feat(cli): setup (#3267)

* commander

* commander

* selber!

* move to packages

* fix(errors): implement Is interface

* test: command

* test: commands

* add init steps

* setup tenant

* add default step yaml

* possibility to set password

* merge v2 into v2-commander

* fix: rename iam command side to instance

* fix: rename iam command side to instance

* fix: rename iam command side to instance

* fix: rename iam command side to instance

* fix: search query builder can filter events in memory

* fix: filters for add member

* fix(setup): add `ExternalSecure` to config

* chore: name iam to instance

* fix: matching

* remove unsued func

* base url

* base url

* test(command): filter funcs

* test: commands

* fix: rename orgiampolicy to domain policy

* start from init

* commands

* config

* fix indexes and add constraints

* fixes

* fix: merge conflicts

* fix: protos

* fix: md files

* setup

* add deprecated org iam policy again

* typo

* fix search query

* fix filter

* Apply suggestions from code review

* remove custom org from org setup

* add todos for verification

* change apps creation

* simplify package structure

* fix error

* move preparation helper for tests

* fix unique constraints

* fix config mapping in setup

* fix error handling in encryption_keys.go

* fix projection config

* fix query from old views to projection

* fix setup of mgmt api

* set iam project and fix instance projection

* imports

Co-authored-by: Livio Amstutz <livio.a@gmail.com>
Co-authored-by: fabi <fabienne.gerschwiler@gmail.com>

internal/query/projection/action.go

@@ -49,7 +49,7 @@ func NewActionProjection(ctx context.Context, config crdb.StatementHandlerConfig
 			crdb.NewColumn(ActionAllowedToFailCol, crdb.ColumnTypeBool, crdb.Default(false)),
 		},
 			crdb.NewPrimaryKey(ActionInstanceIDCol, ActionIDCol),
-			crdb.NewIndex("ro_idx", []string{ActionResourceOwnerCol}),
+			crdb.WithIndex(crdb.NewIndex("ro_idx", []string{ActionResourceOwnerCol})),
 		),
 	)
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/app.go

@@ -75,7 +75,8 @@ func NewAppProjection(ctx context.Context, config crdb.StatementHandlerConfig) *
 			crdb.NewColumn(AppColumnSequence, crdb.ColumnTypeInt64),
 		},
 			crdb.NewPrimaryKey(AppColumnInstanceID, ActionIDCol),
-			crdb.NewIndex("project_id_idx", []string{AppColumnProjectID}),
+			crdb.WithIndex(crdb.NewIndex("project_id_idx", []string{AppColumnProjectID})),
+			crdb.WithConstraint(crdb.NewConstraint("id_unique", []string{AppColumnID})),
 		),
 		crdb.NewSuffixedTable([]*crdb.Column{
 			crdb.NewColumn(AppAPIConfigColumnAppID, crdb.ColumnTypeText, crdb.DeleteCascade(AppColumnID)),
@@ -85,7 +86,7 @@ func NewAppProjection(ctx context.Context, config crdb.StatementHandlerConfig) *
 		},
 			crdb.NewPrimaryKey(AppAPIConfigColumnAppID),
 			appAPITableSuffix,
-			crdb.NewIndex("client_id_idx", []string{AppAPIConfigColumnClientID}),
+			crdb.WithIndex(crdb.NewIndex("client_id_idx", []string{AppAPIConfigColumnClientID})),
 		),
 		crdb.NewSuffixedTable([]*crdb.Column{
 			crdb.NewColumn(AppOIDCConfigColumnAppID, crdb.ColumnTypeText, crdb.DeleteCascade(AppColumnID)),
@@ -108,7 +109,7 @@ func NewAppProjection(ctx context.Context, config crdb.StatementHandlerConfig) *
 		},
 			crdb.NewPrimaryKey(AppOIDCConfigColumnAppID),
 			appOIDCTableSuffix,
-			crdb.NewIndex("client_id_idx", []string{AppOIDCConfigColumnClientID}),
+			crdb.WithIndex(crdb.NewIndex("client_id_idx", []string{AppOIDCConfigColumnClientID})),
 		),
 	)
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/authn_key.go

@@ -53,8 +53,8 @@ func NewAuthNKeyProjection(ctx context.Context, config crdb.StatementHandlerConf
 			crdb.NewColumn(AuthNKeyTypeCol, crdb.ColumnTypeEnum, crdb.Default(0)),
 		},
 			crdb.NewPrimaryKey(AuthNKeyInstanceIDCol, AuthNKeyIDCol),
-			crdb.NewIndex("enabled_idx", []string{AuthNKeyEnabledCol}),
-			crdb.NewIndex("identifier_idx", []string{AuthNKeyIdentifierCol}),
+			crdb.WithIndex(crdb.NewIndex("enabled_idx", []string{AuthNKeyEnabledCol})),
+			crdb.WithIndex(crdb.NewIndex("identifier_idx", []string{AuthNKeyIdentifierCol})),
 		),
 	)
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/domain_policy.go

@@ -60,15 +60,15 @@ func (p *DomainPolicyProjection) reducers() []handler.AggregateReducer {
 			Aggregate: org.AggregateType,
 			EventRedusers: []handler.EventReducer{
 				{
-					Event:  org.OrgDomainPolicyAddedEventType,
+					Event:  org.DomainPolicyAddedEventType,
 					Reduce: p.reduceAdded,
 				},
 				{
-					Event:  org.OrgDomainPolicyChangedEventType,
+					Event:  org.DomainPolicyChangedEventType,
 					Reduce: p.reduceChanged,
 				},
 				{
-					Event:  org.OrgDomainPolicyRemovedEventType,
+					Event:  org.DomainPolicyRemovedEventType,
 					Reduce: p.reduceRemoved,
 				},
 			},
@@ -77,11 +77,11 @@ func (p *DomainPolicyProjection) reducers() []handler.AggregateReducer {
 			Aggregate: instance.AggregateType,
 			EventRedusers: []handler.EventReducer{
 				{
-					Event:  instance.InstanceDomainPolicyAddedEventType,
+					Event:  instance.DomainPolicyAddedEventType,
 					Reduce: p.reduceAdded,
 				},
 				{
-					Event:  instance.InstanceDomainPolicyChangedEventType,
+					Event:  instance.DomainPolicyChangedEventType,
 					Reduce: p.reduceChanged,
 				},
 			},
@@ -93,14 +93,14 @@ func (p *DomainPolicyProjection) reduceAdded(event eventstore.Event) (*handler.S
 	var policyEvent policy.DomainPolicyAddedEvent
 	var isDefault bool
 	switch e := event.(type) {
-	case *org.OrgDomainPolicyAddedEvent:
+	case *org.DomainPolicyAddedEvent:
 		policyEvent = e.DomainPolicyAddedEvent
 		isDefault = false
-	case *instance.InstanceDomainPolicyAddedEvent:
+	case *instance.DomainPolicyAddedEvent:
 		policyEvent = e.DomainPolicyAddedEvent
 		isDefault = true
 	default:
-		return nil, errors.ThrowInvalidArgumentf(nil, "PROJE-CSE7A", "reduce.wrong.event.type %v", []eventstore.EventType{org.OrgDomainPolicyAddedEventType, instance.InstanceDomainPolicyAddedEventType})
+		return nil, errors.ThrowInvalidArgumentf(nil, "PROJE-CSE7A", "reduce.wrong.event.type %v", []eventstore.EventType{org.DomainPolicyAddedEventType, instance.DomainPolicyAddedEventType})
 	}
 	return crdb.NewCreateStatement(
 		&policyEvent,
@@ -120,12 +120,12 @@ func (p *DomainPolicyProjection) reduceAdded(event eventstore.Event) (*handler.S
 func (p *DomainPolicyProjection) reduceChanged(event eventstore.Event) (*handler.Statement, error) {
 	var policyEvent policy.DomainPolicyChangedEvent
 	switch e := event.(type) {
-	case *org.OrgDomainPolicyChangedEvent:
+	case *org.DomainPolicyChangedEvent:
 		policyEvent = e.DomainPolicyChangedEvent
-	case *instance.InstanceDomainPolicyChangedEvent:
+	case *instance.DomainPolicyChangedEvent:
 		policyEvent = e.DomainPolicyChangedEvent
 	default:
-		return nil, errors.ThrowInvalidArgumentf(nil, "PROJE-qgVug", "reduce.wrong.event.type %v", []eventstore.EventType{org.OrgDomainPolicyChangedEventType, instance.InstanceDomainPolicyChangedEventType})
+		return nil, errors.ThrowInvalidArgumentf(nil, "PROJE-qgVug", "reduce.wrong.event.type %v", []eventstore.EventType{org.DomainPolicyChangedEventType, instance.DomainPolicyChangedEventType})
 	}
 	cols := []handler.Column{
 		handler.NewCol(DomainPolicyChangeDateCol, policyEvent.CreationDate()),
@@ -143,9 +143,9 @@ func (p *DomainPolicyProjection) reduceChanged(event eventstore.Event) (*handler
 }
 
 func (p *DomainPolicyProjection) reduceRemoved(event eventstore.Event) (*handler.Statement, error) {
-	policyEvent, ok := event.(*org.OrgDomainPolicyRemovedEvent)
+	policyEvent, ok := event.(*org.DomainPolicyRemovedEvent)
 	if !ok {
-		return nil, errors.ThrowInvalidArgumentf(nil, "PROJE-JAENd", "reduce.wrong.event.type %s", org.OrgDomainPolicyRemovedEventType)
+		return nil, errors.ThrowInvalidArgumentf(nil, "PROJE-JAENd", "reduce.wrong.event.type %s", org.DomainPolicyRemovedEventType)
 	}
 	return crdb.NewDeleteStatement(
 		policyEvent,

internal/query/projection/domain_policy_test.go

@@ -26,12 +26,12 @@ func TestDomainPolicyProjection_reduces(t *testing.T) {
 			name: "org.reduceAdded",
 			args: args{
 				event: getEvent(testEvent(
-					repository.EventType(org.OrgDomainPolicyAddedEventType),
+					repository.EventType(org.DomainPolicyAddedEventType),
 					org.AggregateType,
 					[]byte(`{
 						"userLoginMustBeDomain": true
 }`),
-				), org.OrgDomainPolicyAddedEventMapper),
+				), org.DomainPolicyAddedEventMapper),
 			},
 			reduce: (&DomainPolicyProjection{}).reduceAdded,
 			want: wantReduce{
@@ -64,12 +64,12 @@ func TestDomainPolicyProjection_reduces(t *testing.T) {
 			reduce: (&DomainPolicyProjection{}).reduceChanged,
 			args: args{
 				event: getEvent(testEvent(
-					repository.EventType(org.OrgDomainPolicyChangedEventType),
+					repository.EventType(org.DomainPolicyChangedEventType),
 					org.AggregateType,
 					[]byte(`{
 						"userLoginMustBeDomain": true
 		}`),
-				), org.OrgDomainPolicyChangedEventMapper),
+				), org.DomainPolicyChangedEventMapper),
 			},
 			want: wantReduce{
 				aggregateType:    eventstore.AggregateType("org"),
@@ -96,10 +96,10 @@ func TestDomainPolicyProjection_reduces(t *testing.T) {
 			reduce: (&DomainPolicyProjection{}).reduceRemoved,
 			args: args{
 				event: getEvent(testEvent(
-					repository.EventType(org.OrgDomainPolicyRemovedEventType),
+					repository.EventType(org.DomainPolicyRemovedEventType),
 					org.AggregateType,
 					nil,
-				), org.OrgDomainPolicyRemovedEventMapper),
+				), org.DomainPolicyRemovedEventMapper),
 			},
 			want: wantReduce{
 				aggregateType:    eventstore.AggregateType("org"),
@@ -123,12 +123,12 @@ func TestDomainPolicyProjection_reduces(t *testing.T) {
 			reduce: (&DomainPolicyProjection{}).reduceAdded,
 			args: args{
 				event: getEvent(testEvent(
-					repository.EventType(instance.InstanceDomainPolicyAddedEventType),
+					repository.EventType(instance.DomainPolicyAddedEventType),
 					instance.AggregateType,
 					[]byte(`{
 						"userLoginMustBeDomain": true
 					}`),
-				), instance.InstanceDomainPolicyAddedEventMapper),
+				), instance.DomainPolicyAddedEventMapper),
 			},
 			want: wantReduce{
 				aggregateType:    eventstore.AggregateType("instance"),
@@ -160,12 +160,12 @@ func TestDomainPolicyProjection_reduces(t *testing.T) {
 			reduce: (&DomainPolicyProjection{}).reduceChanged,
 			args: args{
 				event: getEvent(testEvent(
-					repository.EventType(instance.InstanceDomainPolicyChangedEventType),
+					repository.EventType(instance.DomainPolicyChangedEventType),
 					instance.AggregateType,
 					[]byte(`{
 						"userLoginMustBeDomain": true
 					}`),
-				), instance.InstanceDomainPolicyChangedEventMapper),
+				), instance.DomainPolicyChangedEventMapper),
 			},
 			want: wantReduce{
 				aggregateType:    eventstore.AggregateType("instance"),

internal/query/projection/idp.go

@@ -77,7 +77,8 @@ func NewIDPProjection(ctx context.Context, config crdb.StatementHandlerConfig) *
 			crdb.NewColumn(IDPTypeCol, crdb.ColumnTypeEnum),
 		},
 			crdb.NewPrimaryKey(IDPInstanceIDCol, IDPIDCol),
-			crdb.NewIndex("ro_idx", []string{IDPResourceOwnerCol}),
+			crdb.WithIndex(crdb.NewIndex("ro_idx", []string{IDPResourceOwnerCol})),
+			crdb.WithConstraint(crdb.NewConstraint("id_unique", []string{IDPIDCol})),
 		),
 		crdb.NewSuffixedTable([]*crdb.Column{
 			crdb.NewColumn(OIDCConfigIDPIDCol, crdb.ColumnTypeText, crdb.DeleteCascade(IDPIDCol)),

internal/query/projection/idp_login_policy_link.go

@@ -45,7 +45,7 @@ func NewIDPLoginPolicyLinkProjection(ctx context.Context, config crdb.StatementH
 			crdb.NewColumn(IDPLoginPolicyLinkInstanceIDCol, crdb.ColumnTypeText),
 		},
 			crdb.NewPrimaryKey(IDPLoginPolicyLinkInstanceIDCol, IDPLoginPolicyLinkAggregateIDCol, IDPLoginPolicyLinkIDPIDCol),
-			crdb.NewIndex("ro_idx", []string{IDPLoginPolicyLinkResourceOwnerCol}),
+			crdb.WithIndex(crdb.NewIndex("ro_idx", []string{IDPLoginPolicyLinkResourceOwnerCol})),
 		),
 	)
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/idp_user_link.go

@@ -46,7 +46,7 @@ func NewIDPUserLinkProjection(ctx context.Context, config crdb.StatementHandlerC
 			crdb.NewColumn(IDPUserLinkDisplayNameCol, crdb.ColumnTypeText),
 		},
 			crdb.NewPrimaryKey(IDPUserLinkInstanceIDCol, IDPUserLinkIDPIDCol, IDPUserLinkExternalUserIDCol),
-			crdb.NewIndex("user_idx", []string{IDPUserLinkUserIDCol}),
+			crdb.WithIndex(crdb.NewIndex("user_idx", []string{IDPUserLinkUserIDCol})),
 		),
 	)
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/instance.go

@@ -11,7 +11,7 @@ import (
 )
 
 const (
-	InstanceProjectionTable = "projections.instance"
+	InstanceProjectionTable = "projections.instances"
 
 	InstanceColumnID              = "id"
 	InstanceColumnChangeDate      = "change_date"
@@ -23,12 +23,12 @@ const (
 	InstanceColumnDefaultLanguage = "default_language"
 )
 
-type IAMProjection struct {
+type InstanceProjection struct {
 	crdb.StatementHandler
 }
 
-func NewIAMProjection(ctx context.Context, config crdb.StatementHandlerConfig) *IAMProjection {
-	p := new(IAMProjection)
+func NewInstanceProjection(ctx context.Context, config crdb.StatementHandlerConfig) *InstanceProjection {
+	p := new(InstanceProjection)
 	config.ProjectionName = InstanceProjectionTable
 	config.Reducers = p.reducers()
 	config.InitCheck = crdb.NewTableCheck(
@@ -49,7 +49,7 @@ func NewIAMProjection(ctx context.Context, config crdb.StatementHandlerConfig) *
 	return p
 }
 
-func (p *IAMProjection) reducers() []handler.AggregateReducer {
+func (p *InstanceProjection) reducers() []handler.AggregateReducer {
 	return []handler.AggregateReducer{
 		{
 			Aggregate: instance.AggregateType,
@@ -79,7 +79,7 @@ func (p *IAMProjection) reducers() []handler.AggregateReducer {
 	}
 }
 
-func (p *IAMProjection) reduceGlobalOrgSet(event eventstore.Event) (*handler.Statement, error) {
+func (p *InstanceProjection) reduceGlobalOrgSet(event eventstore.Event) (*handler.Statement, error) {
 	e, ok := event.(*instance.GlobalOrgSetEvent)
 	if !ok {
 		return nil, errors.ThrowInvalidArgumentf(nil, "HANDL-2n9f2", "reduce.wrong.event.type %s", instance.GlobalOrgSetEventType)
@@ -95,7 +95,7 @@ func (p *IAMProjection) reduceGlobalOrgSet(event eventstore.Event) (*handler.Sta
 	), nil
 }
 
-func (p *IAMProjection) reduceIAMProjectSet(event eventstore.Event) (*handler.Statement, error) {
+func (p *InstanceProjection) reduceIAMProjectSet(event eventstore.Event) (*handler.Statement, error) {
 	e, ok := event.(*instance.ProjectSetEvent)
 	if !ok {
 		return nil, errors.ThrowInvalidArgumentf(nil, "HANDL-30o0e", "reduce.wrong.event.type %s", instance.ProjectSetEventType)
@@ -111,7 +111,7 @@ func (p *IAMProjection) reduceIAMProjectSet(event eventstore.Event) (*handler.St
 	), nil
 }
 
-func (p *IAMProjection) reduceDefaultLanguageSet(event eventstore.Event) (*handler.Statement, error) {
+func (p *InstanceProjection) reduceDefaultLanguageSet(event eventstore.Event) (*handler.Statement, error) {
 	e, ok := event.(*instance.DefaultLanguageSetEvent)
 	if !ok {
 		return nil, errors.ThrowInvalidArgumentf(nil, "HANDL-30o0e", "reduce.wrong.event.type %s", instance.DefaultLanguageSetEventType)
@@ -127,7 +127,7 @@ func (p *IAMProjection) reduceDefaultLanguageSet(event eventstore.Event) (*handl
 	), nil
 }
 
-func (p *IAMProjection) reduceSetupEvent(event eventstore.Event) (*handler.Statement, error) {
+func (p *InstanceProjection) reduceSetupEvent(event eventstore.Event) (*handler.Statement, error) {
 	e, ok := event.(*instance.SetupStepEvent)
 	if !ok {
 		return nil, errors.ThrowInvalidArgumentf(nil, "HANDL-d9nfw", "reduce.wrong.event.type %v", []eventstore.EventType{instance.SetupDoneEventType, instance.SetupStartedEventType})

internal/query/projection/instance_member.go

@@ -29,7 +29,7 @@ func NewInstanceMemberProjection(ctx context.Context, config crdb.StatementHandl
 		crdb.NewTable(
 			append(memberColumns, crdb.NewColumn(InstanceColumnID, crdb.ColumnTypeText)),
 			crdb.NewPrimaryKey(MemberInstanceID, InstanceColumnID, MemberUserIDCol),
-			crdb.NewIndex("user_idx", []string{MemberUserIDCol}),
+			crdb.WithIndex(crdb.NewIndex("user_idx", []string{MemberUserIDCol})),
 		),
 	)
 

internal/query/projection/instance_test.go

@@ -30,7 +30,7 @@ func TestInstanceProjection_reduces(t *testing.T) {
 					[]byte(`{"globalOrgId": "orgid"}`),
 				), instance.GlobalOrgSetMapper),
 			},
-			reduce: (&IAMProjection{}).reduceGlobalOrgSet,
+			reduce: (&InstanceProjection{}).reduceGlobalOrgSet,
 			want: wantReduce{
 				projection:       InstanceProjectionTable,
 				aggregateType:    eventstore.AggregateType("instance"),
@@ -39,7 +39,7 @@ func TestInstanceProjection_reduces(t *testing.T) {
 				executer: &testExecuter{
 					executions: []execution{
 						{
-							expectedStmt: "UPSERT INTO projections.instance (id, change_date, sequence, global_org_id) VALUES ($1, $2, $3, $4)",
+							expectedStmt: "UPSERT INTO projections.instances (id, change_date, sequence, global_org_id) VALUES ($1, $2, $3, $4)",
 							expectedArgs: []interface{}{
 								"instance-id",
 								anyArg{},
@@ -60,7 +60,7 @@ func TestInstanceProjection_reduces(t *testing.T) {
 					[]byte(`{"iamProjectId": "project-id"}`),
 				), instance.ProjectSetMapper),
 			},
-			reduce: (&IAMProjection{}).reduceIAMProjectSet,
+			reduce: (&InstanceProjection{}).reduceIAMProjectSet,
 			want: wantReduce{
 				projection:       InstanceProjectionTable,
 				aggregateType:    eventstore.AggregateType("instance"),
@@ -69,7 +69,7 @@ func TestInstanceProjection_reduces(t *testing.T) {
 				executer: &testExecuter{
 					executions: []execution{
 						{
-							expectedStmt: "UPSERT INTO projections.instance (id, change_date, sequence, iam_project_id) VALUES ($1, $2, $3, $4)",
+							expectedStmt: "UPSERT INTO projections.instances (id, change_date, sequence, iam_project_id) VALUES ($1, $2, $3, $4)",
 							expectedArgs: []interface{}{
 								"instance-id",
 								anyArg{},
@@ -90,7 +90,7 @@ func TestInstanceProjection_reduces(t *testing.T) {
 					[]byte(`{"language": "en"}`),
 				), instance.DefaultLanguageSetMapper),
 			},
-			reduce: (&IAMProjection{}).reduceDefaultLanguageSet,
+			reduce: (&InstanceProjection{}).reduceDefaultLanguageSet,
 			want: wantReduce{
 				projection:       InstanceProjectionTable,
 				aggregateType:    eventstore.AggregateType("instance"),
@@ -99,7 +99,7 @@ func TestInstanceProjection_reduces(t *testing.T) {
 				executer: &testExecuter{
 					executions: []execution{
 						{
-							expectedStmt: "UPSERT INTO projections.instance (id, change_date, sequence, default_language) VALUES ($1, $2, $3, $4)",
+							expectedStmt: "UPSERT INTO projections.instances (id, change_date, sequence, default_language) VALUES ($1, $2, $3, $4)",
 							expectedArgs: []interface{}{
 								"instance-id",
 								anyArg{},
@@ -120,7 +120,7 @@ func TestInstanceProjection_reduces(t *testing.T) {
 					[]byte(`{"Step": 1}`),
 				), instance.SetupStepMapper),
 			},
-			reduce: (&IAMProjection{}).reduceSetupEvent,
+			reduce: (&InstanceProjection{}).reduceSetupEvent,
 			want: wantReduce{
 				projection:       InstanceProjectionTable,
 				aggregateType:    eventstore.AggregateType("instance"),
@@ -129,7 +129,7 @@ func TestInstanceProjection_reduces(t *testing.T) {
 				executer: &testExecuter{
 					executions: []execution{
 						{
-							expectedStmt: "UPSERT INTO projections.instance (id, change_date, sequence, setup_started) VALUES ($1, $2, $3, $4)",
+							expectedStmt: "UPSERT INTO projections.instances (id, change_date, sequence, setup_started) VALUES ($1, $2, $3, $4)",
 							expectedArgs: []interface{}{
 								"instance-id",
 								anyArg{},
@@ -150,7 +150,7 @@ func TestInstanceProjection_reduces(t *testing.T) {
 					[]byte(`{"Step": 1}`),
 				), instance.SetupStepMapper),
 			},
-			reduce: (&IAMProjection{}).reduceSetupEvent,
+			reduce: (&InstanceProjection{}).reduceSetupEvent,
 			want: wantReduce{
 				projection:       InstanceProjectionTable,
 				aggregateType:    eventstore.AggregateType("instance"),
@@ -159,7 +159,7 @@ func TestInstanceProjection_reduces(t *testing.T) {
 				executer: &testExecuter{
 					executions: []execution{
 						{
-							expectedStmt: "UPSERT INTO projections.instance (id, change_date, sequence, setup_done) VALUES ($1, $2, $3, $4)",
+							expectedStmt: "UPSERT INTO projections.instances (id, change_date, sequence, setup_done) VALUES ($1, $2, $3, $4)",
 							expectedArgs: []interface{}{
 								"instance-id",
 								anyArg{},

internal/query/projection/key.go

@@ -59,6 +59,7 @@ func NewKeyProjection(ctx context.Context, config crdb.StatementHandlerConfig, k
 			crdb.NewColumn(KeyColumnUse, crdb.ColumnTypeText, crdb.Default("")),
 		},
 			crdb.NewPrimaryKey(KeyColumnInstanceID, KeyColumnID),
+			crdb.WithConstraint(crdb.NewConstraint("id_unique", []string{KeyColumnID})),
 		),
 		crdb.NewSuffixedTable([]*crdb.Column{
 			crdb.NewColumn(KeyPrivateColumnID, crdb.ColumnTypeText, crdb.DeleteCascade(KeyColumnID)),

internal/query/projection/login_name.go

@@ -103,7 +103,7 @@ func NewLoginNameProjection(ctx context.Context, config crdb.StatementHandlerCon
 		},
 			crdb.NewPrimaryKey(LoginNameUserInstanceIDCol, LoginNameUserIDCol),
 			loginNameUserSuffix,
-			crdb.NewIndex("ro_idx", []string{LoginNameUserResourceOwnerCol}),
+			crdb.WithIndex(crdb.NewIndex("ro_idx", []string{LoginNameUserResourceOwnerCol})),
 		),
 		crdb.NewSuffixedTable([]*crdb.Column{
 			crdb.NewColumn(LoginNameDomainNameCol, crdb.ColumnTypeText),
@@ -122,7 +122,7 @@ func NewLoginNameProjection(ctx context.Context, config crdb.StatementHandlerCon
 		},
 			crdb.NewPrimaryKey(LoginNamePoliciesInstanceIDCol, LoginNamePoliciesResourceOwnerCol),
 			loginNamePolicySuffix,
-			crdb.NewIndex("is_default_idx", []string{LoginNamePoliciesResourceOwnerCol, LoginNamePoliciesIsDefaultCol}),
+			crdb.WithIndex(crdb.NewIndex("is_default_idx", []string{LoginNamePoliciesResourceOwnerCol, LoginNamePoliciesIsDefaultCol})),
 		),
 	)
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)
@@ -175,15 +175,15 @@ func (p *LoginNameProjection) reducers() []handler.AggregateReducer {
 			Aggregate: org.AggregateType,
 			EventRedusers: []handler.EventReducer{
 				{
-					Event:  org.OrgDomainPolicyAddedEventType,
+					Event:  org.DomainPolicyAddedEventType,
 					Reduce: p.reduceOrgIAMPolicyAdded,
 				},
 				{
-					Event:  org.OrgDomainPolicyChangedEventType,
+					Event:  org.DomainPolicyChangedEventType,
 					Reduce: p.reduceDomainPolicyChanged,
 				},
 				{
-					Event:  org.OrgDomainPolicyRemovedEventType,
+					Event:  org.DomainPolicyRemovedEventType,
 					Reduce: p.reduceDomainPolicyRemoved,
 				},
 				{
@@ -204,11 +204,11 @@ func (p *LoginNameProjection) reducers() []handler.AggregateReducer {
 			Aggregate: instance.AggregateType,
 			EventRedusers: []handler.EventReducer{
 				{
-					Event:  instance.InstanceDomainPolicyAddedEventType,
+					Event:  instance.DomainPolicyAddedEventType,
 					Reduce: p.reduceOrgIAMPolicyAdded,
 				},
 				{
-					Event:  instance.InstanceDomainPolicyChangedEventType,
+					Event:  instance.DomainPolicyChangedEventType,
 					Reduce: p.reduceDomainPolicyChanged,
 				},
 			},
@@ -300,14 +300,14 @@ func (p *LoginNameProjection) reduceOrgIAMPolicyAdded(event eventstore.Event) (*
 	)
 
 	switch e := event.(type) {
-	case *org.OrgDomainPolicyAddedEvent:
+	case *org.DomainPolicyAddedEvent:
 		policyEvent = &e.DomainPolicyAddedEvent
 		isDefault = false
-	case *instance.InstanceDomainPolicyAddedEvent:
+	case *instance.DomainPolicyAddedEvent:
 		policyEvent = &e.DomainPolicyAddedEvent
 		isDefault = true
 	default:
-		return nil, errors.ThrowInvalidArgumentf(nil, "HANDL-yCV6S", "reduce.wrong.event.type %v", []eventstore.EventType{org.OrgDomainPolicyAddedEventType, instance.InstanceDomainPolicyAddedEventType})
+		return nil, errors.ThrowInvalidArgumentf(nil, "HANDL-yCV6S", "reduce.wrong.event.type %v", []eventstore.EventType{org.DomainPolicyAddedEventType, instance.DomainPolicyAddedEventType})
 	}
 
 	return crdb.NewCreateStatement(
@@ -326,12 +326,12 @@ func (p *LoginNameProjection) reduceDomainPolicyChanged(event eventstore.Event)
 	var policyEvent *policy.DomainPolicyChangedEvent
 
 	switch e := event.(type) {
-	case *org.OrgDomainPolicyChangedEvent:
+	case *org.DomainPolicyChangedEvent:
 		policyEvent = &e.DomainPolicyChangedEvent
-	case *instance.InstanceDomainPolicyChangedEvent:
+	case *instance.DomainPolicyChangedEvent:
 		policyEvent = &e.DomainPolicyChangedEvent
 	default:
-		return nil, errors.ThrowInvalidArgumentf(nil, "HANDL-ArFDd", "reduce.wrong.event.type %v", []eventstore.EventType{org.OrgDomainPolicyChangedEventType, instance.InstanceDomainPolicyChangedEventType})
+		return nil, errors.ThrowInvalidArgumentf(nil, "HANDL-ArFDd", "reduce.wrong.event.type %v", []eventstore.EventType{org.DomainPolicyChangedEventType, instance.DomainPolicyChangedEventType})
 	}
 
 	if policyEvent.UserLoginMustBeDomain == nil {
@@ -351,9 +351,9 @@ func (p *LoginNameProjection) reduceDomainPolicyChanged(event eventstore.Event)
 }
 
 func (p *LoginNameProjection) reduceDomainPolicyRemoved(event eventstore.Event) (*handler.Statement, error) {
-	e, ok := event.(*org.OrgDomainPolicyRemovedEvent)
+	e, ok := event.(*org.DomainPolicyRemovedEvent)
 	if !ok {
-		return nil, errors.ThrowInvalidArgumentf(nil, "HANDL-ysEeB", "reduce.wrong.event.type %s", org.OrgDomainPolicyRemovedEventType)
+		return nil, errors.ThrowInvalidArgumentf(nil, "HANDL-ysEeB", "reduce.wrong.event.type %s", org.DomainPolicyRemovedEventType)
 	}
 
 	return crdb.NewDeleteStatement(

internal/query/projection/login_name_test.go

@@ -209,12 +209,12 @@ func TestLoginNameProjection_reduces(t *testing.T) {
 			name: "org.OrgDomainPolicyAddedEventType",
 			args: args{
 				event: getEvent(testEvent(
-					repository.EventType(org.OrgDomainPolicyAddedEventType),
+					repository.EventType(org.DomainPolicyAddedEventType),
 					user.AggregateType,
 					[]byte(`{
 					"userLoginMustBeDomain": true
 				}`),
-				), org.OrgDomainPolicyAddedEventMapper),
+				), org.DomainPolicyAddedEventMapper),
 			},
 			reduce: (&LoginNameProjection{}).reduceOrgIAMPolicyAdded,
 			want: wantReduce{
@@ -241,12 +241,12 @@ func TestLoginNameProjection_reduces(t *testing.T) {
 			name: "org.OrgDomainPolicyChangedEventType",
 			args: args{
 				event: getEvent(testEvent(
-					repository.EventType(org.OrgDomainPolicyChangedEventType),
+					repository.EventType(org.DomainPolicyChangedEventType),
 					user.AggregateType,
 					[]byte(`{
 					"userLoginMustBeDomain": false
 				}`),
-				), org.OrgDomainPolicyChangedEventMapper),
+				), org.DomainPolicyChangedEventMapper),
 			},
 			reduce: (&LoginNameProjection{}).reduceDomainPolicyChanged,
 			want: wantReduce{
@@ -271,10 +271,10 @@ func TestLoginNameProjection_reduces(t *testing.T) {
 			name: "org.OrgDomainPolicyChangedEventType no change",
 			args: args{
 				event: getEvent(testEvent(
-					repository.EventType(org.OrgDomainPolicyChangedEventType),
+					repository.EventType(org.DomainPolicyChangedEventType),
 					user.AggregateType,
 					[]byte(`{}`),
-				), org.OrgDomainPolicyChangedEventMapper),
+				), org.DomainPolicyChangedEventMapper),
 			},
 			reduce: (&LoginNameProjection{}).reduceDomainPolicyChanged,
 			want: wantReduce{
@@ -291,10 +291,10 @@ func TestLoginNameProjection_reduces(t *testing.T) {
 			name: "org.OrgDomainPolicyRemovedEventType",
 			args: args{
 				event: getEvent(testEvent(
-					repository.EventType(org.OrgDomainPolicyRemovedEventType),
+					repository.EventType(org.DomainPolicyRemovedEventType),
 					user.AggregateType,
 					[]byte(`{}`),
-				), org.OrgDomainPolicyRemovedEventMapper),
+				), org.DomainPolicyRemovedEventMapper),
 			},
 			reduce: (&LoginNameProjection{}).reduceDomainPolicyRemoved,
 			want: wantReduce{
@@ -418,12 +418,12 @@ func TestLoginNameProjection_reduces(t *testing.T) {
 			name: "iam.OrgDomainPolicyAddedEventType",
 			args: args{
 				event: getEvent(testEvent(
-					repository.EventType(instance.InstanceDomainPolicyAddedEventType),
+					repository.EventType(instance.DomainPolicyAddedEventType),
 					user.AggregateType,
 					[]byte(`{
 					"userLoginMustBeDomain": true
 				}`),
-				), instance.InstanceDomainPolicyAddedEventMapper),
+				), instance.DomainPolicyAddedEventMapper),
 			},
 			reduce: (&LoginNameProjection{}).reduceOrgIAMPolicyAdded,
 			want: wantReduce{
@@ -450,12 +450,12 @@ func TestLoginNameProjection_reduces(t *testing.T) {
 			name: "iam.OrgDomainPolicyChangedEventType",
 			args: args{
 				event: getEvent(testEvent(
-					repository.EventType(instance.InstanceDomainPolicyChangedEventType),
+					repository.EventType(instance.DomainPolicyChangedEventType),
 					user.AggregateType,
 					[]byte(`{
 					"userLoginMustBeDomain": false
 				}`),
-				), instance.InstanceDomainPolicyChangedEventMapper),
+				), instance.DomainPolicyChangedEventMapper),
 			},
 			reduce: (&LoginNameProjection{}).reduceDomainPolicyChanged,
 			want: wantReduce{
@@ -480,10 +480,10 @@ func TestLoginNameProjection_reduces(t *testing.T) {
 			name: "iam.OrgDomainPolicyChangedEventType no change",
 			args: args{
 				event: getEvent(testEvent(
-					repository.EventType(instance.InstanceDomainPolicyChangedEventType),
+					repository.EventType(instance.DomainPolicyChangedEventType),
 					user.AggregateType,
 					[]byte(`{}`),
-				), instance.InstanceDomainPolicyChangedEventMapper),
+				), instance.DomainPolicyChangedEventMapper),
 			},
 			reduce: (&LoginNameProjection{}).reduceDomainPolicyChanged,
 			want: wantReduce{

internal/query/projection/org.go

@@ -46,8 +46,8 @@ func NewOrgProjection(ctx context.Context, config crdb.StatementHandlerConfig) *
 			crdb.NewColumn(OrgColumnDomain, crdb.ColumnTypeText),
 		},
 			crdb.NewPrimaryKey(OrgColumnInstanceID, OrgColumnID),
-			crdb.NewIndex("domain_idx", []string{OrgColumnDomain}),
-			crdb.NewIndex("name_idx", []string{OrgColumnName}),
+			crdb.WithIndex(crdb.NewIndex("domain_idx", []string{OrgColumnDomain})),
+			crdb.WithIndex(crdb.NewIndex("name_idx", []string{OrgColumnName})),
 		),
 	)
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/org_member.go

@@ -28,7 +28,7 @@ func NewOrgMemberProjection(ctx context.Context, config crdb.StatementHandlerCon
 		crdb.NewTable(
 			append(memberColumns, crdb.NewColumn(OrgMemberOrgIDCol, crdb.ColumnTypeText)),
 			crdb.NewPrimaryKey(MemberInstanceID, OrgMemberOrgIDCol, MemberUserIDCol),
-			crdb.NewIndex("user_idx", []string{MemberUserIDCol}),
+			crdb.WithIndex(crdb.NewIndex("user_idx", []string{MemberUserIDCol})),
 		),
 	)
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/project.go

@@ -54,7 +54,7 @@ func NewProjectProjection(ctx context.Context, config crdb.StatementHandlerConfi
 			crdb.NewColumn(ProjectColumnCreator, crdb.ColumnTypeText),
 		},
 			crdb.NewPrimaryKey(ProjectColumnInstanceID, ProjectColumnID),
-			crdb.NewIndex("ro_idx", []string{ProjectColumnResourceOwner}),
+			crdb.WithIndex(crdb.NewIndex("ro_idx", []string{ProjectColumnResourceOwner})),
 		),
 	)
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/project_grant.go

@@ -52,8 +52,8 @@ func NewProjectGrantProjection(ctx context.Context, config crdb.StatementHandler
 			crdb.NewColumn(ProjectGrantColumnCreator, crdb.ColumnTypeText),
 		},
 			crdb.NewPrimaryKey(ProjectGrantColumnInstanceID, ProjectGrantColumnGrantID),
-			crdb.NewIndex("ro_idx", []string{ProjectGrantColumnResourceOwner}),
-			crdb.NewIndex("granted_org_idx", []string{ProjectGrantColumnGrantedOrgID}),
+			crdb.WithIndex(crdb.NewIndex("ro_idx", []string{ProjectGrantColumnResourceOwner})),
+			crdb.WithIndex(crdb.NewIndex("granted_org_idx", []string{ProjectGrantColumnGrantedOrgID})),
 		),
 	)
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/project_grant_member.go

@@ -34,7 +34,7 @@ func NewProjectGrantMemberProjection(ctx context.Context, config crdb.StatementH
 				crdb.NewColumn(ProjectGrantMemberGrantIDCol, crdb.ColumnTypeText),
 			),
 			crdb.NewPrimaryKey(MemberInstanceID, ProjectGrantMemberProjectIDCol, ProjectGrantMemberGrantIDCol, MemberUserIDCol),
-			crdb.NewIndex("user_idx", []string{MemberUserIDCol}),
+			crdb.WithIndex(crdb.NewIndex("user_idx", []string{MemberUserIDCol})),
 		),
 	)
 

internal/query/projection/project_member.go

@@ -32,7 +32,7 @@ func NewProjectMemberProjection(ctx context.Context, config crdb.StatementHandle
 				crdb.NewColumn(ProjectMemberProjectIDCol, crdb.ColumnTypeText),
 			),
 			crdb.NewPrimaryKey(MemberInstanceID, ProjectMemberProjectIDCol, MemberUserIDCol),
-			crdb.NewIndex("user_idx", []string{MemberUserIDCol}),
+			crdb.WithIndex(crdb.NewIndex("user_idx", []string{MemberUserIDCol})),
 		),
 	)
 

internal/query/projection/projection.go

@@ -3,7 +3,6 @@ package projection
 import (
 	"context"
 	"database/sql"
-	"fmt"
 	"time"
 
 	"github.com/caos/zitadel/internal/crypto"
@@ -35,7 +34,6 @@ func Start(ctx context.Context, sqlClient *sql.DB, es *eventstore.Eventstore, co
 		BulkLimit:         config.BulkLimit,
 	}
 
-	now := time.Now()
 	NewOrgProjection(ctx, applyCustomConfig(projectionConfig, config.Customizations["orgs"]))
 	NewActionProjection(ctx, applyCustomConfig(projectionConfig, config.Customizations["actions"]))
 	NewFlowProjection(ctx, applyCustomConfig(projectionConfig, config.Customizations["flows"]))
@@ -69,14 +67,13 @@ func Start(ctx context.Context, sqlClient *sql.DB, es *eventstore.Eventstore, co
 	NewUserGrantProjection(ctx, applyCustomConfig(projectionConfig, config.Customizations["user_grants"]))
 	NewUserMetadataProjection(ctx, applyCustomConfig(projectionConfig, config.Customizations["user_metadata"]))
 	NewUserAuthMethodProjection(ctx, applyCustomConfig(projectionConfig, config.Customizations["user_auth_method"]))
-	NewIAMProjection(ctx, applyCustomConfig(projectionConfig, config.Customizations["iam"]))
+	NewInstanceProjection(ctx, applyCustomConfig(projectionConfig, config.Customizations["instances"]))
 	NewSecretGeneratorProjection(ctx, applyCustomConfig(projectionConfig, config.Customizations["secret_generators"]))
 	NewSMTPConfigProjection(ctx, applyCustomConfig(projectionConfig, config.Customizations["smtp_configs"]))
 	NewSMSConfigProjection(ctx, applyCustomConfig(projectionConfig, config.Customizations["sms_config"]))
 	NewOIDCSettingsProjection(ctx, applyCustomConfig(projectionConfig, config.Customizations["oidc_settings"]))
 	NewDebugNotificationProviderProjection(ctx, applyCustomConfig(projectionConfig, config.Customizations["debug_notification_provider"]))
 	NewKeyProjection(ctx, applyCustomConfig(projectionConfig, config.Customizations["keys"]), keyEncryptionAlgorithm, keyChan)
-	fmt.Println(time.Now().Sub(now))
 	return nil
 }
 

internal/query/projection/user.go

@@ -75,8 +75,9 @@ func NewUserProjection(ctx context.Context, config crdb.StatementHandlerConfig)
 			crdb.NewColumn(UserTypeCol, crdb.ColumnTypeEnum),
 		},
 			crdb.NewPrimaryKey(UserInstanceIDCol, UserIDCol),
-			crdb.NewIndex("username_idx", []string{UserUsernameCol}),
-			crdb.NewIndex("ro_idx", []string{UserResourceOwnerCol}),
+			crdb.WithIndex(crdb.NewIndex("username_idx", []string{UserUsernameCol})),
+			crdb.WithIndex(crdb.NewIndex("ro_idx", []string{UserResourceOwnerCol})),
+			crdb.WithConstraint(crdb.NewConstraint("id_unique", []string{UserIDCol})),
 		),
 		crdb.NewSuffixedTable([]*crdb.Column{
 			crdb.NewColumn(HumanUserIDCol, crdb.ColumnTypeText, crdb.DeleteCascade(UserIDCol)),

internal/query/projection/user_auth_method.go

@@ -48,7 +48,7 @@ func NewUserAuthMethodProjection(ctx context.Context, config crdb.StatementHandl
 			crdb.NewColumn(UserAuthMethodNameCol, crdb.ColumnTypeText),
 		},
 			crdb.NewPrimaryKey(UserAuthMethodInstanceIDCol, UserAuthMethodUserIDCol, UserAuthMethodTypeCol, UserAuthMethodTokenIDCol),
-			crdb.NewIndex("ro_idx", []string{UserAuthMethodResourceOwnerCol}),
+			crdb.WithIndex(crdb.NewIndex("ro_idx", []string{UserAuthMethodResourceOwnerCol})),
 		),
 	)
 	p.StatementHandler = crdb.NewStatementHandler(ctx, config)

internal/query/projection/user_grant.go

@@ -54,8 +54,8 @@ func NewUserGrantProjection(ctx context.Context, config crdb.StatementHandlerCon
 			crdb.NewColumn(UserGrantRoles, crdb.ColumnTypeTextArray, crdb.Nullable()),
 		},
 			crdb.NewPrimaryKey(UserGrantInstanceID, UserGrantID),
-			crdb.NewIndex("user_idx", []string{UserGrantUserID}),
-			crdb.NewIndex("ro_idx", []string{UserGrantResourceOwner}),
+			crdb.WithIndex(crdb.NewIndex("user_idx", []string{UserGrantUserID})),
+			crdb.WithIndex(crdb.NewIndex("ro_idx", []string{UserGrantResourceOwner})),
 		),
 	)
 

internal/query/projection/user_metadata.go

@@ -43,7 +43,7 @@ func NewUserMetadataProjection(ctx context.Context, config crdb.StatementHandler
 			crdb.NewColumn(UserMetadataColumnValue, crdb.ColumnTypeBytes, crdb.Nullable()),
 		},
 			crdb.NewPrimaryKey(UserMetadataColumnInstanceID, UserMetadataColumnUserID),
-			crdb.NewIndex("ro_idx", []string{UserGrantResourceOwner}),
+			crdb.WithIndex(crdb.NewIndex("ro_idx", []string{UserGrantResourceOwner})),
 		),
 	)
 

internal/query/projection/user_personal_access_token.go

@@ -47,8 +47,8 @@ func NewPersonalAccessTokenProjection(ctx context.Context, config crdb.Statement
 			crdb.NewColumn(PersonalAccessTokenColumnScopes, crdb.ColumnTypeTextArray, crdb.Nullable()),
 		},
 			crdb.NewPrimaryKey(PersonalAccessTokenColumnInstanceID, PersonalAccessTokenColumnID),
-			crdb.NewIndex("user_idx", []string{PersonalAccessTokenColumnUserID}),
-			crdb.NewIndex("ro_idx", []string{PersonalAccessTokenColumnResourceOwner}),
+			crdb.WithIndex(crdb.NewIndex("user_idx", []string{PersonalAccessTokenColumnUserID})),
+			crdb.WithIndex(crdb.NewIndex("ro_idx", []string{PersonalAccessTokenColumnResourceOwner})),
 		),
 	)