feat(eventstore): increase parallel write capabilities (#5940)

This implementation increases parallel write capabilities of the eventstore.
Please have a look at the technical advisories: [05](https://zitadel.com/docs/support/advisory/a10005) and  [06](https://zitadel.com/docs/support/advisory/a10006).
The implementation of eventstore.push is rewritten and stored events are migrated to a new table `eventstore.events2`.
If you are using cockroach: make sure that the database user of ZITADEL has `VIEWACTIVITY` grant. This is used to query events.

internal/auth/repository/eventsourcing/handler/user_session.go

@@ -3,19 +3,16 @@ package handler
 import (
 	"context"
 
-	"github.com/zitadel/logging"
-
+	"github.com/zitadel/zitadel/internal/api/authz"
+	auth_view "github.com/zitadel/zitadel/internal/auth/repository/eventsourcing/view"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/errors"
 	"github.com/zitadel/zitadel/internal/eventstore"
-	v1 "github.com/zitadel/zitadel/internal/eventstore/v1"
+	"github.com/zitadel/zitadel/internal/eventstore/handler/v2"
 	"github.com/zitadel/zitadel/internal/eventstore/v1/models"
-	"github.com/zitadel/zitadel/internal/eventstore/v1/query"
-	es_sdk "github.com/zitadel/zitadel/internal/eventstore/v1/sdk"
-	"github.com/zitadel/zitadel/internal/eventstore/v1/spooler"
 	org_model "github.com/zitadel/zitadel/internal/org/model"
 	org_es_model "github.com/zitadel/zitadel/internal/org/repository/eventsourcing/model"
-	"github.com/zitadel/zitadel/internal/org/repository/view"
+	org_view "github.com/zitadel/zitadel/internal/org/repository/view"
 	query2 "github.com/zitadel/zitadel/internal/query"
 	"github.com/zitadel/zitadel/internal/repository/instance"
 	"github.com/zitadel/zitadel/internal/repository/org"
@@ -28,158 +25,299 @@ const (
 )
 
 type UserSession struct {
-	handler
-	subscription *v1.Subscription
-	queries      *query2.Queries
+	queries *query2.Queries
+	view    *auth_view.View
+	es      handler.EventStore
 }
 
-func newUserSession(ctx context.Context, handler handler, queries *query2.Queries) *UserSession {
-	h := &UserSession{
-		handler: handler,
-		queries: queries,
-	}
+var _ handler.Projection = (*UserSession)(nil)
 
-	h.subscribe(ctx)
-
-	return h
+func newUserSession(
+	ctx context.Context,
+	config handler.Config,
+	view *auth_view.View,
+	queries *query2.Queries,
+) *handler.Handler {
+	return handler.NewHandler(
+		ctx,
+		&config,
+		&UserSession{
+			queries: queries,
+			view:    view,
+			es:      config.Eventstore,
+		},
+	)
 }
 
-func (u *UserSession) subscribe(ctx context.Context) {
-	u.subscription = u.es.Subscribe(u.AggregateTypes()...)
-	go func() {
-		for event := range u.subscription.Events {
-			query.ReduceEvent(ctx, u, event)
-		}
-	}()
-}
-
-func (u *UserSession) ViewModel() string {
+// Name implements [handler.Projection]
+func (*UserSession) Name() string {
 	return userSessionTable
 }
 
-func (u *UserSession) Subscription() *v1.Subscription {
-	return u.subscription
-}
-
-func (_ *UserSession) AggregateTypes() []models.AggregateType {
-	return []models.AggregateType{user.AggregateType, org.AggregateType, instance.AggregateType}
-}
-
-func (u *UserSession) CurrentSequence(ctx context.Context, instanceID string) (uint64, error) {
-	sequence, err := u.view.GetLatestUserSessionSequence(ctx, instanceID)
-	if err != nil {
-		return 0, err
+// Reducers implements [handler.Projection]
+func (s *UserSession) Reducers() []handler.AggregateReducer {
+	return []handler.AggregateReducer{
+		{
+			Aggregate: user.AggregateType,
+			EventReducers: []handler.EventReducer{
+				{
+					Event:  user.UserV1PasswordCheckSucceededType,
+					Reduce: s.Reduce,
+				},
+				{
+					Event:  user.UserV1PasswordCheckFailedType,
+					Reduce: s.Reduce,
+				},
+				{
+					Event:  user.UserV1MFAOTPCheckSucceededType,
+					Reduce: s.Reduce,
+				},
+				{
+					Event:  user.UserV1MFAOTPCheckFailedType,
+					Reduce: s.Reduce,
+				},
+				{
+					Event:  user.UserV1SignedOutType,
+					Reduce: s.Reduce,
+				},
+				{
+					Event:  user.HumanPasswordCheckSucceededType,
+					Reduce: s.Reduce,
+				},
+				{
+					Event:  user.HumanPasswordCheckFailedType,
+					Reduce: s.Reduce,
+				},
+				{
+					Event:  user.UserIDPLoginCheckSucceededType,
+					Reduce: s.Reduce,
+				},
+				{
+					Event:  user.HumanMFAOTPCheckSucceededType,
+					Reduce: s.Reduce,
+				},
+				{
+					Event:  user.HumanMFAOTPCheckFailedType,
+					Reduce: s.Reduce,
+				},
+				{
+					Event:  user.HumanU2FTokenCheckSucceededType,
+					Reduce: s.Reduce,
+				},
+				{
+					Event:  user.HumanU2FTokenCheckFailedType,
+					Reduce: s.Reduce,
+				},
+				{
+					Event:  user.HumanPasswordlessTokenCheckSucceededType,
+					Reduce: s.Reduce,
+				},
+				{
+					Event:  user.HumanPasswordlessTokenCheckFailedType,
+					Reduce: s.Reduce,
+				},
+				{
+					Event:  user.HumanSignedOutType,
+					Reduce: s.Reduce,
+				},
+				{
+					Event:  user.UserV1PasswordChangedType,
+					Reduce: s.Reduce,
+				},
+				{
+					Event:  user.UserV1MFAOTPRemovedType,
+					Reduce: s.Reduce,
+				},
+				{
+					Event:  user.UserV1ProfileChangedType,
+					Reduce: s.Reduce,
+				},
+				{
+					Event:  user.UserLockedType,
+					Reduce: s.Reduce,
+				},
+				{
+					Event:  user.UserDeactivatedType,
+					Reduce: s.Reduce,
+				},
+				{
+					Event:  user.HumanPasswordChangedType,
+					Reduce: s.Reduce,
+				},
+				{
+					Event:  user.HumanMFAOTPRemovedType,
+					Reduce: s.Reduce,
+				},
+				{
+					Event:  user.HumanProfileChangedType,
+					Reduce: s.Reduce,
+				},
+				{
+					Event:  user.HumanAvatarAddedType,
+					Reduce: s.Reduce,
+				},
+				{
+					Event:  user.HumanAvatarRemovedType,
+					Reduce: s.Reduce,
+				},
+				{
+					Event:  user.UserDomainClaimedType,
+					Reduce: s.Reduce,
+				},
+				{
+					Event:  user.UserUserNameChangedType,
+					Reduce: s.Reduce,
+				},
+				{
+					Event:  user.UserIDPLinkRemovedType,
+					Reduce: s.Reduce,
+				},
+				{
+					Event:  user.UserIDPLinkCascadeRemovedType,
+					Reduce: s.Reduce,
+				},
+				{
+					Event:  user.HumanPasswordlessTokenRemovedType,
+					Reduce: s.Reduce,
+				},
+				{
+					Event:  user.HumanU2FTokenRemovedType,
+					Reduce: s.Reduce,
+				},
+				{
+					Event:  user.UserRemovedType,
+					Reduce: s.Reduce,
+				},
+			},
+		},
+		{
+			Aggregate: org.AggregateType,
+			EventReducers: []handler.EventReducer{
+				{
+					Event:  org.OrgDomainPrimarySetEventType,
+					Reduce: s.Reduce,
+				},
+				{
+					Event:  org.OrgRemovedEventType,
+					Reduce: s.Reduce,
+				},
+			},
+		},
+		{
+			Aggregate: instance.AggregateType,
+			EventReducers: []handler.EventReducer{
+				{
+					Event:  instance.InstanceRemovedEventType,
+					Reduce: s.Reduce,
+				},
+			},
+		},
 	}
-	return sequence.CurrentSequence, nil
 }
 
-func (u *UserSession) EventQuery(ctx context.Context, instanceIDs []string) (*models.SearchQuery, error) {
-	sequences, err := u.view.GetLatestUserSessionSequences(ctx, instanceIDs)
-	if err != nil {
-		return nil, err
-	}
-	return newSearchQuery(sequences, u.AggregateTypes(), instanceIDs), nil
+func (u *UserSession) Reduce(event eventstore.Event) (_ *handler.Statement, err error) {
+	return handler.NewStatement(event, func(ex handler.Executer, projectionName string) error {
+		var session *view_model.UserSessionView
+		switch event.Type() {
+		case user.UserV1PasswordCheckSucceededType,
+			user.UserV1PasswordCheckFailedType,
+			user.UserV1MFAOTPCheckSucceededType,
+			user.UserV1MFAOTPCheckFailedType,
+			user.UserV1SignedOutType,
+			user.HumanPasswordCheckSucceededType,
+			user.HumanPasswordCheckFailedType,
+			user.UserIDPLoginCheckSucceededType,
+			user.HumanMFAOTPCheckSucceededType,
+			user.HumanMFAOTPCheckFailedType,
+			user.HumanU2FTokenCheckSucceededType,
+			user.HumanU2FTokenCheckFailedType,
+			user.HumanPasswordlessTokenCheckSucceededType,
+			user.HumanPasswordlessTokenCheckFailedType,
+			user.HumanSignedOutType:
+
+			eventData, err := view_model.UserSessionFromEvent(event)
+			if err != nil {
+				return err
+			}
+			session, err = u.view.UserSessionByIDs(eventData.UserAgentID, event.Aggregate().ID, event.Aggregate().InstanceID)
+			if err != nil {
+				if !errors.IsNotFound(err) {
+					return err
+				}
+				session = &view_model.UserSessionView{
+					CreationDate:  event.CreatedAt(),
+					ResourceOwner: event.Aggregate().ResourceOwner,
+					UserAgentID:   eventData.UserAgentID,
+					UserID:        event.Aggregate().ID,
+					State:         int32(domain.UserSessionStateActive),
+					InstanceID:    event.Aggregate().InstanceID,
+				}
+			}
+			return u.updateSession(session, event)
+		case user.UserV1PasswordChangedType,
+			user.UserV1MFAOTPRemovedType,
+			user.UserV1ProfileChangedType,
+			user.UserLockedType,
+			user.UserDeactivatedType,
+			user.HumanPasswordChangedType,
+			user.HumanMFAOTPRemovedType,
+			user.HumanProfileChangedType,
+			user.HumanAvatarAddedType,
+			user.HumanAvatarRemovedType,
+			user.UserDomainClaimedType,
+			user.UserUserNameChangedType,
+			user.UserIDPLinkRemovedType,
+			user.UserIDPLinkCascadeRemovedType,
+			user.HumanPasswordlessTokenRemovedType,
+			user.HumanU2FTokenRemovedType:
+			sessions, err := u.view.UserSessionsByUserID(event.Aggregate().ID, event.Aggregate().InstanceID)
+			if err != nil || len(sessions) == 0 {
+				return err
+			}
+			if err = u.appendEventOnSessions(sessions, event); err != nil {
+				return err
+			}
+			if err = u.view.PutUserSessions(sessions); err != nil {
+				return err
+			}
+			return nil
+		case org.OrgDomainPrimarySetEventType:
+			return u.fillLoginNamesOnOrgUsers(event)
+		case user.UserRemovedType:
+			return u.view.DeleteUserSessions(event.Aggregate().ID, event.Aggregate().InstanceID)
+		case instance.InstanceRemovedEventType:
+			return u.view.DeleteInstanceUserSessions(event.Aggregate().InstanceID)
+		case org.OrgRemovedEventType:
+			return u.view.DeleteOrgUserSessions(event)
+		default:
+			return nil
+		}
+	}), nil
 }
 
-func (u *UserSession) Reduce(event *models.Event) (err error) {
-	var session *view_model.UserSessionView
-	switch eventstore.EventType(event.Type) {
-	case user.UserV1PasswordCheckSucceededType,
-		user.UserV1PasswordCheckFailedType,
-		user.UserV1MFAOTPCheckSucceededType,
-		user.UserV1MFAOTPCheckFailedType,
-		user.UserV1SignedOutType,
-		user.HumanPasswordCheckSucceededType,
-		user.HumanPasswordCheckFailedType,
-		user.UserIDPLoginCheckSucceededType,
-		user.HumanMFAOTPCheckSucceededType,
-		user.HumanMFAOTPCheckFailedType,
-		user.HumanU2FTokenCheckSucceededType,
-		user.HumanU2FTokenCheckFailedType,
-		user.HumanPasswordlessTokenCheckSucceededType,
-		user.HumanPasswordlessTokenCheckFailedType,
-		user.HumanSignedOutType:
-		eventData, err := view_model.UserSessionFromEvent(event)
-		if err != nil {
+func (u *UserSession) appendEventOnSessions(sessions []*view_model.UserSessionView, event eventstore.Event) error {
+	for _, session := range sessions {
+		if err := session.AppendEvent(event); err != nil {
 			return err
 		}
-		session, err = u.view.UserSessionByIDs(eventData.UserAgentID, event.AggregateID, event.InstanceID)
-		if err != nil {
-			if !errors.IsNotFound(err) {
-				return err
-			}
-			session = &view_model.UserSessionView{
-				CreationDate:  event.CreationDate,
-				ResourceOwner: event.ResourceOwner,
-				UserAgentID:   eventData.UserAgentID,
-				UserID:        event.AggregateID,
-				State:         int32(domain.UserSessionStateActive),
-				InstanceID:    event.InstanceID,
-			}
-		}
-		return u.updateSession(session, event)
-	case user.UserV1PasswordChangedType,
-		user.UserV1MFAOTPRemovedType,
-		user.UserV1ProfileChangedType,
-		user.UserLockedType,
-		user.UserDeactivatedType,
-		user.HumanPasswordChangedType,
-		user.HumanMFAOTPRemovedType,
-		user.HumanProfileChangedType,
-		user.HumanAvatarAddedType,
-		user.HumanAvatarRemovedType,
-		user.UserDomainClaimedType,
-		user.UserUserNameChangedType,
-		user.UserIDPLinkRemovedType,
-		user.UserIDPLinkCascadeRemovedType,
-		user.HumanPasswordlessTokenRemovedType,
-		user.HumanU2FTokenRemovedType:
-		sessions, err := u.view.UserSessionsByUserID(event.AggregateID, event.InstanceID)
-		if err != nil {
+		if err := u.fillUserInfo(session); err != nil {
 			return err
 		}
-		if len(sessions) == 0 {
-			return u.view.ProcessedUserSessionSequence(event)
-		}
-		for _, session := range sessions {
-			if err := session.AppendEvent(event); err != nil {
-				return err
-			}
-			if err := u.fillUserInfo(session); err != nil {
-				return err
-			}
-		}
-		return u.view.PutUserSessions(sessions, event)
-	case org.OrgDomainPrimarySetEventType:
-		return u.fillLoginNamesOnOrgUsers(event)
-	case user.UserRemovedType:
-		return u.view.DeleteUserSessions(event.AggregateID, event.InstanceID, event)
-	case instance.InstanceRemovedEventType:
-		return u.view.DeleteInstanceUserSessions(event)
-	case org.OrgRemovedEventType:
-		return u.view.DeleteOrgUserSessions(event)
-	default:
-		return u.view.ProcessedUserSessionSequence(event)
 	}
+	return nil
 }
 
-func (u *UserSession) OnError(event *models.Event, err error) error {
-	logging.WithFields("id", event.AggregateID).WithError(err).Warn("something went wrong in user session handler")
-	return spooler.HandleError(event, err, u.view.GetLatestUserSessionFailedEvent, u.view.ProcessedUserSessionFailedEvent, u.view.ProcessedUserSessionSequence, u.errorCountUntilSkip)
-}
-
-func (u *UserSession) OnSuccess(instanceIDs []string) error {
-	return spooler.HandleSuccess(u.view.UpdateUserSessionSpoolerRunTimestamp, instanceIDs)
-}
-
-func (u *UserSession) updateSession(session *view_model.UserSessionView, event *models.Event) error {
+func (u *UserSession) updateSession(session *view_model.UserSessionView, event eventstore.Event) error {
 	if err := session.AppendEvent(event); err != nil {
 		return err
 	}
 	if err := u.fillUserInfo(session); err != nil {
 		return err
 	}
-	return u.view.PutUserSession(session, event)
+	if err := u.view.PutUserSession(session); err != nil {
+		return err
+	}
+	return nil
 }
 
 func (u *UserSession) fillUserInfo(session *view_model.UserSessionView) error {
@@ -194,15 +332,15 @@ func (u *UserSession) fillUserInfo(session *view_model.UserSessionView) error {
 	return nil
 }
 
-func (u *UserSession) fillLoginNamesOnOrgUsers(event *models.Event) error {
-	sessions, err := u.view.UserSessionsByOrgID(event.ResourceOwner, event.InstanceID)
+func (u *UserSession) fillLoginNamesOnOrgUsers(event eventstore.Event) error {
+	sessions, err := u.view.UserSessionsByOrgID(event.Aggregate().ResourceOwner, event.Aggregate().InstanceID)
 	if err != nil {
 		return err
 	}
 	if len(sessions) == 0 {
-		return u.view.ProcessedUserSessionSequence(event)
+		return nil
 	}
-	userLoginMustBeDomain, primaryDomain, err := u.loginNameInformation(context.Background(), event.ResourceOwner, event.InstanceID)
+	userLoginMustBeDomain, primaryDomain, err := u.loginNameInformation(context.Background(), event.Aggregate().ResourceOwner, event.Aggregate().InstanceID)
 	if err != nil {
 		return err
 	}
@@ -212,7 +350,7 @@ func (u *UserSession) fillLoginNamesOnOrgUsers(event *models.Event) error {
 	for _, session := range sessions {
 		session.LoginName = session.UserName + "@" + primaryDomain
 	}
-	return u.view.PutUserSessions(sessions, event)
+	return u.view.PutUserSessions(sessions)
 }
 
 func (u *UserSession) loginNameInformation(ctx context.Context, orgID string, instanceID string) (userLoginMustBeDomain bool, primaryDomain string, err error) {
@@ -223,7 +361,7 @@ func (u *UserSession) loginNameInformation(ctx context.Context, orgID string, in
 	if org.DomainPolicy != nil {
 		return org.DomainPolicy.UserLoginMustBeDomain, org.GetPrimaryDomain().Domain, nil
 	}
-	policy, err := u.queries.DefaultDomainPolicy(withInstanceID(ctx, org.InstanceID))
+	policy, err := u.queries.DefaultDomainPolicy(authz.WithInstanceID(ctx, org.InstanceID))
 	if err != nil {
 		return false, "", err
 	}
@@ -231,7 +369,7 @@ func (u *UserSession) loginNameInformation(ctx context.Context, orgID string, in
 }
 
 func (u *UserSession) getOrgByID(ctx context.Context, orgID, instanceID string) (*org_model.Org, error) {
-	orgQuery, err := view.OrgByIDQuery(orgID, instanceID, 0)
+	query, err := org_view.OrgByIDQuery(orgID, instanceID, 0)
 	if err != nil {
 		return nil, err
 	}
@@ -241,13 +379,16 @@ func (u *UserSession) getOrgByID(ctx context.Context, orgID, instanceID string)
 			AggregateID: orgID,
 		},
 	}
-	err = es_sdk.Filter(ctx, u.Eventstore().FilterEvents, esOrg.AppendEvents, orgQuery)
-	if err != nil && !errors.IsNotFound(err) {
+	events, err := u.es.Filter(ctx, query)
+	if err != nil {
 		return nil, err
 	}
+	if err = esOrg.AppendEvents(events...); err != nil {
+		return nil, err
+	}
+
 	if esOrg.Sequence == 0 {
 		return nil, errors.ThrowNotFound(nil, "EVENT-3m9vs", "Errors.Org.NotFound")
 	}
-
 	return org_es_model.OrgToModel(esOrg), nil
 }