feat: new projects (#1207)

* fix: project events * fix: project events * fix: project events * fix: eventmapper * fix: project commands * fix: project role commands * fix: project command side * fix: oidc application * fix: oidc application * fix: reduce * fix: reduce * fix: project member * fix: project grant command side * fix: application command side * fix: project grant member remove * Update internal/v2/command/project.go Co-authored-by: Livio Amstutz <livio.a@gmail.com> * Update internal/v2/command/project.go Co-authored-by: Livio Amstutz <livio.a@gmail.com> * Update internal/v2/command/project_application.go Co-authored-by: Livio Amstutz <livio.a@gmail.com> * Update internal/v2/command/project_application.go Co-authored-by: Livio Amstutz <livio.a@gmail.com> * Update internal/v2/command/project_application.go Co-authored-by: Livio Amstutz <livio.a@gmail.com> * fix: oidc application string pw * fix: project events * fix: project grant member * feat: change application to interface Co-authored-by: Livio Amstutz <livio.a@gmail.com>
2025-08-12 00:57:33 +00:00 · 2021-01-28 06:35:26 +01:00
parent dfcb96d6a3
commit c65331df1a
58 changed files with 3746 additions and 965 deletions
--- a/internal/api/grpc/management/application.go
+++ b/internal/api/grpc/management/application.go
@@ -2,6 +2,7 @@ package management

 import (
 	"context"
+	"github.com/caos/zitadel/internal/api/authz"

 	"github.com/golang/protobuf/ptypes/empty"

@@ -25,49 +26,43 @@ func (s *Server) ApplicationByID(ctx context.Context, in *management.Application
 }

 func (s *Server) CreateOIDCApplication(ctx context.Context, in *management.OIDCApplicationCreate) (*management.Application, error) {
-	app, err := s.project.AddApplication(ctx, oidcAppCreateToModel(in))
+	app, err := s.command.AddOIDCApplication(ctx, oidcAppCreateToDomain(in), authz.GetCtxData(ctx).OrgID)
 	if err != nil {
 		return nil, err
 	}
-	return appFromModel(app), nil
+	return oidcAppFromDomain(app), nil
 }
 func (s *Server) UpdateApplication(ctx context.Context, in *management.ApplicationUpdate) (*management.Application, error) {
-	app, err := s.project.ChangeApplication(ctx, appUpdateToModel(in))
+	app, err := s.command.ChangeApplication(ctx, in.ProjectId, appUpdateToDomain(in), authz.GetCtxData(ctx).OrgID)
 	if err != nil {
 		return nil, err
 	}
-	return appFromModel(app), nil
+	return appFromDomain(app), nil
 }
-func (s *Server) DeactivateApplication(ctx context.Context, in *management.ApplicationID) (*management.Application, error) {
-	app, err := s.project.DeactivateApplication(ctx, in.ProjectId, in.Id)
-	if err != nil {
-		return nil, err
-	}
-	return appFromModel(app), nil
+func (s *Server) DeactivateApplication(ctx context.Context, in *management.ApplicationID) (*empty.Empty, error) {
+	err := s.command.DeactivateApplication(ctx, in.ProjectId, in.Id, authz.GetCtxData(ctx).OrgID)
+	return &empty.Empty{}, err
 }
-func (s *Server) ReactivateApplication(ctx context.Context, in *management.ApplicationID) (*management.Application, error) {
-	app, err := s.project.ReactivateApplication(ctx, in.ProjectId, in.Id)
-	if err != nil {
-		return nil, err
-	}
-	return appFromModel(app), nil
+func (s *Server) ReactivateApplication(ctx context.Context, in *management.ApplicationID) (*empty.Empty, error) {
+	err := s.command.ReactivateApplication(ctx, in.ProjectId, in.Id, authz.GetCtxData(ctx).OrgID)
+	return &empty.Empty{}, err
 }

 func (s *Server) RemoveApplication(ctx context.Context, in *management.ApplicationID) (*empty.Empty, error) {
-	err := s.project.RemoveApplication(ctx, in.ProjectId, in.Id)
+	err := s.command.RemoveApplication(ctx, in.ProjectId, in.Id, authz.GetCtxData(ctx).OrgID)
 	return &empty.Empty{}, err
 }

 func (s *Server) UpdateApplicationOIDCConfig(ctx context.Context, in *management.OIDCConfigUpdate) (*management.OIDCConfig, error) {
-	config, err := s.project.ChangeOIDCConfig(ctx, oidcConfigUpdateToModel(in))
+	config, err := s.command.ChangeOIDCApplication(ctx, oidcConfigUpdateToDomain(in), authz.GetCtxData(ctx).OrgID)
 	if err != nil {
 		return nil, err
 	}
-	return oidcConfigFromModel(config), nil
+	return oidcConfigFromDomain(config), nil
 }

 func (s *Server) RegenerateOIDCClientSecret(ctx context.Context, in *management.ApplicationID) (*management.ClientSecret, error) {
-	config, err := s.project.ChangeOIDConfigSecret(ctx, in.ProjectId, in.Id)
+	config, err := s.command.ChangeOIDCApplicationSecret(ctx, in.ProjectId, in.Id, authz.GetCtxData(ctx).ResourceOwner)
 	if err != nil {
 		return nil, err
 	}
--- a/internal/api/grpc/management/application_converter.go
+++ b/internal/api/grpc/management/application_converter.go
@@ -2,6 +2,8 @@ package management

 import (
 	"encoding/json"
+	"github.com/caos/zitadel/internal/v2/domain"
+	"google.golang.org/protobuf/types/known/timestamppb"

 	"github.com/caos/logging"
 	"github.com/golang/protobuf/ptypes"
@@ -16,44 +18,46 @@ import (
 	"github.com/caos/zitadel/pkg/grpc/message"
 )

-func appFromModel(app *proj_model.Application) *management.Application {
-	changeDate, err := ptypes.TimestampProto(app.ChangeDate)
-	logging.Log("GRPC-di7rw").OnError(err).Debug("unable to parse timestamp")
+func appFromDomain(app domain.Application) *management.Application {
+	return &management.Application{
+		Id:    app.GetAppID(),
+		State: appStateFromDomain(app.GetState()),
+		Name:  app.GetApplicationName(),
+	}
+}

+func oidcAppFromDomain(app *domain.OIDCApp) *management.Application {
 	return &management.Application{
 		Id:         app.AppID,
-		State:      appStateFromModel(app.State),
-		ChangeDate: changeDate,
-		Name:       app.Name,
+		State:      appStateFromDomain(app.State),
+		ChangeDate: timestamppb.New(app.ChangeDate),
+		Name:       app.AppName,
 		Sequence:   app.Sequence,
-		AppConfig:  appConfigFromModel(app),
+		AppConfig:  oidcAppConfigFromDomain(app),
 	}
 }

-func appConfigFromModel(app *proj_model.Application) management.AppConfig {
-	if app.Type == proj_model.AppTypeOIDC {
-		return &management.Application_OidcConfig{
-			OidcConfig: oidcConfigFromModel(app.OIDCConfig),
-		}
+func oidcAppConfigFromDomain(app *domain.OIDCApp) management.AppConfig {
+	return &management.Application_OidcConfig{
+		OidcConfig: oidcConfigFromDomain(app),
 	}
-	return nil
 }

-func oidcConfigFromModel(config *proj_model.OIDCConfig) *management.OIDCConfig {
+func oidcConfigFromDomain(config *domain.OIDCApp) *management.OIDCConfig {
 	return &management.OIDCConfig{
 		RedirectUris:             config.RedirectUris,
-		ResponseTypes:            oidcResponseTypesFromModel(config.ResponseTypes),
-		GrantTypes:               oidcGrantTypesFromModel(config.GrantTypes),
-		ApplicationType:          oidcApplicationTypeFromModel(config.ApplicationType),
+		ResponseTypes:            oidcResponseTypesFromDomain(config.ResponseTypes),
+		GrantTypes:               oidcGrantTypesFromDomain(config.GrantTypes),
+		ApplicationType:          oidcApplicationTypeFromDomain(config.ApplicationType),
 		ClientId:                 config.ClientID,
 		ClientSecret:             config.ClientSecretString,
-		AuthMethodType:           oidcAuthMethodTypeFromModel(config.AuthMethodType),
+		AuthMethodType:           oidcAuthMethodTypeFromDomain(config.AuthMethodType),
 		PostLogoutRedirectUris:   config.PostLogoutRedirectUris,
-		Version:                  oidcVersionFromModel(config.OIDCVersion),
+		Version:                  oidcVersionFromDomain(config.OIDCVersion),
 		NoneCompliant:            config.Compliance.NoneCompliant,
 		ComplianceProblems:       complianceProblemsToLocalizedMessages(config.Compliance.Problems),
 		DevMode:                  config.DevMode,
-		AccessTokenType:          oidcTokenTypeFromModel(config.AccessTokenType),
+		AccessTokenType:          oidcTokenTypeFromDomain(config.AccessTokenType),
 		AccessTokenRoleAssertion: config.AccessTokenRoleAssertion,
 		IdTokenRoleAssertion:     config.IDTokenRoleAssertion,
 		IdTokenUserinfoAssertion: config.IDTokenUserinfoAssertion,
@@ -91,55 +95,49 @@ func complianceProblemsToLocalizedMessages(problems []string) []*message.Localiz

 }

-func oidcAppCreateToModel(app *management.OIDCApplicationCreate) *proj_model.Application {
-	return &proj_model.Application{
+func oidcAppCreateToDomain(app *management.OIDCApplicationCreate) *domain.OIDCApp {
+	return &domain.OIDCApp{
 		ObjectRoot: models.ObjectRoot{
 			AggregateID: app.ProjectId,
 		},
-		Name: app.Name,
-		Type: proj_model.AppTypeOIDC,
-		OIDCConfig: &proj_model.OIDCConfig{
-			OIDCVersion:              oidcVersionToModel(app.Version),
-			RedirectUris:             app.RedirectUris,
-			ResponseTypes:            oidcResponseTypesToModel(app.ResponseTypes),
-			GrantTypes:               oidcGrantTypesToModel(app.GrantTypes),
-			ApplicationType:          oidcApplicationTypeToModel(app.ApplicationType),
-			AuthMethodType:           oidcAuthMethodTypeToModel(app.AuthMethodType),
-			PostLogoutRedirectUris:   app.PostLogoutRedirectUris,
-			DevMode:                  app.DevMode,
-			AccessTokenType:          oidcTokenTypeToModel(app.AccessTokenType),
-			AccessTokenRoleAssertion: app.AccessTokenRoleAssertion,
-			IDTokenRoleAssertion:     app.IdTokenRoleAssertion,
-			IDTokenUserinfoAssertion: app.IdTokenUserinfoAssertion,
-			ClockSkew:                app.ClockSkew.AsDuration(),
-		},
+		AppName:                  app.Name,
+		OIDCVersion:              oidcVersionToDomain(app.Version),
+		RedirectUris:             app.RedirectUris,
+		ResponseTypes:            oidcResponseTypesToDomain(app.ResponseTypes),
+		GrantTypes:               oidcGrantTypesToDomain(app.GrantTypes),
+		ApplicationType:          oidcApplicationTypeToDomain(app.ApplicationType),
+		AuthMethodType:           oidcAuthMethodTypeToDomain(app.AuthMethodType),
+		PostLogoutRedirectUris:   app.PostLogoutRedirectUris,
+		DevMode:                  app.DevMode,
+		AccessTokenType:          oidcTokenTypeToDomain(app.AccessTokenType),
+		AccessTokenRoleAssertion: app.AccessTokenRoleAssertion,
+		IDTokenRoleAssertion:     app.IdTokenRoleAssertion,
+		IDTokenUserinfoAssertion: app.IdTokenUserinfoAssertion,
+		ClockSkew:                app.ClockSkew.AsDuration(),
 	}
 }

-func appUpdateToModel(app *management.ApplicationUpdate) *proj_model.Application {
-	return &proj_model.Application{
-		ObjectRoot: models.ObjectRoot{
-			AggregateID: app.ProjectId,
-		},
-		AppID: app.Id,
-		Name:  app.Name,
+func appUpdateToDomain(app *management.ApplicationUpdate) domain.Application {
+	return &domain.ChangeApp{
+		AppID:   app.Id,
+		AppName: app.Name,
 	}
 }

-func oidcConfigUpdateToModel(app *management.OIDCConfigUpdate) *proj_model.OIDCConfig {
-	return &proj_model.OIDCConfig{
+func oidcConfigUpdateToDomain(app *management.OIDCConfigUpdate) *domain.OIDCApp {
+	return &domain.OIDCApp{
 		ObjectRoot: models.ObjectRoot{
 			AggregateID: app.ProjectId,
 		},
 		AppID:                    app.ApplicationId,
 		RedirectUris:             app.RedirectUris,
-		ResponseTypes:            oidcResponseTypesToModel(app.ResponseTypes),
-		GrantTypes:               oidcGrantTypesToModel(app.GrantTypes),
-		ApplicationType:          oidcApplicationTypeToModel(app.ApplicationType),
-		AuthMethodType:           oidcAuthMethodTypeToModel(app.AuthMethodType),
+		ResponseTypes:            oidcResponseTypesToDomain(app.ResponseTypes),
+		GrantTypes:               oidcGrantTypesToDomain(app.GrantTypes),
+		ApplicationType:          oidcApplicationTypeToDomain(app.ApplicationType),
+		AuthMethodType:           oidcAuthMethodTypeToDomain(app.AuthMethodType),
 		PostLogoutRedirectUris:   app.PostLogoutRedirectUris,
 		DevMode:                  app.DevMode,
-		AccessTokenType:          oidcTokenTypeToModel(app.AccessTokenType),
+		AccessTokenType:          oidcTokenTypeToDomain(app.AccessTokenType),
 		AccessTokenRoleAssertion: app.AccessTokenRoleAssertion,
 		IDTokenRoleAssertion:     app.IdTokenRoleAssertion,
 		IDTokenUserinfoAssertion: app.IdTokenUserinfoAssertion,
@@ -226,6 +224,17 @@ func applicationViewFromModel(application *proj_model.ApplicationView) *manageme
 	return converted
 }

+func appStateFromDomain(state domain.AppState) management.AppState {
+	switch state {
+	case domain.AppStateActive:
+		return management.AppState_APPSTATE_ACTIVE
+	case domain.AppStateInactive:
+		return management.AppState_APPSTATE_INACTIVE
+	default:
+		return management.AppState_APPSTATE_UNSPECIFIED
+	}
+}
+
 func appStateFromModel(state proj_model.AppState) management.AppState {
 	switch state {
 	case proj_model.AppStateActive:
@@ -237,26 +246,42 @@ func appStateFromModel(state proj_model.AppState) management.AppState {
 	}
 }

-func oidcResponseTypesToModel(responseTypes []management.OIDCResponseType) []proj_model.OIDCResponseType {
+func oidcResponseTypesToDomain(responseTypes []management.OIDCResponseType) []domain.OIDCResponseType {
 	if responseTypes == nil || len(responseTypes) == 0 {
-		return []proj_model.OIDCResponseType{proj_model.OIDCResponseTypeCode}
+		return []domain.OIDCResponseType{domain.OIDCResponseTypeCode}
 	}
-	oidcResponseTypes := make([]proj_model.OIDCResponseType, len(responseTypes))
+	oidcResponseTypes := make([]domain.OIDCResponseType, len(responseTypes))

 	for i, responseType := range responseTypes {
 		switch responseType {
 		case management.OIDCResponseType_OIDCRESPONSETYPE_CODE:
-			oidcResponseTypes[i] = proj_model.OIDCResponseTypeCode
+			oidcResponseTypes[i] = domain.OIDCResponseTypeCode
 		case management.OIDCResponseType_OIDCRESPONSETYPE_ID_TOKEN:
-			oidcResponseTypes[i] = proj_model.OIDCResponseTypeIDToken
+			oidcResponseTypes[i] = domain.OIDCResponseTypeIDToken
 		case management.OIDCResponseType_OIDCRESPONSETYPE_ID_TOKEN_TOKEN:
-			oidcResponseTypes[i] = proj_model.OIDCResponseTypeIDTokenToken
+			oidcResponseTypes[i] = domain.OIDCResponseTypeIDTokenToken
 		}
 	}

 	return oidcResponseTypes
 }

+func oidcResponseTypesFromDomain(responseTypes []domain.OIDCResponseType) []management.OIDCResponseType {
+	oidcResponseTypes := make([]management.OIDCResponseType, len(responseTypes))
+
+	for i, responseType := range responseTypes {
+		switch responseType {
+		case domain.OIDCResponseTypeCode:
+			oidcResponseTypes[i] = management.OIDCResponseType_OIDCRESPONSETYPE_CODE
+		case domain.OIDCResponseTypeIDToken:
+			oidcResponseTypes[i] = management.OIDCResponseType_OIDCRESPONSETYPE_ID_TOKEN
+		case domain.OIDCResponseTypeIDTokenToken:
+			oidcResponseTypes[i] = management.OIDCResponseType_OIDCRESPONSETYPE_ID_TOKEN_TOKEN
+		}
+	}
+
+	return oidcResponseTypes
+}
 func oidcResponseTypesFromModel(responseTypes []proj_model.OIDCResponseType) []management.OIDCResponseType {
 	oidcResponseTypes := make([]management.OIDCResponseType, len(responseTypes))

@@ -274,20 +299,36 @@ func oidcResponseTypesFromModel(responseTypes []proj_model.OIDCResponseType) []m
 	return oidcResponseTypes
 }

-func oidcGrantTypesToModel(grantTypes []management.OIDCGrantType) []proj_model.OIDCGrantType {
+func oidcGrantTypesToDomain(grantTypes []management.OIDCGrantType) []domain.OIDCGrantType {
 	if grantTypes == nil || len(grantTypes) == 0 {
-		return []proj_model.OIDCGrantType{proj_model.OIDCGrantTypeAuthorizationCode}
+		return []domain.OIDCGrantType{domain.OIDCGrantTypeAuthorizationCode}
 	}
-	oidcGrantTypes := make([]proj_model.OIDCGrantType, len(grantTypes))
+	oidcGrantTypes := make([]domain.OIDCGrantType, len(grantTypes))

 	for i, grantType := range grantTypes {
 		switch grantType {
 		case management.OIDCGrantType_OIDCGRANTTYPE_AUTHORIZATION_CODE:
-			oidcGrantTypes[i] = proj_model.OIDCGrantTypeAuthorizationCode
+			oidcGrantTypes[i] = domain.OIDCGrantTypeAuthorizationCode
 		case management.OIDCGrantType_OIDCGRANTTYPE_IMPLICIT:
-			oidcGrantTypes[i] = proj_model.OIDCGrantTypeImplicit
+			oidcGrantTypes[i] = domain.OIDCGrantTypeImplicit
 		case management.OIDCGrantType_OIDCGRANTTYPE_REFRESH_TOKEN:
-			oidcGrantTypes[i] = proj_model.OIDCGrantTypeRefreshToken
+			oidcGrantTypes[i] = domain.OIDCGrantTypeRefreshToken
+		}
+	}
+	return oidcGrantTypes
+}
+
+func oidcGrantTypesFromDomain(grantTypes []domain.OIDCGrantType) []management.OIDCGrantType {
+	oidcGrantTypes := make([]management.OIDCGrantType, len(grantTypes))
+
+	for i, grantType := range grantTypes {
+		switch grantType {
+		case domain.OIDCGrantTypeAuthorizationCode:
+			oidcGrantTypes[i] = management.OIDCGrantType_OIDCGRANTTYPE_AUTHORIZATION_CODE
+		case domain.OIDCGrantTypeImplicit:
+			oidcGrantTypes[i] = management.OIDCGrantType_OIDCGRANTTYPE_IMPLICIT
+		case domain.OIDCGrantTypeRefreshToken:
+			oidcGrantTypes[i] = management.OIDCGrantType_OIDCGRANTTYPE_REFRESH_TOKEN
 		}
 	}
 	return oidcGrantTypes
@@ -309,24 +350,37 @@ func oidcGrantTypesFromModel(grantTypes []proj_model.OIDCGrantType) []management
 	return oidcGrantTypes
 }

-func oidcApplicationTypeToModel(appType management.OIDCApplicationType) proj_model.OIDCApplicationType {
+func oidcApplicationTypeToDomain(appType management.OIDCApplicationType) domain.OIDCApplicationType {
 	switch appType {
 	case management.OIDCApplicationType_OIDCAPPLICATIONTYPE_WEB:
-		return proj_model.OIDCApplicationTypeWeb
+		return domain.OIDCApplicationTypeWeb
 	case management.OIDCApplicationType_OIDCAPPLICATIONTYPE_USER_AGENT:
-		return proj_model.OIDCApplicationTypeUserAgent
+		return domain.OIDCApplicationTypeUserAgent
 	case management.OIDCApplicationType_OIDCAPPLICATIONTYPE_NATIVE:
-		return proj_model.OIDCApplicationTypeNative
+		return domain.OIDCApplicationTypeNative
 	}
-	return proj_model.OIDCApplicationTypeWeb
+	return domain.OIDCApplicationTypeWeb
 }

-func oidcVersionToModel(version management.OIDCVersion) proj_model.OIDCVersion {
+func oidcVersionToDomain(version management.OIDCVersion) domain.OIDCVersion {
 	switch version {
 	case management.OIDCVersion_OIDCV1_0:
-		return proj_model.OIDCVersionV1
+		return domain.OIDCVersionV1
+	}
+	return domain.OIDCVersionV1
+}
+
+func oidcApplicationTypeFromDomain(appType domain.OIDCApplicationType) management.OIDCApplicationType {
+	switch appType {
+	case domain.OIDCApplicationTypeWeb:
+		return management.OIDCApplicationType_OIDCAPPLICATIONTYPE_WEB
+	case domain.OIDCApplicationTypeUserAgent:
+		return management.OIDCApplicationType_OIDCAPPLICATIONTYPE_USER_AGENT
+	case domain.OIDCApplicationTypeNative:
+		return management.OIDCApplicationType_OIDCAPPLICATIONTYPE_NATIVE
+	default:
+		return management.OIDCApplicationType_OIDCAPPLICATIONTYPE_WEB
 	}
-	return proj_model.OIDCVersionV1
 }

 func oidcApplicationTypeFromModel(appType proj_model.OIDCApplicationType) management.OIDCApplicationType {
@@ -342,16 +396,29 @@ func oidcApplicationTypeFromModel(appType proj_model.OIDCApplicationType) manage
 	}
 }

-func oidcAuthMethodTypeToModel(authType management.OIDCAuthMethodType) proj_model.OIDCAuthMethodType {
+func oidcAuthMethodTypeToDomain(authType management.OIDCAuthMethodType) domain.OIDCAuthMethodType {
 	switch authType {
 	case management.OIDCAuthMethodType_OIDCAUTHMETHODTYPE_BASIC:
-		return proj_model.OIDCAuthMethodTypeBasic
+		return domain.OIDCAuthMethodTypeBasic
 	case management.OIDCAuthMethodType_OIDCAUTHMETHODTYPE_POST:
-		return proj_model.OIDCAuthMethodTypePost
+		return domain.OIDCAuthMethodTypePost
 	case management.OIDCAuthMethodType_OIDCAUTHMETHODTYPE_NONE:
-		return proj_model.OIDCAuthMethodTypeNone
+		return domain.OIDCAuthMethodTypeNone
 	default:
-		return proj_model.OIDCAuthMethodTypeBasic
+		return domain.OIDCAuthMethodTypeBasic
+	}
+}
+
+func oidcAuthMethodTypeFromDomain(authType domain.OIDCAuthMethodType) management.OIDCAuthMethodType {
+	switch authType {
+	case domain.OIDCAuthMethodTypeBasic:
+		return management.OIDCAuthMethodType_OIDCAUTHMETHODTYPE_BASIC
+	case domain.OIDCAuthMethodTypePost:
+		return management.OIDCAuthMethodType_OIDCAUTHMETHODTYPE_POST
+	case domain.OIDCAuthMethodTypeNone:
+		return management.OIDCAuthMethodType_OIDCAUTHMETHODTYPE_NONE
+	default:
+		return management.OIDCAuthMethodType_OIDCAUTHMETHODTYPE_BASIC
 	}
 }

@@ -368,14 +435,25 @@ func oidcAuthMethodTypeFromModel(authType proj_model.OIDCAuthMethodType) managem
 	}
 }

-func oidcTokenTypeToModel(tokenType management.OIDCTokenType) proj_model.OIDCTokenType {
+func oidcTokenTypeToDomain(tokenType management.OIDCTokenType) domain.OIDCTokenType {
 	switch tokenType {
 	case management.OIDCTokenType_OIDCTokenType_Bearer:
-		return proj_model.OIDCTokenTypeBearer
+		return domain.OIDCTokenTypeBearer
 	case management.OIDCTokenType_OIDCTokenType_JWT:
-		return proj_model.OIDCTokenTypeJWT
+		return domain.OIDCTokenTypeJWT
 	default:
-		return proj_model.OIDCTokenTypeBearer
+		return domain.OIDCTokenTypeBearer
+	}
+}
+
+func oidcTokenTypeFromDomain(tokenType domain.OIDCTokenType) management.OIDCTokenType {
+	switch tokenType {
+	case domain.OIDCTokenTypeBearer:
+		return management.OIDCTokenType_OIDCTokenType_Bearer
+	case domain.OIDCTokenTypeJWT:
+		return management.OIDCTokenType_OIDCTokenType_JWT
+	default:
+		return management.OIDCTokenType_OIDCTokenType_Bearer
 	}
 }

@@ -390,6 +468,15 @@ func oidcTokenTypeFromModel(tokenType proj_model.OIDCTokenType) management.OIDCT
 	}
 }

+func oidcVersionFromDomain(version domain.OIDCVersion) management.OIDCVersion {
+	switch version {
+	case domain.OIDCVersionV1:
+		return management.OIDCVersion_OIDCV1_0
+	default:
+		return management.OIDCVersion_OIDCV1_0
+	}
+}
+
 func oidcVersionFromModel(version proj_model.OIDCVersion) management.OIDCVersion {
 	switch version {
 	case proj_model.OIDCVersionV1:
--- a/internal/api/grpc/management/project.go
+++ b/internal/api/grpc/management/project.go
@@ -12,36 +12,31 @@ import (
 )

 func (s *Server) CreateProject(ctx context.Context, in *management.ProjectCreateRequest) (*management.Project, error) {
-	project, err := s.project.CreateProject(ctx, projectCreateToModel(in))
+	ctxData := authz.GetCtxData(ctx)
+	project, err := s.command.AddProject(ctx, projectCreateToDomain(in), ctxData.ResourceOwner, ctxData.UserID)
 	if err != nil {
 		return nil, err
 	}
-	return projectFromModel(project), nil
+	return projectFromDomain(project), nil
 }
 func (s *Server) UpdateProject(ctx context.Context, in *management.ProjectUpdateRequest) (*management.Project, error) {
-	project, err := s.project.UpdateProject(ctx, projectUpdateToModel(in))
+	project, err := s.command.ChangeProject(ctx, projectUpdateToDomain(in), authz.GetCtxData(ctx).ResourceOwner)
 	if err != nil {
 		return nil, err
 	}
-	return projectFromModel(project), nil
+	return projectFromDomain(project), nil
 }
-func (s *Server) DeactivateProject(ctx context.Context, in *management.ProjectID) (*management.Project, error) {
-	project, err := s.project.DeactivateProject(ctx, in.Id)
-	if err != nil {
-		return nil, err
-	}
-	return projectFromModel(project), nil
+func (s *Server) DeactivateProject(ctx context.Context, in *management.ProjectID) (*empty.Empty, error) {
+	err := s.command.DeactivateProject(ctx, in.Id, authz.GetCtxData(ctx).ResourceOwner)
+	return &empty.Empty{}, err
 }
-func (s *Server) ReactivateProject(ctx context.Context, in *management.ProjectID) (*management.Project, error) {
-	project, err := s.project.ReactivateProject(ctx, in.Id)
-	if err != nil {
-		return nil, err
-	}
-	return projectFromModel(project), nil
+func (s *Server) ReactivateProject(ctx context.Context, in *management.ProjectID) (*empty.Empty, error) {
+	err := s.command.ReactivateProject(ctx, in.Id, authz.GetCtxData(ctx).ResourceOwner)
+	return &empty.Empty{}, err
 }

 func (s *Server) RemoveProject(ctx context.Context, in *management.ProjectID) (*empty.Empty, error) {
-	err := s.project.RemoveProject(ctx, in.Id)
+	err := s.command.RemoveProject(ctx, in.Id, authz.GetCtxData(ctx).OrgID)
 	return &empty.Empty{}, err
 }

@@ -82,28 +77,28 @@ func (s *Server) GetGrantedProjectByID(ctx context.Context, in *management.Proje
 }

 func (s *Server) AddProjectRole(ctx context.Context, in *management.ProjectRoleAdd) (*management.ProjectRole, error) {
-	role, err := s.project.AddProjectRole(ctx, projectRoleAddToModel(in))
+	role, err := s.command.AddProjectRole(ctx, projectRoleAddToDomain(in), authz.GetCtxData(ctx).OrgID)
 	if err != nil {
 		return nil, err
 	}
-	return projectRoleFromModel(role), nil
+	return projectRoleFromDomain(role), nil
 }

 func (s *Server) BulkAddProjectRole(ctx context.Context, in *management.ProjectRoleAddBulk) (*empty.Empty, error) {
-	err := s.project.BulkAddProjectRole(ctx, projectRoleAddBulkToModel(in))
+	err := s.command.BulkAddProjectRole(ctx, in.Id, authz.GetCtxData(ctx).OrgID, projectRoleAddBulkToDomain(in))
 	return &empty.Empty{}, err
 }

 func (s *Server) ChangeProjectRole(ctx context.Context, in *management.ProjectRoleChange) (*management.ProjectRole, error) {
-	role, err := s.project.ChangeProjectRole(ctx, projectRoleChangeToModel(in))
+	role, err := s.command.ChangeProjectRole(ctx, projectRoleChangeToDomain(in), authz.GetCtxData(ctx).OrgID)
 	if err != nil {
 		return nil, err
 	}
-	return projectRoleFromModel(role), nil
+	return projectRoleFromDomain(role), nil
 }

 func (s *Server) RemoveProjectRole(ctx context.Context, in *management.ProjectRoleRemove) (*empty.Empty, error) {
-	err := s.project.RemoveProjectRole(ctx, in.Id, in.Key)
+	err := s.command.RemoveProjectRole(ctx, in.Id, in.Key, authz.GetCtxData(ctx).OrgID)
 	return &empty.Empty{}, err
 }

--- a/internal/api/grpc/management/project_converter.go
+++ b/internal/api/grpc/management/project_converter.go
@@ -2,6 +2,8 @@ package management

 import (
 	"encoding/json"
+	"github.com/caos/zitadel/internal/v2/domain"
+	"google.golang.org/protobuf/types/known/timestamppb"

 	"github.com/caos/logging"
 	"github.com/golang/protobuf/ptypes"
@@ -14,18 +16,11 @@ import (
 	"github.com/caos/zitadel/pkg/grpc/message"
 )

-func projectFromModel(project *proj_model.Project) *management.Project {
-	creationDate, err := ptypes.TimestampProto(project.CreationDate)
-	logging.Log("GRPC-iejs3").OnError(err).Debug("unable to parse timestamp")
-
-	changeDate, err := ptypes.TimestampProto(project.ChangeDate)
-	logging.Log("GRPC-di7rw").OnError(err).Debug("unable to parse timestamp")
-
+func projectFromDomain(project *domain.Project) *management.Project {
 	return &management.Project{
 		Id:                   project.AggregateID,
-		State:                projectStateFromModel(project.State),
-		CreationDate:         creationDate,
-		ChangeDate:           changeDate,
+		State:                projectStateFromDomain(project.State),
+		ChangeDate:           timestamppb.New(project.ChangeDate),
 		Name:                 project.Name,
 		Sequence:             project.Sequence,
 		ProjectRoleAssertion: project.ProjectRoleAssertion,
@@ -110,6 +105,17 @@ func projectRoleViewFromModel(role *proj_model.ProjectRoleView) *management.Proj
 	}
 }

+func projectStateFromDomain(state domain.ProjectState) management.ProjectState {
+	switch state {
+	case domain.ProjectStateActive:
+		return management.ProjectState_PROJECTSTATE_ACTIVE
+	case domain.ProjectStateInactive:
+		return management.ProjectState_PROJECTSTATE_INACTIVE
+	default:
+		return management.ProjectState_PROJECTSTATE_UNSPECIFIED
+	}
+}
+
 func projectStateFromModel(state proj_model.ProjectState) management.ProjectState {
 	switch state {
 	case proj_model.ProjectStateActive:
@@ -121,16 +127,16 @@ func projectStateFromModel(state proj_model.ProjectState) management.ProjectStat
 	}
 }

-func projectCreateToModel(project *management.ProjectCreateRequest) *proj_model.Project {
-	return &proj_model.Project{
+func projectCreateToDomain(project *management.ProjectCreateRequest) *domain.Project {
+	return &domain.Project{
 		Name:                 project.Name,
 		ProjectRoleAssertion: project.ProjectRoleAssertion,
 		ProjectRoleCheck:     project.ProjectRoleCheck,
 	}
 }

-func projectUpdateToModel(project *management.ProjectUpdateRequest) *proj_model.Project {
-	return &proj_model.Project{
+func projectUpdateToDomain(project *management.ProjectUpdateRequest) *domain.Project {
+	return &domain.Project{
 		ObjectRoot: models.ObjectRoot{
 			AggregateID: project.Id,
 		},
@@ -140,27 +146,20 @@ func projectUpdateToModel(project *management.ProjectUpdateRequest) *proj_model.
 	}
 }

-func projectRoleFromModel(role *proj_model.ProjectRole) *management.ProjectRole {
-	creationDate, err := ptypes.TimestampProto(role.CreationDate)
-	logging.Log("GRPC-due83").OnError(err).Debug("unable to parse timestamp")
-
-	changeDate, err := ptypes.TimestampProto(role.ChangeDate)
-	logging.Log("GRPC-id93s").OnError(err).Debug("unable to parse timestamp")
-
+func projectRoleFromDomain(role *domain.ProjectRole) *management.ProjectRole {
 	return &management.ProjectRole{
-		CreationDate: creationDate,
-		ChangeDate:   changeDate,
-		Sequence:     role.Sequence,
-		Key:          role.Key,
-		DisplayName:  role.DisplayName,
-		Group:        role.Group,
+		ChangeDate:  timestamppb.New(role.ChangeDate),
+		Sequence:    role.Sequence,
+		Key:         role.Key,
+		DisplayName: role.DisplayName,
+		Group:       role.Group,
 	}
 }

-func projectRoleAddBulkToModel(bulk *management.ProjectRoleAddBulk) []*proj_model.ProjectRole {
-	roles := make([]*proj_model.ProjectRole, len(bulk.ProjectRoles))
+func projectRoleAddBulkToDomain(bulk *management.ProjectRoleAddBulk) []*domain.ProjectRole {
+	roles := make([]*domain.ProjectRole, len(bulk.ProjectRoles))
 	for i, role := range bulk.ProjectRoles {
-		roles[i] = &proj_model.ProjectRole{
+		roles[i] = &domain.ProjectRole{
 			ObjectRoot: models.ObjectRoot{
 				AggregateID: bulk.Id,
 			},
@@ -172,8 +171,8 @@ func projectRoleAddBulkToModel(bulk *management.ProjectRoleAddBulk) []*proj_mode
 	return roles
 }

-func projectRoleAddToModel(role *management.ProjectRoleAdd) *proj_model.ProjectRole {
-	return &proj_model.ProjectRole{
+func projectRoleAddToDomain(role *management.ProjectRoleAdd) *domain.ProjectRole {
+	return &domain.ProjectRole{
 		ObjectRoot: models.ObjectRoot{
 			AggregateID: role.Id,
 		},
@@ -183,8 +182,8 @@ func projectRoleAddToModel(role *management.ProjectRoleAdd) *proj_model.ProjectR
 	}
 }

-func projectRoleChangeToModel(role *management.ProjectRoleChange) *proj_model.ProjectRole {
-	return &proj_model.ProjectRole{
+func projectRoleChangeToDomain(role *management.ProjectRoleChange) *domain.ProjectRole {
+	return &domain.ProjectRole{
 		ObjectRoot: models.ObjectRoot{
 			AggregateID: role.Id,
 		},
--- a/internal/api/grpc/management/project_grant.go
+++ b/internal/api/grpc/management/project_grant.go
@@ -29,36 +29,30 @@ func (s *Server) ProjectGrantByID(ctx context.Context, in *management.ProjectGra
 }

 func (s *Server) CreateProjectGrant(ctx context.Context, in *management.ProjectGrantCreate) (*management.ProjectGrant, error) {
-	grant, err := s.project.AddProjectGrant(ctx, projectGrantCreateToModel(in))
+	grant, err := s.command.AddProjectGrant(ctx, projectGrantCreateToDomain(in), authz.GetCtxData(ctx).OrgID)
 	if err != nil {
 		return nil, err
 	}
-	return projectGrantFromModel(grant), nil
+	return projectGrantFromDomain(grant), nil
 }
 func (s *Server) UpdateProjectGrant(ctx context.Context, in *management.ProjectGrantUpdate) (*management.ProjectGrant, error) {
-	grant, err := s.project.ChangeProjectGrant(ctx, projectGrantUpdateToModel(in))
+	grant, err := s.command.ChangeProjectGrant(ctx, projectGrantUpdateToDomain(in), authz.GetCtxData(ctx).OrgID)
 	if err != nil {
 		return nil, err
 	}
-	return projectGrantFromModel(grant), nil
+	return projectGrantFromDomain(grant), nil
 }
-func (s *Server) DeactivateProjectGrant(ctx context.Context, in *management.ProjectGrantID) (*management.ProjectGrant, error) {
-	grant, err := s.project.DeactivateProjectGrant(ctx, in.ProjectId, in.Id)
-	if err != nil {
-		return nil, err
-	}
-	return projectGrantFromModel(grant), nil
+func (s *Server) DeactivateProjectGrant(ctx context.Context, in *management.ProjectGrantID) (*empty.Empty, error) {
+	err := s.command.DeactivateProjectGrant(ctx, in.ProjectId, in.Id, authz.GetCtxData(ctx).OrgID)
+	return &empty.Empty{}, err
 }

-func (s *Server) ReactivateProjectGrant(ctx context.Context, in *management.ProjectGrantID) (*management.ProjectGrant, error) {
-	grant, err := s.project.ReactivateProjectGrant(ctx, in.ProjectId, in.Id)
-	if err != nil {
-		return nil, err
-	}
-	return projectGrantFromModel(grant), nil
+func (s *Server) ReactivateProjectGrant(ctx context.Context, in *management.ProjectGrantID) (*empty.Empty, error) {
+	err := s.command.ReactivateProjectGrant(ctx, in.ProjectId, in.Id, authz.GetCtxData(ctx).OrgID)
+	return &empty.Empty{}, err
 }

 func (s *Server) RemoveProjectGrant(ctx context.Context, in *management.ProjectGrantID) (*empty.Empty, error) {
-	err := s.project.RemoveProjectGrant(ctx, in.ProjectId, in.Id)
+	err := s.command.RemoveProjectGrant(ctx, in.ProjectId, in.Id, authz.GetCtxData(ctx).OrgID)
 	return &empty.Empty{}, err
 }
--- a/internal/api/grpc/management/project_grant_converter.go
+++ b/internal/api/grpc/management/project_grant_converter.go
@@ -2,6 +2,8 @@ package management

 import (
 	"github.com/caos/logging"
+	"github.com/caos/zitadel/internal/v2/domain"
+	"google.golang.org/protobuf/types/known/timestamppb"

 	"github.com/golang/protobuf/ptypes"

@@ -11,6 +13,19 @@ import (
 	"github.com/caos/zitadel/pkg/grpc/management"
 )

+func projectGrantFromDomain(grant *domain.ProjectGrant) *management.ProjectGrant {
+	return &management.ProjectGrant{
+		Id:           grant.GrantID,
+		State:        projectGrantStateFromDomain(grant.State),
+		CreationDate: timestamppb.New(grant.CreationDate),
+		ChangeDate:   timestamppb.New(grant.ChangeDate),
+		GrantedOrgId: grant.GrantedOrgID,
+		RoleKeys:     grant.RoleKeys,
+		Sequence:     grant.Sequence,
+		ProjectId:    grant.AggregateID,
+	}
+}
+
 func projectGrantFromModel(grant *proj_model.ProjectGrant) *management.ProjectGrant {
 	creationDate, err := ptypes.TimestampProto(grant.CreationDate)
 	logging.Log("GRPC-8d73s").OnError(err).Debug("unable to parse timestamp")
@@ -30,8 +45,8 @@ func projectGrantFromModel(grant *proj_model.ProjectGrant) *management.ProjectGr
 	}
 }

-func projectGrantCreateToModel(grant *management.ProjectGrantCreate) *proj_model.ProjectGrant {
-	return &proj_model.ProjectGrant{
+func projectGrantCreateToDomain(grant *management.ProjectGrantCreate) *domain.ProjectGrant {
+	return &domain.ProjectGrant{
 		ObjectRoot: models.ObjectRoot{
 			AggregateID: grant.ProjectId,
 		},
@@ -40,8 +55,8 @@ func projectGrantCreateToModel(grant *management.ProjectGrantCreate) *proj_model
 	}
 }

-func projectGrantUpdateToModel(grant *management.ProjectGrantUpdate) *proj_model.ProjectGrant {
-	return &proj_model.ProjectGrant{
+func projectGrantUpdateToDomain(grant *management.ProjectGrantUpdate) *domain.ProjectGrant {
+	return &domain.ProjectGrant{
 		ObjectRoot: models.ObjectRoot{
 			AggregateID: grant.ProjectId,
 		},
@@ -134,6 +149,16 @@ func projectGrantFromGrantedProjectModel(project *proj_model.ProjectGrantView) *
 	}
 }

+func projectGrantStateFromDomain(state domain.ProjectGrantState) management.ProjectGrantState {
+	switch state {
+	case domain.ProjectGrantStateActive:
+		return management.ProjectGrantState_PROJECTGRANTSTATE_ACTIVE
+	case domain.ProjectGrantStateInactive:
+		return management.ProjectGrantState_PROJECTGRANTSTATE_INACTIVE
+	default:
+		return management.ProjectGrantState_PROJECTGRANTSTATE_UNSPECIFIED
+	}
+}
 func projectGrantStateFromModel(state proj_model.ProjectGrantState) management.ProjectGrantState {
 	switch state {
 	case proj_model.ProjectGrantStateActive:
--- a/internal/api/grpc/management/project_grant_member.go
+++ b/internal/api/grpc/management/project_grant_member.go
@@ -2,6 +2,7 @@ package management

 import (
 	"context"
+	"github.com/caos/zitadel/internal/api/authz"

 	"github.com/golang/protobuf/ptypes/empty"

@@ -21,22 +22,22 @@ func (s *Server) SearchProjectGrantMembers(ctx context.Context, in *management.P
 }

 func (s *Server) AddProjectGrantMember(ctx context.Context, in *management.ProjectGrantMemberAdd) (*management.ProjectGrantMember, error) {
-	member, err := s.project.AddProjectGrantMember(ctx, projectGrantMemberAddToModel(in))
+	member, err := s.command.AddProjectGrantMember(ctx, projectGrantMemberAddToDomain(in), authz.GetCtxData(ctx).OrgID)
 	if err != nil {
 		return nil, err
 	}
-	return projectGrantMemberFromModel(member), nil
+	return projectGrantMemberFromDomain(member), nil
 }

 func (s *Server) ChangeProjectGrantMember(ctx context.Context, in *management.ProjectGrantMemberChange) (*management.ProjectGrantMember, error) {
-	member, err := s.project.ChangeProjectGrantMember(ctx, projectGrantMemberChangeToModel(in))
+	member, err := s.command.ChangeProjectGrantMember(ctx, projectGrantMemberChangeToDomain(in), authz.GetCtxData(ctx).OrgID)
 	if err != nil {
 		return nil, err
 	}
-	return projectGrantMemberFromModel(member), nil
+	return projectGrantMemberFromDomain(member), nil
 }

 func (s *Server) RemoveProjectGrantMember(ctx context.Context, in *management.ProjectGrantMemberRemove) (*empty.Empty, error) {
-	err := s.project.RemoveProjectGrantMember(ctx, in.ProjectId, in.GrantId, in.UserId)
+	err := s.command.RemoveProjectGrantMember(ctx, in.ProjectId, in.UserId, in.GrantId, authz.GetCtxData(ctx).OrgID)
 	return &empty.Empty{}, err
 }
--- a/internal/api/grpc/management/project_grant_member_converter.go
+++ b/internal/api/grpc/management/project_grant_member_converter.go
@@ -3,13 +3,25 @@ package management
 import (
 	"github.com/caos/logging"
 	"github.com/caos/zitadel/internal/model"
+	"github.com/caos/zitadel/internal/v2/domain"
 	"github.com/golang/protobuf/ptypes"
+	"google.golang.org/protobuf/types/known/timestamppb"

 	"github.com/caos/zitadel/internal/eventstore/models"
 	proj_model "github.com/caos/zitadel/internal/project/model"
 	"github.com/caos/zitadel/pkg/grpc/management"
 )

+func projectGrantMemberFromDomain(member *domain.ProjectGrantMember) *management.ProjectGrantMember {
+	return &management.ProjectGrantMember{
+		CreationDate: timestamppb.New(member.CreationDate),
+		ChangeDate:   timestamppb.New(member.ChangeDate),
+		Sequence:     member.Sequence,
+		UserId:       member.UserID,
+		Roles:        member.Roles,
+	}
+}
+
 func projectGrantMemberFromModel(member *proj_model.ProjectGrantMember) *management.ProjectGrantMember {
 	creationDate, err := ptypes.TimestampProto(member.CreationDate)
 	logging.Log("GRPC-7du3s").OnError(err).Debug("unable to parse timestamp")
@@ -26,8 +38,8 @@ func projectGrantMemberFromModel(member *proj_model.ProjectGrantMember) *managem
 	}
 }

-func projectGrantMemberAddToModel(member *management.ProjectGrantMemberAdd) *proj_model.ProjectGrantMember {
-	return &proj_model.ProjectGrantMember{
+func projectGrantMemberAddToDomain(member *management.ProjectGrantMemberAdd) *domain.ProjectGrantMember {
+	return &domain.ProjectGrantMember{
 		ObjectRoot: models.ObjectRoot{
 			AggregateID: member.ProjectId,
 		},
@@ -37,8 +49,8 @@ func projectGrantMemberAddToModel(member *management.ProjectGrantMemberAdd) *pro
 	}
 }

-func projectGrantMemberChangeToModel(member *management.ProjectGrantMemberChange) *proj_model.ProjectGrantMember {
-	return &proj_model.ProjectGrantMember{
+func projectGrantMemberChangeToDomain(member *management.ProjectGrantMemberChange) *domain.ProjectGrantMember {
+	return &domain.ProjectGrantMember{
 		ObjectRoot: models.ObjectRoot{
 			AggregateID: member.ProjectId,
 		},
--- a/internal/api/grpc/management/project_member.go
+++ b/internal/api/grpc/management/project_member.go
@@ -2,6 +2,7 @@ package management

 import (
 	"context"
+	"github.com/caos/zitadel/internal/api/authz"

 	"github.com/golang/protobuf/ptypes/empty"

@@ -27,22 +28,22 @@ func (s *Server) SearchProjectMembers(ctx context.Context, in *management.Projec
 }

 func (s *Server) AddProjectMember(ctx context.Context, in *management.ProjectMemberAdd) (*management.ProjectMember, error) {
-	member, err := s.project.AddProjectMember(ctx, projectMemberAddToModel(in))
+	member, err := s.command.AddProjectMember(ctx, projectMemberAddToDomain(in), authz.GetCtxData(ctx).OrgID)
 	if err != nil {
 		return nil, err
 	}
-	return projectMemberFromModel(member), nil
+	return projectMemberFromDomain(member), nil
 }

 func (s *Server) ChangeProjectMember(ctx context.Context, in *management.ProjectMemberChange) (*management.ProjectMember, error) {
-	member, err := s.project.ChangeProjectMember(ctx, projectMemberChangeToModel(in))
+	member, err := s.command.ChangeProjectMember(ctx, projectMemberChangeToDomain(in), authz.GetCtxData(ctx).OrgID)
 	if err != nil {
 		return nil, err
 	}
-	return projectMemberFromModel(member), nil
+	return projectMemberFromDomain(member), nil
 }

 func (s *Server) RemoveProjectMember(ctx context.Context, in *management.ProjectMemberRemove) (*empty.Empty, error) {
-	err := s.project.RemoveProjectMember(ctx, in.Id, in.UserId)
+	err := s.command.RemoveProjectMember(ctx, in.Id, in.UserId, authz.GetCtxData(ctx).OrgID)
 	return &empty.Empty{}, err
 }
--- a/internal/api/grpc/management/project_member_converter.go
+++ b/internal/api/grpc/management/project_member_converter.go
@@ -2,31 +2,27 @@ package management

 import (
 	"github.com/caos/logging"
+	"github.com/caos/zitadel/internal/v2/domain"
 	"github.com/golang/protobuf/ptypes"
+	"google.golang.org/protobuf/types/known/timestamppb"

 	"github.com/caos/zitadel/internal/eventstore/models"
 	proj_model "github.com/caos/zitadel/internal/project/model"
 	"github.com/caos/zitadel/pkg/grpc/management"
 )

-func projectMemberFromModel(member *proj_model.ProjectMember) *management.ProjectMember {
-	creationDate, err := ptypes.TimestampProto(member.CreationDate)
-	logging.Log("GRPC-kd8re").OnError(err).Debug("unable to parse timestamp")
-
-	changeDate, err := ptypes.TimestampProto(member.ChangeDate)
-	logging.Log("GRPC-dlei3").OnError(err).Debug("unable to parse timestamp")
-
+func projectMemberFromDomain(member *domain.Member) *management.ProjectMember {
 	return &management.ProjectMember{
-		CreationDate: creationDate,
-		ChangeDate:   changeDate,
+		CreationDate: timestamppb.New(member.CreationDate),
+		ChangeDate:   timestamppb.New(member.ChangeDate),
 		Sequence:     member.Sequence,
 		UserId:       member.UserID,
 		Roles:        member.Roles,
 	}
 }

-func projectMemberAddToModel(member *management.ProjectMemberAdd) *proj_model.ProjectMember {
-	return &proj_model.ProjectMember{
+func projectMemberAddToDomain(member *management.ProjectMemberAdd) *domain.Member {
+	return &domain.Member{
 		ObjectRoot: models.ObjectRoot{
 			AggregateID: member.Id,
 		},
@@ -35,8 +31,8 @@ func projectMemberAddToModel(member *management.ProjectMemberAdd) *proj_model.Pr
 	}
 }

-func projectMemberChangeToModel(member *management.ProjectMemberChange) *proj_model.ProjectMember {
-	return &proj_model.ProjectMember{
+func projectMemberChangeToDomain(member *management.ProjectMemberChange) *domain.Member {
+	return &domain.Member{
 		ObjectRoot: models.ObjectRoot{
 			AggregateID: member.Id,
 		},