feat(eventstore): increase parallel write capabilities (#5940)

This implementation increases parallel write capabilities of the eventstore.
Please have a look at the technical advisories: [05](https://zitadel.com/docs/support/advisory/a10005) and  [06](https://zitadel.com/docs/support/advisory/a10006).
The implementation of eventstore.push is rewritten and stored events are migrated to a new table `eventstore.events2`.
If you are using cockroach: make sure that the database user of ZITADEL has `VIEWACTIVITY` grant. This is used to query events.

internal/notification/handlers/user_notifier.go

@@ -11,11 +11,9 @@ import (
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/errors"
 	"github.com/zitadel/zitadel/internal/eventstore"
-	"github.com/zitadel/zitadel/internal/eventstore/handler"
-	"github.com/zitadel/zitadel/internal/eventstore/handler/crdb"
+	"github.com/zitadel/zitadel/internal/eventstore/handler/v2"
 	"github.com/zitadel/zitadel/internal/notification/types"
 	"github.com/zitadel/zitadel/internal/query"
-	"github.com/zitadel/zitadel/internal/query/projection"
 	"github.com/zitadel/zitadel/internal/repository/session"
 	"github.com/zitadel/zitadel/internal/repository/user"
 )
@@ -25,7 +23,6 @@ const (
 )
 
 type userNotifier struct {
-	crdb.StatementHandler
 	commands     Commands
 	queries      *NotificationQueries
 	channels     types.ChannelChains
@@ -34,29 +31,29 @@ type userNotifier struct {
 
 func NewUserNotifier(
 	ctx context.Context,
-	config crdb.StatementHandlerConfig,
+	config handler.Config,
 	commands Commands,
 	queries *NotificationQueries,
 	channels types.ChannelChains,
 	otpEmailTmpl string,
-) *userNotifier {
-	p := new(userNotifier)
-	config.ProjectionName = UserNotificationsProjectionTable
-	config.Reducers = p.reducers()
-	p.StatementHandler = crdb.NewStatementHandler(ctx, config)
-	p.commands = commands
-	p.queries = queries
-	p.channels = channels
-	p.otpEmailTmpl = otpEmailTmpl
-	projection.NotificationsProjection = p
-	return p
+) *handler.Handler {
+	return handler.NewHandler(ctx, &config, &userNotifier{
+		commands:     commands,
+		queries:      queries,
+		otpEmailTmpl: otpEmailTmpl,
+		channels:     channels,
+	})
 }
 
-func (u *userNotifier) reducers() []handler.AggregateReducer {
+func (u *userNotifier) Name() string {
+	return UserNotificationsProjectionTable
+}
+
+func (u *userNotifier) Reducers() []handler.AggregateReducer {
 	return []handler.AggregateReducer{
 		{
 			Aggregate: user.AggregateType,
-			EventRedusers: []handler.EventReducer{
+			EventReducers: []handler.EventReducer{
 				{
 					Event:  user.UserV1InitialCodeAddedType,
 					Reduce: u.reduceInitCodeAdded,
@@ -113,7 +110,7 @@ func (u *userNotifier) reducers() []handler.AggregateReducer {
 		},
 		{
 			Aggregate: session.AggregateType,
-			EventRedusers: []handler.EventReducer{
+			EventReducers: []handler.EventReducer{
 				{
 					Event:  session.OTPSMSChallengedType,
 					Reduce: u.reduceSessionOTPSMSChallenged,
@@ -132,52 +129,52 @@ func (u *userNotifier) reduceInitCodeAdded(event eventstore.Event) (*handler.Sta
 	if !ok {
 		return nil, errors.ThrowInvalidArgumentf(nil, "HANDL-EFe2f", "reduce.wrong.event.type %s", user.HumanInitialCodeAddedType)
 	}
-	ctx := HandlerContext(event.Aggregate())
-	alreadyHandled, err := u.checkIfCodeAlreadyHandledOrExpired(ctx, event, e.Expiry, nil,
-		user.UserV1InitialCodeAddedType, user.UserV1InitialCodeSentType,
-		user.HumanInitialCodeAddedType, user.HumanInitialCodeSentType)
-	if err != nil {
-		return nil, err
-	}
-	if alreadyHandled {
-		return crdb.NewNoOpStatement(e), nil
-	}
-	code, err := crypto.DecryptString(e.Code, u.queries.UserDataCrypto)
-	if err != nil {
-		return nil, err
-	}
-	colors, err := u.queries.ActiveLabelPolicyByOrg(ctx, e.Aggregate().ResourceOwner, false)
-	if err != nil {
-		return nil, err
-	}
 
-	template, err := u.queries.MailTemplateByOrg(ctx, e.Aggregate().ResourceOwner, false)
-	if err != nil {
-		return nil, err
-	}
+	return handler.NewStatement(event, func(ex handler.Executer, projectionName string) error {
+		ctx := HandlerContext(event.Aggregate())
+		alreadyHandled, err := u.checkIfCodeAlreadyHandledOrExpired(ctx, event, e.Expiry, nil,
+			user.UserV1InitialCodeAddedType, user.UserV1InitialCodeSentType,
+			user.HumanInitialCodeAddedType, user.HumanInitialCodeSentType)
+		if err != nil {
+			return err
+		}
+		if alreadyHandled {
+			return nil
+		}
+		code, err := crypto.DecryptString(e.Code, u.queries.UserDataCrypto)
+		if err != nil {
+			return err
+		}
+		colors, err := u.queries.ActiveLabelPolicyByOrg(ctx, e.Aggregate().ResourceOwner, false)
+		if err != nil {
+			return err
+		}
 
-	notifyUser, err := u.queries.GetNotifyUserByID(ctx, true, e.Aggregate().ID, false)
-	if err != nil {
-		return nil, err
-	}
-	translator, err := u.queries.GetTranslatorWithOrgTexts(ctx, notifyUser.ResourceOwner, domain.InitCodeMessageType)
-	if err != nil {
-		return nil, err
-	}
-	ctx, err = u.queries.Origin(ctx, e)
-	if err != nil {
-		return nil, err
-	}
-	err = types.SendEmail(ctx, u.channels, string(template.Template), translator, notifyUser, colors, e).
-		SendUserInitCode(ctx, notifyUser, code)
-	if err != nil {
-		return nil, err
-	}
-	err = u.commands.HumanInitCodeSent(ctx, e.Aggregate().ResourceOwner, e.Aggregate().ID)
-	if err != nil {
-		return nil, err
-	}
-	return crdb.NewNoOpStatement(e), nil
+		template, err := u.queries.MailTemplateByOrg(ctx, e.Aggregate().ResourceOwner, false)
+		if err != nil {
+			return err
+		}
+
+		notifyUser, err := u.queries.GetNotifyUserByID(ctx, true, e.Aggregate().ID, false)
+		if err != nil {
+			return err
+		}
+		translator, err := u.queries.GetTranslatorWithOrgTexts(ctx, notifyUser.ResourceOwner, domain.InitCodeMessageType)
+		if err != nil {
+			return err
+		}
+
+		ctx, err = u.queries.Origin(ctx, e)
+		if err != nil {
+			return err
+		}
+		err = types.SendEmail(ctx, u.channels, string(template.Template), translator, notifyUser, colors, e).
+			SendUserInitCode(ctx, notifyUser, code)
+		if err != nil {
+			return err
+		}
+		return u.commands.HumanInitCodeSent(ctx, e.Aggregate().ResourceOwner, e.Aggregate().ID)
+	}), nil
 }
 
 func (u *userNotifier) reduceEmailCodeAdded(event eventstore.Event) (*handler.Statement, error) {
@@ -187,54 +184,54 @@ func (u *userNotifier) reduceEmailCodeAdded(event eventstore.Event) (*handler.St
 	}
 
 	if e.CodeReturned {
-		return crdb.NewNoOpStatement(e), nil
-	}
-	ctx := HandlerContext(event.Aggregate())
-	alreadyHandled, err := u.checkIfCodeAlreadyHandledOrExpired(ctx, event, e.Expiry, nil,
-		user.UserV1EmailCodeAddedType, user.UserV1EmailCodeSentType,
-		user.HumanEmailCodeAddedType, user.HumanEmailCodeSentType)
-	if err != nil {
-		return nil, err
-	}
-	if alreadyHandled {
-		return crdb.NewNoOpStatement(e), nil
-	}
-	code, err := crypto.DecryptString(e.Code, u.queries.UserDataCrypto)
-	if err != nil {
-		return nil, err
-	}
-	colors, err := u.queries.ActiveLabelPolicyByOrg(ctx, e.Aggregate().ResourceOwner, false)
-	if err != nil {
-		return nil, err
+		return handler.NewNoOpStatement(e), nil
 	}
 
-	template, err := u.queries.MailTemplateByOrg(ctx, e.Aggregate().ResourceOwner, false)
-	if err != nil {
-		return nil, err
-	}
+	return handler.NewStatement(event, func(ex handler.Executer, projectionName string) error {
+		ctx := HandlerContext(event.Aggregate())
+		alreadyHandled, err := u.checkIfCodeAlreadyHandledOrExpired(ctx, event, e.Expiry, nil,
+			user.UserV1EmailCodeAddedType, user.UserV1EmailCodeSentType,
+			user.HumanEmailCodeAddedType, user.HumanEmailCodeSentType)
+		if err != nil {
+			return err
+		}
+		if alreadyHandled {
+			return nil
+		}
+		code, err := crypto.DecryptString(e.Code, u.queries.UserDataCrypto)
+		if err != nil {
+			return err
+		}
+		colors, err := u.queries.ActiveLabelPolicyByOrg(ctx, e.Aggregate().ResourceOwner, false)
+		if err != nil {
+			return err
+		}
 
-	notifyUser, err := u.queries.GetNotifyUserByID(ctx, true, e.Aggregate().ID, false)
-	if err != nil {
-		return nil, err
-	}
-	translator, err := u.queries.GetTranslatorWithOrgTexts(ctx, notifyUser.ResourceOwner, domain.VerifyEmailMessageType)
-	if err != nil {
-		return nil, err
-	}
-	ctx, err = u.queries.Origin(ctx, e)
-	if err != nil {
-		return nil, err
-	}
-	err = types.SendEmail(ctx, u.channels, string(template.Template), translator, notifyUser, colors, e).
-		SendEmailVerificationCode(ctx, notifyUser, code, e.URLTemplate)
-	if err != nil {
-		return nil, err
-	}
-	err = u.commands.HumanEmailVerificationCodeSent(ctx, e.Aggregate().ResourceOwner, e.Aggregate().ID)
-	if err != nil {
-		return nil, err
-	}
-	return crdb.NewNoOpStatement(e), nil
+		template, err := u.queries.MailTemplateByOrg(ctx, e.Aggregate().ResourceOwner, false)
+		if err != nil {
+			return err
+		}
+
+		notifyUser, err := u.queries.GetNotifyUserByID(ctx, true, e.Aggregate().ID, false)
+		if err != nil {
+			return err
+		}
+		translator, err := u.queries.GetTranslatorWithOrgTexts(ctx, notifyUser.ResourceOwner, domain.VerifyEmailMessageType)
+		if err != nil {
+			return err
+		}
+
+		ctx, err = u.queries.Origin(ctx, e)
+		if err != nil {
+			return err
+		}
+		err = types.SendEmail(ctx, u.channels, string(template.Template), translator, notifyUser, colors, e).
+			SendEmailVerificationCode(ctx, notifyUser, code, e.URLTemplate)
+		if err != nil {
+			return err
+		}
+		return u.commands.HumanEmailVerificationCodeSent(ctx, e.Aggregate().ResourceOwner, e.Aggregate().ID)
+	}), nil
 }
 
 func (u *userNotifier) reducePasswordCodeAdded(event eventstore.Event) (*handler.Statement, error) {
@@ -243,57 +240,57 @@ func (u *userNotifier) reducePasswordCodeAdded(event eventstore.Event) (*handler
 		return nil, errors.ThrowInvalidArgumentf(nil, "HANDL-Eeg3s", "reduce.wrong.event.type %s", user.HumanPasswordCodeAddedType)
 	}
 	if e.CodeReturned {
-		return crdb.NewNoOpStatement(e), nil
-	}
-	ctx := HandlerContext(event.Aggregate())
-	alreadyHandled, err := u.checkIfCodeAlreadyHandledOrExpired(ctx, event, e.Expiry, nil,
-		user.UserV1PasswordCodeAddedType, user.UserV1PasswordCodeSentType,
-		user.HumanPasswordCodeAddedType, user.HumanPasswordCodeSentType)
-	if err != nil {
-		return nil, err
-	}
-	if alreadyHandled {
-		return crdb.NewNoOpStatement(e), nil
-	}
-	code, err := crypto.DecryptString(e.Code, u.queries.UserDataCrypto)
-	if err != nil {
-		return nil, err
-	}
-	colors, err := u.queries.ActiveLabelPolicyByOrg(ctx, e.Aggregate().ResourceOwner, false)
-	if err != nil {
-		return nil, err
+		return handler.NewNoOpStatement(e), nil
 	}
 
-	template, err := u.queries.MailTemplateByOrg(ctx, e.Aggregate().ResourceOwner, false)
-	if err != nil {
-		return nil, err
-	}
+	return handler.NewStatement(event, func(ex handler.Executer, projectionName string) error {
+		ctx := HandlerContext(event.Aggregate())
+		alreadyHandled, err := u.checkIfCodeAlreadyHandledOrExpired(ctx, event, e.Expiry, nil,
+			user.UserV1PasswordCodeAddedType, user.UserV1PasswordCodeSentType,
+			user.HumanPasswordCodeAddedType, user.HumanPasswordCodeSentType)
+		if err != nil {
+			return err
+		}
+		if alreadyHandled {
+			return nil
+		}
+		code, err := crypto.DecryptString(e.Code, u.queries.UserDataCrypto)
+		if err != nil {
+			return err
+		}
+		colors, err := u.queries.ActiveLabelPolicyByOrg(ctx, e.Aggregate().ResourceOwner, false)
+		if err != nil {
+			return err
+		}
 
-	notifyUser, err := u.queries.GetNotifyUserByID(ctx, true, e.Aggregate().ID, false)
-	if err != nil {
-		return nil, err
-	}
-	translator, err := u.queries.GetTranslatorWithOrgTexts(ctx, notifyUser.ResourceOwner, domain.PasswordResetMessageType)
-	if err != nil {
-		return nil, err
-	}
-	ctx, err = u.queries.Origin(ctx, e)
-	if err != nil {
-		return nil, err
-	}
-	notify := types.SendEmail(ctx, u.channels, string(template.Template), translator, notifyUser, colors, e)
-	if e.NotificationType == domain.NotificationTypeSms {
-		notify = types.SendSMSTwilio(ctx, u.channels, translator, notifyUser, colors, e)
-	}
-	err = notify.SendPasswordCode(ctx, notifyUser, code, e.URLTemplate)
-	if err != nil {
-		return nil, err
-	}
-	err = u.commands.PasswordCodeSent(ctx, e.Aggregate().ResourceOwner, e.Aggregate().ID)
-	if err != nil {
-		return nil, err
-	}
-	return crdb.NewNoOpStatement(e), nil
+		template, err := u.queries.MailTemplateByOrg(ctx, e.Aggregate().ResourceOwner, false)
+		if err != nil {
+			return err
+		}
+
+		notifyUser, err := u.queries.GetNotifyUserByID(ctx, true, e.Aggregate().ID, false)
+		if err != nil {
+			return err
+		}
+		translator, err := u.queries.GetTranslatorWithOrgTexts(ctx, notifyUser.ResourceOwner, domain.PasswordResetMessageType)
+		if err != nil {
+			return err
+		}
+
+		ctx, err = u.queries.Origin(ctx, e)
+		if err != nil {
+			return err
+		}
+		notify := types.SendEmail(ctx, u.channels, string(template.Template), translator, notifyUser, colors, e)
+		if e.NotificationType == domain.NotificationTypeSms {
+			notify = types.SendSMSTwilio(ctx, u.channels, translator, notifyUser, colors, e)
+		}
+		err = notify.SendPasswordCode(ctx, notifyUser, code, e.URLTemplate)
+		if err != nil {
+			return err
+		}
+		return u.commands.PasswordCodeSent(ctx, e.Aggregate().ResourceOwner, e.Aggregate().ID)
+	}), nil
 }
 
 func (u *userNotifier) reduceOTPSMSCodeAdded(event eventstore.Event) (*handler.Statement, error) {
@@ -319,7 +316,7 @@ func (u *userNotifier) reduceSessionOTPSMSChallenged(event eventstore.Event) (*h
 		return nil, errors.ThrowInvalidArgumentf(nil, "HANDL-Sk32L", "reduce.wrong.event.type %s", session.OTPSMSChallengedType)
 	}
 	if e.CodeReturned {
-		return crdb.NewNoOpStatement(e), nil
+		return handler.NewNoOpStatement(e), nil
 	}
 	ctx := HandlerContext(event.Aggregate())
 	s, err := u.queries.SessionByID(ctx, true, e.Aggregate().ID, "")
@@ -353,7 +350,7 @@ func (u *userNotifier) reduceOTPSMS(
 		return nil, err
 	}
 	if alreadyHandled {
-		return crdb.NewNoOpStatement(event), nil
+		return handler.NewNoOpStatement(event), nil
 	}
 	plainCode, err := crypto.DecryptString(code, u.queries.UserDataCrypto)
 	if err != nil {
@@ -385,7 +382,7 @@ func (u *userNotifier) reduceOTPSMS(
 	if err != nil {
 		return nil, err
 	}
-	return crdb.NewNoOpStatement(event), nil
+	return handler.NewNoOpStatement(event), nil
 }
 
 func (u *userNotifier) reduceOTPEmailCodeAdded(event eventstore.Event) (*handler.Statement, error) {
@@ -419,7 +416,7 @@ func (u *userNotifier) reduceSessionOTPEmailChallenged(event eventstore.Event) (
 		return nil, errors.ThrowInvalidArgumentf(nil, "HANDL-zbsgt", "reduce.wrong.event.type %s", session.OTPEmailChallengedType)
 	}
 	if e.ReturnCode {
-		return crdb.NewNoOpStatement(e), nil
+		return handler.NewNoOpStatement(e), nil
 	}
 	ctx := HandlerContext(event.Aggregate())
 	s, err := u.queries.SessionByID(ctx, true, e.Aggregate().ID, "")
@@ -466,7 +463,7 @@ func (u *userNotifier) reduceOTPEmail(
 		return nil, err
 	}
 	if alreadyHandled {
-		return crdb.NewNoOpStatement(event), nil
+		return handler.NewNoOpStatement(event), nil
 	}
 	plainCode, err := crypto.DecryptString(code, u.queries.UserDataCrypto)
 	if err != nil {
@@ -507,7 +504,7 @@ func (u *userNotifier) reduceOTPEmail(
 	if err != nil {
 		return nil, err
 	}
-	return crdb.NewNoOpStatement(event), nil
+	return handler.NewNoOpStatement(event), nil
 }
 
 func (u *userNotifier) reduceDomainClaimed(event eventstore.Event) (*handler.Statement, error) {
@@ -515,47 +512,46 @@ func (u *userNotifier) reduceDomainClaimed(event eventstore.Event) (*handler.Sta
 	if !ok {
 		return nil, errors.ThrowInvalidArgumentf(nil, "HANDL-Drh5w", "reduce.wrong.event.type %s", user.UserDomainClaimedType)
 	}
-	ctx := HandlerContext(event.Aggregate())
-	alreadyHandled, err := u.queries.IsAlreadyHandled(ctx, event, nil, user.AggregateType,
-		user.UserDomainClaimedType, user.UserDomainClaimedSentType)
-	if err != nil {
-		return nil, err
-	}
-	if alreadyHandled {
-		return crdb.NewNoOpStatement(e), nil
-	}
-	colors, err := u.queries.ActiveLabelPolicyByOrg(ctx, e.Aggregate().ResourceOwner, false)
-	if err != nil {
-		return nil, err
-	}
+	return handler.NewStatement(event, func(ex handler.Executer, projectionName string) error {
+		ctx := HandlerContext(event.Aggregate())
+		alreadyHandled, err := u.queries.IsAlreadyHandled(ctx, event, nil, user.AggregateType,
+			user.UserDomainClaimedType, user.UserDomainClaimedSentType)
+		if err != nil {
+			return err
+		}
+		if alreadyHandled {
+			return nil
+		}
+		colors, err := u.queries.ActiveLabelPolicyByOrg(ctx, e.Aggregate().ResourceOwner, false)
+		if err != nil {
+			return err
+		}
 
-	template, err := u.queries.MailTemplateByOrg(ctx, e.Aggregate().ResourceOwner, false)
-	if err != nil {
-		return nil, err
-	}
+		template, err := u.queries.MailTemplateByOrg(ctx, e.Aggregate().ResourceOwner, false)
+		if err != nil {
+			return err
+		}
 
-	notifyUser, err := u.queries.GetNotifyUserByID(ctx, true, e.Aggregate().ID, false)
-	if err != nil {
-		return nil, err
-	}
-	translator, err := u.queries.GetTranslatorWithOrgTexts(ctx, notifyUser.ResourceOwner, domain.DomainClaimedMessageType)
-	if err != nil {
-		return nil, err
-	}
-	ctx, err = u.queries.Origin(ctx, e)
-	if err != nil {
-		return nil, err
-	}
-	err = types.SendEmail(ctx, u.channels, string(template.Template), translator, notifyUser, colors, e).
-		SendDomainClaimed(ctx, notifyUser, e.UserName)
-	if err != nil {
-		return nil, err
-	}
-	err = u.commands.UserDomainClaimedSent(ctx, e.Aggregate().ResourceOwner, e.Aggregate().ID)
-	if err != nil {
-		return nil, err
-	}
-	return crdb.NewNoOpStatement(e), nil
+		notifyUser, err := u.queries.GetNotifyUserByID(ctx, true, e.Aggregate().ID, false)
+		if err != nil {
+			return err
+		}
+		translator, err := u.queries.GetTranslatorWithOrgTexts(ctx, notifyUser.ResourceOwner, domain.DomainClaimedMessageType)
+		if err != nil {
+			return err
+		}
+
+		ctx, err = u.queries.Origin(ctx, e)
+		if err != nil {
+			return err
+		}
+		err = types.SendEmail(ctx, u.channels, string(template.Template), translator, notifyUser, colors, e).
+			SendDomainClaimed(ctx, notifyUser, e.UserName)
+		if err != nil {
+			return err
+		}
+		return u.commands.UserDomainClaimedSent(ctx, e.Aggregate().ResourceOwner, e.Aggregate().ID)
+	}), nil
 }
 
 func (u *userNotifier) reducePasswordlessCodeRequested(event eventstore.Event) (*handler.Statement, error) {
@@ -564,52 +560,52 @@ func (u *userNotifier) reducePasswordlessCodeRequested(event eventstore.Event) (
 		return nil, errors.ThrowInvalidArgumentf(nil, "HANDL-EDtjd", "reduce.wrong.event.type %s", user.HumanPasswordlessInitCodeAddedType)
 	}
 	if e.CodeReturned {
-		return crdb.NewNoOpStatement(e), nil
-	}
-	ctx := HandlerContext(event.Aggregate())
-	alreadyHandled, err := u.checkIfCodeAlreadyHandledOrExpired(ctx, event, e.Expiry, map[string]interface{}{"id": e.ID}, user.HumanPasswordlessInitCodeSentType)
-	if err != nil {
-		return nil, err
-	}
-	if alreadyHandled {
-		return crdb.NewNoOpStatement(e), nil
-	}
-	code, err := crypto.DecryptString(e.Code, u.queries.UserDataCrypto)
-	if err != nil {
-		return nil, err
-	}
-	colors, err := u.queries.ActiveLabelPolicyByOrg(ctx, e.Aggregate().ResourceOwner, false)
-	if err != nil {
-		return nil, err
+		return handler.NewNoOpStatement(e), nil
 	}
 
-	template, err := u.queries.MailTemplateByOrg(ctx, e.Aggregate().ResourceOwner, false)
-	if err != nil {
-		return nil, err
-	}
+	return handler.NewStatement(event, func(ex handler.Executer, projectionName string) error {
+		ctx := HandlerContext(event.Aggregate())
+		alreadyHandled, err := u.checkIfCodeAlreadyHandledOrExpired(ctx, event, e.Expiry, map[string]interface{}{"id": e.ID}, user.HumanPasswordlessInitCodeSentType)
+		if err != nil {
+			return err
+		}
+		if alreadyHandled {
+			return nil
+		}
+		code, err := crypto.DecryptString(e.Code, u.queries.UserDataCrypto)
+		if err != nil {
+			return err
+		}
+		colors, err := u.queries.ActiveLabelPolicyByOrg(ctx, e.Aggregate().ResourceOwner, false)
+		if err != nil {
+			return err
+		}
 
-	notifyUser, err := u.queries.GetNotifyUserByID(ctx, true, e.Aggregate().ID, false)
-	if err != nil {
-		return nil, err
-	}
-	translator, err := u.queries.GetTranslatorWithOrgTexts(ctx, notifyUser.ResourceOwner, domain.PasswordlessRegistrationMessageType)
-	if err != nil {
-		return nil, err
-	}
-	ctx, err = u.queries.Origin(ctx, e)
-	if err != nil {
-		return nil, err
-	}
-	err = types.SendEmail(ctx, u.channels, string(template.Template), translator, notifyUser, colors, e).
-		SendPasswordlessRegistrationLink(ctx, notifyUser, code, e.ID, e.URLTemplate)
-	if err != nil {
-		return nil, err
-	}
-	err = u.commands.HumanPasswordlessInitCodeSent(ctx, e.Aggregate().ID, e.Aggregate().ResourceOwner, e.ID)
-	if err != nil {
-		return nil, err
-	}
-	return crdb.NewNoOpStatement(e), nil
+		template, err := u.queries.MailTemplateByOrg(ctx, e.Aggregate().ResourceOwner, false)
+		if err != nil {
+			return err
+		}
+
+		notifyUser, err := u.queries.GetNotifyUserByID(ctx, true, e.Aggregate().ID, false)
+		if err != nil {
+			return err
+		}
+		translator, err := u.queries.GetTranslatorWithOrgTexts(ctx, notifyUser.ResourceOwner, domain.PasswordlessRegistrationMessageType)
+		if err != nil {
+			return err
+		}
+
+		ctx, err = u.queries.Origin(ctx, e)
+		if err != nil {
+			return err
+		}
+		err = types.SendEmail(ctx, u.channels, string(template.Template), translator, notifyUser, colors, e).
+			SendPasswordlessRegistrationLink(ctx, notifyUser, code, e.ID, e.URLTemplate)
+		if err != nil {
+			return err
+		}
+		return u.commands.HumanPasswordlessInitCodeSent(ctx, e.Aggregate().ID, e.Aggregate().ResourceOwner, e.ID)
+	}), nil
 }
 
 func (u *userNotifier) reducePasswordChanged(event eventstore.Event) (*handler.Statement, error) {
@@ -617,57 +613,58 @@ func (u *userNotifier) reducePasswordChanged(event eventstore.Event) (*handler.S
 	if !ok {
 		return nil, errors.ThrowInvalidArgumentf(nil, "HANDL-Yko2z8", "reduce.wrong.event.type %s", user.HumanPasswordChangedType)
 	}
-	ctx := HandlerContext(event.Aggregate())
-	alreadyHandled, err := u.queries.IsAlreadyHandled(ctx, event, nil, user.AggregateType, user.HumanPasswordChangeSentType)
-	if err != nil {
-		return nil, err
-	}
-	if alreadyHandled {
-		return crdb.NewNoOpStatement(e), nil
-	}
 
-	notificationPolicy, err := u.queries.NotificationPolicyByOrg(ctx, true, e.Aggregate().ResourceOwner, false)
-	if errors.IsNotFound(err) {
-		return crdb.NewNoOpStatement(e), nil
-	}
-	if err != nil {
-		return nil, err
-	}
+	return handler.NewStatement(event, func(ex handler.Executer, projectionName string) error {
+		ctx := HandlerContext(event.Aggregate())
+		alreadyHandled, err := u.queries.IsAlreadyHandled(ctx, event, nil, user.AggregateType, user.HumanPasswordChangeSentType)
+		if err != nil {
+			return err
+		}
+		if alreadyHandled {
+			return nil
+		}
+
+		notificationPolicy, err := u.queries.NotificationPolicyByOrg(ctx, true, e.Aggregate().ResourceOwner, false)
+		if errors.IsNotFound(err) {
+			return nil
+		}
+		if err != nil {
+			return err
+		}
+
+		if !notificationPolicy.PasswordChange {
+			return nil
+		}
 
-	if notificationPolicy.PasswordChange {
 		colors, err := u.queries.ActiveLabelPolicyByOrg(ctx, e.Aggregate().ResourceOwner, false)
 		if err != nil {
-			return nil, err
+			return err
 		}
 
 		template, err := u.queries.MailTemplateByOrg(ctx, e.Aggregate().ResourceOwner, false)
 		if err != nil {
-			return nil, err
+			return err
 		}
 
 		notifyUser, err := u.queries.GetNotifyUserByID(ctx, true, e.Aggregate().ID, false)
 		if err != nil {
-			return nil, err
+			return err
 		}
 		translator, err := u.queries.GetTranslatorWithOrgTexts(ctx, notifyUser.ResourceOwner, domain.PasswordChangeMessageType)
 		if err != nil {
-			return nil, err
+			return err
 		}
 		ctx, err = u.queries.Origin(ctx, e)
 		if err != nil {
-			return nil, err
+			return err
 		}
 		err = types.SendEmail(ctx, u.channels, string(template.Template), translator, notifyUser, colors, e).
 			SendPasswordChange(ctx, notifyUser)
 		if err != nil {
-			return nil, err
+			return err
 		}
-		err = u.commands.PasswordChangeSent(ctx, e.Aggregate().ResourceOwner, e.Aggregate().ID)
-		if err != nil {
-			return nil, err
-		}
-	}
-	return crdb.NewNoOpStatement(e), nil
+		return u.commands.PasswordChangeSent(ctx, e.Aggregate().ResourceOwner, e.Aggregate().ID)
+	}), nil
 }
 
 func (u *userNotifier) reducePhoneCodeAdded(event eventstore.Event) (*handler.Statement, error) {
@@ -676,53 +673,53 @@ func (u *userNotifier) reducePhoneCodeAdded(event eventstore.Event) (*handler.St
 		return nil, errors.ThrowInvalidArgumentf(nil, "HANDL-He83g", "reduce.wrong.event.type %s", user.HumanPhoneCodeAddedType)
 	}
 	if e.CodeReturned {
-		return crdb.NewNoOpStatement(e), nil
-	}
-	ctx := HandlerContext(event.Aggregate())
-	alreadyHandled, err := u.checkIfCodeAlreadyHandledOrExpired(ctx, event, e.Expiry, nil,
-		user.UserV1PhoneCodeAddedType, user.UserV1PhoneCodeSentType,
-		user.HumanPhoneCodeAddedType, user.HumanPhoneCodeSentType)
-	if err != nil {
-		return nil, err
-	}
-	if alreadyHandled {
-		return crdb.NewNoOpStatement(e), nil
-	}
-	code, err := crypto.DecryptString(e.Code, u.queries.UserDataCrypto)
-	if err != nil {
-		return nil, err
-	}
-	colors, err := u.queries.ActiveLabelPolicyByOrg(ctx, e.Aggregate().ResourceOwner, false)
-	if err != nil {
-		return nil, err
+		return handler.NewNoOpStatement(e), nil
 	}
 
-	notifyUser, err := u.queries.GetNotifyUserByID(ctx, true, e.Aggregate().ID, false)
-	if err != nil {
-		return nil, err
-	}
-	translator, err := u.queries.GetTranslatorWithOrgTexts(ctx, notifyUser.ResourceOwner, domain.VerifyPhoneMessageType)
-	if err != nil {
-		return nil, err
-	}
-	ctx, err = u.queries.Origin(ctx, e)
-	if err != nil {
-		return nil, err
-	}
-	err = types.SendSMSTwilio(ctx, u.channels, translator, notifyUser, colors, e).
-		SendPhoneVerificationCode(ctx, code)
-	if err != nil {
-		return nil, err
-	}
-	err = u.commands.HumanPhoneVerificationCodeSent(ctx, e.Aggregate().ResourceOwner, e.Aggregate().ID)
-	if err != nil {
-		return nil, err
-	}
-	return crdb.NewNoOpStatement(e), nil
+	return handler.NewStatement(event, func(ex handler.Executer, projectionName string) error {
+		ctx := HandlerContext(event.Aggregate())
+		alreadyHandled, err := u.checkIfCodeAlreadyHandledOrExpired(ctx, event, e.Expiry, nil,
+			user.UserV1PhoneCodeAddedType, user.UserV1PhoneCodeSentType,
+			user.HumanPhoneCodeAddedType, user.HumanPhoneCodeSentType)
+		if err != nil {
+			return err
+		}
+		if alreadyHandled {
+			return nil
+		}
+		code, err := crypto.DecryptString(e.Code, u.queries.UserDataCrypto)
+		if err != nil {
+			return err
+		}
+		colors, err := u.queries.ActiveLabelPolicyByOrg(ctx, e.Aggregate().ResourceOwner, false)
+		if err != nil {
+			return err
+		}
+
+		notifyUser, err := u.queries.GetNotifyUserByID(ctx, true, e.Aggregate().ID, false)
+		if err != nil {
+			return err
+		}
+		translator, err := u.queries.GetTranslatorWithOrgTexts(ctx, notifyUser.ResourceOwner, domain.VerifyPhoneMessageType)
+		if err != nil {
+			return err
+		}
+
+		ctx, err = u.queries.Origin(ctx, e)
+		if err != nil {
+			return err
+		}
+		err = types.SendSMSTwilio(ctx, u.channels, translator, notifyUser, colors, e).
+			SendPhoneVerificationCode(ctx, code)
+		if err != nil {
+			return err
+		}
+		return u.commands.HumanPhoneVerificationCodeSent(ctx, e.Aggregate().ResourceOwner, e.Aggregate().ID)
+	}), nil
 }
 
 func (u *userNotifier) checkIfCodeAlreadyHandledOrExpired(ctx context.Context, event eventstore.Event, expiry time.Duration, data map[string]interface{}, eventTypes ...eventstore.EventType) (bool, error) {
-	if event.CreationDate().Add(expiry).Before(time.Now().UTC()) {
+	if event.CreatedAt().Add(expiry).Before(time.Now().UTC()) {
 		return true, nil
 	}
 	return u.queries.IsAlreadyHandled(ctx, event, data, user.AggregateType, eventTypes...)