSelfHostedIDPRelationalChanged,
-				// 		},
+				},
-				// 		{
+				{
-				// 			Event:  org.GoogleIDPAddedEventType,
+					Event:  org.GoogleIDPAddedEventType,
-				// 			Reduce: p.reduceGoogleIDPAdded,
+					Reduce: p.reduceGoogleIDPRelationalAdded,
-				// 		},
+				},
-				// 		{
+				{
-				// 			Event:  org.GoogleIDPChangedEventType,
+					Event:  org.GoogleIDPChangedEventType,
-				// 			Reduce: p.reduceGoogleIDPChanged,
+					Reduce: p.reduceGoogleIDPRelationalChanged,
-				// 		},
+				},
-				// 		{
+				// {
-				// 			Event:  org.LDAPIDPAddedEventType,
+				// 	Event:  org.LDAPIDPAddedEventType,
-				// 			Reduce: p.reduceLDAPIDPAdded,
+				// 	Reduce: p.reduceLDAPIDPAdded,
-				// 		},
+				// },
 				// 		{
 				// 			Event:  org.LDAPIDPChangedEventType,
 				// 			Reduce: p.reduceLDAPIDPChanged,
@@ -368,11 +369,17 @@ func (p *idpTemplateRelationalProjection) reduceOAuthIDPRelationalAdded(event ev
 		return nil, err
 	}
 
+	var orgId *string
+	if idpEvent.Aggregate().ResourceOwner != idpEvent.Agg.InstanceID {
+		orgId = &idpEvent.Aggregate().ResourceOwner
+	}
+
 	return handler.NewMultiStatement(
 		&idpEvent,
 		handler.AddCreateStatement(
 			[]handler.Column{
 				handler.NewCol(IDPTemplateIDCol, idpEvent.ID),
+				handler.NewCol(IDPRelationalOrgId, orgId),
 				handler.NewCol(IDPTemplateInstanceIDCol, idpEvent.Aggregate().InstanceID),
 				handler.NewCol(IDPTemplateStateCol, db_domain.IDPStateActive.String()),
 				handler.NewCol(IDPTemplateNameCol, idpEvent.Name),
@@ -400,7 +407,12 @@ func (p *idpTemplateRelationalProjection) reduceOAuthIDPRelationalChanged(event
 		return nil, zerrors.ThrowInvalidArgumentf(nil, "HANDL-Y1582ks", "reduce.wrong.event.type %v", []eventstore.EventType{org.OAuthIDPChangedEventType, instance.OAuthIDPChangedEventType})
 	}
 
-	oauth, err := p.idpRepo.GetOAuth(context.Background(), p.idpRepo.IDCondition(idpEvent.ID), idpEvent.Agg.InstanceID, nil)
+	var orgId *string
+	if idpEvent.Aggregate().ResourceOwner != idpEvent.Agg.InstanceID {
+		orgId = &idpEvent.Aggregate().ResourceOwner
+	}
+
+	oauth, err := p.idpRepo.GetOAuth(context.Background(), p.idpRepo.IDCondition(idpEvent.ID), idpEvent.Agg.InstanceID, orgId)
 	if err != nil {
 		return nil, err
 	}
@@ -425,6 +437,7 @@ func (p *idpTemplateRelationalProjection) reduceOAuthIDPRelationalChanged(event
 			[]handler.Condition{
 				handler.NewCond(IDPTemplateIDCol, idpEvent.ID),
 				handler.NewCond(IDPTemplateInstanceIDCol, idpEvent.Aggregate().InstanceID),
+				handler.NewCond(IDPRelationalOrgId, orgId),
 			},
 		),
 	), nil
@@ -451,13 +464,18 @@ func (p *idpTemplateRelationalProjection) reduceOIDCIDPRelationalAdded(event eve
 		return nil, err
 	}
 
+	var orgId *string
+	if idpEvent.Aggregate().ResourceOwner != idpEvent.Agg.InstanceID {
+		orgId = &idpEvent.Aggregate().ResourceOwner
+	}
+
 	return handler.NewMultiStatement(
 		&idpEvent,
 		handler.AddCreateStatement(
 			[]handler.Column{
 				handler.NewCol(IDPTemplateIDCol, idpEvent.ID),
-				handler.NewCol(CreatedAt, idpEvent.CreationDate()),
 				handler.NewCol(IDPTemplateInstanceIDCol, idpEvent.Aggregate().InstanceID),
+				handler.NewCol(IDPRelationalOrgId, orgId),
 				handler.NewCol(IDPTemplateStateCol, db_domain.IDPStateActive),
 				handler.NewCol(IDPTemplateNameCol, idpEvent.Name),
 				handler.NewCol(IDPTemplateTypeCol, db_domain.IDPTypeOIDC.String()),
@@ -467,6 +485,7 @@ func (p *idpTemplateRelationalProjection) reduceOIDCIDPRelationalAdded(event eve
 				handler.NewCol(IDPRelationalAllowAutoUpdateCol, idpEvent.IsAutoUpdate),
 				handler.NewCol(IDPRelationalAllowAutoLinkingCol, db_domain.IDPAutoLinkingOption(idpEvent.AutoLinkingOption).String()),
 				handler.NewCol(IDPRelationalPayloadCol, payload),
+				handler.NewCol(CreatedAt, idpEvent.CreationDate()),
 			},
 		),
 	), nil
@@ -488,7 +507,12 @@ func (p *idpTemplateRelationalProjection) reduceOIDCIDPRelationalChanged(event e
 	// 	return nil, zerrors.ThrowInvalidArgumentf(nil, "HANDL-p1582ks", "reduce.wrong.event.type %v", []eventstore.EventType{org.OIDCIDPChangedEventType, instance.OIDCIDPChangedEventType})
 	// }
 
-	oidc, err := p.idpRepo.GetOIDC(context.Background(), p.idpRepo.IDCondition(idpEvent.ID), idpEvent.Agg.InstanceID, nil)
+	var orgId *string
+	if idpEvent.Aggregate().ResourceOwner != idpEvent.Agg.InstanceID {
+		orgId = &idpEvent.Aggregate().ResourceOwner
+	}
+
+	oidc, err := p.idpRepo.GetOIDC(context.Background(), p.idpRepo.IDCondition(idpEvent.ID), idpEvent.Agg.InstanceID, orgId)
 	if err != nil {
 		return nil, err
 	}
@@ -513,6 +537,7 @@ func (p *idpTemplateRelationalProjection) reduceOIDCIDPRelationalChanged(event e
 			[]handler.Condition{
 				handler.NewCond(IDPTemplateIDCol, idpEvent.ID),
 				handler.NewCond(IDPTemplateInstanceIDCol, idpEvent.Aggregate().InstanceID),
+				handler.NewCond(IDPRelationalOrgId, orgId),
 			},
 		),
 	), nil
@@ -547,6 +572,11 @@ func (p *idpTemplateRelationalProjection) reduceOIDCIDPRelationalMigratedAzureAD
 		return nil, err
 	}
 
+	var orgId *string
+	if idpEvent.Aggregate().ResourceOwner != idpEvent.Agg.InstanceID {
+		orgId = &idpEvent.Aggregate().ResourceOwner
+	}
+
 	return handler.NewMultiStatement(
 		&idpEvent,
 		handler.AddUpdateStatement(
@@ -563,6 +593,7 @@ func (p *idpTemplateRelationalProjection) reduceOIDCIDPRelationalMigratedAzureAD
 			[]handler.Condition{
 				handler.NewCond(IDPTemplateIDCol, idpEvent.ID),
 				handler.NewCond(IDPTemplateInstanceIDCol, idpEvent.Aggregate().InstanceID),
+				handler.NewCond(IDPRelationalOrgId, orgId),
 			},
 		),
 	), nil
@@ -595,6 +626,11 @@ func (p *idpTemplateRelationalProjection) reduceOIDCIDPRelationalMigratedGoogle(
 		return nil, err
 	}
 
+	var orgId *string
+	if idpEvent.Aggregate().ResourceOwner != idpEvent.Agg.InstanceID {
+		orgId = &idpEvent.Aggregate().ResourceOwner
+	}
+
 	return handler.NewMultiStatement(
 		&idpEvent,
 		handler.AddUpdateStatement(
@@ -611,12 +647,13 @@ func (p *idpTemplateRelationalProjection) reduceOIDCIDPRelationalMigratedGoogle(
 			[]handler.Condition{
 				handler.NewCond(IDPTemplateIDCol, idpEvent.ID),
 				handler.NewCond(IDPTemplateInstanceIDCol, idpEvent.Aggregate().InstanceID),
+				handler.NewCond(IDPRelationalOrgId, orgId),
 			},
 		),
 	), nil
 }
 
-func (p *idpTemplateRelationalProjection) reduceJWTIDPReducedAdded(event eventstore.Event) (*handler.Statement, error) {
+func (p *idpTemplateRelationalProjection) reduceJWTIDPRelationalAdded(event eventstore.Event) (*handler.Statement, error) {
 	var idpEvent idp.JWTIDPAddedEvent
 	switch e := event.(type) {
 	case *org.JWTIDPAddedEvent:
@@ -644,14 +681,20 @@ func (p *idpTemplateRelationalProjection) reduceJWTIDPReducedAdded(event eventst
 		return nil, err
 	}
 
+	var orgId *string
+	if idpEvent.Aggregate().ResourceOwner != idpEvent.Agg.InstanceID {
+		orgId = &idpEvent.Aggregate().ResourceOwner
+	}
+
 	return handler.NewMultiStatement(
 		&idpEvent,
 		handler.AddCreateStatement(
 			[]handler.Column{
 				handler.NewCol(IDPTemplateIDCol, idpEvent.ID),
 				handler.NewCol(IDPTemplateInstanceIDCol, idpEvent.Aggregate().InstanceID),
-				handler.NewCol(IDPTemplateStateCol, db_domain.IDPStateActive.String()),
+				handler.NewCol(IDPRelationalOrgId, orgId),
 				handler.NewCol(IDPTemplateNameCol, idpEvent.Name),
+				handler.NewCol(IDPTemplateStateCol, db_domain.IDPStateActive.String()),
 				handler.NewCol(IDPTemplateTypeCol, db_domain.IDPTypeJWT.String()),
 				handler.NewCol(IDPRelationalAllowCreationCol, idpEvent.IsCreationAllowed),
 				handler.NewCol(IDPRelationalAllowLinkingCol, idpEvent.IsLinkingAllowed),
@@ -680,8 +723,12 @@ func (p *idpTemplateRelationalProjection) reduceJWTIDPRelationalChanged(event ev
 	// if !ok {
 	// 	return nil, zerrors.ThrowInvalidArgumentf(nil, "HANDL-p1582ks", "reduce.wrong.event.type %v", []eventstore.EventType{org.JWTIDPChangedEventType, instance.JWTIDPChangedEventType})
 	// }
+	var orgId *string
+	if idpEvent.Aggregate().ResourceOwner != idpEvent.Agg.InstanceID {
+		orgId = &idpEvent.Aggregate().ResourceOwner
+	}
 
-	jwt, err := p.idpRepo.GetJWT(context.Background(), p.idpRepo.IDCondition(idpEvent.ID), idpEvent.Agg.InstanceID, nil)
+	jwt, err := p.idpRepo.GetJWT(context.Background(), p.idpRepo.IDCondition(idpEvent.ID), idpEvent.Agg.InstanceID, orgId)
 	if err != nil {
 		return nil, err
 	}
@@ -706,6 +753,7 @@ func (p *idpTemplateRelationalProjection) reduceJWTIDPRelationalChanged(event ev
 			[]handler.Condition{
 				handler.NewCond(IDPTemplateIDCol, idpEvent.ID),
 				handler.NewCond(IDPTemplateInstanceIDCol, idpEvent.Aggregate().InstanceID),
+				handler.NewCond(IDPRelationalOrgId, orgId),
 			},
 		),
 	), nil
@@ -999,12 +1047,18 @@ func (p *idpTemplateRelationalProjection) reduceAzureADIDPRelationalAdded(event
 		return nil, err
 	}
 
+	var orgId *string
+	if idpEvent.Aggregate().ResourceOwner != idpEvent.Agg.InstanceID {
+		orgId = &idpEvent.Aggregate().ResourceOwner
+	}
+
 	return handler.NewMultiStatement(
 		&idpEvent,
 		handler.AddCreateStatement(
 			[]handler.Column{
 				handler.NewCol(IDPTemplateIDCol, idpEvent.ID),
 				handler.NewCol(IDPTemplateInstanceIDCol, idpEvent.Aggregate().InstanceID),
+				handler.NewCol(IDPRelationalOrgId, orgId),
 				handler.NewCol(IDPTemplateNameCol, idpEvent.Name),
 				handler.NewCol(IDPTemplateTypeCol, db_domain.IDPTypeAzure.String()),
 				handler.NewCol(IDPTemplateStateCol, db_domain.IDPStateActive.String()),
@@ -1035,8 +1089,12 @@ func (p *idpTemplateRelationalProjection) reduceAzureADIDPRelationalChanged(even
 	// if !ok {
 	// 	return nil, zerrors.ThrowInvalidArgumentf(nil, "HANDL-p1582ks", "reduce.wrong.event.type %v", []eventstore.EventType{org.AzureADIDPChangedEventType, instance.AzureADIDPChangedEventType})
 	// }
+	var orgId *string
+	if idpEvent.Aggregate().ResourceOwner != idpEvent.Agg.InstanceID {
+		orgId = &idpEvent.Aggregate().ResourceOwner
+	}
 
-	oauth, err := p.idpRepo.GetOAzureAD(context.Background(), p.idpRepo.IDCondition(idpEvent.ID), idpEvent.Agg.InstanceID, nil)
+	oauth, err := p.idpRepo.GetOAzureAD(context.Background(), p.idpRepo.IDCondition(idpEvent.ID), idpEvent.Agg.InstanceID, orgId)
 	if err != nil {
 		return nil, err
 	}
@@ -1061,6 +1119,7 @@ func (p *idpTemplateRelationalProjection) reduceAzureADIDPRelationalChanged(even
 			[]handler.Condition{
 				handler.NewCond(IDPTemplateIDCol, idpEvent.ID),
 				handler.NewCond(IDPTemplateInstanceIDCol, idpEvent.Aggregate().InstanceID),
+				handler.NewCond(IDPRelationalOrgId, orgId),
 			},
 		),
 	), nil
@@ -1093,12 +1152,18 @@ func (p *idpTemplateRelationalProjection) reduceGitHubIDPRelationalAdded(event e
 		return nil, err
 	}
 
+	var orgId *string
+	if idpEvent.Aggregate().ResourceOwner != idpEvent.Agg.InstanceID {
+		orgId = &idpEvent.Aggregate().ResourceOwner
+	}
+
 	return handler.NewMultiStatement(
 		&idpEvent,
 		handler.AddCreateStatement(
 			[]handler.Column{
 				handler.NewCol(IDPTemplateIDCol, idpEvent.ID),
 				handler.NewCol(IDPTemplateInstanceIDCol, idpEvent.Aggregate().InstanceID),
+				handler.NewCol(IDPRelationalOrgId, orgId),
 				handler.NewCol(IDPTemplateNameCol, idpEvent.Name),
 				handler.NewCol(IDPTemplateTypeCol, db_domain.IDPTypeGitHub.String()),
 				handler.NewCol(IDPTemplateStateCol, db_domain.IDPStateActive.String()),
@@ -1162,8 +1227,12 @@ func (p *idpTemplateRelationalProjection) reduceGitHubIDPRelationalChanged(event
 	// if !ok {
 	// 	return nil, zerrors.ThrowInvalidArgumentf(nil, "HANDL-p1582ks", "reduce.wrong.event.type %v", []eventstore.EventType{org.GitHubIDPChangedEventType, instance.GitHubIDPChangedEventType})
 	// }
+	var orgId *string
+	if idpEvent.Aggregate().ResourceOwner != idpEvent.Agg.InstanceID {
+		orgId = &idpEvent.Aggregate().ResourceOwner
+	}
 
-	github, err := p.idpRepo.GetGithub(context.Background(), p.idpRepo.IDCondition(idpEvent.ID), idpEvent.Agg.InstanceID, nil)
+	github, err := p.idpRepo.GetGithub(context.Background(), p.idpRepo.IDCondition(idpEvent.ID), idpEvent.Agg.InstanceID, orgId)
 	if err != nil {
 		return nil, err
 	}
@@ -1188,6 +1257,7 @@ func (p *idpTemplateRelationalProjection) reduceGitHubIDPRelationalChanged(event
 			[]handler.Condition{
 				handler.NewCond(IDPTemplateIDCol, idpEvent.ID),
 				handler.NewCond(IDPTemplateInstanceIDCol, idpEvent.Aggregate().InstanceID),
+				handler.NewCond(IDPRelationalOrgId, orgId),
 			},
 		),
 	), nil
@@ -1223,12 +1293,18 @@ func (p *idpTemplateRelationalProjection) reduceGitHubEnterpriseIDPRelationalAdd
 		return nil, err
 	}
 
+	var orgId *string
+	if idpEvent.Aggregate().ResourceOwner != idpEvent.Agg.InstanceID {
+		orgId = &idpEvent.Aggregate().ResourceOwner
+	}
+
 	return handler.NewMultiStatement(
 		&idpEvent,
 		handler.AddCreateStatement(
 			[]handler.Column{
 				handler.NewCol(IDPTemplateIDCol, idpEvent.ID),
 				handler.NewCol(IDPTemplateInstanceIDCol, idpEvent.Aggregate().InstanceID),
+				handler.NewCol(IDPRelationalOrgId, orgId),
 				handler.NewCol(IDPTemplateStateCol, db_domain.IDPStateActive.String()),
 				handler.NewCol(IDPTemplateNameCol, idpEvent.Name),
 				handler.NewCol(IDPTemplateTypeCol, db_domain.IDPTypeGitHubEnterprise.String()),
@@ -1259,8 +1335,12 @@ func (p *idpTemplateRelationalProjection) reduceGitHubEnterpriseIDPRelationalCha
 	// if !ok {
 	// 	return nil, zerrors.ThrowInvalidArgumentf(nil, "HANDL-SDg3g", "reduce.wrong.event.type %v", []eventstore.EventType{org.GitHubEnterpriseIDPChangedEventType, instance.GitHubEnterpriseIDPChangedEventType})
 	// }
+	var orgId *string
+	if idpEvent.Aggregate().ResourceOwner != idpEvent.Agg.InstanceID {
+		orgId = &idpEvent.Aggregate().ResourceOwner
+	}
 
-	githubEnterprise, err := p.idpRepo.GetGithubEnterprise(context.Background(), p.idpRepo.IDCondition(idpEvent.ID), idpEvent.Agg.InstanceID, nil)
+	githubEnterprise, err := p.idpRepo.GetGithubEnterprise(context.Background(), p.idpRepo.IDCondition(idpEvent.ID), idpEvent.Agg.InstanceID, orgId)
 	if err != nil {
 		return nil, err
 	}
@@ -1285,6 +1365,7 @@ func (p *idpTemplateRelationalProjection) reduceGitHubEnterpriseIDPRelationalCha
 			[]handler.Condition{
 				handler.NewCond(IDPTemplateIDCol, idpEvent.ID),
 				handler.NewCond(IDPTemplateInstanceIDCol, idpEvent.Aggregate().InstanceID),
+				handler.NewCond(IDPRelationalOrgId, orgId),
 			},
 		),
 	), nil
@@ -1317,12 +1398,18 @@ func (p *idpTemplateRelationalProjection) reduceGitLabIDPRelationalAdded(event e
 		return nil, err
 	}
 
+	var orgId *string
+	if idpEvent.Aggregate().ResourceOwner != idpEvent.Agg.InstanceID {
+		orgId = &idpEvent.Aggregate().ResourceOwner
+	}
+
 	return handler.NewMultiStatement(
 		&idpEvent,
 		handler.AddCreateStatement(
 			[]handler.Column{
 				handler.NewCol(IDPTemplateIDCol, idpEvent.ID),
 				handler.NewCol(IDPTemplateInstanceIDCol, idpEvent.Aggregate().InstanceID),
+				handler.NewCol(IDPRelationalOrgId, orgId),
 				handler.NewCol(IDPTemplateNameCol, idpEvent.Name),
 				handler.NewCol(IDPTemplateTypeCol, db_domain.IDPTypeGitLab.String()),
 				handler.NewCol(IDPTemplateStateCol, db_domain.IDPStateActive.String()),
@@ -1353,8 +1440,12 @@ func (p *idpTemplateRelationalProjection) reduceGitLabIDPRelationalChanged(event
 	// if !ok {
 	// 	return nil, zerrors.ThrowInvalidArgumentf(nil, "HANDL-p1582ks", "reduce.wrong.event.type %v", []eventstore.EventType{org.GitLabIDPChangedEventType, instance.GitLabIDPChangedEventType})
 	// }
+	var orgId *string
+	if idpEvent.Aggregate().ResourceOwner != idpEvent.Agg.InstanceID {
+		orgId = &idpEvent.Aggregate().ResourceOwner
+	}
 
-	oauth, err := p.idpRepo.GetGitlab(context.Background(), p.idpRepo.IDCondition(idpEvent.ID), idpEvent.Agg.InstanceID, nil)
+	oauth, err := p.idpRepo.GetGitlab(context.Background(), p.idpRepo.IDCondition(idpEvent.ID), idpEvent.Agg.InstanceID, orgId)
 	if err != nil {
 		return nil, err
 	}
@@ -1379,6 +1470,7 @@ func (p *idpTemplateRelationalProjection) reduceGitLabIDPRelationalChanged(event
 			[]handler.Condition{
 				handler.NewCond(IDPTemplateIDCol, idpEvent.ID),
 				handler.NewCond(IDPTemplateInstanceIDCol, idpEvent.Aggregate().InstanceID),
+				handler.NewCond(IDPRelationalOrgId, orgId),
 			},
 		),
 	), nil
@@ -1412,12 +1504,18 @@ func (p *idpTemplateRelationalProjection) reduceGitLabSelfHostedIDPRelationalAdd
 		return nil, err
 	}
 
+	var orgId *string
+	if idpEvent.Aggregate().ResourceOwner != idpEvent.Agg.InstanceID {
+		orgId = &idpEvent.Aggregate().ResourceOwner
+	}
+
 	return handler.NewMultiStatement(
 		&idpEvent,
 		handler.AddCreateStatement(
 			[]handler.Column{
 				handler.NewCol(IDPTemplateIDCol, idpEvent.ID),
 				handler.NewCol(IDPTemplateInstanceIDCol, idpEvent.Aggregate().InstanceID),
+				handler.NewCol(IDPRelationalOrgId, orgId),
 				handler.NewCol(IDPTemplateNameCol, idpEvent.Name),
 				handler.NewCol(IDPTemplateTypeCol, db_domain.IDPTypeGitLabSelfHosted.String()),
 				handler.NewCol(IDPTemplateStateCol, db_domain.IDPStateActive.String()),
@@ -1448,8 +1546,12 @@ func (p *idpTemplateRelationalProjection) reduceGitLabSelfHostedIDPRelationalCha
 	// if !ok {
 	// 	return nil, zerrors.ThrowInvalidArgumentf(nil, "HANDL-SAf3g2", "reduce.wrong.event.type %v", []eventstore.EventType{org.GitLabSelfHostedIDPChangedEventType, instance.GitLabSelfHostedIDPChangedEventType})
 	// }
+	var orgId *string
+	if idpEvent.Aggregate().ResourceOwner != idpEvent.Agg.InstanceID {
+		orgId = &idpEvent.Aggregate().ResourceOwner
+	}
 
-	gitlabSelfHosted, err := p.idpRepo.GetGitlabSelfHosting(context.Background(), p.idpRepo.IDCondition(idpEvent.ID), idpEvent.Agg.InstanceID, nil)
+	gitlabSelfHosted, err := p.idpRepo.GetGitlabSelfHosting(context.Background(), p.idpRepo.IDCondition(idpEvent.ID), idpEvent.Agg.InstanceID, orgId)
 	if err != nil {
 		return nil, err
 	}
@@ -1474,6 +1576,7 @@ func (p *idpTemplateRelationalProjection) reduceGitLabSelfHostedIDPRelationalCha
 			[]handler.Condition{
 				handler.NewCond(IDPTemplateIDCol, idpEvent.ID),
 				handler.NewCond(IDPTemplateInstanceIDCol, idpEvent.Aggregate().InstanceID),
+				handler.NewCond(IDPRelationalOrgId, orgId),
 			},
 		),
 	), nil
@@ -1535,12 +1638,17 @@ func (p *idpTemplateRelationalProjection) reduceGoogleIDPRelationalAdded(event e
 		return nil, err
 	}
 
+	var orgId *string
+	if idpEvent.Aggregate().ResourceOwner != idpEvent.Agg.InstanceID {
+		orgId = &idpEvent.Aggregate().ResourceOwner
+	}
 	return handler.NewMultiStatement(
 		&idpEvent,
 		handler.AddCreateStatement(
 			[]handler.Column{
 				handler.NewCol(IDPTemplateIDCol, idpEvent.ID),
 				handler.NewCol(IDPTemplateInstanceIDCol, idpEvent.Aggregate().InstanceID),
+				handler.NewCol(IDPRelationalOrgId, orgId),
 				handler.NewCol(IDPTemplateNameCol, idpEvent.Name),
 				handler.NewCol(IDPTemplateTypeCol, db_domain.IDPTypeGoogle.String()),
 				handler.NewCol(IDPTemplateStateCol, db_domain.IDPStateActive.String()),
@@ -1571,8 +1679,12 @@ func (p *idpTemplateRelationalProjection) reduceGoogleIDPRelationalChanged(event
 	// if !ok {
 	// 	return nil, zerrors.ThrowInvalidArgumentf(nil, "HANDL-p1582ks", "reduce.wrong.event.type %v", []eventstore.EventType{org.GoogleIDPChangedEventType, instance.GoogleIDPChangedEventType})
 	// }
+	var orgId *string
+	if idpEvent.Aggregate().ResourceOwner != idpEvent.Agg.InstanceID {
+		orgId = &idpEvent.Aggregate().ResourceOwner
+	}
 
-	oauth, err := p.idpRepo.GetGoogle(context.Background(), p.idpRepo.IDCondition(idpEvent.ID), idpEvent.Agg.InstanceID, nil)
+	oauth, err := p.idpRepo.GetGoogle(context.Background(), p.idpRepo.IDCondition(idpEvent.ID), idpEvent.Agg.InstanceID, orgId)
 	if err != nil {
 		return nil, err
 	}
@@ -1597,6 +1709,7 @@ func (p *idpTemplateRelationalProjection) reduceGoogleIDPRelationalChanged(event
 			[]handler.Condition{
 				handler.NewCond(IDPTemplateIDCol, idpEvent.ID),
 				handler.NewCond(IDPTemplateInstanceIDCol, idpEvent.Aggregate().InstanceID),
+				handler.NewCond(IDPRelationalOrgId, orgId),
 			},
 		),
 	), nil