chore: move the go code into a subfolder

apps/api/internal/repository/action/action.go

@@ -0,0 +1,259 @@
+package action
+
+import (
+	"context"
+	"time"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	UniqueActionNameType = "action_names"
+	eventTypePrefix      = eventstore.EventType("action.")
+	AddedEventType       = eventTypePrefix + "added"
+	ChangedEventType     = eventTypePrefix + "changed"
+	DeactivatedEventType = eventTypePrefix + "deactivated"
+	ReactivatedEventType = eventTypePrefix + "reactivated"
+	RemovedEventType     = eventTypePrefix + "removed"
+)
+
+func NewAddActionNameUniqueConstraint(actionName, resourceOwner string) *eventstore.UniqueConstraint {
+	return eventstore.NewAddEventUniqueConstraint(
+		UniqueActionNameType,
+		actionName+":"+resourceOwner,
+		"Errors.Action.AlreadyExists")
+}
+
+func NewRemoveActionNameUniqueConstraint(actionName, resourceOwner string) *eventstore.UniqueConstraint {
+	return eventstore.NewRemoveUniqueConstraint(
+		UniqueActionNameType,
+		actionName+":"+resourceOwner)
+}
+
+type AddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	Name          string        `json:"name"`
+	Script        string        `json:"script,omitempty"`
+	Timeout       time.Duration `json:"timeout,omitempty"`
+	AllowedToFail bool          `json:"allowedToFail"`
+}
+
+func (e *AddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *AddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return []*eventstore.UniqueConstraint{NewAddActionNameUniqueConstraint(e.Name, e.Aggregate().ResourceOwner)}
+}
+
+func NewAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	name,
+	script string,
+	timeout time.Duration,
+	allowedToFail bool,
+) *AddedEvent {
+	return &AddedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			AddedEventType,
+		),
+		Name:          name,
+		Script:        script,
+		Timeout:       timeout,
+		AllowedToFail: allowedToFail,
+	}
+}
+
+func AddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &AddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "ACTION-4n8vs", "unable to unmarshal action added")
+	}
+
+	return e, nil
+}
+
+type ChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	Name          *string        `json:"name,omitempty"`
+	Script        *string        `json:"script,omitempty"`
+	Timeout       *time.Duration `json:"timeout,omitempty"`
+	AllowedToFail *bool          `json:"allowedToFail,omitempty"`
+	oldName       string
+}
+
+func (e *ChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *ChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	if e.oldName == "" {
+		return nil
+	}
+	return []*eventstore.UniqueConstraint{
+		NewRemoveActionNameUniqueConstraint(e.oldName, e.Aggregate().ResourceOwner),
+		NewAddActionNameUniqueConstraint(*e.Name, e.Aggregate().ResourceOwner),
+	}
+}
+
+func NewChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	changes []ActionChanges,
+) (*ChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "ACTION-dg4t2", "Errors.NoChangesFound")
+	}
+	changeEvent := &ChangedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			ChangedEventType,
+		),
+	}
+	for _, change := range changes {
+		change(changeEvent)
+	}
+	return changeEvent, nil
+}
+
+type ActionChanges func(event *ChangedEvent)
+
+func ChangeName(name, oldName string) func(event *ChangedEvent) {
+	return func(e *ChangedEvent) {
+		e.Name = &name
+		e.oldName = oldName
+	}
+}
+
+func ChangeScript(script string) func(event *ChangedEvent) {
+	return func(e *ChangedEvent) {
+		e.Script = &script
+	}
+}
+
+func ChangeTimeout(timeout time.Duration) func(event *ChangedEvent) {
+	return func(e *ChangedEvent) {
+		e.Timeout = &timeout
+	}
+}
+
+func ChangeAllowedToFail(allowedToFail bool) func(event *ChangedEvent) {
+	return func(e *ChangedEvent) {
+		e.AllowedToFail = &allowedToFail
+	}
+}
+
+func ChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &ChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "ACTION-4n8vs", "unable to unmarshal action changed")
+	}
+
+	return e, nil
+}
+
+type DeactivatedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+}
+
+func (e *DeactivatedEvent) Payload() interface{} {
+	return nil
+}
+
+func (e *DeactivatedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewDeactivatedEvent(ctx context.Context, aggregate *eventstore.Aggregate) *DeactivatedEvent {
+	return &DeactivatedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			DeactivatedEventType,
+		),
+	}
+}
+
+func DeactivatedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	return &DeactivatedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}, nil
+}
+
+type ReactivatedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+}
+
+func (e *ReactivatedEvent) Payload() interface{} {
+	return nil
+}
+
+func (e *ReactivatedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewReactivatedEvent(ctx context.Context, aggregate *eventstore.Aggregate) *ReactivatedEvent {
+	return &ReactivatedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			ReactivatedEventType,
+		),
+	}
+}
+
+func ReactivatedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	return &ReactivatedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}, nil
+}
+
+type RemovedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	name string
+}
+
+func (e *RemovedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *RemovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return []*eventstore.UniqueConstraint{NewRemoveActionNameUniqueConstraint(e.name, e.Aggregate().ResourceOwner)}
+}
+
+func NewRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	name string,
+) *RemovedEvent {
+	return &RemovedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			RemovedEventType,
+		),
+		name: name,
+	}
+}
+
+func RemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	return &RemovedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}, nil
+}

apps/api/internal/repository/action/aggregate.go

@@ -0,0 +1,23 @@
+package action
+
+import "github.com/zitadel/zitadel/internal/eventstore"
+
+const (
+	AggregateType    = "action"
+	AggregateVersion = "v1"
+)
+
+type Aggregate struct {
+	eventstore.Aggregate
+}
+
+func NewAggregate(id, resourceOwner string) *Aggregate {
+	return &Aggregate{
+		Aggregate: eventstore.Aggregate{
+			Type:          AggregateType,
+			Version:       AggregateVersion,
+			ID:            id,
+			ResourceOwner: resourceOwner,
+		},
+	}
+}

apps/api/internal/repository/action/eventstore.go

@@ -0,0 +1,11 @@
+package action
+
+import "github.com/zitadel/zitadel/internal/eventstore"
+
+func init() {
+	eventstore.RegisterFilterEventMapper(AggregateType, AddedEventType, AddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, ChangedEventType, ChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, DeactivatedEventType, DeactivatedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, ReactivatedEventType, ReactivatedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, RemovedEventType, RemovedEventMapper)
+}

apps/api/internal/repository/asset/asset.go

@@ -0,0 +1,87 @@
+package asset
+
+import (
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	AddedEventType   = "asset.added"
+	RemovedEventType = "asset.removed"
+)
+
+type AddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	StoreKey string `json:"storeKey"`
+}
+
+func (e *AddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *AddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewAddedEvent(
+	base *eventstore.BaseEvent,
+	key string,
+) *AddedEvent {
+
+	return &AddedEvent{
+		BaseEvent: *base,
+		StoreKey:  key,
+	}
+}
+
+func AddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &AddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "ASSET-1WEAx", "unable to unmarshal asset")
+	}
+
+	return e, nil
+}
+
+type RemovedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	StoreKey string `json:"storeKey"`
+}
+
+func (e *RemovedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *RemovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewRemovedEvent(
+	base *eventstore.BaseEvent,
+	key string,
+) *RemovedEvent {
+
+	return &RemovedEvent{
+		BaseEvent: *base,
+		StoreKey:  key,
+	}
+}
+
+func RemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &RemovedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "ASSET-1m9PP", "unable to unmarshal asset")
+	}
+
+	return e, nil
+}

apps/api/internal/repository/authrequest/aggregate.go

@@ -0,0 +1,26 @@
+package authrequest
+
+import (
+	"github.com/zitadel/zitadel/internal/eventstore"
+)
+
+const (
+	AggregateType    = "auth_request"
+	AggregateVersion = "v1"
+)
+
+type Aggregate struct {
+	eventstore.Aggregate
+}
+
+func NewAggregate(id, instanceID string) *Aggregate {
+	return &Aggregate{
+		Aggregate: eventstore.Aggregate{
+			Type:          AggregateType,
+			Version:       AggregateVersion,
+			ID:            id,
+			ResourceOwner: instanceID,
+			InstanceID:    instanceID,
+		},
+	}
+}

apps/api/internal/repository/authrequest/auth_request.go

@@ -0,0 +1,294 @@
+package authrequest
+
+import (
+	"context"
+	"time"
+
+	"github.com/zitadel/zitadel/internal/domain"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	authRequestEventPrefix = "auth_request."
+	AddedType              = authRequestEventPrefix + "added"
+	FailedType             = authRequestEventPrefix + "failed"
+	CodeAddedType          = authRequestEventPrefix + "code.added"
+	SessionLinkedType      = authRequestEventPrefix + "session.linked"
+	CodeExchangedType      = authRequestEventPrefix + "code.exchanged"
+	SucceededType          = authRequestEventPrefix + "succeeded"
+)
+
+type AddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	LoginClient      string                    `json:"login_client"`
+	ClientID         string                    `json:"client_id"`
+	RedirectURI      string                    `json:"redirect_uri"`
+	State            string                    `json:"state,omitempty"`
+	Nonce            string                    `json:"nonce,omitempty"`
+	Scope            []string                  `json:"scope,omitempty"`
+	Audience         []string                  `json:"audience,omitempty"`
+	ResponseType     domain.OIDCResponseType   `json:"response_type,omitempty"`
+	ResponseMode     domain.OIDCResponseMode   `json:"response_mode,omitempty"`
+	CodeChallenge    *domain.OIDCCodeChallenge `json:"code_challenge,omitempty"`
+	Prompt           []domain.Prompt           `json:"prompt,omitempty"`
+	UILocales        []string                  `json:"ui_locales,omitempty"`
+	MaxAge           *time.Duration            `json:"max_age,omitempty"`
+	LoginHint        *string                   `json:"login_hint,omitempty"`
+	HintUserID       *string                   `json:"hint_user_id,omitempty"`
+	NeedRefreshToken bool                      `json:"need_refresh_token,omitempty"`
+	Issuer           string                    `json:"issuer,omitempty"`
+}
+
+func (e *AddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *AddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewAddedEvent(ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	loginClient,
+	clientID,
+	redirectURI,
+	state,
+	nonce string,
+	scope,
+	audience []string,
+	responseType domain.OIDCResponseType,
+	responseMode domain.OIDCResponseMode,
+	codeChallenge *domain.OIDCCodeChallenge,
+	prompt []domain.Prompt,
+	uiLocales []string,
+	maxAge *time.Duration,
+	loginHint,
+	hintUserID *string,
+	needRefreshToken bool,
+	issuer string,
+) *AddedEvent {
+	return &AddedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			AddedType,
+		),
+		LoginClient:      loginClient,
+		ClientID:         clientID,
+		RedirectURI:      redirectURI,
+		State:            state,
+		Nonce:            nonce,
+		Scope:            scope,
+		Audience:         audience,
+		ResponseType:     responseType,
+		ResponseMode:     responseMode,
+		CodeChallenge:    codeChallenge,
+		Prompt:           prompt,
+		UILocales:        uiLocales,
+		MaxAge:           maxAge,
+		LoginHint:        loginHint,
+		HintUserID:       hintUserID,
+		NeedRefreshToken: needRefreshToken,
+		Issuer:           issuer,
+	}
+}
+
+func AddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	added := &AddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(added)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "AUTHR-DG4gn", "unable to unmarshal auth request added")
+	}
+
+	return added, nil
+}
+
+type SessionLinkedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	SessionID   string                      `json:"session_id"`
+	UserID      string                      `json:"user_id"`
+	AuthTime    time.Time                   `json:"auth_time"`
+	AuthMethods []domain.UserAuthMethodType `json:"auth_methods"`
+}
+
+func (e *SessionLinkedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SessionLinkedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewSessionLinkedEvent(ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	sessionID,
+	userID string,
+	authTime time.Time,
+	authMethods []domain.UserAuthMethodType,
+) *SessionLinkedEvent {
+	return &SessionLinkedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SessionLinkedType,
+		),
+		SessionID:   sessionID,
+		UserID:      userID,
+		AuthTime:    authTime,
+		AuthMethods: authMethods,
+	}
+}
+
+func SessionLinkedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	added := &SessionLinkedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(added)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "AUTHR-Sfe3w", "unable to unmarshal auth request session linked")
+	}
+
+	return added, nil
+}
+
+type FailedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	Reason domain.OIDCErrorReason `json:"reason,omitempty"`
+}
+
+func (e *FailedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *FailedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewFailedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	reason domain.OIDCErrorReason,
+) *FailedEvent {
+	return &FailedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			FailedType,
+		),
+		Reason: reason,
+	}
+}
+
+func FailedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	added := &FailedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(added)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "AUTHR-Sfe3w", "unable to unmarshal auth request session linked")
+	}
+
+	return added, nil
+}
+
+type CodeAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+}
+
+func (e *CodeAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *CodeAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewCodeAddedEvent(ctx context.Context,
+	aggregate *eventstore.Aggregate,
+) *CodeAddedEvent {
+	return &CodeAddedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			CodeAddedType,
+		),
+	}
+}
+
+func CodeAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	added := &CodeAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(added)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "AUTHR-Sfe3w", "unable to unmarshal auth request code added")
+	}
+
+	return added, nil
+}
+
+type CodeExchangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+}
+
+func (e *CodeExchangedEvent) Payload() interface{} {
+	return nil
+}
+
+func (e *CodeExchangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewCodeExchangedEvent(ctx context.Context,
+	aggregate *eventstore.Aggregate,
+) *CodeExchangedEvent {
+	return &CodeExchangedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			CodeExchangedType,
+		),
+	}
+}
+
+func CodeExchangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	return &CodeExchangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}, nil
+}
+
+type SucceededEvent struct {
+	eventstore.BaseEvent `json:"-"`
+}
+
+func (e *SucceededEvent) Payload() interface{} {
+	return nil
+}
+
+func (e *SucceededEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewSucceededEvent(ctx context.Context,
+	aggregate *eventstore.Aggregate,
+) *SucceededEvent {
+	return &SucceededEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SucceededType,
+		),
+	}
+}
+
+func SucceededEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	return &SucceededEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}, nil
+}

apps/api/internal/repository/authrequest/eventstore.go

@@ -0,0 +1,12 @@
+package authrequest
+
+import "github.com/zitadel/zitadel/internal/eventstore"
+
+func init() {
+	eventstore.RegisterFilterEventMapper(AggregateType, AddedType, AddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, SessionLinkedType, SessionLinkedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, CodeAddedType, CodeAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, CodeExchangedType, CodeExchangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, FailedType, FailedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, SucceededType, SucceededEventMapper)
+}

apps/api/internal/repository/debug_events/aggregate.go

@@ -0,0 +1,27 @@
+package debug_events
+
+import (
+	"github.com/zitadel/zitadel/internal/eventstore"
+)
+
+const (
+	eventTypePrefix = eventstore.EventType("debug.")
+)
+
+const (
+	AggregateType    = "debug"
+	AggregateVersion = "v1"
+)
+
+type Aggregate struct {
+	eventstore.Aggregate
+}
+
+func NewAggregate(id, resourceOwner string) *eventstore.Aggregate {
+	return &eventstore.Aggregate{
+		Type:          AggregateType,
+		Version:       AggregateVersion,
+		ID:            id,
+		ResourceOwner: resourceOwner,
+	}
+}

apps/api/internal/repository/debug_events/debug.go

@@ -0,0 +1,125 @@
+package debug_events
+
+import (
+	"context"
+	"time"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	AddedEventType   = eventTypePrefix + "added"
+	ChangedEventType = eventTypePrefix + "changed"
+	RemovedEventType = eventTypePrefix + "removed"
+)
+
+type AddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+	ProjectionSleep      time.Duration `json:"projectionSleep,omitempty"`
+	Blob                 *string       `json:"blob,omitempty"`
+}
+
+func (e *AddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *AddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewAddedEvent(ctx context.Context, aggregate *eventstore.Aggregate, projectionSleep time.Duration, blob *string) *AddedEvent {
+	return &AddedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			AddedEventType,
+		),
+		Blob:            blob,
+		ProjectionSleep: projectionSleep,
+	}
+}
+
+func DebugAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	debugAdded := &AddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(debugAdded)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "ORG-Bren2", "unable to unmarshal debug added")
+	}
+
+	return debugAdded, nil
+}
+
+type ChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+	ProjectionSleep      time.Duration `json:"projectionSleep,omitempty"`
+	Blob                 *string       `json:"blob,omitempty"`
+}
+
+func (e *ChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *ChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewChangedEvent(ctx context.Context, aggregate *eventstore.Aggregate, projectionSleep time.Duration, blob *string) *ChangedEvent {
+	return &ChangedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			ChangedEventType,
+		),
+		ProjectionSleep: projectionSleep,
+		Blob:            blob,
+	}
+}
+
+func DebugChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	debugChanged := &ChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(debugChanged)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "ORG-Bren2", "unable to unmarshal debug added")
+	}
+
+	return debugChanged, nil
+}
+
+type RemovedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+	ProjectionSleep      time.Duration `json:"projectionSleep,omitempty"`
+}
+
+func (e *RemovedEvent) Payload() interface{} {
+	return nil
+}
+
+func (e *RemovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewRemovedEvent(ctx context.Context, aggregate *eventstore.Aggregate, projectionSleep time.Duration) *RemovedEvent {
+	return &RemovedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			RemovedEventType,
+		),
+		ProjectionSleep: projectionSleep,
+	}
+}
+
+func DebugRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	return &RemovedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}, nil
+}
+
+func AggregateFromWriteModel(ctx context.Context, wm *eventstore.WriteModel) *eventstore.Aggregate {
+	return eventstore.AggregateFromWriteModelCtx(ctx, wm, AggregateType, AggregateVersion)
+}

apps/api/internal/repository/debug_events/eventstore.go

@@ -0,0 +1,11 @@
+package debug_events
+
+import (
+	"github.com/zitadel/zitadel/internal/eventstore"
+)
+
+func init() {
+	eventstore.RegisterFilterEventMapper(AggregateType, AddedEventType, DebugAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, ChangedEventType, DebugChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, RemovedEventType, DebugRemovedEventMapper)
+}

apps/api/internal/repository/deviceauth/aggregate.go

@@ -0,0 +1,19 @@
+package deviceauth
+
+import "github.com/zitadel/zitadel/internal/eventstore"
+
+const (
+	AggregateType    = "device_auth"
+	AggregateVersion = "v1"
+)
+
+func NewAggregate(aggrID, instanceID string) *eventstore.Aggregate {
+	return &eventstore.Aggregate{
+		ID:   aggrID,
+		Type: AggregateType,
+		// we use the id because we don't know the resource owner yet
+		ResourceOwner: instanceID,
+		InstanceID:    instanceID,
+		Version:       AggregateVersion,
+	}
+}

apps/api/internal/repository/deviceauth/constraints.go

@@ -0,0 +1,40 @@
+package deviceauth
+
+import (
+	"github.com/zitadel/zitadel/internal/eventstore"
+)
+
+const (
+	UniqueUserCode      = "user_code"
+	UniqueDeviceCode    = "device_code"
+	DuplicateUserCode   = "Errors.DeviceUserCode.AlreadyExists"
+	DuplicateDeviceCode = "Errors.DeviceCode.AlreadyExists"
+)
+
+func NewAddUniqueConstraints(deviceCode, userCode string) []*eventstore.UniqueConstraint {
+	return []*eventstore.UniqueConstraint{
+		eventstore.NewAddEventUniqueConstraint(
+			UniqueDeviceCode,
+			deviceCode,
+			DuplicateDeviceCode,
+		),
+		eventstore.NewAddEventUniqueConstraint(
+			UniqueUserCode,
+			userCode,
+			DuplicateUserCode,
+		),
+	}
+}
+
+func NewRemoveUniqueConstraints(deviceCode, userCode string) []*eventstore.UniqueConstraint {
+	return []*eventstore.UniqueConstraint{
+		eventstore.NewRemoveUniqueConstraint(
+			UniqueDeviceCode,
+			deviceCode,
+		),
+		eventstore.NewRemoveUniqueConstraint(
+			UniqueUserCode,
+			userCode,
+		),
+	}
+}

apps/api/internal/repository/deviceauth/device_auth.go

@@ -0,0 +1,155 @@
+package deviceauth
+
+import (
+	"context"
+	"time"
+
+	"golang.org/x/text/language"
+
+	"github.com/zitadel/zitadel/internal/domain"
+	"github.com/zitadel/zitadel/internal/eventstore"
+)
+
+const (
+	eventTypePrefix   eventstore.EventType = "device.authorization."
+	AddedEventType                         = eventTypePrefix + "added"
+	ApprovedEventType                      = eventTypePrefix + "approved"
+	CanceledEventType                      = eventTypePrefix + "canceled"
+	DoneEventType                          = eventTypePrefix + "done"
+)
+
+type AddedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+
+	ClientID         string
+	DeviceCode       string
+	UserCode         string
+	Expires          time.Time
+	Scopes           []string
+	Audience         []string
+	State            domain.DeviceAuthState
+	NeedRefreshToken bool
+}
+
+func (e *AddedEvent) SetBaseEvent(b *eventstore.BaseEvent) {
+	e.BaseEvent = b
+}
+
+func (e *AddedEvent) Payload() any {
+	return e
+}
+
+func (e *AddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return NewAddUniqueConstraints(e.DeviceCode, e.UserCode)
+}
+
+func NewAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	clientID string,
+	deviceCode string,
+	userCode string,
+	expires time.Time,
+	scopes []string,
+	audience []string,
+	needRefreshToken bool,
+) *AddedEvent {
+	return &AddedEvent{
+		eventstore.NewBaseEventForPush(
+			ctx, aggregate, AddedEventType,
+		),
+		clientID, deviceCode, userCode, expires, scopes, audience,
+		domain.DeviceAuthStateInitiated, needRefreshToken,
+	}
+}
+
+type ApprovedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+
+	UserID            string
+	UserOrgID         string
+	UserAuthMethods   []domain.UserAuthMethodType
+	AuthTime          time.Time
+	PreferredLanguage *language.Tag
+	UserAgent         *domain.UserAgent
+	SessionID         string
+}
+
+func (e *ApprovedEvent) SetBaseEvent(b *eventstore.BaseEvent) {
+	e.BaseEvent = b
+}
+
+func (e *ApprovedEvent) Payload() any {
+	return e
+}
+
+func (e *ApprovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewApprovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	userID,
+	userOrgID string,
+	userAuthMethods []domain.UserAuthMethodType,
+	authTime time.Time,
+	preferredLanguage *language.Tag,
+	userAgent *domain.UserAgent,
+	sessionID string,
+) *ApprovedEvent {
+	return &ApprovedEvent{
+		BaseEvent: eventstore.NewBaseEventForPush(
+			ctx, aggregate, ApprovedEventType,
+		),
+		UserID:            userID,
+		UserOrgID:         userOrgID,
+		UserAuthMethods:   userAuthMethods,
+		AuthTime:          authTime,
+		PreferredLanguage: preferredLanguage,
+		UserAgent:         userAgent,
+		SessionID:         sessionID,
+	}
+}
+
+type CanceledEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+
+	Reason domain.DeviceAuthCanceled
+}
+
+func (e *CanceledEvent) SetBaseEvent(b *eventstore.BaseEvent) {
+	e.BaseEvent = b
+}
+
+func (e *CanceledEvent) Payload() any {
+	return e
+}
+
+func (e *CanceledEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewCanceledEvent(ctx context.Context, aggregate *eventstore.Aggregate, reason domain.DeviceAuthCanceled) *CanceledEvent {
+	return &CanceledEvent{eventstore.NewBaseEventForPush(ctx, aggregate, CanceledEventType), reason}
+}
+
+type DoneEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+}
+
+func (e *DoneEvent) SetBaseEvent(b *eventstore.BaseEvent) {
+	e.BaseEvent = b
+}
+
+func (e *DoneEvent) Payload() any {
+	return e
+}
+
+func (e *DoneEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewDoneEvent(ctx context.Context, aggregate *eventstore.Aggregate) *DoneEvent {
+	return &DoneEvent{eventstore.NewBaseEventForPush(ctx, aggregate, DoneEventType)}
+}

apps/api/internal/repository/deviceauth/eventstore.go

@@ -0,0 +1,10 @@
+package deviceauth
+
+import "github.com/zitadel/zitadel/internal/eventstore"
+
+func init() {
+	eventstore.RegisterFilterEventMapper(AggregateType, AddedEventType, eventstore.GenericEventMapper[AddedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, ApprovedEventType, eventstore.GenericEventMapper[ApprovedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, CanceledEventType, eventstore.GenericEventMapper[CanceledEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, DoneEventType, eventstore.GenericEventMapper[DoneEvent])
+}

apps/api/internal/repository/execution/aggregate.go

@@ -0,0 +1,34 @@
+package execution
+
+import (
+	"strings"
+
+	"github.com/zitadel/zitadel/internal/domain"
+	"github.com/zitadel/zitadel/internal/eventstore"
+)
+
+const (
+	AggregateType    = "execution"
+	AggregateVersion = "v1"
+)
+
+func NewAggregate(aggrID, instanceID string) *eventstore.Aggregate {
+	return &eventstore.Aggregate{
+		ID:            aggrID,
+		Type:          AggregateType,
+		ResourceOwner: instanceID,
+		InstanceID:    instanceID,
+		Version:       AggregateVersion,
+	}
+}
+
+func ID(executionType domain.ExecutionType, value string) string {
+	if strings.HasPrefix(value, "/") {
+		return strings.Join([]string{executionType.String(), value}, "")
+	}
+	return strings.Join([]string{executionType.String(), value}, "/")
+}
+
+func IDAll(executionType domain.ExecutionType) string {
+	return executionType.String()
+}

apps/api/internal/repository/execution/eventstore.go

@@ -0,0 +1,9 @@
+package execution
+
+import "github.com/zitadel/zitadel/internal/eventstore"
+
+func init() {
+	eventstore.RegisterFilterEventMapper(AggregateType, SetEventType, eventstore.GenericEventMapper[SetEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SetEventV2Type, eventstore.GenericEventMapper[SetEventV2])
+	eventstore.RegisterFilterEventMapper(AggregateType, RemovedEventType, eventstore.GenericEventMapper[RemovedEvent])
+}

apps/api/internal/repository/execution/execution.go

@@ -0,0 +1,100 @@
+package execution
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/domain"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	eventTypePrefix  eventstore.EventType = "execution."
+	SetEventType                          = eventTypePrefix + "set"
+	SetEventV2Type                        = eventTypePrefix + "v2.set"
+	RemovedEventType                      = eventTypePrefix + "removed"
+)
+
+type SetEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+
+	Targets  []string `json:"targets"`
+	Includes []string `json:"includes"`
+}
+
+func (e *SetEvent) SetBaseEvent(b *eventstore.BaseEvent) {
+	e.BaseEvent = b
+}
+
+func (e *SetEvent) Payload() any {
+	return e
+}
+
+func (e *SetEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+type SetEventV2 struct {
+	*eventstore.BaseEvent `json:"-"`
+
+	Targets []*Target `json:"targets"`
+}
+
+func (e *SetEventV2) SetBaseEvent(b *eventstore.BaseEvent) {
+	e.BaseEvent = b
+}
+
+func (e *SetEventV2) Payload() any {
+	return e
+}
+
+func (e *SetEventV2) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+type Target struct {
+	Type   domain.ExecutionTargetType `json:"type"`
+	Target string                     `json:"target"`
+}
+
+func (t *Target) Validate() error {
+	if t.Type == domain.ExecutionTargetTypeUnspecified || t.Target == "" {
+		return zerrors.ThrowInvalidArgument(nil, "COMMAND-hdm4zl1hmd", "Errors.Execution.Invalid")
+	}
+	return nil
+}
+
+func NewSetEventV2(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	targets []*Target,
+) *SetEventV2 {
+	return &SetEventV2{
+		BaseEvent: eventstore.NewBaseEventForPush(
+			ctx, aggregate, SetEventV2Type,
+		),
+		Targets: targets,
+	}
+}
+
+type RemovedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+}
+
+func (e *RemovedEvent) SetBaseEvent(b *eventstore.BaseEvent) {
+	e.BaseEvent = b
+}
+
+func (e *RemovedEvent) Payload() any {
+	return e
+}
+
+func (e *RemovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewRemovedEvent(ctx context.Context, aggregate *eventstore.Aggregate) *RemovedEvent {
+	return &RemovedEvent{
+		eventstore.NewBaseEventForPush(ctx, aggregate, RemovedEventType),
+	}
+}

apps/api/internal/repository/execution/queue.go

@@ -0,0 +1,71 @@
+package execution
+
+import (
+	"encoding/json"
+	"time"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+)
+
+const (
+	QueueName = "execution"
+)
+
+type Request struct {
+	Aggregate   *eventstore.Aggregate `json:"aggregate"`
+	Sequence    uint64                `json:"sequence"`
+	EventType   eventstore.EventType  `json:"eventType"`
+	CreatedAt   time.Time             `json:"createdAt"`
+	UserID      string                `json:"userID"`
+	EventData   []byte                `json:"eventData"`
+	TargetsData []byte                `json:"targetsData"`
+}
+
+func (e *Request) Kind() string {
+	return "execution_request"
+}
+
+func ContextInfoFromRequest(e *Request) *ContextInfoEvent {
+	return &ContextInfoEvent{
+		AggregateID:   e.Aggregate.ID,
+		AggregateType: string(e.Aggregate.Type),
+		ResourceOwner: e.Aggregate.ResourceOwner,
+		InstanceID:    e.Aggregate.InstanceID,
+		Version:       string(e.Aggregate.Version),
+		Sequence:      e.Sequence,
+		EventType:     string(e.EventType),
+		CreatedAt:     e.CreatedAt.Format(time.RFC3339Nano),
+		UserID:        e.UserID,
+		EventPayload:  e.EventData,
+	}
+}
+
+type ContextInfoEvent struct {
+	AggregateID   string          `json:"aggregateID,omitempty"`
+	AggregateType string          `json:"aggregateType,omitempty"`
+	ResourceOwner string          `json:"resourceOwner,omitempty"`
+	InstanceID    string          `json:"instanceID,omitempty"`
+	Version       string          `json:"version,omitempty"`
+	Sequence      uint64          `json:"sequence,omitempty"`
+	EventType     string          `json:"event_type,omitempty"`
+	CreatedAt     string          `json:"created_at,omitempty"`
+	UserID        string          `json:"userID,omitempty"`
+	EventPayload  json.RawMessage `json:"event_payload,omitempty"`
+}
+
+func (c *ContextInfoEvent) GetHTTPRequestBody() []byte {
+	data, err := json.Marshal(c)
+	if err != nil {
+		return nil
+	}
+	return data
+}
+
+func (c *ContextInfoEvent) SetHTTPResponseBody(resp []byte) error {
+	// response is irrelevant and will not be unmarshaled
+	return nil
+}
+
+func (c *ContextInfoEvent) GetContent() any {
+	return c.EventPayload
+}

apps/api/internal/repository/feature/aggregate.go

@@ -0,0 +1,15 @@
+package feature
+
+import (
+	"github.com/zitadel/zitadel/internal/eventstore"
+)
+
+const (
+	eventTypePrefix = eventstore.EventType("feature.")
+	setSuffix       = ".set"
+)
+
+const (
+	AggregateType    = "feature"
+	AggregateVersion = "v1"
+)

apps/api/internal/repository/feature/eventstore.go

@@ -0,0 +1,9 @@
+package feature
+
+import (
+	"github.com/zitadel/zitadel/internal/eventstore"
+)
+
+func init() {
+	eventstore.RegisterFilterEventMapper(AggregateType, DefaultLoginInstanceEventType, eventstore.GenericEventMapper[SetEvent[Boolean]])
+}

apps/api/internal/repository/feature/feature.go

@@ -0,0 +1,79 @@
+// Package feature implements the v1 feature repository.
+// DEPRECATED: use ./feature_v2 instead.
+package feature
+
+import (
+	"context"
+	"strings"
+
+	"github.com/zitadel/zitadel/internal/domain"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/feature/feature_v2"
+)
+
+var (
+	DefaultLoginInstanceEventType = eventTypePrefix + eventstore.EventType(strings.ToLower("FeatureLoginDefaultOrg")) + setSuffix
+)
+
+// DefaultLoginInstanceEventToV2 upgrades the SetEvent to a V2 SetEvent so that
+// the v2 reducers can handle the V1 events.
+func DefaultLoginInstanceEventToV2(e *SetEvent[Boolean]) *feature_v2.SetEvent[bool] {
+	v2e := &feature_v2.SetEvent[bool]{
+		BaseEvent: e.BaseEvent,
+		Value:     e.Value.Boolean,
+	}
+
+	// v1 used a random aggregate ID.
+	// v2 uses the instance ID as aggregate ID.
+	v2e.BaseEvent.Agg.ID = e.Agg.InstanceID
+	v2e.BaseEvent.EventType = feature_v2.InstanceLoginDefaultOrgEventType
+	return v2e
+}
+
+type SetEvent[T SetEventType] struct {
+	*eventstore.BaseEvent `json:"-"`
+
+	Value T
+}
+
+func (e *SetEvent[T]) SetBaseEvent(b *eventstore.BaseEvent) {
+	e.BaseEvent = b
+}
+
+func (e *SetEvent[T]) Payload() interface{} {
+	return e
+}
+
+func (e *SetEvent[T]) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+type SetEventType interface {
+	Boolean
+	FeatureType() domain.FeatureType
+}
+
+type EventType[T SetEventType] struct {
+	eventstore.EventType
+}
+
+type Boolean struct {
+	Boolean bool
+}
+
+func (b Boolean) FeatureType() domain.FeatureType {
+	return domain.FeatureTypeBoolean
+}
+
+func NewSetEvent[T SetEventType](
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	eventType eventstore.EventType,
+	setType T,
+) *SetEvent[T] {
+	return &SetEvent[T]{
+		eventstore.NewBaseEventForPush(
+			ctx, aggregate, eventType),
+		setType,
+	}
+}

apps/api/internal/repository/feature/feature_v2/aggregate.go

@@ -0,0 +1,25 @@
+package feature_v2
+
+import (
+	"github.com/zitadel/zitadel/internal/eventstore"
+)
+
+const (
+	AggregateType    = "feature"
+	AggregateVersion = "v2"
+)
+
+type Aggregate struct {
+	eventstore.Aggregate
+}
+
+func NewAggregate(id, resourceOwner string) *Aggregate {
+	return &Aggregate{
+		Aggregate: eventstore.Aggregate{
+			Type:          AggregateType,
+			Version:       AggregateVersion,
+			ID:            id,
+			ResourceOwner: resourceOwner,
+		},
+	}
+}

apps/api/internal/repository/feature/feature_v2/eventstore.go

@@ -0,0 +1,32 @@
+package feature_v2
+
+import (
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/feature"
+)
+
+func init() {
+	eventstore.RegisterFilterEventMapper(AggregateType, SystemResetEventType, eventstore.GenericEventMapper[ResetEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SystemLoginDefaultOrgEventType, eventstore.GenericEventMapper[SetEvent[bool]])
+	eventstore.RegisterFilterEventMapper(AggregateType, SystemUserSchemaEventType, eventstore.GenericEventMapper[SetEvent[bool]])
+	eventstore.RegisterFilterEventMapper(AggregateType, SystemTokenExchangeEventType, eventstore.GenericEventMapper[SetEvent[bool]])
+	eventstore.RegisterFilterEventMapper(AggregateType, SystemImprovedPerformanceEventType, eventstore.GenericEventMapper[SetEvent[[]feature.ImprovedPerformanceType]])
+	eventstore.RegisterFilterEventMapper(AggregateType, SystemOIDCSingleV1SessionTerminationEventType, eventstore.GenericEventMapper[SetEvent[bool]])
+	eventstore.RegisterFilterEventMapper(AggregateType, SystemDisableUserTokenEvent, eventstore.GenericEventMapper[SetEvent[bool]])
+	eventstore.RegisterFilterEventMapper(AggregateType, SystemEnableBackChannelLogout, eventstore.GenericEventMapper[SetEvent[bool]])
+	eventstore.RegisterFilterEventMapper(AggregateType, SystemLoginVersion, eventstore.GenericEventMapper[SetEvent[*feature.LoginV2]])
+	eventstore.RegisterFilterEventMapper(AggregateType, SystemPermissionCheckV2, eventstore.GenericEventMapper[SetEvent[bool]])
+
+	eventstore.RegisterFilterEventMapper(AggregateType, InstanceResetEventType, eventstore.GenericEventMapper[ResetEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, InstanceLoginDefaultOrgEventType, eventstore.GenericEventMapper[SetEvent[bool]])
+	eventstore.RegisterFilterEventMapper(AggregateType, InstanceUserSchemaEventType, eventstore.GenericEventMapper[SetEvent[bool]])
+	eventstore.RegisterFilterEventMapper(AggregateType, InstanceTokenExchangeEventType, eventstore.GenericEventMapper[SetEvent[bool]])
+	eventstore.RegisterFilterEventMapper(AggregateType, InstanceImprovedPerformanceEventType, eventstore.GenericEventMapper[SetEvent[[]feature.ImprovedPerformanceType]])
+	eventstore.RegisterFilterEventMapper(AggregateType, InstanceDebugOIDCParentErrorEventType, eventstore.GenericEventMapper[SetEvent[bool]])
+	eventstore.RegisterFilterEventMapper(AggregateType, InstanceOIDCSingleV1SessionTerminationEventType, eventstore.GenericEventMapper[SetEvent[bool]])
+	eventstore.RegisterFilterEventMapper(AggregateType, InstanceDisableUserTokenEvent, eventstore.GenericEventMapper[SetEvent[bool]])
+	eventstore.RegisterFilterEventMapper(AggregateType, InstanceEnableBackChannelLogout, eventstore.GenericEventMapper[SetEvent[bool]])
+	eventstore.RegisterFilterEventMapper(AggregateType, InstanceLoginVersion, eventstore.GenericEventMapper[SetEvent[*feature.LoginV2]])
+	eventstore.RegisterFilterEventMapper(AggregateType, InstancePermissionCheckV2, eventstore.GenericEventMapper[SetEvent[bool]])
+	eventstore.RegisterFilterEventMapper(AggregateType, InstanceConsoleUseV2UserApi, eventstore.GenericEventMapper[SetEvent[bool]])
+}

apps/api/internal/repository/feature/feature_v2/feature.go

@@ -0,0 +1,146 @@
+package feature_v2
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/feature"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+var (
+	SystemResetEventType                          = resetEventTypeFromFeature(feature.LevelSystem)
+	SystemLoginDefaultOrgEventType                = setEventTypeFromFeature(feature.LevelSystem, feature.KeyLoginDefaultOrg)
+	SystemUserSchemaEventType                     = setEventTypeFromFeature(feature.LevelSystem, feature.KeyUserSchema)
+	SystemTokenExchangeEventType                  = setEventTypeFromFeature(feature.LevelSystem, feature.KeyTokenExchange)
+	SystemImprovedPerformanceEventType            = setEventTypeFromFeature(feature.LevelSystem, feature.KeyImprovedPerformance)
+	SystemOIDCSingleV1SessionTerminationEventType = setEventTypeFromFeature(feature.LevelSystem, feature.KeyOIDCSingleV1SessionTermination)
+	SystemDisableUserTokenEvent                   = setEventTypeFromFeature(feature.LevelSystem, feature.KeyDisableUserTokenEvent)
+	SystemEnableBackChannelLogout                 = setEventTypeFromFeature(feature.LevelSystem, feature.KeyEnableBackChannelLogout)
+	SystemLoginVersion                            = setEventTypeFromFeature(feature.LevelSystem, feature.KeyLoginV2)
+	SystemPermissionCheckV2                       = setEventTypeFromFeature(feature.LevelSystem, feature.KeyPermissionCheckV2)
+
+	InstanceResetEventType                          = resetEventTypeFromFeature(feature.LevelInstance)
+	InstanceLoginDefaultOrgEventType                = setEventTypeFromFeature(feature.LevelInstance, feature.KeyLoginDefaultOrg)
+	InstanceUserSchemaEventType                     = setEventTypeFromFeature(feature.LevelInstance, feature.KeyUserSchema)
+	InstanceTokenExchangeEventType                  = setEventTypeFromFeature(feature.LevelInstance, feature.KeyTokenExchange)
+	InstanceImprovedPerformanceEventType            = setEventTypeFromFeature(feature.LevelInstance, feature.KeyImprovedPerformance)
+	InstanceDebugOIDCParentErrorEventType           = setEventTypeFromFeature(feature.LevelInstance, feature.KeyDebugOIDCParentError)
+	InstanceOIDCSingleV1SessionTerminationEventType = setEventTypeFromFeature(feature.LevelInstance, feature.KeyOIDCSingleV1SessionTermination)
+	InstanceDisableUserTokenEvent                   = setEventTypeFromFeature(feature.LevelInstance, feature.KeyDisableUserTokenEvent)
+	InstanceEnableBackChannelLogout                 = setEventTypeFromFeature(feature.LevelInstance, feature.KeyEnableBackChannelLogout)
+	InstanceLoginVersion                            = setEventTypeFromFeature(feature.LevelInstance, feature.KeyLoginV2)
+	InstancePermissionCheckV2                       = setEventTypeFromFeature(feature.LevelInstance, feature.KeyPermissionCheckV2)
+	InstanceConsoleUseV2UserApi                     = setEventTypeFromFeature(feature.LevelInstance, feature.KeyConsoleUseV2UserApi)
+)
+
+const (
+	resetSuffix = "reset"
+	setSuffix   = "set"
+)
+
+func resetEventTypeFromFeature(level feature.Level) eventstore.EventType {
+	return eventstore.EventType(strings.Join([]string{AggregateType, level.String(), resetSuffix}, "."))
+}
+
+func setEventTypeFromFeature(level feature.Level, key feature.Key) eventstore.EventType {
+	return eventstore.EventType(strings.Join([]string{AggregateType, level.String(), key.String(), setSuffix}, "."))
+}
+
+type ResetEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+}
+
+func (e *ResetEvent) SetBaseEvent(b *eventstore.BaseEvent) {
+	e.BaseEvent = b
+}
+
+func (e *ResetEvent) Payload() interface{} {
+	return e
+}
+
+func (e *ResetEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewResetEvent(
+	ctx context.Context,
+	aggregate *Aggregate,
+	eventType eventstore.EventType,
+) *ResetEvent {
+	return &ResetEvent{
+		eventstore.NewBaseEventForPush(
+			ctx, &aggregate.Aggregate, eventType),
+	}
+}
+
+type SetEvent[T any] struct {
+	*eventstore.BaseEvent `json:"-"`
+
+	Value T
+}
+
+func (e *SetEvent[T]) SetBaseEvent(b *eventstore.BaseEvent) {
+	e.BaseEvent = b
+}
+
+func (e *SetEvent[T]) Payload() interface{} {
+	return e
+}
+
+func (e *SetEvent[T]) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+type FeatureJSON struct {
+	Key   feature.Key
+	Value []byte
+}
+
+// FeatureJSON prepares converts the event to a key-value pair with a JSON value payload.
+func (e *SetEvent[T]) FeatureJSON() (*FeatureJSON, error) {
+	_, key, err := e.FeatureInfo()
+	if err != nil {
+		return nil, err
+	}
+	jsonValue, err := json.Marshal(e.Value)
+	if err != nil {
+		return nil, zerrors.ThrowInternalf(err, "FEAT-go9Ji", "reduce.wrong.event.type %s", e.EventType)
+	}
+	return &FeatureJSON{
+		Key:   key,
+		Value: jsonValue,
+	}, nil
+}
+
+// FeatureInfo extracts a feature's level and key from the event.
+func (e *SetEvent[T]) FeatureInfo() (feature.Level, feature.Key, error) {
+	ss := strings.Split(string(e.EventType), ".")
+	if len(ss) != 4 {
+		return 0, 0, zerrors.ThrowInternalf(nil, "FEAT-Ahs4m", "reduce.wrong.event.type %s", e.EventType)
+	}
+	level, err := feature.LevelString(ss[1])
+	if err != nil {
+		return 0, 0, zerrors.ThrowInternalf(err, "FEAT-Boo2i", "reduce.wrong.event.type %s", e.EventType)
+	}
+	key, err := feature.KeyString(ss[2])
+	if err != nil {
+		return 0, 0, zerrors.ThrowInternalf(err, "FEAT-eir0M", "reduce.wrong.event.type %s", e.EventType)
+	}
+	return level, key, nil
+}
+
+func NewSetEvent[T any](
+	ctx context.Context,
+	aggregate *Aggregate,
+	eventType eventstore.EventType,
+	value T,
+) *SetEvent[T] {
+	return &SetEvent[T]{
+		eventstore.NewBaseEventForPush(
+			ctx, &aggregate.Aggregate, eventType),
+		value,
+	}
+}

apps/api/internal/repository/feature/feature_v2/feature_test.go

@@ -0,0 +1,118 @@
+package feature_v2
+
+import (
+	"math"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/feature"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+func TestSetEvent_FeatureJSON(t *testing.T) {
+	tests := []struct {
+		name    string
+		e       *SetEvent[float64] // using float so it's easy to create marshal errors
+		want    *FeatureJSON
+		wantErr error
+	}{
+		{
+			name: "invalid key error",
+			e: &SetEvent[float64]{
+				BaseEvent: &eventstore.BaseEvent{
+					EventType: "feature.system.foo_bar.some_feat",
+				},
+			},
+			wantErr: zerrors.ThrowInternalf(nil, "FEAT-eir0M", "reduce.wrong.event.type %s", "feature.system.foo_bar.some_feat"),
+		},
+		{
+			name: "marshal error",
+			e: &SetEvent[float64]{
+				BaseEvent: &eventstore.BaseEvent{
+					EventType: SystemLoginDefaultOrgEventType,
+				},
+				Value: math.NaN(),
+			},
+			wantErr: zerrors.ThrowInternalf(nil, "FEAT-go9Ji", "reduce.wrong.event.type %s", SystemLoginDefaultOrgEventType),
+		},
+		{
+			name: "success",
+			e: &SetEvent[float64]{
+				BaseEvent: &eventstore.BaseEvent{
+					EventType: SystemLoginDefaultOrgEventType,
+				},
+				Value: 555,
+			},
+			want: &FeatureJSON{
+				Key:   feature.KeyLoginDefaultOrg,
+				Value: []byte(`555`),
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := tt.e.FeatureJSON()
+			require.ErrorIs(t, err, tt.wantErr)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
+
+func TestSetEvent_FeatureInfo(t *testing.T) {
+	tests := []struct {
+		name    string
+		e       *SetEvent[bool]
+		want    feature.Level
+		want1   feature.Key
+		wantErr error
+	}{
+		{
+			name: "format error",
+			e: &SetEvent[bool]{
+				BaseEvent: &eventstore.BaseEvent{
+					EventType: "foo.bar",
+				},
+			},
+			wantErr: zerrors.ThrowInternalf(nil, "FEAT-Ahs4m", "reduce.wrong.event.type %s", "foo.bar"),
+		},
+		{
+			name: "level error",
+			e: &SetEvent[bool]{
+				BaseEvent: &eventstore.BaseEvent{
+					EventType: "feature.foo.bar.something",
+				},
+			},
+			wantErr: zerrors.ThrowInternalf(nil, "FEAT-Boo2i", "reduce.wrong.event.type %s", "feature.foo.bar.something"),
+		},
+		{
+			name: "key error",
+			e: &SetEvent[bool]{
+				BaseEvent: &eventstore.BaseEvent{
+					EventType: "feature.system.bar.something",
+				},
+			},
+			wantErr: zerrors.ThrowInternalf(nil, "FEAT-eir0M", "reduce.wrong.event.type %s", "feature.system.bar.something"),
+		},
+		{
+			name: "success",
+			e: &SetEvent[bool]{
+				BaseEvent: &eventstore.BaseEvent{
+					EventType: SystemLoginDefaultOrgEventType,
+				},
+			},
+			want:  feature.LevelSystem,
+			want1: feature.KeyLoginDefaultOrg,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, got1, err := tt.e.FeatureInfo()
+			require.ErrorIs(t, err, tt.wantErr)
+			assert.Equal(t, tt.want, got)
+			assert.Equal(t, tt.want1, got1)
+		})
+	}
+}

apps/api/internal/repository/flow/flow.go

@@ -0,0 +1,136 @@
+package flow
+
+import (
+	"github.com/zitadel/zitadel/internal/domain"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	eventTypePrefix                       = eventstore.EventType("flow.")
+	triggerActionsPrefix                  = eventTypePrefix + "trigger_actions."
+	TriggerActionsSetEventType            = triggerActionsPrefix + "set"
+	TriggerActionsCascadeRemovedEventType = triggerActionsPrefix + "cascade.removed"
+	FlowClearedEventType                  = eventTypePrefix + "cleared"
+)
+
+type TriggerActionsSetEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	FlowType    domain.FlowType    `json:"flowType"`
+	TriggerType domain.TriggerType `json:"triggerType"`
+	ActionIDs   []string           `json:"actionIDs"`
+}
+
+func (e *TriggerActionsSetEvent) Payload() interface{} {
+	return e
+}
+
+func (e *TriggerActionsSetEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewTriggerActionsSetEvent(
+	base *eventstore.BaseEvent,
+	flowType domain.FlowType,
+	triggerType domain.TriggerType,
+	actionIDs []string,
+) *TriggerActionsSetEvent {
+	return &TriggerActionsSetEvent{
+		BaseEvent:   *base,
+		FlowType:    flowType,
+		TriggerType: triggerType,
+		ActionIDs:   actionIDs,
+	}
+}
+
+func TriggerActionsSetEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &TriggerActionsSetEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "FLOW-4n8vs", "unable to unmarshal trigger actions")
+	}
+
+	return e, nil
+}
+
+type TriggerActionsCascadeRemovedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	FlowType    domain.FlowType    `json:"flowType"`
+	TriggerType domain.TriggerType `json:"triggerType"`
+	ActionID    string             `json:"actionID"`
+}
+
+func (e *TriggerActionsCascadeRemovedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *TriggerActionsCascadeRemovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewTriggerActionsCascadeRemovedEvent(
+	base *eventstore.BaseEvent,
+	flowType domain.FlowType,
+	actionID string,
+) *TriggerActionsCascadeRemovedEvent {
+	return &TriggerActionsCascadeRemovedEvent{
+		BaseEvent: *base,
+		FlowType:  flowType,
+		ActionID:  actionID,
+	}
+}
+
+func TriggerActionsCascadeRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &TriggerActionsCascadeRemovedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "FLOW-4n8vs", "unable to unmarshal trigger actions")
+	}
+
+	return e, nil
+}
+
+type FlowClearedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	FlowType domain.FlowType `json:"flowType"`
+}
+
+func (e *FlowClearedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *FlowClearedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewFlowClearedEvent(
+	base *eventstore.BaseEvent,
+	flowType domain.FlowType,
+) *FlowClearedEvent {
+	return &FlowClearedEvent{
+		BaseEvent: *base,
+		FlowType:  flowType,
+	}
+}
+
+func FlowClearedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &FlowClearedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "FLOW-BHfg2", "unable to unmarshal flow cleared")
+	}
+
+	return e, nil
+}

apps/api/internal/repository/idp/apple.go

@@ -0,0 +1,161 @@
+package idp
+
+import (
+	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+type AppleIDPAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID         string              `json:"id"`
+	Name       string              `json:"name,omitempty"`
+	ClientID   string              `json:"clientId"`
+	TeamID     string              `json:"teamId"`
+	KeyID      string              `json:"keyId"`
+	PrivateKey *crypto.CryptoValue `json:"privateKey"`
+	Scopes     []string            `json:"scopes,omitempty"`
+	Options
+}
+
+func NewAppleIDPAddedEvent(
+	base *eventstore.BaseEvent,
+	id,
+	name,
+	clientID,
+	teamID,
+	keyID string,
+	privateKey *crypto.CryptoValue,
+	scopes []string,
+	options Options,
+) *AppleIDPAddedEvent {
+	return &AppleIDPAddedEvent{
+		BaseEvent:  *base,
+		ID:         id,
+		Name:       name,
+		ClientID:   clientID,
+		TeamID:     teamID,
+		KeyID:      keyID,
+		PrivateKey: privateKey,
+		Scopes:     scopes,
+		Options:    options,
+	}
+}
+
+func (e *AppleIDPAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *AppleIDPAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func AppleIDPAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &AppleIDPAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-Beqss", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type AppleIDPChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID         string              `json:"id"`
+	Name       *string             `json:"name,omitempty"`
+	ClientID   *string             `json:"clientId,omitempty"`
+	TeamID     *string             `json:"teamId,omitempty"`
+	KeyID      *string             `json:"keyId,omitempty"`
+	PrivateKey *crypto.CryptoValue `json:"privateKey,omitempty"`
+	Scopes     []string            `json:"scopes,omitempty"`
+	OptionChanges
+}
+
+func NewAppleIDPChangedEvent(
+	base *eventstore.BaseEvent,
+	id string,
+	changes []AppleIDPChanges,
+) (*AppleIDPChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IDP-SF3h2", "Errors.NoChangesFound")
+	}
+	changedEvent := &AppleIDPChangedEvent{
+		BaseEvent: *base,
+		ID:        id,
+	}
+	for _, change := range changes {
+		change(changedEvent)
+	}
+	return changedEvent, nil
+}
+
+type AppleIDPChanges func(*AppleIDPChangedEvent)
+
+func ChangeAppleName(name string) func(*AppleIDPChangedEvent) {
+	return func(e *AppleIDPChangedEvent) {
+		e.Name = &name
+	}
+}
+
+func ChangeAppleClientID(clientID string) func(*AppleIDPChangedEvent) {
+	return func(e *AppleIDPChangedEvent) {
+		e.ClientID = &clientID
+	}
+}
+
+func ChangeAppleTeamID(teamID string) func(*AppleIDPChangedEvent) {
+	return func(e *AppleIDPChangedEvent) {
+		e.TeamID = &teamID
+	}
+}
+
+func ChangeAppleKeyID(keyID string) func(*AppleIDPChangedEvent) {
+	return func(e *AppleIDPChangedEvent) {
+		e.KeyID = &keyID
+	}
+}
+
+func ChangeApplePrivateKey(privateKey *crypto.CryptoValue) func(*AppleIDPChangedEvent) {
+	return func(e *AppleIDPChangedEvent) {
+		e.PrivateKey = privateKey
+	}
+}
+
+func ChangeAppleScopes(scopes []string) func(*AppleIDPChangedEvent) {
+	return func(e *AppleIDPChangedEvent) {
+		e.Scopes = scopes
+	}
+}
+
+func ChangeAppleOptions(options OptionChanges) func(*AppleIDPChangedEvent) {
+	return func(e *AppleIDPChangedEvent) {
+		e.OptionChanges = options
+	}
+}
+
+func (e *AppleIDPChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *AppleIDPChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func AppleIDPChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &AppleIDPChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-NBe1s", "unable to unmarshal event")
+	}
+
+	return e, nil
+}

apps/api/internal/repository/idp/azuread.go

@@ -0,0 +1,161 @@
+package idp
+
+import (
+	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+type AzureADIDPAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID              string              `json:"id"`
+	Name            string              `json:"name,omitempty"`
+	ClientID        string              `json:"client_id,omitempty"`
+	ClientSecret    *crypto.CryptoValue `json:"client_secret,omitempty"`
+	Scopes          []string            `json:"scopes,omitempty"`
+	Tenant          string              `json:"tenant,omitempty"`
+	IsEmailVerified bool                `json:"isEmailVerified,omitempty"`
+	Options
+}
+
+func NewAzureADIDPAddedEvent(
+	base *eventstore.BaseEvent,
+	id,
+	name,
+	clientID string,
+	clientSecret *crypto.CryptoValue,
+	scopes []string,
+	tenant string,
+	isEmailVerified bool,
+	options Options,
+) *AzureADIDPAddedEvent {
+	return &AzureADIDPAddedEvent{
+		BaseEvent:       *base,
+		ID:              id,
+		Name:            name,
+		ClientID:        clientID,
+		ClientSecret:    clientSecret,
+		Scopes:          scopes,
+		Tenant:          tenant,
+		IsEmailVerified: isEmailVerified,
+		Options:         options,
+	}
+}
+
+func (e *AzureADIDPAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *AzureADIDPAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func AzureADIDPAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &AzureADIDPAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-Grh2g", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type AzureADIDPChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID              string              `json:"id"`
+	Name            *string             `json:"name,omitempty"`
+	ClientID        *string             `json:"client_id,omitempty"`
+	ClientSecret    *crypto.CryptoValue `json:"client_secret,omitempty"`
+	Scopes          []string            `json:"scopes,omitempty"`
+	Tenant          *string             `json:"tenant,omitempty"`
+	IsEmailVerified *bool               `json:"isEmailVerified,omitempty"`
+	OptionChanges
+}
+
+func NewAzureADIDPChangedEvent(
+	base *eventstore.BaseEvent,
+	id string,
+	changes []AzureADIDPChanges,
+) (*AzureADIDPChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IDP-BH3dl", "Errors.NoChangesFound")
+	}
+	changedEvent := &AzureADIDPChangedEvent{
+		BaseEvent: *base,
+		ID:        id,
+	}
+	for _, change := range changes {
+		change(changedEvent)
+	}
+	return changedEvent, nil
+}
+
+type AzureADIDPChanges func(*AzureADIDPChangedEvent)
+
+func ChangeAzureADName(name string) func(*AzureADIDPChangedEvent) {
+	return func(e *AzureADIDPChangedEvent) {
+		e.Name = &name
+	}
+}
+
+func ChangeAzureADClientID(clientID string) func(*AzureADIDPChangedEvent) {
+	return func(e *AzureADIDPChangedEvent) {
+		e.ClientID = &clientID
+	}
+}
+
+func ChangeAzureADClientSecret(clientSecret *crypto.CryptoValue) func(*AzureADIDPChangedEvent) {
+	return func(e *AzureADIDPChangedEvent) {
+		e.ClientSecret = clientSecret
+	}
+}
+
+func ChangeAzureADOptions(options OptionChanges) func(*AzureADIDPChangedEvent) {
+	return func(e *AzureADIDPChangedEvent) {
+		e.OptionChanges = options
+	}
+}
+
+func ChangeAzureADScopes(scopes []string) func(*AzureADIDPChangedEvent) {
+	return func(e *AzureADIDPChangedEvent) {
+		e.Scopes = scopes
+	}
+}
+
+func ChangeAzureADTenant(tenant string) func(*AzureADIDPChangedEvent) {
+	return func(e *AzureADIDPChangedEvent) {
+		e.Tenant = &tenant
+	}
+}
+
+func ChangeAzureADIsEmailVerified(isEmailVerified bool) func(*AzureADIDPChangedEvent) {
+	return func(e *AzureADIDPChangedEvent) {
+		e.IsEmailVerified = &isEmailVerified
+	}
+}
+
+func (e *AzureADIDPChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *AzureADIDPChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func AzureADIDPChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &AzureADIDPChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-D3gjzh", "unable to unmarshal event")
+	}
+
+	return e, nil
+}

apps/api/internal/repository/idp/github.go

@@ -0,0 +1,303 @@
+package idp
+
+import (
+	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+type GitHubIDPAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID           string              `json:"id"`
+	Name         string              `json:"name,omitempty"`
+	ClientID     string              `json:"clientId,omitempty"`
+	ClientSecret *crypto.CryptoValue `json:"clientSecret,omitempty"`
+	Scopes       []string            `json:"scopes,omitempty"`
+	Options
+}
+
+func NewGitHubIDPAddedEvent(
+	base *eventstore.BaseEvent,
+	id,
+	name,
+	clientID string,
+	clientSecret *crypto.CryptoValue,
+	scopes []string,
+	options Options,
+) *GitHubIDPAddedEvent {
+	return &GitHubIDPAddedEvent{
+		BaseEvent:    *base,
+		ID:           id,
+		Name:         name,
+		ClientID:     clientID,
+		ClientSecret: clientSecret,
+		Scopes:       scopes,
+		Options:      options,
+	}
+}
+
+func (e *GitHubIDPAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *GitHubIDPAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func GitHubIDPAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &GitHubIDPAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-sdfs3", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type GitHubIDPChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID           string              `json:"id"`
+	Name         *string             `json:"name,omitempty"`
+	ClientID     *string             `json:"clientId,omitempty"`
+	ClientSecret *crypto.CryptoValue `json:"clientSecret,omitempty"`
+	Scopes       []string            `json:"scopes,omitempty"`
+	OptionChanges
+}
+
+func NewGitHubIDPChangedEvent(
+	base *eventstore.BaseEvent,
+	id string,
+	changes []GitHubIDPChanges,
+) (*GitHubIDPChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IDP-BH3dl", "Errors.NoChangesFound")
+	}
+	changedEvent := &GitHubIDPChangedEvent{
+		BaseEvent: *base,
+		ID:        id,
+	}
+	for _, change := range changes {
+		change(changedEvent)
+	}
+	return changedEvent, nil
+}
+
+type GitHubIDPChanges func(*GitHubIDPChangedEvent)
+
+func ChangeGitHubName(name string) func(*GitHubIDPChangedEvent) {
+	return func(e *GitHubIDPChangedEvent) {
+		e.Name = &name
+	}
+}
+func ChangeGitHubClientID(clientID string) func(*GitHubIDPChangedEvent) {
+	return func(e *GitHubIDPChangedEvent) {
+		e.ClientID = &clientID
+	}
+}
+
+func ChangeGitHubClientSecret(clientSecret *crypto.CryptoValue) func(*GitHubIDPChangedEvent) {
+	return func(e *GitHubIDPChangedEvent) {
+		e.ClientSecret = clientSecret
+	}
+}
+
+func ChangeGitHubOptions(options OptionChanges) func(*GitHubIDPChangedEvent) {
+	return func(e *GitHubIDPChangedEvent) {
+		e.OptionChanges = options
+	}
+}
+
+func ChangeGitHubScopes(scopes []string) func(*GitHubIDPChangedEvent) {
+	return func(e *GitHubIDPChangedEvent) {
+		e.Scopes = scopes
+	}
+}
+
+func (e *GitHubIDPChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *GitHubIDPChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func GitHubIDPChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &GitHubIDPChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-Sfrth", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type GitHubEnterpriseIDPAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID                    string              `json:"id"`
+	Name                  string              `json:"name,omitempty"`
+	ClientID              string              `json:"clientId,omitempty"`
+	ClientSecret          *crypto.CryptoValue `json:"clientSecret,omitempty"`
+	AuthorizationEndpoint string              `json:"authorizationEndpoint,omitempty"`
+	TokenEndpoint         string              `json:"tokenEndpoint,omitempty"`
+	UserEndpoint          string              `json:"userEndpoint,omitempty"`
+	Scopes                []string            `json:"scopes,omitempty"`
+	Options
+}
+
+func NewGitHubEnterpriseIDPAddedEvent(
+	base *eventstore.BaseEvent,
+	id,
+	name,
+	clientID string,
+	clientSecret *crypto.CryptoValue,
+	authorizationEndpoint,
+	tokenEndpoint,
+	userEndpoint string,
+	scopes []string,
+	options Options,
+) *GitHubEnterpriseIDPAddedEvent {
+	return &GitHubEnterpriseIDPAddedEvent{
+		*base,
+		id,
+		name,
+		clientID,
+		clientSecret,
+		authorizationEndpoint,
+		tokenEndpoint,
+		userEndpoint,
+		scopes,
+		options,
+	}
+}
+
+func (e *GitHubEnterpriseIDPAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *GitHubEnterpriseIDPAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func GitHubEnterpriseIDPAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &GitHubEnterpriseIDPAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-sdfs3", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type GitHubEnterpriseIDPChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID                    string              `json:"id"`
+	Name                  *string             `json:"name,omitempty"`
+	ClientID              *string             `json:"clientId,omitempty"`
+	ClientSecret          *crypto.CryptoValue `json:"clientSecret,omitempty"`
+	AuthorizationEndpoint *string             `json:"authorizationEndpoint,omitempty"`
+	TokenEndpoint         *string             `json:"tokenEndpoint,omitempty"`
+	UserEndpoint          *string             `json:"userEndpoint,omitempty"`
+	Scopes                []string            `json:"scopes,omitempty"`
+	OptionChanges
+}
+
+func NewGitHubEnterpriseIDPChangedEvent(
+	base *eventstore.BaseEvent,
+	id string,
+	changes []GitHubEnterpriseIDPChanges,
+) (*GitHubEnterpriseIDPChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IDP-JHKs9", "Errors.NoChangesFound")
+	}
+	changedEvent := &GitHubEnterpriseIDPChangedEvent{
+		BaseEvent: *base,
+		ID:        id,
+	}
+	for _, change := range changes {
+		change(changedEvent)
+	}
+	return changedEvent, nil
+}
+
+type GitHubEnterpriseIDPChanges func(*GitHubEnterpriseIDPChangedEvent)
+
+func ChangeGitHubEnterpriseName(name string) func(*GitHubEnterpriseIDPChangedEvent) {
+	return func(e *GitHubEnterpriseIDPChangedEvent) {
+		e.Name = &name
+	}
+}
+func ChangeGitHubEnterpriseClientID(clientID string) func(*GitHubEnterpriseIDPChangedEvent) {
+	return func(e *GitHubEnterpriseIDPChangedEvent) {
+		e.ClientID = &clientID
+	}
+}
+
+func ChangeGitHubEnterpriseClientSecret(clientSecret *crypto.CryptoValue) func(*GitHubEnterpriseIDPChangedEvent) {
+	return func(e *GitHubEnterpriseIDPChangedEvent) {
+		e.ClientSecret = clientSecret
+	}
+}
+
+func ChangeGitHubEnterpriseOptions(options OptionChanges) func(*GitHubEnterpriseIDPChangedEvent) {
+	return func(e *GitHubEnterpriseIDPChangedEvent) {
+		e.OptionChanges = options
+	}
+}
+
+func ChangeGitHubEnterpriseAuthorizationEndpoint(authorizationEndpoint string) func(*GitHubEnterpriseIDPChangedEvent) {
+	return func(e *GitHubEnterpriseIDPChangedEvent) {
+		e.AuthorizationEndpoint = &authorizationEndpoint
+	}
+}
+
+func ChangeGitHubEnterpriseTokenEndpoint(tokenEndpoint string) func(*GitHubEnterpriseIDPChangedEvent) {
+	return func(e *GitHubEnterpriseIDPChangedEvent) {
+		e.TokenEndpoint = &tokenEndpoint
+	}
+}
+
+func ChangeGitHubEnterpriseUserEndpoint(userEndpoint string) func(*GitHubEnterpriseIDPChangedEvent) {
+	return func(e *GitHubEnterpriseIDPChangedEvent) {
+		e.UserEndpoint = &userEndpoint
+	}
+}
+
+func ChangeGitHubEnterpriseScopes(scopes []string) func(*GitHubEnterpriseIDPChangedEvent) {
+	return func(e *GitHubEnterpriseIDPChangedEvent) {
+		e.Scopes = scopes
+	}
+}
+
+func (e *GitHubEnterpriseIDPChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *GitHubEnterpriseIDPChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func GitHubEnterpriseIDPChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &GitHubEnterpriseIDPChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-ASf3r", "unable to unmarshal event")
+	}
+
+	return e, nil
+}

apps/api/internal/repository/idp/gitlab.go

@@ -0,0 +1,285 @@
+package idp
+
+import (
+	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+type GitLabIDPAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID           string              `json:"id"`
+	Name         string              `json:"name,omitempty"`
+	ClientID     string              `json:"client_id"`
+	ClientSecret *crypto.CryptoValue `json:"client_secret"`
+	Scopes       []string            `json:"scopes,omitempty"`
+	Options
+}
+
+func NewGitLabIDPAddedEvent(
+	base *eventstore.BaseEvent,
+	id,
+	name,
+	clientID string,
+	clientSecret *crypto.CryptoValue,
+	scopes []string,
+	options Options,
+) *GitLabIDPAddedEvent {
+	return &GitLabIDPAddedEvent{
+		BaseEvent:    *base,
+		ID:           id,
+		Name:         name,
+		ClientID:     clientID,
+		ClientSecret: clientSecret,
+		Scopes:       scopes,
+		Options:      options,
+	}
+}
+
+func (e *GitLabIDPAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *GitLabIDPAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func GitLabIDPAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &GitLabIDPAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-KLewio", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type GitLabIDPChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID           string              `json:"id"`
+	Name         *string             `json:"name,omitempty"`
+	ClientID     *string             `json:"client_id,omitempty"`
+	ClientSecret *crypto.CryptoValue `json:"client_secret,omitempty"`
+	Scopes       []string            `json:"scopes,omitempty"`
+	OptionChanges
+}
+
+func NewGitLabIDPChangedEvent(
+	base *eventstore.BaseEvent,
+	id string,
+	changes []GitLabIDPChanges,
+) (*GitLabIDPChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IDP-K2gje", "Errors.NoChangesFound")
+	}
+	changedEvent := &GitLabIDPChangedEvent{
+		BaseEvent: *base,
+		ID:        id,
+	}
+	for _, change := range changes {
+		change(changedEvent)
+	}
+	return changedEvent, nil
+}
+
+type GitLabIDPChanges func(*GitLabIDPChangedEvent)
+
+func ChangeGitLabName(name string) func(*GitLabIDPChangedEvent) {
+	return func(e *GitLabIDPChangedEvent) {
+		e.Name = &name
+	}
+}
+
+func ChangeGitLabClientID(clientID string) func(*GitLabIDPChangedEvent) {
+	return func(e *GitLabIDPChangedEvent) {
+		e.ClientID = &clientID
+	}
+}
+
+func ChangeGitLabClientSecret(clientSecret *crypto.CryptoValue) func(*GitLabIDPChangedEvent) {
+	return func(e *GitLabIDPChangedEvent) {
+		e.ClientSecret = clientSecret
+	}
+}
+
+func ChangeGitLabScopes(scopes []string) func(*GitLabIDPChangedEvent) {
+	return func(e *GitLabIDPChangedEvent) {
+		e.Scopes = scopes
+	}
+}
+
+func ChangeGitLabOptions(options OptionChanges) func(*GitLabIDPChangedEvent) {
+	return func(e *GitLabIDPChangedEvent) {
+		e.OptionChanges = options
+	}
+}
+
+func (e *GitLabIDPChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *GitLabIDPChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func GitLabIDPChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &GitLabIDPChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-Sfhjk", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type GitLabSelfHostedIDPAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID           string              `json:"id"`
+	Name         string              `json:"name"`
+	Issuer       string              `json:"issuer"`
+	ClientID     string              `json:"client_id"`
+	ClientSecret *crypto.CryptoValue `json:"client_secret"`
+	Scopes       []string            `json:"scopes,omitempty"`
+	Options
+}
+
+func NewGitLabSelfHostedIDPAddedEvent(
+	base *eventstore.BaseEvent,
+	id,
+	name,
+	issuer,
+	clientID string,
+	clientSecret *crypto.CryptoValue,
+	scopes []string,
+	options Options,
+) *GitLabSelfHostedIDPAddedEvent {
+	return &GitLabSelfHostedIDPAddedEvent{
+		BaseEvent:    *base,
+		ID:           id,
+		Name:         name,
+		Issuer:       issuer,
+		ClientID:     clientID,
+		ClientSecret: clientSecret,
+		Scopes:       scopes,
+		Options:      options,
+	}
+}
+
+func (e *GitLabSelfHostedIDPAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *GitLabSelfHostedIDPAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func GitLabSelfHostedIDPAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &GitLabSelfHostedIDPAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-S1efv", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type GitLabSelfHostedIDPChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID           string              `json:"id"`
+	Name         *string             `json:"name,omitempty"`
+	Issuer       *string             `json:"issuer,omitempty"`
+	ClientID     *string             `json:"client_id,omitempty"`
+	ClientSecret *crypto.CryptoValue `json:"client_secret,omitempty"`
+	Scopes       []string            `json:"scopes,omitempty"`
+	OptionChanges
+}
+
+func NewGitLabSelfHostedIDPChangedEvent(
+	base *eventstore.BaseEvent,
+	id string,
+	changes []GitLabSelfHostedIDPChanges,
+) (*GitLabSelfHostedIDPChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IDP-Dghj6", "Errors.NoChangesFound")
+	}
+	changedEvent := &GitLabSelfHostedIDPChangedEvent{
+		BaseEvent: *base,
+		ID:        id,
+	}
+	for _, change := range changes {
+		change(changedEvent)
+	}
+	return changedEvent, nil
+}
+
+type GitLabSelfHostedIDPChanges func(*GitLabSelfHostedIDPChangedEvent)
+
+func ChangeGitLabSelfHostedName(name string) func(*GitLabSelfHostedIDPChangedEvent) {
+	return func(e *GitLabSelfHostedIDPChangedEvent) {
+		e.Name = &name
+	}
+}
+
+func ChangeGitLabSelfHostedIssuer(issuer string) func(*GitLabSelfHostedIDPChangedEvent) {
+	return func(e *GitLabSelfHostedIDPChangedEvent) {
+		e.Issuer = &issuer
+	}
+}
+
+func ChangeGitLabSelfHostedClientID(clientID string) func(*GitLabSelfHostedIDPChangedEvent) {
+	return func(e *GitLabSelfHostedIDPChangedEvent) {
+		e.ClientID = &clientID
+	}
+}
+
+func ChangeGitLabSelfHostedClientSecret(clientSecret *crypto.CryptoValue) func(*GitLabSelfHostedIDPChangedEvent) {
+	return func(e *GitLabSelfHostedIDPChangedEvent) {
+		e.ClientSecret = clientSecret
+	}
+}
+
+func ChangeGitLabSelfHostedScopes(scopes []string) func(*GitLabSelfHostedIDPChangedEvent) {
+	return func(e *GitLabSelfHostedIDPChangedEvent) {
+		e.Scopes = scopes
+	}
+}
+
+func ChangeGitLabSelfHostedOptions(options OptionChanges) func(*GitLabSelfHostedIDPChangedEvent) {
+	return func(e *GitLabSelfHostedIDPChangedEvent) {
+		e.OptionChanges = options
+	}
+}
+
+func (e *GitLabSelfHostedIDPChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *GitLabSelfHostedIDPChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func GitLabSelfHostedIDPChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &GitLabSelfHostedIDPChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-SFrhj", "unable to unmarshal event")
+	}
+
+	return e, nil
+}

apps/api/internal/repository/idp/google.go

@@ -0,0 +1,140 @@
+package idp
+
+import (
+	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+type GoogleIDPAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID           string              `json:"id"`
+	Name         string              `json:"name,omitempty"`
+	ClientID     string              `json:"clientId"`
+	ClientSecret *crypto.CryptoValue `json:"clientSecret"`
+	Scopes       []string            `json:"scopes,omitempty"`
+	Options
+}
+
+func NewGoogleIDPAddedEvent(
+	base *eventstore.BaseEvent,
+	id,
+	name,
+	clientID string,
+	clientSecret *crypto.CryptoValue,
+	scopes []string,
+	options Options,
+) *GoogleIDPAddedEvent {
+	return &GoogleIDPAddedEvent{
+		BaseEvent:    *base,
+		ID:           id,
+		Name:         name,
+		ClientID:     clientID,
+		ClientSecret: clientSecret,
+		Scopes:       scopes,
+		Options:      options,
+	}
+}
+
+func (e *GoogleIDPAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *GoogleIDPAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func GoogleIDPAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &GoogleIDPAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-SAff1", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type GoogleIDPChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID           string              `json:"id"`
+	Name         *string             `json:"name,omitempty"`
+	ClientID     *string             `json:"clientId,omitempty"`
+	ClientSecret *crypto.CryptoValue `json:"clientSecret,omitempty"`
+	Scopes       []string            `json:"scopes,omitempty"`
+	OptionChanges
+}
+
+func NewGoogleIDPChangedEvent(
+	base *eventstore.BaseEvent,
+	id string,
+	changes []GoogleIDPChanges,
+) (*GoogleIDPChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IDP-Dg3qs", "Errors.NoChangesFound")
+	}
+	changedEvent := &GoogleIDPChangedEvent{
+		BaseEvent: *base,
+		ID:        id,
+	}
+	for _, change := range changes {
+		change(changedEvent)
+	}
+	return changedEvent, nil
+}
+
+type GoogleIDPChanges func(*GoogleIDPChangedEvent)
+
+func ChangeGoogleName(name string) func(*GoogleIDPChangedEvent) {
+	return func(e *GoogleIDPChangedEvent) {
+		e.Name = &name
+	}
+}
+func ChangeGoogleClientID(clientID string) func(*GoogleIDPChangedEvent) {
+	return func(e *GoogleIDPChangedEvent) {
+		e.ClientID = &clientID
+	}
+}
+
+func ChangeGoogleClientSecret(clientSecret *crypto.CryptoValue) func(*GoogleIDPChangedEvent) {
+	return func(e *GoogleIDPChangedEvent) {
+		e.ClientSecret = clientSecret
+	}
+}
+
+func ChangeGoogleScopes(scopes []string) func(*GoogleIDPChangedEvent) {
+	return func(e *GoogleIDPChangedEvent) {
+		e.Scopes = scopes
+	}
+}
+
+func ChangeGoogleOptions(options OptionChanges) func(*GoogleIDPChangedEvent) {
+	return func(e *GoogleIDPChangedEvent) {
+		e.OptionChanges = options
+	}
+}
+
+func (e *GoogleIDPChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *GoogleIDPChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func GoogleIDPChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &GoogleIDPChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-SF3t2", "unable to unmarshal event")
+	}
+
+	return e, nil
+}

apps/api/internal/repository/idp/idp.go

@@ -0,0 +1,102 @@
+package idp
+
+import (
+	"github.com/zitadel/zitadel/internal/domain"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+type Options struct {
+	IsCreationAllowed bool                     `json:"isCreationAllowed,omitempty"`
+	IsLinkingAllowed  bool                     `json:"isLinkingAllowed,omitempty"`
+	IsAutoCreation    bool                     `json:"isAutoCreation,omitempty"`
+	IsAutoUpdate      bool                     `json:"isAutoUpdate,omitempty"`
+	AutoLinkingOption domain.AutoLinkingOption `json:"autoLinkingOption,omitempty"`
+}
+
+type OptionChanges struct {
+	IsCreationAllowed *bool                     `json:"isCreationAllowed,omitempty"`
+	IsLinkingAllowed  *bool                     `json:"isLinkingAllowed,omitempty"`
+	IsAutoCreation    *bool                     `json:"isAutoCreation,omitempty"`
+	IsAutoUpdate      *bool                     `json:"isAutoUpdate,omitempty"`
+	AutoLinkingOption *domain.AutoLinkingOption `json:"autoLinkingOption,omitempty"`
+}
+
+func (o *Options) Changes(options Options) OptionChanges {
+	opts := OptionChanges{}
+	if o.IsCreationAllowed != options.IsCreationAllowed {
+		opts.IsCreationAllowed = &options.IsCreationAllowed
+	}
+	if o.IsLinkingAllowed != options.IsLinkingAllowed {
+		opts.IsLinkingAllowed = &options.IsLinkingAllowed
+	}
+	if o.IsAutoCreation != options.IsAutoCreation {
+		opts.IsAutoCreation = &options.IsAutoCreation
+	}
+	if o.IsAutoUpdate != options.IsAutoUpdate {
+		opts.IsAutoUpdate = &options.IsAutoUpdate
+	}
+	if o.AutoLinkingOption != options.AutoLinkingOption {
+		opts.AutoLinkingOption = &options.AutoLinkingOption
+	}
+	return opts
+}
+
+func (o *Options) ReduceChanges(changes OptionChanges) {
+	if changes.IsCreationAllowed != nil {
+		o.IsCreationAllowed = *changes.IsCreationAllowed
+	}
+	if changes.IsLinkingAllowed != nil {
+		o.IsLinkingAllowed = *changes.IsLinkingAllowed
+	}
+	if changes.IsAutoCreation != nil {
+		o.IsAutoCreation = *changes.IsAutoCreation
+	}
+	if changes.IsAutoUpdate != nil {
+		o.IsAutoUpdate = *changes.IsAutoUpdate
+	}
+	if changes.AutoLinkingOption != nil {
+		o.AutoLinkingOption = *changes.AutoLinkingOption
+	}
+}
+
+func (o *OptionChanges) IsZero() bool {
+	return o.IsCreationAllowed == nil && o.IsLinkingAllowed == nil && o.IsAutoCreation == nil && o.IsAutoUpdate == nil && o.AutoLinkingOption == nil
+}
+
+type RemovedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID string `json:"id"`
+}
+
+func NewRemovedEvent(
+	base *eventstore.BaseEvent,
+	id string,
+) *RemovedEvent {
+	return &RemovedEvent{
+		BaseEvent: *base,
+		ID:        id,
+	}
+}
+
+func (e *RemovedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *RemovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func RemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &RemovedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-plSD2", "unable to unmarshal event")
+	}
+
+	return e, nil
+}

apps/api/internal/repository/idp/jwt.go

@@ -0,0 +1,150 @@
+package idp
+
+import (
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+type JWTIDPAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID           string `json:"id"`
+	Name         string `json:"name,omitempty"`
+	Issuer       string `json:"issuer,omitempty"`
+	JWTEndpoint  string `json:"jwtEndpoint,omitempty"`
+	KeysEndpoint string `json:"keysEndpoint,omitempty"`
+	HeaderName   string `json:"headerName,omitempty"`
+	Options
+}
+
+func NewJWTIDPAddedEvent(
+	base *eventstore.BaseEvent,
+	id,
+	name,
+	issuer,
+	jwtEndpoint,
+	keysEndpoint,
+	headerName string,
+	options Options,
+) *JWTIDPAddedEvent {
+	return &JWTIDPAddedEvent{
+		BaseEvent:    *base,
+		ID:           id,
+		Name:         name,
+		Issuer:       issuer,
+		JWTEndpoint:  jwtEndpoint,
+		KeysEndpoint: keysEndpoint,
+		HeaderName:   headerName,
+		Options:      options,
+	}
+}
+
+func (e *JWTIDPAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *JWTIDPAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func JWTIDPAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &JWTIDPAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-Et1dq", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type JWTIDPChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID           string  `json:"id"`
+	Name         *string `json:"name,omitempty"`
+	Issuer       *string `json:"issuer,omitempty"`
+	JWTEndpoint  *string `json:"jwtEndpoint,omitempty"`
+	KeysEndpoint *string `json:"keysEndpoint,omitempty"`
+	HeaderName   *string `json:"headerName,omitempty"`
+	OptionChanges
+}
+
+func NewJWTIDPChangedEvent(
+	base *eventstore.BaseEvent,
+	id string,
+	changes []JWTIDPChanges,
+) (*JWTIDPChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IDP-BH3dl", "Errors.NoChangesFound")
+	}
+	changedEvent := &JWTIDPChangedEvent{
+		BaseEvent: *base,
+		ID:        id,
+	}
+	for _, change := range changes {
+		change(changedEvent)
+	}
+	return changedEvent, nil
+}
+
+type JWTIDPChanges func(*JWTIDPChangedEvent)
+
+func ChangeJWTName(name string) func(*JWTIDPChangedEvent) {
+	return func(e *JWTIDPChangedEvent) {
+		e.Name = &name
+	}
+}
+
+func ChangeJWTIssuer(issuer string) func(*JWTIDPChangedEvent) {
+	return func(e *JWTIDPChangedEvent) {
+		e.Issuer = &issuer
+	}
+}
+
+func ChangeJWTEndpoint(jwtEndpoint string) func(*JWTIDPChangedEvent) {
+	return func(e *JWTIDPChangedEvent) {
+		e.JWTEndpoint = &jwtEndpoint
+	}
+}
+
+func ChangeJWTKeysEndpoint(keysEndpoint string) func(*JWTIDPChangedEvent) {
+	return func(e *JWTIDPChangedEvent) {
+		e.KeysEndpoint = &keysEndpoint
+	}
+}
+
+func ChangeJWTHeaderName(headerName string) func(*JWTIDPChangedEvent) {
+	return func(e *JWTIDPChangedEvent) {
+		e.HeaderName = &headerName
+	}
+}
+
+func ChangeJWTOptions(options OptionChanges) func(*JWTIDPChangedEvent) {
+	return func(e *JWTIDPChangedEvent) {
+		e.OptionChanges = options
+	}
+}
+
+func (e *JWTIDPChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *JWTIDPChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func JWTIDPChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &JWTIDPChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-D3gjzh", "unable to unmarshal event")
+	}
+
+	return e, nil
+}

apps/api/internal/repository/idp/ldap.go

@@ -0,0 +1,359 @@
+package idp
+
+import (
+	"time"
+
+	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+type LDAPIDPAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID                string              `json:"id"`
+	Name              string              `json:"name"`
+	Servers           []string            `json:"servers"`
+	StartTLS          bool                `json:"startTLS"`
+	BaseDN            string              `json:"baseDN"`
+	BindDN            string              `json:"bindDN"`
+	BindPassword      *crypto.CryptoValue `json:"bindPassword"`
+	UserBase          string              `json:"userBase"`
+	UserObjectClasses []string            `json:"userObjectClasses"`
+	UserFilters       []string            `json:"userFilters"`
+	Timeout           time.Duration       `json:"timeout"`
+	RootCA            []byte              `json:"rootCA"`
+
+	LDAPAttributes
+	Options
+}
+
+type LDAPAttributes struct {
+	IDAttribute                string `json:"idAttribute,omitempty"`
+	FirstNameAttribute         string `json:"firstNameAttribute,omitempty"`
+	LastNameAttribute          string `json:"lastNameAttribute,omitempty"`
+	DisplayNameAttribute       string `json:"displayNameAttribute,omitempty"`
+	NickNameAttribute          string `json:"nickNameAttribute,omitempty"`
+	PreferredUsernameAttribute string `json:"preferredUsernameAttribute,omitempty"`
+	EmailAttribute             string `json:"emailAttribute,omitempty"`
+	EmailVerifiedAttribute     string `json:"emailVerifiedAttribute,omitempty"`
+	PhoneAttribute             string `json:"phoneAttribute,omitempty"`
+	PhoneVerifiedAttribute     string `json:"phoneVerifiedAttribute,omitempty"`
+	PreferredLanguageAttribute string `json:"preferredLanguageAttribute,omitempty"`
+	AvatarURLAttribute         string `json:"avatarURLAttribute,omitempty"`
+	ProfileAttribute           string `json:"profileAttribute,omitempty"`
+}
+
+func (o *LDAPAttributes) Changes(attributes LDAPAttributes) LDAPAttributeChanges {
+	attrs := LDAPAttributeChanges{}
+	if o.IDAttribute != attributes.IDAttribute {
+		attrs.IDAttribute = &attributes.IDAttribute
+	}
+	if o.FirstNameAttribute != attributes.FirstNameAttribute {
+		attrs.FirstNameAttribute = &attributes.FirstNameAttribute
+	}
+	if o.LastNameAttribute != attributes.LastNameAttribute {
+		attrs.LastNameAttribute = &attributes.LastNameAttribute
+	}
+	if o.DisplayNameAttribute != attributes.DisplayNameAttribute {
+		attrs.DisplayNameAttribute = &attributes.DisplayNameAttribute
+	}
+	if o.NickNameAttribute != attributes.NickNameAttribute {
+		attrs.NickNameAttribute = &attributes.NickNameAttribute
+	}
+	if o.PreferredUsernameAttribute != attributes.PreferredUsernameAttribute {
+		attrs.PreferredUsernameAttribute = &attributes.PreferredUsernameAttribute
+	}
+	if o.EmailAttribute != attributes.EmailAttribute {
+		attrs.EmailAttribute = &attributes.EmailAttribute
+	}
+	if o.EmailVerifiedAttribute != attributes.EmailVerifiedAttribute {
+		attrs.EmailVerifiedAttribute = &attributes.EmailVerifiedAttribute
+	}
+	if o.PhoneAttribute != attributes.PhoneAttribute {
+		attrs.PhoneAttribute = &attributes.PhoneAttribute
+	}
+	if o.PhoneVerifiedAttribute != attributes.PhoneVerifiedAttribute {
+		attrs.PhoneVerifiedAttribute = &attributes.PhoneVerifiedAttribute
+	}
+	if o.PreferredLanguageAttribute != attributes.PreferredLanguageAttribute {
+		attrs.PreferredLanguageAttribute = &attributes.PreferredLanguageAttribute
+	}
+	if o.AvatarURLAttribute != attributes.AvatarURLAttribute {
+		attrs.AvatarURLAttribute = &attributes.AvatarURLAttribute
+	}
+	if o.ProfileAttribute != attributes.ProfileAttribute {
+		attrs.ProfileAttribute = &attributes.ProfileAttribute
+	}
+	return attrs
+}
+
+func (o *LDAPAttributes) ReduceChanges(changes LDAPAttributeChanges) {
+	if changes.IDAttribute != nil {
+		o.IDAttribute = *changes.IDAttribute
+	}
+	if changes.FirstNameAttribute != nil {
+		o.FirstNameAttribute = *changes.FirstNameAttribute
+	}
+	if changes.LastNameAttribute != nil {
+		o.LastNameAttribute = *changes.LastNameAttribute
+	}
+	if changes.DisplayNameAttribute != nil {
+		o.DisplayNameAttribute = *changes.DisplayNameAttribute
+	}
+	if changes.NickNameAttribute != nil {
+		o.NickNameAttribute = *changes.NickNameAttribute
+	}
+	if changes.PreferredUsernameAttribute != nil {
+		o.PreferredUsernameAttribute = *changes.PreferredUsernameAttribute
+	}
+	if changes.EmailAttribute != nil {
+		o.EmailAttribute = *changes.EmailAttribute
+	}
+	if changes.EmailVerifiedAttribute != nil {
+		o.EmailVerifiedAttribute = *changes.EmailVerifiedAttribute
+	}
+	if changes.PhoneAttribute != nil {
+		o.PhoneAttribute = *changes.PhoneAttribute
+	}
+	if changes.PhoneVerifiedAttribute != nil {
+		o.PhoneVerifiedAttribute = *changes.PhoneVerifiedAttribute
+	}
+	if changes.PreferredLanguageAttribute != nil {
+		o.PreferredLanguageAttribute = *changes.PreferredLanguageAttribute
+	}
+	if changes.AvatarURLAttribute != nil {
+		o.AvatarURLAttribute = *changes.AvatarURLAttribute
+	}
+	if changes.ProfileAttribute != nil {
+		o.ProfileAttribute = *changes.ProfileAttribute
+	}
+}
+
+func NewLDAPIDPAddedEvent(
+	base *eventstore.BaseEvent,
+	id string,
+	name string,
+	servers []string,
+	startTLS bool,
+	baseDN string,
+	bindDN string,
+	bindPassword *crypto.CryptoValue,
+	userBase string,
+	userObjectClasses []string,
+	userFilters []string,
+	timeout time.Duration,
+	rootCA []byte,
+	attributes LDAPAttributes,
+	options Options,
+) *LDAPIDPAddedEvent {
+	return &LDAPIDPAddedEvent{
+		BaseEvent:         *base,
+		ID:                id,
+		Name:              name,
+		Servers:           servers,
+		StartTLS:          startTLS,
+		BaseDN:            baseDN,
+		BindDN:            bindDN,
+		BindPassword:      bindPassword,
+		UserBase:          userBase,
+		UserObjectClasses: userObjectClasses,
+		UserFilters:       userFilters,
+		Timeout:           timeout,
+		RootCA:            rootCA,
+		LDAPAttributes:    attributes,
+		Options:           options,
+	}
+}
+
+func (e *LDAPIDPAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *LDAPIDPAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func LDAPIDPAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &LDAPIDPAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-Dgh42", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type LDAPIDPChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID                string              `json:"id"`
+	Name              *string             `json:"name,omitempty"`
+	Servers           []string            `json:"servers,omitempty"`
+	StartTLS          *bool               `json:"startTLS,omitempty"`
+	BaseDN            *string             `json:"baseDN,omitempty"`
+	BindDN            *string             `json:"bindDN,omitempty"`
+	BindPassword      *crypto.CryptoValue `json:"bindPassword,omitempty"`
+	UserBase          *string             `json:"userBase,omitempty"`
+	UserObjectClasses []string            `json:"userObjectClasses,omitempty"`
+	UserFilters       []string            `json:"userFilters,omitempty"`
+	Timeout           *time.Duration      `json:"timeout,omitempty"`
+	RootCA            []byte              `json:"rootCA,omitempty"`
+
+	LDAPAttributeChanges
+	OptionChanges
+}
+
+type LDAPAttributeChanges struct {
+	IDAttribute                *string `json:"idAttribute,omitempty"`
+	FirstNameAttribute         *string `json:"firstNameAttribute,omitempty"`
+	LastNameAttribute          *string `json:"lastNameAttribute,omitempty"`
+	DisplayNameAttribute       *string `json:"displayNameAttribute,omitempty"`
+	NickNameAttribute          *string `json:"nickNameAttribute,omitempty"`
+	PreferredUsernameAttribute *string `json:"preferredUsernameAttribute,omitempty"`
+	EmailAttribute             *string `json:"emailAttribute,omitempty"`
+	EmailVerifiedAttribute     *string `json:"emailVerifiedAttribute,omitempty"`
+	PhoneAttribute             *string `json:"phoneAttribute,omitempty"`
+	PhoneVerifiedAttribute     *string `json:"phoneVerifiedAttribute,omitempty"`
+	PreferredLanguageAttribute *string `json:"preferredLanguageAttribute,omitempty"`
+	AvatarURLAttribute         *string `json:"avatarURLAttribute,omitempty"`
+	ProfileAttribute           *string `json:"profileAttribute,omitempty"`
+}
+
+func (o LDAPAttributeChanges) IsZero() bool {
+	return o.IDAttribute == nil &&
+		o.FirstNameAttribute == nil &&
+		o.LastNameAttribute == nil &&
+		o.DisplayNameAttribute == nil &&
+		o.NickNameAttribute == nil &&
+		o.PreferredUsernameAttribute == nil &&
+		o.EmailAttribute == nil &&
+		o.EmailVerifiedAttribute == nil &&
+		o.PhoneAttribute == nil &&
+		o.PhoneVerifiedAttribute == nil &&
+		o.PreferredLanguageAttribute == nil &&
+		o.AvatarURLAttribute == nil &&
+		o.ProfileAttribute == nil
+}
+
+func NewLDAPIDPChangedEvent(
+	base *eventstore.BaseEvent,
+	id string,
+	changes []LDAPIDPChanges,
+) (*LDAPIDPChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IDP-SDf3f", "Errors.NoChangesFound")
+	}
+	changedEvent := &LDAPIDPChangedEvent{
+		BaseEvent: *base,
+		ID:        id,
+	}
+	for _, change := range changes {
+		change(changedEvent)
+	}
+	return changedEvent, nil
+}
+
+type LDAPIDPChanges func(*LDAPIDPChangedEvent)
+
+func ChangeLDAPName(name string) func(*LDAPIDPChangedEvent) {
+	return func(e *LDAPIDPChangedEvent) {
+		e.Name = &name
+	}
+}
+
+func ChangeLDAPServers(servers []string) func(*LDAPIDPChangedEvent) {
+	return func(e *LDAPIDPChangedEvent) {
+		e.Servers = servers
+	}
+}
+
+func ChangeLDAPStartTLS(startTls bool) func(*LDAPIDPChangedEvent) {
+	return func(e *LDAPIDPChangedEvent) {
+		e.StartTLS = &startTls
+	}
+}
+
+func ChangeLDAPBaseDN(baseDN string) func(*LDAPIDPChangedEvent) {
+	return func(e *LDAPIDPChangedEvent) {
+		e.BaseDN = &baseDN
+	}
+}
+
+func ChangeLDAPBindDN(bindDN string) func(*LDAPIDPChangedEvent) {
+	return func(e *LDAPIDPChangedEvent) {
+		e.BindDN = &bindDN
+	}
+}
+
+func ChangeLDAPBindPassword(password *crypto.CryptoValue) func(*LDAPIDPChangedEvent) {
+	return func(e *LDAPIDPChangedEvent) {
+		e.BindPassword = password
+	}
+}
+
+func ChangeLDAPUserBase(userBase string) func(*LDAPIDPChangedEvent) {
+	return func(e *LDAPIDPChangedEvent) {
+		e.UserBase = &userBase
+	}
+}
+
+func ChangeLDAPUserObjectClasses(objectClasses []string) func(*LDAPIDPChangedEvent) {
+	return func(e *LDAPIDPChangedEvent) {
+		e.UserObjectClasses = objectClasses
+	}
+}
+
+func ChangeLDAPUserFilters(userFilters []string) func(*LDAPIDPChangedEvent) {
+	return func(e *LDAPIDPChangedEvent) {
+		e.UserFilters = userFilters
+	}
+}
+
+func ChangeLDAPTimeout(timeout time.Duration) func(*LDAPIDPChangedEvent) {
+	return func(e *LDAPIDPChangedEvent) {
+		e.Timeout = &timeout
+	}
+}
+
+func ChangeLDAPRootCA(rootCA []byte) func(*LDAPIDPChangedEvent) {
+	return func(e *LDAPIDPChangedEvent) {
+		e.RootCA = rootCA
+	}
+}
+
+func ChangeLDAPAttributes(attributes LDAPAttributeChanges) func(*LDAPIDPChangedEvent) {
+	return func(e *LDAPIDPChangedEvent) {
+		e.LDAPAttributeChanges = attributes
+	}
+}
+
+func ChangeLDAPOptions(options OptionChanges) func(*LDAPIDPChangedEvent) {
+	return func(e *LDAPIDPChangedEvent) {
+		e.OptionChanges = options
+	}
+}
+
+func (e *LDAPIDPChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *LDAPIDPChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func LDAPIDPChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &LDAPIDPChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-Sfth3", "unable to unmarshal event")
+	}
+
+	return e, nil
+}

apps/api/internal/repository/idp/oauth.go

@@ -0,0 +1,190 @@
+package idp
+
+import (
+	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+type OAuthIDPAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID                    string              `json:"id"`
+	Name                  string              `json:"name,omitempty"`
+	ClientID              string              `json:"clientId,omitempty"`
+	ClientSecret          *crypto.CryptoValue `json:"clientSecret,omitempty"`
+	AuthorizationEndpoint string              `json:"authorizationEndpoint,omitempty"`
+	TokenEndpoint         string              `json:"tokenEndpoint,omitempty"`
+	UserEndpoint          string              `json:"userEndpoint,omitempty"`
+	Scopes                []string            `json:"scopes,omitempty"`
+	IDAttribute           string              `json:"idAttribute,omitempty"`
+	UsePKCE               bool                `json:"usePKCE,omitempty"`
+	Options
+}
+
+func NewOAuthIDPAddedEvent(
+	base *eventstore.BaseEvent,
+	id,
+	name,
+	clientID string,
+	clientSecret *crypto.CryptoValue,
+	authorizationEndpoint,
+	tokenEndpoint,
+	userEndpoint,
+	idAttribute string,
+	scopes []string,
+	usePKCE bool,
+	options Options,
+) *OAuthIDPAddedEvent {
+	return &OAuthIDPAddedEvent{
+		BaseEvent:             *base,
+		ID:                    id,
+		Name:                  name,
+		ClientID:              clientID,
+		ClientSecret:          clientSecret,
+		AuthorizationEndpoint: authorizationEndpoint,
+		TokenEndpoint:         tokenEndpoint,
+		UserEndpoint:          userEndpoint,
+		Scopes:                scopes,
+		IDAttribute:           idAttribute,
+		UsePKCE:               usePKCE,
+		Options:               options,
+	}
+}
+
+func (e *OAuthIDPAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *OAuthIDPAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func OAuthIDPAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &OAuthIDPAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-Et1dq", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type OAuthIDPChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID                    string              `json:"id"`
+	Name                  *string             `json:"name,omitempty"`
+	ClientID              *string             `json:"clientId,omitempty"`
+	ClientSecret          *crypto.CryptoValue `json:"clientSecret,omitempty"`
+	AuthorizationEndpoint *string             `json:"authorizationEndpoint,omitempty"`
+	TokenEndpoint         *string             `json:"tokenEndpoint,omitempty"`
+	UserEndpoint          *string             `json:"userEndpoint,omitempty"`
+	Scopes                []string            `json:"scopes,omitempty"`
+	IDAttribute           *string             `json:"idAttribute,omitempty"`
+	UsePKCE               *bool               `json:"usePKCE,omitempty"`
+	OptionChanges
+}
+
+func NewOAuthIDPChangedEvent(
+	base *eventstore.BaseEvent,
+	id string,
+	changes []OAuthIDPChanges,
+) (*OAuthIDPChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IDP-BH3dl", "Errors.NoChangesFound")
+	}
+	changedEvent := &OAuthIDPChangedEvent{
+		BaseEvent: *base,
+		ID:        id,
+	}
+	for _, change := range changes {
+		change(changedEvent)
+	}
+	return changedEvent, nil
+}
+
+type OAuthIDPChanges func(*OAuthIDPChangedEvent)
+
+func ChangeOAuthName(name string) func(*OAuthIDPChangedEvent) {
+	return func(e *OAuthIDPChangedEvent) {
+		e.Name = &name
+	}
+}
+func ChangeOAuthClientID(clientID string) func(*OAuthIDPChangedEvent) {
+	return func(e *OAuthIDPChangedEvent) {
+		e.ClientID = &clientID
+	}
+}
+
+func ChangeOAuthClientSecret(clientSecret *crypto.CryptoValue) func(*OAuthIDPChangedEvent) {
+	return func(e *OAuthIDPChangedEvent) {
+		e.ClientSecret = clientSecret
+	}
+}
+
+func ChangeOAuthOptions(options OptionChanges) func(*OAuthIDPChangedEvent) {
+	return func(e *OAuthIDPChangedEvent) {
+		e.OptionChanges = options
+	}
+}
+
+func ChangeOAuthAuthorizationEndpoint(authorizationEndpoint string) func(*OAuthIDPChangedEvent) {
+	return func(e *OAuthIDPChangedEvent) {
+		e.AuthorizationEndpoint = &authorizationEndpoint
+	}
+}
+
+func ChangeOAuthTokenEndpoint(tokenEndpoint string) func(*OAuthIDPChangedEvent) {
+	return func(e *OAuthIDPChangedEvent) {
+		e.TokenEndpoint = &tokenEndpoint
+	}
+}
+
+func ChangeOAuthUserEndpoint(userEndpoint string) func(*OAuthIDPChangedEvent) {
+	return func(e *OAuthIDPChangedEvent) {
+		e.UserEndpoint = &userEndpoint
+	}
+}
+
+func ChangeOAuthScopes(scopes []string) func(*OAuthIDPChangedEvent) {
+	return func(e *OAuthIDPChangedEvent) {
+		e.Scopes = scopes
+	}
+}
+
+func ChangeOAuthIDAttribute(idAttribute string) func(*OAuthIDPChangedEvent) {
+	return func(e *OAuthIDPChangedEvent) {
+		e.IDAttribute = &idAttribute
+	}
+}
+
+func ChangeOAuthUsePKCE(usePKCE bool) func(*OAuthIDPChangedEvent) {
+	return func(e *OAuthIDPChangedEvent) {
+		e.UsePKCE = &usePKCE
+	}
+}
+
+func (e *OAuthIDPChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *OAuthIDPChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func OAuthIDPChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &OAuthIDPChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-SAf3gw", "unable to unmarshal event")
+	}
+
+	return e, nil
+}

apps/api/internal/repository/idp/oidc.go

@@ -0,0 +1,260 @@
+package idp
+
+import (
+	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+type OIDCIDPAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID               string              `json:"id"`
+	Name             string              `json:"name"`
+	Issuer           string              `json:"issuer"`
+	ClientID         string              `json:"clientId"`
+	ClientSecret     *crypto.CryptoValue `json:"clientSecret"`
+	Scopes           []string            `json:"scopes,omitempty"`
+	IsIDTokenMapping bool                `json:"idTokenMapping,omitempty"`
+	UsePKCE          bool                `json:"usePKCE,omitempty"`
+	Options
+}
+
+func NewOIDCIDPAddedEvent(
+	base *eventstore.BaseEvent,
+	id,
+	name,
+	issuer,
+	clientID string,
+	clientSecret *crypto.CryptoValue,
+	scopes []string,
+	isIDTokenMapping, usePKCE bool,
+	options Options,
+) *OIDCIDPAddedEvent {
+	return &OIDCIDPAddedEvent{
+		BaseEvent:        *base,
+		ID:               id,
+		Name:             name,
+		Issuer:           issuer,
+		ClientID:         clientID,
+		ClientSecret:     clientSecret,
+		Scopes:           scopes,
+		IsIDTokenMapping: isIDTokenMapping,
+		UsePKCE:          usePKCE,
+		Options:          options,
+	}
+}
+
+func (e *OIDCIDPAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *OIDCIDPAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func OIDCIDPAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &OIDCIDPAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-Et1dq", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type OIDCIDPChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID               string              `json:"id"`
+	Name             *string             `json:"name,omitempty"`
+	Issuer           *string             `json:"issuer,omitempty"`
+	ClientID         *string             `json:"clientId,omitempty"`
+	ClientSecret     *crypto.CryptoValue `json:"clientSecret,omitempty"`
+	Scopes           []string            `json:"scopes,omitempty"`
+	IsIDTokenMapping *bool               `json:"idTokenMapping,omitempty"`
+	UsePKCE          *bool               `json:"usePKCE,omitempty"`
+	OptionChanges
+}
+
+func NewOIDCIDPChangedEvent(
+	base *eventstore.BaseEvent,
+	id string,
+	changes []OIDCIDPChanges,
+) (*OIDCIDPChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IDP-BH3dl", "Errors.NoChangesFound")
+	}
+	changedEvent := &OIDCIDPChangedEvent{
+		BaseEvent: *base,
+		ID:        id,
+	}
+	for _, change := range changes {
+		change(changedEvent)
+	}
+	return changedEvent, nil
+}
+
+type OIDCIDPChanges func(*OIDCIDPChangedEvent)
+
+func ChangeOIDCName(name string) func(*OIDCIDPChangedEvent) {
+	return func(e *OIDCIDPChangedEvent) {
+		e.Name = &name
+	}
+}
+
+func ChangeOIDCIssuer(issuer string) func(*OIDCIDPChangedEvent) {
+	return func(e *OIDCIDPChangedEvent) {
+		e.Issuer = &issuer
+	}
+}
+
+func ChangeOIDCClientID(clientID string) func(*OIDCIDPChangedEvent) {
+	return func(e *OIDCIDPChangedEvent) {
+		e.ClientID = &clientID
+	}
+}
+
+func ChangeOIDCClientSecret(clientSecret *crypto.CryptoValue) func(*OIDCIDPChangedEvent) {
+	return func(e *OIDCIDPChangedEvent) {
+		e.ClientSecret = clientSecret
+	}
+}
+
+func ChangeOIDCOptions(options OptionChanges) func(*OIDCIDPChangedEvent) {
+	return func(e *OIDCIDPChangedEvent) {
+		e.OptionChanges = options
+	}
+}
+
+func ChangeOIDCScopes(scopes []string) func(*OIDCIDPChangedEvent) {
+	return func(e *OIDCIDPChangedEvent) {
+		e.Scopes = scopes
+	}
+}
+
+func ChangeOIDCIsIDTokenMapping(idTokenMapping bool) func(*OIDCIDPChangedEvent) {
+	return func(e *OIDCIDPChangedEvent) {
+		e.IsIDTokenMapping = &idTokenMapping
+	}
+}
+
+func ChangeOIDCUsePKCE(usePKCE bool) func(*OIDCIDPChangedEvent) {
+	return func(e *OIDCIDPChangedEvent) {
+		e.UsePKCE = &usePKCE
+	}
+}
+
+func (e *OIDCIDPChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *OIDCIDPChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func OIDCIDPChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &OIDCIDPChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-D3gjzh", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type OIDCIDPMigratedAzureADEvent struct {
+	AzureADIDPAddedEvent
+}
+
+func NewOIDCIDPMigratedAzureADEvent(
+	base *eventstore.BaseEvent,
+	id,
+	name,
+	clientID string,
+	clientSecret *crypto.CryptoValue,
+	scopes []string,
+	tenant string,
+	isEmailVerified bool,
+	options Options,
+) *OIDCIDPMigratedAzureADEvent {
+	return &OIDCIDPMigratedAzureADEvent{
+		AzureADIDPAddedEvent: AzureADIDPAddedEvent{
+			BaseEvent:       *base,
+			ID:              id,
+			Name:            name,
+			ClientID:        clientID,
+			ClientSecret:    clientSecret,
+			Scopes:          scopes,
+			Tenant:          tenant,
+			IsEmailVerified: isEmailVerified,
+			Options:         options,
+		},
+	}
+}
+
+func (e *OIDCIDPMigratedAzureADEvent) Data() interface{} {
+	return e
+}
+
+func (e *OIDCIDPMigratedAzureADEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func OIDCIDPMigratedAzureADEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := AzureADIDPAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &OIDCIDPMigratedAzureADEvent{AzureADIDPAddedEvent: *e.(*AzureADIDPAddedEvent)}, nil
+}
+
+type OIDCIDPMigratedGoogleEvent struct {
+	GoogleIDPAddedEvent
+}
+
+func NewOIDCIDPMigratedGoogleEvent(
+	base *eventstore.BaseEvent,
+	id,
+	name,
+	clientID string,
+	clientSecret *crypto.CryptoValue,
+	scopes []string,
+	options Options,
+) *OIDCIDPMigratedGoogleEvent {
+	return &OIDCIDPMigratedGoogleEvent{
+		GoogleIDPAddedEvent: GoogleIDPAddedEvent{
+			BaseEvent:    *base,
+			ID:           id,
+			Name:         name,
+			ClientID:     clientID,
+			ClientSecret: clientSecret,
+			Scopes:       scopes,
+			Options:      options,
+		},
+	}
+}
+
+func (e *OIDCIDPMigratedGoogleEvent) Data() interface{} {
+	return e
+}
+
+func (e *OIDCIDPMigratedGoogleEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func OIDCIDPMigratedGoogleEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := GoogleIDPAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &OIDCIDPMigratedGoogleEvent{GoogleIDPAddedEvent: *e.(*GoogleIDPAddedEvent)}, nil
+}

apps/api/internal/repository/idp/saml.go

@@ -0,0 +1,192 @@
+package idp
+
+import (
+	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/domain"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+type SAMLIDPAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID                            string                   `json:"id"`
+	Name                          string                   `json:"name,omitempty"`
+	Metadata                      []byte                   `json:"metadata,omitempty"`
+	Key                           *crypto.CryptoValue      `json:"key,omitempty"`
+	Certificate                   []byte                   `json:"certificate,omitempty"`
+	Binding                       string                   `json:"binding,omitempty"`
+	WithSignedRequest             bool                     `json:"withSignedRequest,omitempty"`
+	NameIDFormat                  *domain.SAMLNameIDFormat `json:"nameIDFormat,omitempty"`
+	TransientMappingAttributeName string                   `json:"transientMappingAttributeName,omitempty"`
+	FederatedLogoutEnabled        bool                     `json:"federatedLogoutEnabled,omitempty"`
+	Options
+}
+
+func NewSAMLIDPAddedEvent(
+	base *eventstore.BaseEvent,
+	id,
+	name string,
+	metadata []byte,
+	key *crypto.CryptoValue,
+	certificate []byte,
+	binding string,
+	withSignedRequest bool,
+	nameIDFormat *domain.SAMLNameIDFormat,
+	transientMappingAttributeName string,
+	federatedLogoutEnabled bool,
+	options Options,
+) *SAMLIDPAddedEvent {
+	return &SAMLIDPAddedEvent{
+		BaseEvent:                     *base,
+		ID:                            id,
+		Name:                          name,
+		Metadata:                      metadata,
+		Key:                           key,
+		Certificate:                   certificate,
+		Binding:                       binding,
+		WithSignedRequest:             withSignedRequest,
+		NameIDFormat:                  nameIDFormat,
+		TransientMappingAttributeName: transientMappingAttributeName,
+		FederatedLogoutEnabled:        federatedLogoutEnabled,
+		Options:                       options,
+	}
+}
+
+func (e *SAMLIDPAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SAMLIDPAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func SAMLIDPAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &SAMLIDPAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-v9uajo3k71", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type SAMLIDPChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID                            string                   `json:"id"`
+	Name                          *string                  `json:"name,omitempty"`
+	Metadata                      []byte                   `json:"metadata,omitempty"`
+	Key                           *crypto.CryptoValue      `json:"key,omitempty"`
+	Certificate                   []byte                   `json:"certificate,omitempty"`
+	Binding                       *string                  `json:"binding,omitempty"`
+	WithSignedRequest             *bool                    `json:"withSignedRequest,omitempty"`
+	NameIDFormat                  *domain.SAMLNameIDFormat `json:"nameIDFormat,omitempty"`
+	TransientMappingAttributeName *string                  `json:"transientMappingAttributeName,omitempty"`
+	FederatedLogoutEnabled        *bool                    `json:"federatedLogoutEnabled,omitempty"`
+	OptionChanges
+}
+
+func NewSAMLIDPChangedEvent(
+	base *eventstore.BaseEvent,
+	id string,
+	changes []SAMLIDPChanges,
+) (*SAMLIDPChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IDP-cz6mnf860t", "Errors.NoChangesFound")
+	}
+	changedEvent := &SAMLIDPChangedEvent{
+		BaseEvent: *base,
+		ID:        id,
+	}
+	for _, change := range changes {
+		change(changedEvent)
+	}
+	return changedEvent, nil
+}
+
+type SAMLIDPChanges func(*SAMLIDPChangedEvent)
+
+func ChangeSAMLName(name string) func(*SAMLIDPChangedEvent) {
+	return func(e *SAMLIDPChangedEvent) {
+		e.Name = &name
+	}
+}
+
+func ChangeSAMLMetadata(metadata []byte) func(*SAMLIDPChangedEvent) {
+	return func(e *SAMLIDPChangedEvent) {
+		e.Metadata = metadata
+	}
+}
+
+func ChangeSAMLKey(key *crypto.CryptoValue) func(*SAMLIDPChangedEvent) {
+	return func(e *SAMLIDPChangedEvent) {
+		e.Key = key
+	}
+}
+
+func ChangeSAMLCertificate(certificate []byte) func(*SAMLIDPChangedEvent) {
+	return func(e *SAMLIDPChangedEvent) {
+		e.Certificate = certificate
+	}
+}
+
+func ChangeSAMLBinding(binding string) func(*SAMLIDPChangedEvent) {
+	return func(e *SAMLIDPChangedEvent) {
+		e.Binding = &binding
+	}
+}
+
+func ChangeSAMLWithSignedRequest(withSignedRequest bool) func(*SAMLIDPChangedEvent) {
+	return func(e *SAMLIDPChangedEvent) {
+		e.WithSignedRequest = &withSignedRequest
+	}
+}
+
+func ChangeSAMLNameIDFormat(nameIDFormat *domain.SAMLNameIDFormat) func(*SAMLIDPChangedEvent) {
+	return func(e *SAMLIDPChangedEvent) {
+		e.NameIDFormat = nameIDFormat
+	}
+}
+
+func ChangeSAMLTransientMappingAttributeName(name string) func(*SAMLIDPChangedEvent) {
+	return func(e *SAMLIDPChangedEvent) {
+		e.TransientMappingAttributeName = &name
+	}
+}
+
+func ChangeSAMLFederatedLogoutEnabled(federatedLogoutEnabled bool) func(*SAMLIDPChangedEvent) {
+	return func(e *SAMLIDPChangedEvent) {
+		e.FederatedLogoutEnabled = &federatedLogoutEnabled
+	}
+}
+
+func ChangeSAMLOptions(options OptionChanges) func(*SAMLIDPChangedEvent) {
+	return func(e *SAMLIDPChangedEvent) {
+		e.OptionChanges = options
+	}
+}
+
+func (e *SAMLIDPChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SAMLIDPChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func SAMLIDPChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &SAMLIDPChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-w1t1824tw5", "unable to unmarshal event")
+	}
+
+	return e, nil
+}

apps/api/internal/repository/idpconfig/idp_config.go

@@ -0,0 +1,267 @@
+package idpconfig
+
+import (
+	"github.com/zitadel/zitadel/internal/domain"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	UniqueIDPConfigNameType = "idp_config_names"
+)
+
+func NewAddIDPConfigNameUniqueConstraint(idpConfigName, resourceOwner string) *eventstore.UniqueConstraint {
+	return eventstore.NewAddEventUniqueConstraint(
+		UniqueIDPConfigNameType,
+		idpConfigName+resourceOwner,
+		"Errors.IDPConfig.AlreadyExists")
+}
+
+func NewRemoveIDPConfigNameUniqueConstraint(idpConfigName, resourceOwner string) *eventstore.UniqueConstraint {
+	return eventstore.NewRemoveUniqueConstraint(
+		UniqueIDPConfigNameType,
+		idpConfigName+resourceOwner)
+}
+
+type IDPConfigAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ConfigID     string                      `json:"idpConfigId"`
+	Name         string                      `json:"name,omitempty"`
+	Typ          domain.IDPConfigType        `json:"idpType,omitempty"`
+	StylingType  domain.IDPConfigStylingType `json:"stylingType,omitempty"`
+	AutoRegister bool                        `json:"autoRegister,omitempty"`
+}
+
+func NewIDPConfigAddedEvent(
+	base *eventstore.BaseEvent,
+	configID,
+	name string,
+	configType domain.IDPConfigType,
+	stylingType domain.IDPConfigStylingType,
+	autoRegister bool,
+) *IDPConfigAddedEvent {
+	return &IDPConfigAddedEvent{
+		BaseEvent:    *base,
+		ConfigID:     configID,
+		Name:         name,
+		StylingType:  stylingType,
+		Typ:          configType,
+		AutoRegister: autoRegister,
+	}
+}
+
+func (e *IDPConfigAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *IDPConfigAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return []*eventstore.UniqueConstraint{NewAddIDPConfigNameUniqueConstraint(e.Name, e.Aggregate().ResourceOwner)}
+}
+
+func IDPConfigAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &IDPConfigAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "OIDC-plaBZ", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type IDPConfigChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ConfigID     string                       `json:"idpConfigId"`
+	Name         *string                      `json:"name,omitempty"`
+	StylingType  *domain.IDPConfigStylingType `json:"stylingType,omitempty"`
+	AutoRegister *bool                        `json:"autoRegister,omitempty"`
+	oldName      string                       `json:"-"`
+}
+
+func (e *IDPConfigChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *IDPConfigChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	if e.oldName == "" {
+		return nil
+	}
+	return []*eventstore.UniqueConstraint{
+		NewRemoveIDPConfigNameUniqueConstraint(e.oldName, e.Aggregate().ResourceOwner),
+		NewAddIDPConfigNameUniqueConstraint(*e.Name, e.Aggregate().ResourceOwner),
+	}
+}
+
+func NewIDPConfigChangedEvent(
+	base *eventstore.BaseEvent,
+	configID,
+	oldName string,
+	changes []IDPConfigChanges,
+) (*IDPConfigChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IDPCONFIG-Dsg21", "Errors.NoChangesFound")
+	}
+	changeEvent := &IDPConfigChangedEvent{
+		BaseEvent: *base,
+		ConfigID:  configID,
+		oldName:   oldName,
+	}
+	for _, change := range changes {
+		change(changeEvent)
+	}
+	return changeEvent, nil
+}
+
+type IDPConfigChanges func(*IDPConfigChangedEvent)
+
+func ChangeName(name string) func(*IDPConfigChangedEvent) {
+	return func(e *IDPConfigChangedEvent) {
+		e.Name = &name
+	}
+}
+
+func ChangeStyleType(styleType domain.IDPConfigStylingType) func(*IDPConfigChangedEvent) {
+	return func(e *IDPConfigChangedEvent) {
+		e.StylingType = &styleType
+	}
+}
+
+func ChangeAutoRegister(autoRegister bool) func(*IDPConfigChangedEvent) {
+	return func(e *IDPConfigChangedEvent) {
+		e.AutoRegister = &autoRegister
+	}
+}
+
+func IDPConfigChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &IDPConfigChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "OIDC-plaBZ", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type IDPConfigDeactivatedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ConfigID string `json:"idpConfigId"`
+}
+
+func NewIDPConfigDeactivatedEvent(
+	base *eventstore.BaseEvent,
+	configID string,
+) *IDPConfigDeactivatedEvent {
+
+	return &IDPConfigDeactivatedEvent{
+		BaseEvent: *base,
+		ConfigID:  configID,
+	}
+}
+
+func (e *IDPConfigDeactivatedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *IDPConfigDeactivatedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func IDPConfigDeactivatedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &IDPConfigDeactivatedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "OIDC-plaBZ", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type IDPConfigReactivatedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ConfigID string `json:"idpConfigId"`
+}
+
+func NewIDPConfigReactivatedEvent(
+	base *eventstore.BaseEvent,
+	configID string,
+) *IDPConfigReactivatedEvent {
+
+	return &IDPConfigReactivatedEvent{
+		BaseEvent: *base,
+		ConfigID:  configID,
+	}
+}
+
+func (e *IDPConfigReactivatedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *IDPConfigReactivatedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func IDPConfigReactivatedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &IDPConfigReactivatedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "OIDC-plaBZ", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type IDPConfigRemovedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ConfigID string `json:"idpConfigId"`
+	name     string
+}
+
+func NewIDPConfigRemovedEvent(
+	base *eventstore.BaseEvent,
+	configID string,
+	name string,
+) *IDPConfigRemovedEvent {
+
+	return &IDPConfigRemovedEvent{
+		BaseEvent: *base,
+		ConfigID:  configID,
+		name:      name,
+	}
+}
+
+func (e *IDPConfigRemovedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *IDPConfigRemovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return []*eventstore.UniqueConstraint{NewRemoveIDPConfigNameUniqueConstraint(e.name, e.Aggregate().ResourceOwner)}
+}
+
+func IDPConfigRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &IDPConfigRemovedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "OIDC-plaBZ", "unable to unmarshal event")
+	}
+
+	return e, nil
+}

apps/api/internal/repository/idpconfig/jwt_config.go

@@ -0,0 +1,136 @@
+package idpconfig
+
+import (
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	JWTConfigAddedEventType   eventstore.EventType = "jwt.config.added"
+	JWTConfigChangedEventType eventstore.EventType = "jwt.config.changed"
+)
+
+type JWTConfigAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	IDPConfigID  string `json:"idpConfigId"`
+	JWTEndpoint  string `json:"jwtEndpoint,omitempty"`
+	Issuer       string `json:"issuer,omitempty"`
+	KeysEndpoint string `json:"keysEndpoint,omitempty"`
+	HeaderName   string `json:"headerName,omitempty"`
+}
+
+func (e *JWTConfigAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *JWTConfigAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewJWTConfigAddedEvent(
+	base *eventstore.BaseEvent,
+	idpConfigID,
+	jwtEndpoint,
+	issuer,
+	keysEndpoint,
+	headerName string,
+) *JWTConfigAddedEvent {
+	return &JWTConfigAddedEvent{
+		BaseEvent:    *base,
+		IDPConfigID:  idpConfigID,
+		JWTEndpoint:  jwtEndpoint,
+		Issuer:       issuer,
+		KeysEndpoint: keysEndpoint,
+		HeaderName:   headerName,
+	}
+}
+
+func JWTConfigAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &JWTConfigAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "JWT-m0fwf", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type JWTConfigChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	IDPConfigID string `json:"idpConfigId"`
+
+	JWTEndpoint  *string `json:"jwtEndpoint,omitempty"`
+	Issuer       *string `json:"issuer,omitempty"`
+	KeysEndpoint *string `json:"keysEndpoint,omitempty"`
+	HeaderName   *string `json:"headerName,omitempty"`
+}
+
+func (e *JWTConfigChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *JWTConfigChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewJWTConfigChangedEvent(
+	base *eventstore.BaseEvent,
+	idpConfigID string,
+	changes []JWTConfigChanges,
+) (*JWTConfigChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IDPCONFIG-fn93s", "Errors.NoChangesFound")
+	}
+	changeEvent := &JWTConfigChangedEvent{
+		BaseEvent:   *base,
+		IDPConfigID: idpConfigID,
+	}
+	for _, change := range changes {
+		change(changeEvent)
+	}
+	return changeEvent, nil
+}
+
+type JWTConfigChanges func(*JWTConfigChangedEvent)
+
+func ChangeJWTEndpoint(jwtEndpoint string) func(*JWTConfigChangedEvent) {
+	return func(e *JWTConfigChangedEvent) {
+		e.JWTEndpoint = &jwtEndpoint
+	}
+}
+
+func ChangeJWTIssuer(issuer string) func(*JWTConfigChangedEvent) {
+	return func(e *JWTConfigChangedEvent) {
+		e.Issuer = &issuer
+	}
+}
+
+func ChangeKeysEndpoint(keysEndpoint string) func(*JWTConfigChangedEvent) {
+	return func(e *JWTConfigChangedEvent) {
+		e.KeysEndpoint = &keysEndpoint
+	}
+}
+
+func ChangeHeaderName(headerName string) func(*JWTConfigChangedEvent) {
+	return func(e *JWTConfigChangedEvent) {
+		e.HeaderName = &headerName
+	}
+}
+
+func JWTConfigChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &JWTConfigChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "JWT-fk3fs", "unable to unmarshal event")
+	}
+
+	return e, nil
+}

apps/api/internal/repository/idpconfig/oidc_config.go

@@ -0,0 +1,181 @@
+package idpconfig
+
+import (
+	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/domain"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	OIDCConfigAddedEventType   eventstore.EventType = "oidc.config.added"
+	OIDCConfigChangedEventType eventstore.EventType = "oidc.config.changed"
+)
+
+type OIDCConfigAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	IDPConfigID           string              `json:"idpConfigId"`
+	ClientID              string              `json:"clientId,omitempty"`
+	ClientSecret          *crypto.CryptoValue `json:"clientSecret,omitempty"`
+	Issuer                string              `json:"issuer,omitempty"`
+	AuthorizationEndpoint string              `json:"authorizationEndpoint,omitempty"`
+	TokenEndpoint         string              `json:"tokenEndpoint,omitempty"`
+	Scopes                []string            `json:"scopes,omitempty"`
+
+	IDPDisplayNameMapping domain.OIDCMappingField `json:"idpDisplayNameMapping,omitempty"`
+	UserNameMapping       domain.OIDCMappingField `json:"usernameMapping,omitempty"`
+}
+
+func (e *OIDCConfigAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *OIDCConfigAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewOIDCConfigAddedEvent(
+	base *eventstore.BaseEvent,
+	clientID,
+	idpConfigID,
+	issuer,
+	authorizationEndpoint,
+	tokenEndpoint string,
+	clientSecret *crypto.CryptoValue,
+	idpDisplayNameMapping,
+	userNameMapping domain.OIDCMappingField,
+	scopes ...string,
+) *OIDCConfigAddedEvent {
+
+	return &OIDCConfigAddedEvent{
+		BaseEvent:             *base,
+		IDPConfigID:           idpConfigID,
+		ClientID:              clientID,
+		ClientSecret:          clientSecret,
+		Issuer:                issuer,
+		AuthorizationEndpoint: authorizationEndpoint,
+		TokenEndpoint:         tokenEndpoint,
+		Scopes:                scopes,
+		IDPDisplayNameMapping: idpDisplayNameMapping,
+		UserNameMapping:       userNameMapping,
+	}
+}
+
+func OIDCConfigAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &OIDCConfigAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "OIDC-plaBZ", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type OIDCConfigChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	IDPConfigID string `json:"idpConfigId"`
+
+	ClientID              *string             `json:"clientId,omitempty"`
+	ClientSecret          *crypto.CryptoValue `json:"clientSecret,omitempty"`
+	Issuer                *string             `json:"issuer,omitempty"`
+	AuthorizationEndpoint *string             `json:"authorizationEndpoint,omitempty"`
+	TokenEndpoint         *string             `json:"tokenEndpoint,omitempty"`
+	Scopes                []string            `json:"scopes,omitempty"`
+
+	IDPDisplayNameMapping *domain.OIDCMappingField `json:"idpDisplayNameMapping,omitempty"`
+	UserNameMapping       *domain.OIDCMappingField `json:"usernameMapping,omitempty"`
+}
+
+func (e *OIDCConfigChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *OIDCConfigChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewOIDCConfigChangedEvent(
+	base *eventstore.BaseEvent,
+	idpConfigID string,
+	changes []OIDCConfigChanges,
+) (*OIDCConfigChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IDPCONFIG-ADzr5", "Errors.NoChangesFound")
+	}
+	changeEvent := &OIDCConfigChangedEvent{
+		BaseEvent:   *base,
+		IDPConfigID: idpConfigID,
+	}
+	for _, change := range changes {
+		change(changeEvent)
+	}
+	return changeEvent, nil
+}
+
+type OIDCConfigChanges func(*OIDCConfigChangedEvent)
+
+func ChangeClientID(clientID string) func(*OIDCConfigChangedEvent) {
+	return func(e *OIDCConfigChangedEvent) {
+		e.ClientID = &clientID
+	}
+}
+
+func ChangeClientSecret(secret *crypto.CryptoValue) func(*OIDCConfigChangedEvent) {
+	return func(e *OIDCConfigChangedEvent) {
+		e.ClientSecret = secret
+	}
+}
+
+func ChangeIssuer(issuer string) func(*OIDCConfigChangedEvent) {
+	return func(e *OIDCConfigChangedEvent) {
+		e.Issuer = &issuer
+	}
+}
+
+func ChangeAuthorizationEndpoint(authorizationEndpoint string) func(*OIDCConfigChangedEvent) {
+	return func(e *OIDCConfigChangedEvent) {
+		e.AuthorizationEndpoint = &authorizationEndpoint
+	}
+}
+
+func ChangeTokenEndpoint(tokenEndpoint string) func(*OIDCConfigChangedEvent) {
+	return func(e *OIDCConfigChangedEvent) {
+		e.TokenEndpoint = &tokenEndpoint
+	}
+}
+
+func ChangeIDPDisplayNameMapping(idpDisplayNameMapping domain.OIDCMappingField) func(*OIDCConfigChangedEvent) {
+	return func(e *OIDCConfigChangedEvent) {
+		e.IDPDisplayNameMapping = &idpDisplayNameMapping
+	}
+}
+
+func ChangeUserNameMapping(userNameMapping domain.OIDCMappingField) func(*OIDCConfigChangedEvent) {
+	return func(e *OIDCConfigChangedEvent) {
+		e.UserNameMapping = &userNameMapping
+	}
+}
+
+func ChangeScopes(scopes []string) func(*OIDCConfigChangedEvent) {
+	return func(e *OIDCConfigChangedEvent) {
+		e.Scopes = scopes
+	}
+}
+
+func OIDCConfigChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &OIDCConfigChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "OIDC-plaBZ", "unable to unmarshal event")
+	}
+
+	return e, nil
+}

apps/api/internal/repository/idpintent/aggregate.go

@@ -0,0 +1,29 @@
+package idpintent
+
+import (
+	"github.com/zitadel/zitadel/internal/eventstore"
+)
+
+const (
+	instanceEventTypePrefix = eventstore.EventType("idpintent.")
+)
+
+const (
+	AggregateType    = "idpintent"
+	AggregateVersion = "v1"
+)
+
+type Aggregate struct {
+	eventstore.Aggregate
+}
+
+func NewAggregate(id, resourceOwner string) *Aggregate {
+	return &Aggregate{
+		Aggregate: eventstore.Aggregate{
+			Type:          AggregateType,
+			Version:       AggregateVersion,
+			ID:            id,
+			ResourceOwner: resourceOwner,
+		},
+	}
+}

apps/api/internal/repository/idpintent/eventstore.go

@@ -0,0 +1,15 @@
+package idpintent
+
+import (
+	"github.com/zitadel/zitadel/internal/eventstore"
+)
+
+func init() {
+	eventstore.RegisterFilterEventMapper(AggregateType, StartedEventType, StartedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, SucceededEventType, SucceededEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, SAMLSucceededEventType, SAMLSucceededEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, SAMLRequestEventType, SAMLRequestEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LDAPSucceededEventType, LDAPSucceededEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, FailedEventType, FailedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, ConsumedEventType, eventstore.GenericEventMapper[ConsumedEvent])
+}

apps/api/internal/repository/idpintent/intent.go

@@ -0,0 +1,362 @@
+package idpintent
+
+import (
+	"context"
+	"net/url"
+	"time"
+
+	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	StartedEventType       = instanceEventTypePrefix + "started"
+	SucceededEventType     = instanceEventTypePrefix + "succeeded"
+	SAMLSucceededEventType = instanceEventTypePrefix + "saml.succeeded"
+	SAMLRequestEventType   = instanceEventTypePrefix + "saml.requested"
+	LDAPSucceededEventType = instanceEventTypePrefix + "ldap.succeeded"
+	FailedEventType        = instanceEventTypePrefix + "failed"
+	ConsumedEventType      = instanceEventTypePrefix + "consumed"
+)
+
+type StartedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	SuccessURL   *url.URL       `json:"successURL"`
+	FailureURL   *url.URL       `json:"failureURL"`
+	IDPID        string         `json:"idpId"`
+	IDPArguments map[string]any `json:"idpArguments,omitempty"`
+}
+
+func NewStartedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	successURL,
+	failureURL *url.URL,
+	idpID string,
+	idpArguments map[string]any,
+) *StartedEvent {
+	return &StartedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			StartedEventType,
+		),
+		SuccessURL:   successURL,
+		FailureURL:   failureURL,
+		IDPID:        idpID,
+		IDPArguments: idpArguments,
+	}
+}
+
+func (e *StartedEvent) Payload() any {
+	return e
+}
+
+func (e *StartedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func StartedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &StartedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-Sf3f1", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type SucceededEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	IDPUser     []byte `json:"idpUser"`
+	IDPUserID   string `json:"idpUserId,omitempty"`
+	IDPUserName string `json:"idpUserName,omitempty"`
+	UserID      string `json:"userId,omitempty"`
+
+	IDPAccessToken *crypto.CryptoValue `json:"idpAccessToken,omitempty"`
+	IDPIDToken     string              `json:"idpIdToken,omitempty"`
+	ExpiresAt      time.Time           `json:"expiresAt,omitempty"`
+}
+
+func NewSucceededEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	idpUser []byte,
+	idpUserID,
+	idpUserName,
+	userID string,
+	idpAccessToken *crypto.CryptoValue,
+	idpIDToken string,
+	expiresAt time.Time,
+) *SucceededEvent {
+	return &SucceededEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SucceededEventType,
+		),
+		IDPUser:        idpUser,
+		IDPUserID:      idpUserID,
+		IDPUserName:    idpUserName,
+		UserID:         userID,
+		IDPAccessToken: idpAccessToken,
+		IDPIDToken:     idpIDToken,
+		ExpiresAt:      expiresAt,
+	}
+}
+
+func (e *SucceededEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SucceededEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func SucceededEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &SucceededEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-HBreq", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type SAMLSucceededEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	IDPUser     []byte `json:"idpUser"`
+	IDPUserID   string `json:"idpUserId,omitempty"`
+	IDPUserName string `json:"idpUserName,omitempty"`
+	UserID      string `json:"userId,omitempty"`
+
+	Assertion *crypto.CryptoValue `json:"assertion,omitempty"`
+	ExpiresAt time.Time           `json:"expiresAt,omitempty"`
+}
+
+func NewSAMLSucceededEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	idpUser []byte,
+	idpUserID,
+	idpUserName,
+	userID string,
+	assertion *crypto.CryptoValue,
+	expiresAt time.Time,
+) *SAMLSucceededEvent {
+	return &SAMLSucceededEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SAMLSucceededEventType,
+		),
+		IDPUser:     idpUser,
+		IDPUserID:   idpUserID,
+		IDPUserName: idpUserName,
+		UserID:      userID,
+		Assertion:   assertion,
+		ExpiresAt:   expiresAt,
+	}
+}
+
+func (e *SAMLSucceededEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SAMLSucceededEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func SAMLSucceededEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &SAMLSucceededEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-l4tw23y6lq", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type SAMLRequestEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	RequestID string `json:"requestId"`
+}
+
+func NewSAMLRequestEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	requestID string,
+) *SAMLRequestEvent {
+	return &SAMLRequestEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SAMLRequestEventType,
+		),
+		RequestID: requestID,
+	}
+}
+
+func (e *SAMLRequestEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SAMLRequestEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func SAMLRequestEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &SAMLRequestEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-l85678vwlf", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type LDAPSucceededEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	IDPUser     []byte `json:"idpUser"`
+	IDPUserID   string `json:"idpUserId,omitempty"`
+	IDPUserName string `json:"idpUserName,omitempty"`
+	UserID      string `json:"userId,omitempty"`
+
+	EntryAttributes map[string][]string `json:"user,omitempty"`
+	ExpiresAt       time.Time           `json:"expiresAt,omitempty"`
+}
+
+func NewLDAPSucceededEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	idpUser []byte,
+	idpUserID,
+	idpUserName,
+	userID string,
+	attributes map[string][]string,
+	expiresAt time.Time,
+) *LDAPSucceededEvent {
+	return &LDAPSucceededEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			LDAPSucceededEventType,
+		),
+		IDPUser:         idpUser,
+		IDPUserID:       idpUserID,
+		IDPUserName:     idpUserName,
+		UserID:          userID,
+		EntryAttributes: attributes,
+		ExpiresAt:       expiresAt,
+	}
+}
+
+func (e *LDAPSucceededEvent) Payload() interface{} {
+	return e
+}
+
+func (e *LDAPSucceededEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func LDAPSucceededEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &LDAPSucceededEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-HBreq", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type FailedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	Reason string `json:"reason,omitempty"`
+}
+
+func NewFailedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	reason string,
+) *FailedEvent {
+	return &FailedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			FailedEventType,
+		),
+		Reason: reason,
+	}
+}
+
+func (e *FailedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *FailedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func FailedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &FailedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-Sfer3", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type ConsumedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+}
+
+func NewConsumedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+) *ConsumedEvent {
+	return &ConsumedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			ConsumedEventType,
+		),
+	}
+}
+
+func (e *ConsumedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *ConsumedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func (e *ConsumedEvent) SetBaseEvent(base *eventstore.BaseEvent) {
+	e.BaseEvent = *base
+}

apps/api/internal/repository/instance/aggregate.go

@@ -0,0 +1,30 @@
+package instance
+
+import (
+	"github.com/zitadel/zitadel/internal/eventstore"
+)
+
+const (
+	instanceEventTypePrefix = eventstore.EventType("instance.")
+)
+
+const (
+	AggregateType    = "instance"
+	AggregateVersion = "v1"
+)
+
+type Aggregate struct {
+	eventstore.Aggregate
+}
+
+func NewAggregate(instanceID string) *Aggregate {
+	return &Aggregate{
+		Aggregate: eventstore.Aggregate{
+			InstanceID:    instanceID,
+			Type:          AggregateType,
+			Version:       AggregateVersion,
+			ID:            instanceID,
+			ResourceOwner: instanceID,
+		},
+	}
+}

apps/api/internal/repository/instance/custom_text.go

@@ -0,0 +1,104 @@
+package instance
+
+import (
+	"context"
+
+	"golang.org/x/text/language"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/policy"
+)
+
+var (
+	CustomTextSetEventType             = instanceEventTypePrefix + policy.CustomTextSetEventType
+	CustomTextRemovedEventType         = instanceEventTypePrefix + policy.CustomTextRemovedEventType
+	CustomTextTemplateRemovedEventType = instanceEventTypePrefix + policy.CustomTextTemplateRemovedEventType
+)
+
+type CustomTextSetEvent struct {
+	policy.CustomTextSetEvent
+}
+
+func NewCustomTextSetEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	template,
+	key,
+	text string,
+	language language.Tag,
+) *CustomTextSetEvent {
+	return &CustomTextSetEvent{
+		CustomTextSetEvent: *policy.NewCustomTextSetEvent(
+			eventstore.NewBaseEventForPush(ctx, aggregate, CustomTextSetEventType),
+			template,
+			key,
+			text,
+			language),
+	}
+}
+
+func CustomTextSetEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.CustomTextSetEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &CustomTextSetEvent{CustomTextSetEvent: *e.(*policy.CustomTextSetEvent)}, nil
+}
+
+type CustomTextRemovedEvent struct {
+	policy.CustomTextRemovedEvent
+}
+
+func NewCustomTextRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	template,
+	key string,
+	language language.Tag,
+) *CustomTextRemovedEvent {
+	return &CustomTextRemovedEvent{
+		CustomTextRemovedEvent: *policy.NewCustomTextRemovedEvent(
+			eventstore.NewBaseEventForPush(ctx, aggregate, CustomTextRemovedEventType),
+			template,
+			key,
+			language),
+	}
+}
+
+func CustomTextRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.CustomTextRemovedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &CustomTextRemovedEvent{CustomTextRemovedEvent: *e.(*policy.CustomTextRemovedEvent)}, nil
+}
+
+type CustomTextTemplateRemovedEvent struct {
+	policy.CustomTextTemplateRemovedEvent
+}
+
+func NewCustomTextTemplateRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	template string,
+	language language.Tag,
+) *CustomTextTemplateRemovedEvent {
+	return &CustomTextTemplateRemovedEvent{
+		CustomTextTemplateRemovedEvent: *policy.NewCustomTextTemplateRemovedEvent(
+			eventstore.NewBaseEventForPush(ctx, aggregate, CustomTextTemplateRemovedEventType),
+			template,
+			language,
+		),
+	}
+}
+
+func CustomTextTemplateRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.CustomTextTemplateRemovedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &CustomTextTemplateRemovedEvent{CustomTextTemplateRemovedEvent: *e.(*policy.CustomTextTemplateRemovedEvent)}, nil
+}

apps/api/internal/repository/instance/debug_notification_file.go

@@ -0,0 +1,104 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/settings"
+)
+
+const (
+	fileType = ".file"
+)
+
+var (
+	DebugNotificationProviderFileAddedEventType   = instanceEventTypePrefix + settings.DebugNotificationPrefix + fileType + settings.DebugNotificationProviderAdded
+	DebugNotificationProviderFileChangedEventType = instanceEventTypePrefix + settings.DebugNotificationPrefix + fileType + settings.DebugNotificationProviderChanged
+	DebugNotificationProviderFileRemovedEventType = instanceEventTypePrefix + settings.DebugNotificationPrefix + fileType + settings.DebugNotificationProviderRemoved
+)
+
+type DebugNotificationProviderFileAddedEvent struct {
+	settings.DebugNotificationProviderAddedEvent
+}
+
+func NewDebugNotificationProviderFileAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	compact bool,
+) *DebugNotificationProviderFileAddedEvent {
+	return &DebugNotificationProviderFileAddedEvent{
+		DebugNotificationProviderAddedEvent: *settings.NewDebugNotificationProviderAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				DebugNotificationProviderFileAddedEventType),
+			compact),
+	}
+}
+
+func DebugNotificationProviderFileAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := settings.DebugNotificationProviderAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &DebugNotificationProviderFileAddedEvent{DebugNotificationProviderAddedEvent: *e.(*settings.DebugNotificationProviderAddedEvent)}, nil
+}
+
+type DebugNotificationProviderFileChangedEvent struct {
+	settings.DebugNotificationProviderChangedEvent
+}
+
+func NewDebugNotificationProviderFileChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	changes []settings.DebugNotificationProviderChanges,
+) (*DebugNotificationProviderFileChangedEvent, error) {
+	changedEvent, err := settings.NewDebugNotificationProviderChangedEvent(
+		eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			DebugNotificationProviderFileChangedEventType),
+		changes,
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &DebugNotificationProviderFileChangedEvent{DebugNotificationProviderChangedEvent: *changedEvent}, nil
+}
+
+func DebugNotificationProviderFileChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := settings.DebugNotificationProviderChangedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &DebugNotificationProviderFileChangedEvent{DebugNotificationProviderChangedEvent: *e.(*settings.DebugNotificationProviderChangedEvent)}, nil
+}
+
+type DebugNotificationProviderFileRemovedEvent struct {
+	settings.DebugNotificationProviderRemovedEvent
+}
+
+func NewDebugNotificationProviderFileRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+) *DebugNotificationProviderFileRemovedEvent {
+	return &DebugNotificationProviderFileRemovedEvent{
+		DebugNotificationProviderRemovedEvent: *settings.NewDebugNotificationProviderRemovedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				DebugNotificationProviderFileRemovedEventType),
+		),
+	}
+}
+
+func DebugNotificationProviderFileRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := settings.DebugNotificationProviderRemovedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &DebugNotificationProviderFileRemovedEvent{DebugNotificationProviderRemovedEvent: *e.(*settings.DebugNotificationProviderRemovedEvent)}, nil
+}

apps/api/internal/repository/instance/debug_notification_log.go

@@ -0,0 +1,106 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/settings"
+)
+
+const (
+	logType = ".log"
+)
+
+var (
+	DebugNotificationProviderLogAddedEventType    = instanceEventTypePrefix + settings.DebugNotificationPrefix + logType + settings.DebugNotificationProviderAdded
+	DebugNotificationProviderLogChangedEventType  = instanceEventTypePrefix + settings.DebugNotificationPrefix + logType + settings.DebugNotificationProviderChanged
+	DebugNotificationProviderLogEnabledEventType  = instanceEventTypePrefix + settings.DebugNotificationPrefix + logType + settings.DebugNotificationProviderEnabled
+	DebugNotificationProviderLogDisabledEventType = instanceEventTypePrefix + settings.DebugNotificationPrefix + logType + settings.DebugNotificationProviderDisabled
+	DebugNotificationProviderLogRemovedEventType  = instanceEventTypePrefix + settings.DebugNotificationPrefix + logType + settings.DebugNotificationProviderRemoved
+)
+
+type DebugNotificationProviderLogAddedEvent struct {
+	settings.DebugNotificationProviderAddedEvent
+}
+
+func NewDebugNotificationProviderLogAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	compact bool,
+) *DebugNotificationProviderLogAddedEvent {
+	return &DebugNotificationProviderLogAddedEvent{
+		DebugNotificationProviderAddedEvent: *settings.NewDebugNotificationProviderAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				DebugNotificationProviderLogAddedEventType),
+			compact),
+	}
+}
+
+func DebugNotificationProviderLogAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := settings.DebugNotificationProviderAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &DebugNotificationProviderLogAddedEvent{DebugNotificationProviderAddedEvent: *e.(*settings.DebugNotificationProviderAddedEvent)}, nil
+}
+
+type DebugNotificationProviderLogChangedEvent struct {
+	settings.DebugNotificationProviderChangedEvent
+}
+
+func NewDebugNotificationProviderLogChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	changes []settings.DebugNotificationProviderChanges,
+) (*DebugNotificationProviderLogChangedEvent, error) {
+	changedEvent, err := settings.NewDebugNotificationProviderChangedEvent(
+		eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			DebugNotificationProviderLogChangedEventType),
+		changes,
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &DebugNotificationProviderLogChangedEvent{DebugNotificationProviderChangedEvent: *changedEvent}, nil
+}
+
+func DebugNotificationProviderLogChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := settings.DebugNotificationProviderChangedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &DebugNotificationProviderLogChangedEvent{DebugNotificationProviderChangedEvent: *e.(*settings.DebugNotificationProviderChangedEvent)}, nil
+}
+
+type DebugNotificationProviderLogRemovedEvent struct {
+	settings.DebugNotificationProviderRemovedEvent
+}
+
+func NewDebugNotificationProviderLogRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+) *DebugNotificationProviderLogRemovedEvent {
+	return &DebugNotificationProviderLogRemovedEvent{
+		DebugNotificationProviderRemovedEvent: *settings.NewDebugNotificationProviderRemovedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				DebugNotificationProviderLogRemovedEventType),
+		),
+	}
+}
+
+func DebugNotificationProviderLogRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := settings.DebugNotificationProviderRemovedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &DebugNotificationProviderLogRemovedEvent{DebugNotificationProviderRemovedEvent: *e.(*settings.DebugNotificationProviderRemovedEvent)}, nil
+}

apps/api/internal/repository/instance/domain.go

@@ -0,0 +1,201 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	UniqueInstanceDomain              = "instance_domain"
+	domainEventPrefix                 = instanceEventTypePrefix + "domain."
+	InstanceDomainAddedEventType      = domainEventPrefix + "added"
+	InstanceDomainPrimarySetEventType = domainEventPrefix + "primary.set"
+	InstanceDomainRemovedEventType    = domainEventPrefix + "removed"
+
+	InstanceDomainSearchType     = "instance_domain"
+	InstanceDomainSearchField    = "domain"
+	InstanceDomainObjectRevision = uint8(1)
+)
+
+func NewAddInstanceDomainUniqueConstraint(domain string) *eventstore.UniqueConstraint {
+	return eventstore.NewAddGlobalUniqueConstraint(
+		UniqueInstanceDomain,
+		domain,
+		"Errors.Instance.Domain.AlreadyExists")
+}
+
+func NewRemoveInstanceDomainUniqueConstraint(domain string) *eventstore.UniqueConstraint {
+	return eventstore.NewRemoveGlobalUniqueConstraint(
+		UniqueInstanceDomain,
+		domain)
+}
+
+type DomainAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	Domain    string `json:"domain,omitempty"`
+	Generated bool   `json:"generated,omitempty"`
+}
+
+func (e *DomainAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *DomainAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return []*eventstore.UniqueConstraint{NewAddInstanceDomainUniqueConstraint(e.Domain)}
+}
+
+func (e *DomainAddedEvent) Fields() []*eventstore.FieldOperation {
+	return []*eventstore.FieldOperation{
+		eventstore.SetField(
+			e.Aggregate(),
+			domainSearchObject(e.Domain),
+			InstanceDomainSearchField,
+			&eventstore.Value{
+				Value: e.Domain,
+				// TODO: (adlerhurst) ensure uniqueness if we go with fields table: https://github.com/zitadel/zitadel/issues/9009
+				MustBeUnique: false,
+				ShouldIndex:  true,
+			},
+
+			eventstore.FieldTypeInstanceID,
+			eventstore.FieldTypeResourceOwner,
+			eventstore.FieldTypeAggregateType,
+			eventstore.FieldTypeAggregateID,
+			eventstore.FieldTypeObjectType,
+			eventstore.FieldTypeObjectID,
+			eventstore.FieldTypeFieldName,
+		),
+	}
+}
+
+func NewDomainAddedEvent(ctx context.Context, aggregate *eventstore.Aggregate, domain string, generated bool) *DomainAddedEvent {
+	return &DomainAddedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			InstanceDomainAddedEventType,
+		),
+		Domain:    domain,
+		Generated: generated,
+	}
+}
+
+func DomainAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	domainAdded := &DomainAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(domainAdded)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "INSTANCE-3noij", "unable to unmarshal instance domain added")
+	}
+
+	return domainAdded, nil
+}
+
+type DomainPrimarySetEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	Domain string `json:"domain,omitempty"`
+}
+
+func (e *DomainPrimarySetEvent) Payload() interface{} {
+	return e
+}
+
+func (e *DomainPrimarySetEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewDomainPrimarySetEvent(ctx context.Context, aggregate *eventstore.Aggregate, domain string) *DomainPrimarySetEvent {
+	return &DomainPrimarySetEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			InstanceDomainPrimarySetEventType,
+		),
+		Domain: domain,
+	}
+}
+
+func DomainPrimarySetEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	domainAdded := &DomainPrimarySetEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(domainAdded)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "INSTANCE-29jöF", "unable to unmarshal instance domain added")
+	}
+
+	return domainAdded, nil
+}
+
+type DomainRemovedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	Domain string `json:"domain,omitempty"`
+}
+
+func (e *DomainRemovedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *DomainRemovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return []*eventstore.UniqueConstraint{NewRemoveInstanceDomainUniqueConstraint(e.Domain)}
+}
+
+func (e *DomainRemovedEvent) Fields() []*eventstore.FieldOperation {
+	return []*eventstore.FieldOperation{
+		eventstore.SetField(
+			e.Aggregate(),
+			domainSearchObject(e.Domain),
+			InstanceDomainSearchField,
+			&eventstore.Value{
+				Value:        e.Domain,
+				MustBeUnique: true,
+				ShouldIndex:  true,
+			},
+
+			eventstore.FieldTypeInstanceID,
+			eventstore.FieldTypeResourceOwner,
+			eventstore.FieldTypeAggregateType,
+			eventstore.FieldTypeAggregateID,
+			eventstore.FieldTypeObjectType,
+			eventstore.FieldTypeObjectID,
+			eventstore.FieldTypeFieldName,
+		),
+	}
+}
+
+func NewDomainRemovedEvent(ctx context.Context, aggregate *eventstore.Aggregate, domain string) *DomainRemovedEvent {
+	return &DomainRemovedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			InstanceDomainRemovedEventType,
+		),
+		Domain: domain,
+	}
+}
+
+func DomainRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	domainRemoved := &DomainRemovedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(domainRemoved)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "INSTANCE-BngB2", "unable to unmarshal instance domain removed")
+	}
+
+	return domainRemoved, nil
+}
+
+func domainSearchObject(domain string) eventstore.Object {
+	return eventstore.Object{
+		Type:     InstanceDomainSearchType,
+		ID:       domain,
+		Revision: InstanceDomainObjectRevision,
+	}
+}

apps/api/internal/repository/instance/event_default_language.go

@@ -0,0 +1,55 @@
+package instance
+
+import (
+	"context"
+
+	"golang.org/x/text/language"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	DefaultLanguageSetEventType eventstore.EventType = "instance.default.language.set"
+)
+
+type DefaultLanguageSetEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	Language language.Tag `json:"language"`
+}
+
+func (e *DefaultLanguageSetEvent) Payload() interface{} {
+	return e
+}
+
+func (e *DefaultLanguageSetEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewDefaultLanguageSetEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	language language.Tag,
+) *DefaultLanguageSetEvent {
+	return &DefaultLanguageSetEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			DefaultLanguageSetEventType,
+		),
+		Language: language,
+	}
+}
+
+func DefaultLanguageSetMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &DefaultLanguageSetEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IAM-3j9fs", "unable to unmarshal default language set")
+	}
+
+	return e, nil
+}

apps/api/internal/repository/instance/event_iam_project_set.go

@@ -0,0 +1,98 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	ProjectSetEventType eventstore.EventType = "instance.iam.project.set"
+	ConsoleSetEventType eventstore.EventType = "instance.iam.console.set"
+)
+
+type ProjectSetEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ProjectID string `json:"iamProjectId"`
+}
+
+func (e *ProjectSetEvent) Payload() interface{} {
+	return e
+}
+
+func (e *ProjectSetEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewIAMProjectSetEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	projectID string,
+) *ProjectSetEvent {
+	return &ProjectSetEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			ProjectSetEventType,
+		),
+		ProjectID: projectID,
+	}
+}
+
+func ProjectSetMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &ProjectSetEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IAM-cdFZH", "unable to unmarshal global org set")
+	}
+
+	return e, nil
+}
+
+type ConsoleSetEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ClientID string `json:"clientId"`
+	AppID    string `json:"appId"`
+}
+
+func (e *ConsoleSetEvent) Payload() interface{} {
+	return e
+}
+
+func (e *ConsoleSetEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewIAMConsoleSetEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	clientID,
+	appID *string,
+) *ConsoleSetEvent {
+	return &ConsoleSetEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			ConsoleSetEventType,
+		),
+		ClientID: *clientID,
+		AppID:    *appID,
+	}
+}
+
+func ConsoleSetMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &ConsoleSetEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IAM-cdFZH", "unable to unmarshal console set")
+	}
+
+	return e, nil
+}

apps/api/internal/repository/instance/event_org_set.go

@@ -0,0 +1,53 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	DefaultOrgSetEventType eventstore.EventType = "instance.default.org.set"
+)
+
+type DefaultOrgSetEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	OrgID string `json:"orgId"`
+}
+
+func (e *DefaultOrgSetEvent) Payload() interface{} {
+	return e
+}
+
+func (e *DefaultOrgSetEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewDefaultOrgSetEventEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	orgID string,
+) *DefaultOrgSetEvent {
+	return &DefaultOrgSetEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			DefaultOrgSetEventType,
+		),
+		OrgID: orgID,
+	}
+}
+
+func DefaultOrgSetMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &DefaultOrgSetEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IAM-cdFZH", "unable to unmarshal default org set")
+	}
+
+	return e, nil
+}

apps/api/internal/repository/instance/eventstore.go

@@ -0,0 +1,134 @@
+package instance
+
+import (
+	"github.com/zitadel/zitadel/internal/eventstore"
+)
+
+func init() {
+	eventstore.RegisterFilterEventMapper(AggregateType, DefaultOrgSetEventType, DefaultOrgSetMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, ProjectSetEventType, ProjectSetMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, ConsoleSetEventType, ConsoleSetMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, DefaultLanguageSetEventType, DefaultLanguageSetMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, SecretGeneratorAddedEventType, SecretGeneratorAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, SecretGeneratorChangedEventType, SecretGeneratorChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, SecretGeneratorRemovedEventType, SecretGeneratorRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, SMTPConfigAddedEventType, eventstore.GenericEventMapper[SMTPConfigAddedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SMTPConfigChangedEventType, eventstore.GenericEventMapper[SMTPConfigChangedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SMTPConfigActivatedEventType, eventstore.GenericEventMapper[SMTPConfigActivatedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SMTPConfigDeactivatedEventType, eventstore.GenericEventMapper[SMTPConfigDeactivatedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SMTPConfigPasswordChangedEventType, eventstore.GenericEventMapper[SMTPConfigPasswordChangedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SMTPConfigHTTPAddedEventType, eventstore.GenericEventMapper[SMTPConfigHTTPAddedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SMTPConfigHTTPChangedEventType, eventstore.GenericEventMapper[SMTPConfigHTTPChangedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SMTPConfigRemovedEventType, eventstore.GenericEventMapper[SMTPConfigRemovedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SMSConfigTwilioAddedEventType, eventstore.GenericEventMapper[SMSConfigTwilioAddedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SMSConfigTwilioChangedEventType, eventstore.GenericEventMapper[SMSConfigTwilioChangedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SMSConfigTwilioTokenChangedEventType, eventstore.GenericEventMapper[SMSConfigTwilioTokenChangedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SMSConfigHTTPAddedEventType, eventstore.GenericEventMapper[SMSConfigHTTPAddedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SMSConfigHTTPChangedEventType, eventstore.GenericEventMapper[SMSConfigHTTPChangedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SMSConfigTwilioActivatedEventType, eventstore.GenericEventMapper[SMSConfigTwilioActivatedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SMSConfigTwilioDeactivatedEventType, eventstore.GenericEventMapper[SMSConfigTwilioDeactivatedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SMSConfigTwilioRemovedEventType, eventstore.GenericEventMapper[SMSConfigTwilioRemovedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SMSConfigActivatedEventType, eventstore.GenericEventMapper[SMSConfigActivatedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SMSConfigDeactivatedEventType, eventstore.GenericEventMapper[SMSConfigDeactivatedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SMSConfigRemovedEventType, eventstore.GenericEventMapper[SMSConfigRemovedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, DebugNotificationProviderFileAddedEventType, DebugNotificationProviderFileAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, DebugNotificationProviderFileChangedEventType, DebugNotificationProviderFileChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, DebugNotificationProviderFileRemovedEventType, DebugNotificationProviderFileRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, DebugNotificationProviderLogAddedEventType, DebugNotificationProviderLogAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, DebugNotificationProviderLogChangedEventType, DebugNotificationProviderLogChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, DebugNotificationProviderLogRemovedEventType, DebugNotificationProviderLogRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, OIDCSettingsAddedEventType, OIDCSettingsAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, OIDCSettingsChangedEventType, OIDCSettingsChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, SecurityPolicySetEventType, SecurityPolicySetEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyAddedEventType, LabelPolicyAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyChangedEventType, LabelPolicyChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyActivatedEventType, LabelPolicyActivatedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyLogoAddedEventType, LabelPolicyLogoAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyLogoRemovedEventType, LabelPolicyLogoRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyIconAddedEventType, LabelPolicyIconAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyIconRemovedEventType, LabelPolicyIconRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyLogoDarkAddedEventType, LabelPolicyLogoDarkAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyLogoDarkRemovedEventType, LabelPolicyLogoDarkRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyIconDarkAddedEventType, LabelPolicyIconDarkAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyIconDarkRemovedEventType, LabelPolicyIconDarkRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyFontAddedEventType, LabelPolicyFontAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyFontRemovedEventType, LabelPolicyFontRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyAssetsRemovedEventType, LabelPolicyAssetsRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LoginPolicyAddedEventType, LoginPolicyAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LoginPolicyChangedEventType, LoginPolicyChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, DomainPolicyAddedEventType, DomainPolicyAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, DomainPolicyChangedEventType, DomainPolicyChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, PasswordAgePolicyAddedEventType, PasswordAgePolicyAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, PasswordAgePolicyChangedEventType, PasswordAgePolicyChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, PasswordComplexityPolicyAddedEventType, PasswordComplexityPolicyAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, PasswordComplexityPolicyChangedEventType, PasswordComplexityPolicyChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LockoutPolicyAddedEventType, LockoutPolicyAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LockoutPolicyChangedEventType, LockoutPolicyChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, PrivacyPolicyAddedEventType, PrivacyPolicyAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, PrivacyPolicyChangedEventType, PrivacyPolicyChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, MemberAddedEventType, MemberAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, MemberChangedEventType, MemberChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, MemberRemovedEventType, MemberRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, MemberCascadeRemovedEventType, MemberCascadeRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, IDPConfigAddedEventType, IDPConfigAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, IDPConfigChangedEventType, IDPConfigChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, IDPConfigRemovedEventType, IDPConfigRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, IDPConfigDeactivatedEventType, IDPConfigDeactivatedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, IDPConfigReactivatedEventType, IDPConfigReactivatedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, IDPOIDCConfigAddedEventType, IDPOIDCConfigAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, IDPOIDCConfigChangedEventType, IDPOIDCConfigChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, IDPJWTConfigAddedEventType, IDPJWTConfigAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, IDPJWTConfigChangedEventType, IDPJWTConfigChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, OAuthIDPAddedEventType, OAuthIDPAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, OAuthIDPChangedEventType, OAuthIDPChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, OIDCIDPAddedEventType, OIDCIDPAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, OIDCIDPChangedEventType, OIDCIDPChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, OIDCIDPMigratedAzureADEventType, OIDCIDPMigratedAzureADEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, OIDCIDPMigratedGoogleEventType, OIDCIDPMigratedGoogleEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, JWTIDPAddedEventType, JWTIDPAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, JWTIDPChangedEventType, JWTIDPChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, AzureADIDPAddedEventType, AzureADIDPAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, AzureADIDPChangedEventType, AzureADIDPChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, GitHubIDPAddedEventType, GitHubIDPAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, GitHubIDPChangedEventType, GitHubIDPChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, GitHubEnterpriseIDPAddedEventType, GitHubEnterpriseIDPAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, GitHubEnterpriseIDPChangedEventType, GitHubEnterpriseIDPChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, GitLabIDPAddedEventType, GitLabIDPAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, GitLabIDPChangedEventType, GitLabIDPChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, GitLabSelfHostedIDPAddedEventType, GitLabSelfHostedIDPAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, GitLabSelfHostedIDPChangedEventType, GitLabSelfHostedIDPChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, GoogleIDPAddedEventType, GoogleIDPAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, GoogleIDPChangedEventType, GoogleIDPChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LDAPIDPAddedEventType, LDAPIDPAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LDAPIDPChangedEventType, LDAPIDPChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, AppleIDPAddedEventType, AppleIDPAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, AppleIDPChangedEventType, AppleIDPChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, SAMLIDPAddedEventType, SAMLIDPAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, SAMLIDPChangedEventType, SAMLIDPChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, IDPRemovedEventType, IDPRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LoginPolicyIDPProviderAddedEventType, IdentityProviderAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LoginPolicyIDPProviderRemovedEventType, IdentityProviderRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LoginPolicyIDPProviderCascadeRemovedEventType, IdentityProviderCascadeRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LoginPolicySecondFactorAddedEventType, SecondFactorAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LoginPolicySecondFactorRemovedEventType, SecondFactorRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LoginPolicyMultiFactorAddedEventType, MultiFactorAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LoginPolicyMultiFactorRemovedEventType, MultiFactorRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, MailTemplateAddedEventType, MailTemplateAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, MailTemplateChangedEventType, MailTemplateChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, MailTextAddedEventType, MailTextAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, MailTextChangedEventType, MailTextChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, CustomTextSetEventType, CustomTextSetEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, CustomTextRemovedEventType, CustomTextRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, CustomTextTemplateRemovedEventType, CustomTextTemplateRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, InstanceDomainAddedEventType, DomainAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, InstanceDomainPrimarySetEventType, DomainPrimarySetEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, InstanceDomainRemovedEventType, DomainRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, InstanceAddedEventType, InstanceAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, InstanceChangedEventType, InstanceChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, InstanceRemovedEventType, InstanceRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, NotificationPolicyAddedEventType, NotificationPolicyAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, NotificationPolicyChangedEventType, NotificationPolicyChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, TrustedDomainAddedEventType, eventstore.GenericEventMapper[TrustedDomainAddedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, TrustedDomainRemovedEventType, eventstore.GenericEventMapper[TrustedDomainRemovedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, HostedLoginTranslationSet, HostedLoginTranslationSetEventMapper)
+}

apps/api/internal/repository/instance/hosted_login_translation.go

@@ -0,0 +1,55 @@
+package instance
+
+import (
+	"context"
+
+	"golang.org/x/text/language"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	HostedLoginTranslationSet = instanceEventTypePrefix + "hosted_login_translation.set"
+)
+
+type HostedLoginTranslationSetEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	Translation map[string]any `json:"translation,omitempty"`
+	Language    language.Tag   `json:"language,omitempty"`
+	Level       string         `json:"level,omitempty"`
+}
+
+func NewHostedLoginTranslationSetEvent(ctx context.Context, aggregate *eventstore.Aggregate, translation map[string]any, language language.Tag) *HostedLoginTranslationSetEvent {
+	return &HostedLoginTranslationSetEvent{
+		BaseEvent:   *eventstore.NewBaseEventForPush(ctx, aggregate, HostedLoginTranslationSet),
+		Translation: translation,
+		Language:    language,
+		Level:       string(aggregate.Type),
+	}
+}
+
+func (e *HostedLoginTranslationSetEvent) Payload() any {
+	return e
+}
+
+func (e *HostedLoginTranslationSetEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func (e *HostedLoginTranslationSetEvent) Fields() []*eventstore.FieldOperation {
+	return nil
+}
+
+func HostedLoginTranslationSetEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	translationSet := &HostedLoginTranslationSetEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(translationSet)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "INST-lOxtJJ", "unable to unmarshal hosted login translation set event")
+	}
+
+	return translationSet, nil
+}

apps/api/internal/repository/instance/idp_config.go

@@ -0,0 +1,185 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/domain"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/idpconfig"
+)
+
+const (
+	IDPConfigAddedEventType       eventstore.EventType = "iam.idp.config.added"
+	IDPConfigChangedEventType     eventstore.EventType = "iam.idp.config.changed"
+	IDPConfigRemovedEventType     eventstore.EventType = "iam.idp.config.removed"
+	IDPConfigDeactivatedEventType eventstore.EventType = "iam.idp.config.deactivated"
+	IDPConfigReactivatedEventType eventstore.EventType = "iam.idp.config.reactivated"
+)
+
+type IDPConfigAddedEvent struct {
+	idpconfig.IDPConfigAddedEvent
+}
+
+func NewIDPConfigAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	configID,
+	name string,
+	configType domain.IDPConfigType,
+	stylingType domain.IDPConfigStylingType,
+	autoRegister bool,
+) *IDPConfigAddedEvent {
+
+	return &IDPConfigAddedEvent{
+		IDPConfigAddedEvent: *idpconfig.NewIDPConfigAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				IDPConfigAddedEventType,
+			),
+			configID,
+			name,
+			configType,
+			stylingType,
+			autoRegister,
+		),
+	}
+}
+
+func IDPConfigAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := idpconfig.IDPConfigAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &IDPConfigAddedEvent{IDPConfigAddedEvent: *e.(*idpconfig.IDPConfigAddedEvent)}, nil
+}
+
+type IDPConfigChangedEvent struct {
+	idpconfig.IDPConfigChangedEvent
+}
+
+func NewIDPConfigChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	configID,
+	oldName string,
+	changes []idpconfig.IDPConfigChanges,
+) (*IDPConfigChangedEvent, error) {
+	changeEvent, err := idpconfig.NewIDPConfigChangedEvent(
+		eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			IDPConfigChangedEventType),
+		configID,
+		oldName,
+		changes,
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &IDPConfigChangedEvent{IDPConfigChangedEvent: *changeEvent}, nil
+}
+
+func IDPConfigChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := idpconfig.IDPConfigChangedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &IDPConfigChangedEvent{IDPConfigChangedEvent: *e.(*idpconfig.IDPConfigChangedEvent)}, nil
+}
+
+type IDPConfigRemovedEvent struct {
+	idpconfig.IDPConfigRemovedEvent
+}
+
+func NewIDPConfigRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	configID,
+	name string,
+) *IDPConfigRemovedEvent {
+	return &IDPConfigRemovedEvent{
+		IDPConfigRemovedEvent: *idpconfig.NewIDPConfigRemovedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				IDPConfigRemovedEventType,
+			),
+			configID,
+			name,
+		),
+	}
+}
+
+func IDPConfigRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := idpconfig.IDPConfigRemovedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &IDPConfigRemovedEvent{IDPConfigRemovedEvent: *e.(*idpconfig.IDPConfigRemovedEvent)}, nil
+}
+
+type IDPConfigDeactivatedEvent struct {
+	idpconfig.IDPConfigDeactivatedEvent
+}
+
+func NewIDPConfigDeactivatedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	configID string,
+) *IDPConfigDeactivatedEvent {
+
+	return &IDPConfigDeactivatedEvent{
+		IDPConfigDeactivatedEvent: *idpconfig.NewIDPConfigDeactivatedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				IDPConfigDeactivatedEventType,
+			),
+			configID,
+		),
+	}
+}
+
+func IDPConfigDeactivatedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := idpconfig.IDPConfigDeactivatedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &IDPConfigDeactivatedEvent{IDPConfigDeactivatedEvent: *e.(*idpconfig.IDPConfigDeactivatedEvent)}, nil
+}
+
+type IDPConfigReactivatedEvent struct {
+	idpconfig.IDPConfigReactivatedEvent
+}
+
+func NewIDPConfigReactivatedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	configID string,
+) *IDPConfigReactivatedEvent {
+
+	return &IDPConfigReactivatedEvent{
+		IDPConfigReactivatedEvent: *idpconfig.NewIDPConfigReactivatedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				IDPConfigReactivatedEventType,
+			),
+			configID,
+		),
+	}
+}
+
+func IDPConfigReactivatedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := idpconfig.IDPConfigReactivatedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &IDPConfigReactivatedEvent{IDPConfigReactivatedEvent: *e.(*idpconfig.IDPConfigReactivatedEvent)}, nil
+}

apps/api/internal/repository/instance/idp_jwt_config.go

@@ -0,0 +1,84 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/idpconfig"
+)
+
+const (
+	IDPJWTConfigAddedEventType   eventstore.EventType = "iam.idp." + idpconfig.JWTConfigAddedEventType
+	IDPJWTConfigChangedEventType eventstore.EventType = "iam.idp." + idpconfig.JWTConfigChangedEventType
+)
+
+type IDPJWTConfigAddedEvent struct {
+	idpconfig.JWTConfigAddedEvent
+}
+
+func NewIDPJWTConfigAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	idpConfigID,
+	jwtEndpoint,
+	issuer,
+	keysEndpoint,
+	headerName string,
+) *IDPJWTConfigAddedEvent {
+	return &IDPJWTConfigAddedEvent{
+		JWTConfigAddedEvent: *idpconfig.NewJWTConfigAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				IDPJWTConfigAddedEventType,
+			),
+			idpConfigID,
+			jwtEndpoint,
+			issuer,
+			keysEndpoint,
+			headerName,
+		),
+	}
+}
+
+func IDPJWTConfigAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := idpconfig.JWTConfigAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &IDPJWTConfigAddedEvent{JWTConfigAddedEvent: *e.(*idpconfig.JWTConfigAddedEvent)}, nil
+}
+
+type IDPJWTConfigChangedEvent struct {
+	idpconfig.JWTConfigChangedEvent
+}
+
+func NewIDPJWTConfigChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	idpConfigID string,
+	changes []idpconfig.JWTConfigChanges,
+) (*IDPJWTConfigChangedEvent, error) {
+	changeEvent, err := idpconfig.NewJWTConfigChangedEvent(
+		eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			IDPJWTConfigChangedEventType),
+		idpConfigID,
+		changes,
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &IDPJWTConfigChangedEvent{JWTConfigChangedEvent: *changeEvent}, nil
+}
+
+func IDPJWTConfigChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := idpconfig.JWTConfigChangedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &IDPJWTConfigChangedEvent{JWTConfigChangedEvent: *e.(*idpconfig.JWTConfigChangedEvent)}, nil
+}

apps/api/internal/repository/instance/idp_oidc_config.go

@@ -0,0 +1,95 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/domain"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/idpconfig"
+)
+
+const (
+	IDPOIDCConfigAddedEventType   eventstore.EventType = "iam.idp." + idpconfig.OIDCConfigAddedEventType
+	IDPOIDCConfigChangedEventType eventstore.EventType = "iam.idp." + idpconfig.OIDCConfigChangedEventType
+)
+
+type IDPOIDCConfigAddedEvent struct {
+	idpconfig.OIDCConfigAddedEvent
+}
+
+func NewIDPOIDCConfigAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	clientID,
+	idpConfigID,
+	issuer,
+	authorizationEndpoint,
+	tokenEndpoint string,
+	clientSecret *crypto.CryptoValue,
+	idpDisplayNameMapping,
+	userNameMapping domain.OIDCMappingField,
+	scopes ...string,
+) *IDPOIDCConfigAddedEvent {
+
+	return &IDPOIDCConfigAddedEvent{
+		OIDCConfigAddedEvent: *idpconfig.NewOIDCConfigAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				IDPOIDCConfigAddedEventType,
+			),
+			clientID,
+			idpConfigID,
+			issuer,
+			authorizationEndpoint,
+			tokenEndpoint,
+			clientSecret,
+			idpDisplayNameMapping,
+			userNameMapping,
+			scopes...,
+		),
+	}
+}
+
+func IDPOIDCConfigAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := idpconfig.OIDCConfigAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &IDPOIDCConfigAddedEvent{OIDCConfigAddedEvent: *e.(*idpconfig.OIDCConfigAddedEvent)}, nil
+}
+
+type IDPOIDCConfigChangedEvent struct {
+	idpconfig.OIDCConfigChangedEvent
+}
+
+func NewIDPOIDCConfigChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	idpConfigID string,
+	changes []idpconfig.OIDCConfigChanges,
+) (*IDPOIDCConfigChangedEvent, error) {
+	changeEvent, err := idpconfig.NewOIDCConfigChangedEvent(
+		eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			IDPOIDCConfigChangedEventType),
+		idpConfigID,
+		changes,
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &IDPOIDCConfigChangedEvent{OIDCConfigChangedEvent: *changeEvent}, nil
+}
+
+func IDPOIDCConfigChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := idpconfig.OIDCConfigChangedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &IDPOIDCConfigChangedEvent{OIDCConfigChangedEvent: *e.(*idpconfig.OIDCConfigChangedEvent)}, nil
+}

apps/api/internal/repository/instance/instance.go

@@ -0,0 +1,133 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	InstanceAddedEventType   = instanceEventTypePrefix + "added"
+	InstanceChangedEventType = instanceEventTypePrefix + "changed"
+	InstanceRemovedEventType = instanceEventTypePrefix + "removed"
+)
+
+type InstanceAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	Name string `json:"name,omitempty"`
+}
+
+func (e *InstanceAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *InstanceAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewInstanceAddedEvent(ctx context.Context, aggregate *eventstore.Aggregate, name string) *InstanceAddedEvent {
+	return &InstanceAddedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			InstanceAddedEventType,
+		),
+		Name: name,
+	}
+}
+
+func InstanceAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	instanceAdded := &InstanceAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(instanceAdded)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "INSTANCE-s9l3F", "unable to unmarshal instance added")
+	}
+
+	return instanceAdded, nil
+}
+
+type InstanceChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	Name string `json:"name,omitempty"`
+}
+
+func (e *InstanceChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *InstanceChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewInstanceChangedEvent(ctx context.Context, aggregate *eventstore.Aggregate, newName string) *InstanceChangedEvent {
+	return &InstanceChangedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			InstanceChangedEventType,
+		),
+		Name: newName,
+	}
+}
+
+func InstanceChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	instanceChanged := &InstanceChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(instanceChanged)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "INSTANCE-3hfo8", "unable to unmarshal instance changed")
+	}
+
+	return instanceChanged, nil
+}
+
+type InstanceRemovedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+	name                 string
+	domains              []string
+}
+
+func (e *InstanceRemovedEvent) Payload() interface{} {
+	return nil
+}
+
+func (e *InstanceRemovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	constraints := make([]*eventstore.UniqueConstraint, len(e.domains)+1)
+	for i, domain := range e.domains {
+		constraints[i] = NewRemoveInstanceDomainUniqueConstraint(domain)
+	}
+	constraints[len(e.domains)] = eventstore.NewRemoveInstanceUniqueConstraints()
+	return constraints
+}
+
+func (e *InstanceRemovedEvent) Fields() []*eventstore.FieldOperation {
+	return []*eventstore.FieldOperation{
+		eventstore.RemoveSearchFields(map[eventstore.FieldType]any{
+			eventstore.FieldTypeInstanceID: e.Aggregate().ID,
+		}),
+	}
+}
+
+func NewInstanceRemovedEvent(ctx context.Context, aggregate *eventstore.Aggregate, name string, domains []string) *InstanceRemovedEvent {
+	return &InstanceRemovedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			InstanceRemovedEventType,
+		),
+		name:    name,
+		domains: domains,
+	}
+}
+
+func InstanceRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	return &InstanceRemovedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}, nil
+}

apps/api/internal/repository/instance/member.go

@@ -0,0 +1,160 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/member"
+)
+
+const (
+	MemberAddedEventType          = instanceEventTypePrefix + member.AddedEventType
+	MemberChangedEventType        = instanceEventTypePrefix + member.ChangedEventType
+	MemberRemovedEventType        = instanceEventTypePrefix + member.RemovedEventType
+	MemberCascadeRemovedEventType = instanceEventTypePrefix + member.CascadeRemovedEventType
+)
+
+const (
+	fieldPrefix = "instance"
+)
+
+type MemberAddedEvent struct {
+	member.MemberAddedEvent
+}
+
+func (e *MemberAddedEvent) Fields() []*eventstore.FieldOperation {
+	return e.FieldOperations(fieldPrefix)
+}
+
+func NewMemberAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	userID string,
+	roles ...string,
+) *MemberAddedEvent {
+
+	return &MemberAddedEvent{
+		MemberAddedEvent: *member.NewMemberAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				MemberAddedEventType,
+			),
+			userID,
+			roles...,
+		),
+	}
+}
+
+func MemberAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := member.MemberAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &MemberAddedEvent{MemberAddedEvent: *e.(*member.MemberAddedEvent)}, nil
+}
+
+type MemberChangedEvent struct {
+	member.MemberChangedEvent
+}
+
+func (e *MemberChangedEvent) Fields() []*eventstore.FieldOperation {
+	return e.FieldOperations(fieldPrefix)
+}
+
+func NewMemberChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	userID string,
+	roles ...string,
+) *MemberChangedEvent {
+	return &MemberChangedEvent{
+		MemberChangedEvent: *member.NewMemberChangedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				MemberChangedEventType,
+			),
+			userID,
+			roles...,
+		),
+	}
+}
+
+func MemberChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := member.ChangedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &MemberChangedEvent{MemberChangedEvent: *e.(*member.MemberChangedEvent)}, nil
+}
+
+type MemberRemovedEvent struct {
+	member.MemberRemovedEvent
+}
+
+func (e *MemberRemovedEvent) Fields() []*eventstore.FieldOperation {
+	return e.FieldOperations(fieldPrefix)
+}
+
+func NewMemberRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	userID string,
+) *MemberRemovedEvent {
+	return &MemberRemovedEvent{
+		MemberRemovedEvent: *member.NewRemovedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				MemberRemovedEventType,
+			),
+			userID,
+		),
+	}
+}
+
+func MemberRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := member.RemovedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &MemberRemovedEvent{MemberRemovedEvent: *e.(*member.MemberRemovedEvent)}, nil
+}
+
+type MemberCascadeRemovedEvent struct {
+	member.MemberCascadeRemovedEvent
+}
+
+func (e *MemberCascadeRemovedEvent) Fields() []*eventstore.FieldOperation {
+	return e.FieldOperations(fieldPrefix)
+}
+
+func NewMemberCascadeRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	userID string,
+) *MemberCascadeRemovedEvent {
+	return &MemberCascadeRemovedEvent{
+		MemberCascadeRemovedEvent: *member.NewCascadeRemovedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				MemberCascadeRemovedEventType,
+			),
+			userID,
+		),
+	}
+}
+
+func MemberCascadeRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := member.CascadeRemovedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &MemberCascadeRemovedEvent{MemberCascadeRemovedEvent: *e.(*member.MemberCascadeRemovedEvent)}, nil
+}

apps/api/internal/repository/instance/oidc_settings.go

@@ -0,0 +1,142 @@
+package instance
+
+import (
+	"context"
+	"time"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	oidcSettingsPrefix           = "oidc.settings."
+	OIDCSettingsAddedEventType   = instanceEventTypePrefix + oidcSettingsPrefix + "added"
+	OIDCSettingsChangedEventType = instanceEventTypePrefix + oidcSettingsPrefix + "changed"
+)
+
+type OIDCSettingsAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	AccessTokenLifetime        time.Duration `json:"accessTokenLifetime,omitempty"`
+	IdTokenLifetime            time.Duration `json:"idTokenLifetime,omitempty"`
+	RefreshTokenIdleExpiration time.Duration `json:"refreshTokenIdleExpiration,omitempty"`
+	RefreshTokenExpiration     time.Duration `json:"refreshTokenExpiration,omitempty"`
+}
+
+func NewOIDCSettingsAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	accessTokenLifetime,
+	idTokenLifetime,
+	refreshTokenIdleExpiration,
+	refreshTokenExpiration time.Duration,
+) *OIDCSettingsAddedEvent {
+	return &OIDCSettingsAddedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			OIDCSettingsAddedEventType,
+		),
+		AccessTokenLifetime:        accessTokenLifetime,
+		IdTokenLifetime:            idTokenLifetime,
+		RefreshTokenIdleExpiration: refreshTokenIdleExpiration,
+		RefreshTokenExpiration:     refreshTokenExpiration,
+	}
+}
+
+func (e *OIDCSettingsAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *OIDCSettingsAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func OIDCSettingsAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	oidcSettingsAdded := &OIDCSettingsAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(oidcSettingsAdded)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IAM-soiwj", "unable to unmarshal oidc config added")
+	}
+
+	return oidcSettingsAdded, nil
+}
+
+type OIDCSettingsChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	AccessTokenLifetime        *time.Duration `json:"accessTokenLifetime,omitempty"`
+	IdTokenLifetime            *time.Duration `json:"idTokenLifetime,omitempty"`
+	RefreshTokenIdleExpiration *time.Duration `json:"refreshTokenIdleExpiration,omitempty"`
+	RefreshTokenExpiration     *time.Duration `json:"refreshTokenExpiration,omitempty"`
+}
+
+func (e *OIDCSettingsChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *OIDCSettingsChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewOIDCSettingsChangeEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	changes []OIDCSettingsChanges,
+) (*OIDCSettingsChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IAM-dnlwe", "Errors.NoChangesFound")
+	}
+	changeEvent := &OIDCSettingsChangedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			OIDCSettingsChangedEventType,
+		),
+	}
+	for _, change := range changes {
+		change(changeEvent)
+	}
+	return changeEvent, nil
+}
+
+type OIDCSettingsChanges func(event *OIDCSettingsChangedEvent)
+
+func ChangeOIDCSettingsAccessTokenLifetime(accessTokenLifetime time.Duration) func(event *OIDCSettingsChangedEvent) {
+	return func(e *OIDCSettingsChangedEvent) {
+		e.AccessTokenLifetime = &accessTokenLifetime
+	}
+}
+
+func ChangeOIDCSettingsIdTokenLifetime(idTokenLifetime time.Duration) func(event *OIDCSettingsChangedEvent) {
+	return func(e *OIDCSettingsChangedEvent) {
+		e.IdTokenLifetime = &idTokenLifetime
+	}
+}
+
+func ChangeOIDCSettingsRefreshTokenIdleExpiration(refreshTokenIdleExpiration time.Duration) func(event *OIDCSettingsChangedEvent) {
+	return func(e *OIDCSettingsChangedEvent) {
+		e.RefreshTokenIdleExpiration = &refreshTokenIdleExpiration
+	}
+}
+
+func ChangeOIDCSettingsRefreshTokenExpiration(refreshTokenExpiration time.Duration) func(event *OIDCSettingsChangedEvent) {
+	return func(e *OIDCSettingsChangedEvent) {
+		e.RefreshTokenExpiration = &refreshTokenExpiration
+	}
+}
+
+func OIDCSettingsChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &OIDCSettingsChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IAM-f98uf", "unable to unmarshal oidc settings changed")
+	}
+
+	return e, nil
+}

apps/api/internal/repository/instance/policy_domain.go

@@ -0,0 +1,77 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/policy"
+)
+
+var (
+	DomainPolicyAddedEventType   = instanceEventTypePrefix + policy.DomainPolicyAddedEventType
+	DomainPolicyChangedEventType = instanceEventTypePrefix + policy.DomainPolicyChangedEventType
+)
+
+type DomainPolicyAddedEvent struct {
+	policy.DomainPolicyAddedEvent
+}
+
+func NewDomainPolicyAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	userLoginMustBeDomain,
+	validateOrgDomain,
+	smtpSenderAddressMatchesInstanceDomain bool,
+) *DomainPolicyAddedEvent {
+	return &DomainPolicyAddedEvent{
+		DomainPolicyAddedEvent: *policy.NewDomainPolicyAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				DomainPolicyAddedEventType),
+			userLoginMustBeDomain,
+			validateOrgDomain,
+			smtpSenderAddressMatchesInstanceDomain,
+		),
+	}
+}
+
+func DomainPolicyAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.DomainPolicyAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &DomainPolicyAddedEvent{DomainPolicyAddedEvent: *e.(*policy.DomainPolicyAddedEvent)}, nil
+}
+
+type DomainPolicyChangedEvent struct {
+	policy.DomainPolicyChangedEvent
+}
+
+func NewDomainPolicyChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	changes []policy.DomainPolicyChanges,
+) (*DomainPolicyChangedEvent, error) {
+	changedEvent, err := policy.NewDomainPolicyChangedEvent(
+		eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			DomainPolicyChangedEventType),
+		changes,
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &DomainPolicyChangedEvent{DomainPolicyChangedEvent: *changedEvent}, nil
+}
+
+func DomainPolicyChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.DomainPolicyChangedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &DomainPolicyChangedEvent{DomainPolicyChangedEvent: *e.(*policy.DomainPolicyChangedEvent)}, nil
+}

apps/api/internal/repository/instance/policy_label.go

@@ -0,0 +1,462 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/domain"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/policy"
+)
+
+var (
+	LabelPolicyAddedEventType     = instanceEventTypePrefix + policy.LabelPolicyAddedEventType
+	LabelPolicyChangedEventType   = instanceEventTypePrefix + policy.LabelPolicyChangedEventType
+	LabelPolicyActivatedEventType = instanceEventTypePrefix + policy.LabelPolicyActivatedEventType
+
+	LabelPolicyLogoAddedEventType       = instanceEventTypePrefix + policy.LabelPolicyLogoAddedEventType
+	LabelPolicyLogoRemovedEventType     = instanceEventTypePrefix + policy.LabelPolicyLogoRemovedEventType
+	LabelPolicyIconAddedEventType       = instanceEventTypePrefix + policy.LabelPolicyIconAddedEventType
+	LabelPolicyIconRemovedEventType     = instanceEventTypePrefix + policy.LabelPolicyIconRemovedEventType
+	LabelPolicyLogoDarkAddedEventType   = instanceEventTypePrefix + policy.LabelPolicyLogoDarkAddedEventType
+	LabelPolicyLogoDarkRemovedEventType = instanceEventTypePrefix + policy.LabelPolicyLogoDarkRemovedEventType
+	LabelPolicyIconDarkAddedEventType   = instanceEventTypePrefix + policy.LabelPolicyIconDarkAddedEventType
+	LabelPolicyIconDarkRemovedEventType = instanceEventTypePrefix + policy.LabelPolicyIconDarkRemovedEventType
+
+	LabelPolicyFontAddedEventType   = instanceEventTypePrefix + policy.LabelPolicyFontAddedEventType
+	LabelPolicyFontRemovedEventType = instanceEventTypePrefix + policy.LabelPolicyFontRemovedEventType
+
+	LabelPolicyAssetsRemovedEventType = instanceEventTypePrefix + policy.LabelPolicyAssetsRemovedEventType
+)
+
+type LabelPolicyAddedEvent struct {
+	policy.LabelPolicyAddedEvent
+}
+
+func NewLabelPolicyAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	primaryColor,
+	backgroundColor,
+	warnColor,
+	fontColor,
+	primaryColorDark,
+	backgroundColorDark,
+	warnColorDark,
+	fontColorDark string,
+	hideLoginNameSuffix,
+	errorMsgPopup,
+	disableWatermark bool,
+	themeMode domain.LabelPolicyThemeMode,
+) *LabelPolicyAddedEvent {
+	return &LabelPolicyAddedEvent{
+		LabelPolicyAddedEvent: *policy.NewLabelPolicyAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LabelPolicyAddedEventType),
+			primaryColor,
+			backgroundColor,
+			warnColor,
+			fontColor,
+			primaryColorDark,
+			backgroundColorDark,
+			warnColorDark,
+			fontColorDark,
+			hideLoginNameSuffix,
+			errorMsgPopup,
+			disableWatermark,
+			themeMode),
+	}
+}
+
+func LabelPolicyAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.LabelPolicyAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LabelPolicyAddedEvent{LabelPolicyAddedEvent: *e.(*policy.LabelPolicyAddedEvent)}, nil
+}
+
+type LabelPolicyChangedEvent struct {
+	policy.LabelPolicyChangedEvent
+}
+
+func NewLabelPolicyChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	changes []policy.LabelPolicyChanges,
+) (*LabelPolicyChangedEvent, error) {
+	changedEvent, err := policy.NewLabelPolicyChangedEvent(
+		eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			LabelPolicyChangedEventType),
+		changes,
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &LabelPolicyChangedEvent{LabelPolicyChangedEvent: *changedEvent}, nil
+}
+
+func LabelPolicyChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.LabelPolicyChangedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LabelPolicyChangedEvent{LabelPolicyChangedEvent: *e.(*policy.LabelPolicyChangedEvent)}, nil
+}
+
+type LabelPolicyActivatedEvent struct {
+	policy.LabelPolicyActivatedEvent
+}
+
+func NewLabelPolicyActivatedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+) *LabelPolicyActivatedEvent {
+	return &LabelPolicyActivatedEvent{
+		LabelPolicyActivatedEvent: *policy.NewLabelPolicyActivatedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LabelPolicyActivatedEventType),
+		),
+	}
+}
+
+func LabelPolicyActivatedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.LabelPolicyActivatedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LabelPolicyActivatedEvent{LabelPolicyActivatedEvent: *e.(*policy.LabelPolicyActivatedEvent)}, nil
+}
+
+type LabelPolicyLogoAddedEvent struct {
+	policy.LabelPolicyLogoAddedEvent
+}
+
+func NewLabelPolicyLogoAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	storageKey string,
+) *LabelPolicyLogoAddedEvent {
+	return &LabelPolicyLogoAddedEvent{
+		LabelPolicyLogoAddedEvent: *policy.NewLabelPolicyLogoAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LabelPolicyLogoAddedEventType),
+			storageKey,
+		),
+	}
+}
+
+func LabelPolicyLogoAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.LabelPolicyLogoAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LabelPolicyLogoAddedEvent{LabelPolicyLogoAddedEvent: *e.(*policy.LabelPolicyLogoAddedEvent)}, nil
+}
+
+type LabelPolicyLogoRemovedEvent struct {
+	policy.LabelPolicyLogoRemovedEvent
+}
+
+func NewLabelPolicyLogoRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	storageKey string,
+) *LabelPolicyLogoRemovedEvent {
+	return &LabelPolicyLogoRemovedEvent{
+		LabelPolicyLogoRemovedEvent: *policy.NewLabelPolicyLogoRemovedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LabelPolicyLogoRemovedEventType),
+			storageKey,
+		),
+	}
+}
+
+func LabelPolicyLogoRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.LabelPolicyLogoRemovedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LabelPolicyLogoRemovedEvent{LabelPolicyLogoRemovedEvent: *e.(*policy.LabelPolicyLogoRemovedEvent)}, nil
+}
+
+type LabelPolicyIconAddedEvent struct {
+	policy.LabelPolicyIconAddedEvent
+}
+
+func NewLabelPolicyIconAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	storageKey string,
+) *LabelPolicyIconAddedEvent {
+	return &LabelPolicyIconAddedEvent{
+		LabelPolicyIconAddedEvent: *policy.NewLabelPolicyIconAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LabelPolicyIconAddedEventType),
+			storageKey,
+		),
+	}
+}
+
+func LabelPolicyIconAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.LabelPolicyIconAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LabelPolicyIconAddedEvent{LabelPolicyIconAddedEvent: *e.(*policy.LabelPolicyIconAddedEvent)}, nil
+}
+
+type LabelPolicyIconRemovedEvent struct {
+	policy.LabelPolicyIconRemovedEvent
+}
+
+func NewLabelPolicyIconRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	storageKey string,
+) *LabelPolicyIconRemovedEvent {
+	return &LabelPolicyIconRemovedEvent{
+		LabelPolicyIconRemovedEvent: *policy.NewLabelPolicyIconRemovedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LabelPolicyIconRemovedEventType),
+			storageKey,
+		),
+	}
+}
+
+func LabelPolicyIconRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.LabelPolicyIconRemovedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LabelPolicyIconRemovedEvent{LabelPolicyIconRemovedEvent: *e.(*policy.LabelPolicyIconRemovedEvent)}, nil
+}
+
+type LabelPolicyLogoDarkAddedEvent struct {
+	policy.LabelPolicyLogoDarkAddedEvent
+}
+
+func NewLabelPolicyLogoDarkAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	storageKey string,
+) *LabelPolicyLogoDarkAddedEvent {
+	return &LabelPolicyLogoDarkAddedEvent{
+		LabelPolicyLogoDarkAddedEvent: *policy.NewLabelPolicyLogoDarkAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LabelPolicyLogoDarkAddedEventType),
+			storageKey,
+		),
+	}
+}
+
+func LabelPolicyLogoDarkAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.LabelPolicyLogoDarkAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LabelPolicyLogoDarkAddedEvent{LabelPolicyLogoDarkAddedEvent: *e.(*policy.LabelPolicyLogoDarkAddedEvent)}, nil
+}
+
+type LabelPolicyLogoDarkRemovedEvent struct {
+	policy.LabelPolicyLogoDarkRemovedEvent
+}
+
+func NewLabelPolicyLogoDarkRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	storageKey string,
+) *LabelPolicyLogoDarkRemovedEvent {
+	return &LabelPolicyLogoDarkRemovedEvent{
+		LabelPolicyLogoDarkRemovedEvent: *policy.NewLabelPolicyLogoDarkRemovedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LabelPolicyLogoDarkRemovedEventType),
+			storageKey,
+		),
+	}
+}
+
+func LabelPolicyLogoDarkRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.LabelPolicyLogoDarkRemovedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LabelPolicyLogoDarkRemovedEvent{LabelPolicyLogoDarkRemovedEvent: *e.(*policy.LabelPolicyLogoDarkRemovedEvent)}, nil
+}
+
+type LabelPolicyIconDarkAddedEvent struct {
+	policy.LabelPolicyIconDarkAddedEvent
+}
+
+func NewLabelPolicyIconDarkAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	storageKey string,
+) *LabelPolicyIconDarkAddedEvent {
+	return &LabelPolicyIconDarkAddedEvent{
+		LabelPolicyIconDarkAddedEvent: *policy.NewLabelPolicyIconDarkAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LabelPolicyIconDarkAddedEventType),
+			storageKey,
+		),
+	}
+}
+
+func LabelPolicyIconDarkAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.LabelPolicyIconDarkAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LabelPolicyIconDarkAddedEvent{LabelPolicyIconDarkAddedEvent: *e.(*policy.LabelPolicyIconDarkAddedEvent)}, nil
+}
+
+type LabelPolicyIconDarkRemovedEvent struct {
+	policy.LabelPolicyIconDarkRemovedEvent
+}
+
+func NewLabelPolicyIconDarkRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	storageKey string,
+) *LabelPolicyIconDarkRemovedEvent {
+	return &LabelPolicyIconDarkRemovedEvent{
+		LabelPolicyIconDarkRemovedEvent: *policy.NewLabelPolicyIconDarkRemovedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LabelPolicyIconDarkRemovedEventType),
+			storageKey,
+		),
+	}
+}
+
+func LabelPolicyIconDarkRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.LabelPolicyIconDarkRemovedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LabelPolicyIconDarkRemovedEvent{LabelPolicyIconDarkRemovedEvent: *e.(*policy.LabelPolicyIconDarkRemovedEvent)}, nil
+}
+
+type LabelPolicyFontAddedEvent struct {
+	policy.LabelPolicyFontAddedEvent
+}
+
+func NewLabelPolicyFontAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	storageKey string,
+) *LabelPolicyFontAddedEvent {
+	return &LabelPolicyFontAddedEvent{
+		LabelPolicyFontAddedEvent: *policy.NewLabelPolicyFontAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LabelPolicyFontAddedEventType),
+			storageKey,
+		),
+	}
+}
+
+func LabelPolicyFontAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.LabelPolicyFontAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LabelPolicyFontAddedEvent{LabelPolicyFontAddedEvent: *e.(*policy.LabelPolicyFontAddedEvent)}, nil
+}
+
+type LabelPolicyFontRemovedEvent struct {
+	policy.LabelPolicyFontRemovedEvent
+}
+
+func NewLabelPolicyFontRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	storageKey string,
+) *LabelPolicyFontRemovedEvent {
+	return &LabelPolicyFontRemovedEvent{
+		LabelPolicyFontRemovedEvent: *policy.NewLabelPolicyFontRemovedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LabelPolicyFontRemovedEventType),
+			storageKey,
+		),
+	}
+}
+
+func LabelPolicyFontRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.LabelPolicyFontRemovedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LabelPolicyFontRemovedEvent{LabelPolicyFontRemovedEvent: *e.(*policy.LabelPolicyFontRemovedEvent)}, nil
+}
+
+type LabelPolicyAssetsRemovedEvent struct {
+	policy.LabelPolicyAssetsRemovedEvent
+}
+
+func (e *LabelPolicyAssetsRemovedEvent) Payload() interface{} {
+	return nil
+}
+
+func (e *LabelPolicyAssetsRemovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewLabelPolicyAssetsRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+) *LabelPolicyAssetsRemovedEvent {
+	return &LabelPolicyAssetsRemovedEvent{
+		LabelPolicyAssetsRemovedEvent: *policy.NewLabelPolicyAssetsRemovedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LabelPolicyAssetsRemovedEventType),
+		),
+	}
+}
+
+func LabelPolicyAssetsRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.LabelPolicyAssetsRemovedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LabelPolicyAssetsRemovedEvent{LabelPolicyAssetsRemovedEvent: *e.(*policy.LabelPolicyAssetsRemovedEvent)}, nil
+}

apps/api/internal/repository/instance/policy_login.go

@@ -0,0 +1,106 @@
+package instance
+
+import (
+	"context"
+	"time"
+
+	"github.com/zitadel/zitadel/internal/domain"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/policy"
+)
+
+var (
+	LoginPolicyAddedEventType   = instanceEventTypePrefix + policy.LoginPolicyAddedEventType
+	LoginPolicyChangedEventType = instanceEventTypePrefix + policy.LoginPolicyChangedEventType
+)
+
+type LoginPolicyAddedEvent struct {
+	policy.LoginPolicyAddedEvent
+}
+
+func NewLoginPolicyAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	allowUsernamePassword,
+	allowRegister,
+	allowExternalIDP,
+	forceMFA,
+	forceMFALocalOnly,
+	hidePasswordReset,
+	ignoreUnknownUsernames,
+	allowDomainDiscovery,
+	disableLoginWithEmail,
+	disableLoginWithPhone bool,
+	passwordlessType domain.PasswordlessType,
+	defaultRedirectURI string,
+	passwordCheckLifetime,
+	externalLoginCheckLifetime,
+	mfaInitSkipLifetime,
+	secondFactorCheckLifetime,
+	multiFactorCheckLifetime time.Duration,
+) *LoginPolicyAddedEvent {
+	return &LoginPolicyAddedEvent{
+		LoginPolicyAddedEvent: *policy.NewLoginPolicyAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LoginPolicyAddedEventType),
+			allowUsernamePassword,
+			allowRegister,
+			allowExternalIDP,
+			forceMFA,
+			forceMFALocalOnly,
+			hidePasswordReset,
+			ignoreUnknownUsernames,
+			allowDomainDiscovery,
+			disableLoginWithEmail,
+			disableLoginWithPhone,
+			passwordlessType,
+			defaultRedirectURI,
+			passwordCheckLifetime,
+			externalLoginCheckLifetime,
+			mfaInitSkipLifetime,
+			secondFactorCheckLifetime,
+			multiFactorCheckLifetime),
+	}
+}
+
+func LoginPolicyAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.LoginPolicyAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LoginPolicyAddedEvent{LoginPolicyAddedEvent: *e.(*policy.LoginPolicyAddedEvent)}, nil
+}
+
+type LoginPolicyChangedEvent struct {
+	policy.LoginPolicyChangedEvent
+}
+
+func NewLoginPolicyChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	changes []policy.LoginPolicyChanges,
+) (*LoginPolicyChangedEvent, error) {
+	changedEvent, err := policy.NewLoginPolicyChangedEvent(
+		eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			LoginPolicyChangedEventType),
+		changes,
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &LoginPolicyChangedEvent{LoginPolicyChangedEvent: *changedEvent}, nil
+}
+
+func LoginPolicyChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.LoginPolicyChangedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LoginPolicyChangedEvent{LoginPolicyChangedEvent: *e.(*policy.LoginPolicyChangedEvent)}, nil
+}

apps/api/internal/repository/instance/policy_login_factors.go

@@ -0,0 +1,139 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/domain"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/policy"
+)
+
+var (
+	LoginPolicySecondFactorAddedEventType   = instanceEventTypePrefix + policy.LoginPolicySecondFactorAddedEventType
+	LoginPolicySecondFactorRemovedEventType = instanceEventTypePrefix + policy.LoginPolicySecondFactorRemovedEventType
+
+	LoginPolicyMultiFactorAddedEventType   = instanceEventTypePrefix + policy.LoginPolicyMultiFactorAddedEventType
+	LoginPolicyMultiFactorRemovedEventType = instanceEventTypePrefix + policy.LoginPolicyMultiFactorRemovedEventType
+)
+
+type LoginPolicySecondFactorAddedEvent struct {
+	policy.SecondFactorAddedEvent
+}
+
+func NewLoginPolicySecondFactorAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	mfaType domain.SecondFactorType,
+) *LoginPolicySecondFactorAddedEvent {
+	return &LoginPolicySecondFactorAddedEvent{
+		SecondFactorAddedEvent: *policy.NewSecondFactorAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LoginPolicySecondFactorAddedEventType),
+			mfaType),
+	}
+}
+
+func SecondFactorAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.SecondFactorAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LoginPolicySecondFactorAddedEvent{
+		SecondFactorAddedEvent: *e.(*policy.SecondFactorAddedEvent),
+	}, nil
+}
+
+type LoginPolicySecondFactorRemovedEvent struct {
+	policy.SecondFactorRemovedEvent
+}
+
+func NewLoginPolicySecondFactorRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	mfaType domain.SecondFactorType,
+) *LoginPolicySecondFactorRemovedEvent {
+
+	return &LoginPolicySecondFactorRemovedEvent{
+		SecondFactorRemovedEvent: *policy.NewSecondFactorRemovedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LoginPolicySecondFactorRemovedEventType),
+			mfaType),
+	}
+}
+
+func SecondFactorRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.SecondFactorRemovedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LoginPolicySecondFactorRemovedEvent{
+		SecondFactorRemovedEvent: *e.(*policy.SecondFactorRemovedEvent),
+	}, nil
+}
+
+type LoginPolicyMultiFactorAddedEvent struct {
+	policy.MultiFactorAddedEvent
+}
+
+func NewLoginPolicyMultiFactorAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	mfaType domain.MultiFactorType,
+) *LoginPolicyMultiFactorAddedEvent {
+	return &LoginPolicyMultiFactorAddedEvent{
+		MultiFactorAddedEvent: *policy.NewMultiFactorAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LoginPolicyMultiFactorAddedEventType),
+			mfaType),
+	}
+}
+
+func MultiFactorAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.MultiFactorAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LoginPolicyMultiFactorAddedEvent{
+		MultiFactorAddedEvent: *e.(*policy.MultiFactorAddedEvent),
+	}, nil
+}
+
+type LoginPolicyMultiFactorRemovedEvent struct {
+	policy.MultiFactorRemovedEvent
+}
+
+func NewLoginPolicyMultiFactorRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	mfaType domain.MultiFactorType,
+) *LoginPolicyMultiFactorRemovedEvent {
+
+	return &LoginPolicyMultiFactorRemovedEvent{
+		MultiFactorRemovedEvent: *policy.NewMultiFactorRemovedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LoginPolicyMultiFactorRemovedEventType),
+			mfaType),
+	}
+}
+
+func MultiFactorRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.MultiFactorRemovedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LoginPolicyMultiFactorRemovedEvent{
+		MultiFactorRemovedEvent: *e.(*policy.MultiFactorRemovedEvent),
+	}, nil
+}

apps/api/internal/repository/instance/policy_login_identity_provider.go

@@ -0,0 +1,104 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/domain"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/policy"
+)
+
+var (
+	LoginPolicyIDPProviderAddedEventType          = instanceEventTypePrefix + policy.LoginPolicyIDPProviderAddedType
+	LoginPolicyIDPProviderRemovedEventType        = instanceEventTypePrefix + policy.LoginPolicyIDPProviderRemovedType
+	LoginPolicyIDPProviderCascadeRemovedEventType = instanceEventTypePrefix + policy.LoginPolicyIDPProviderCascadeRemovedType
+)
+
+type IdentityProviderAddedEvent struct {
+	policy.IdentityProviderAddedEvent
+}
+
+func NewIdentityProviderAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	idpConfigID string,
+) *IdentityProviderAddedEvent {
+
+	return &IdentityProviderAddedEvent{
+		IdentityProviderAddedEvent: *policy.NewIdentityProviderAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LoginPolicyIDPProviderAddedEventType),
+			idpConfigID,
+			domain.IdentityProviderTypeSystem),
+	}
+}
+
+func IdentityProviderAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.IdentityProviderAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &IdentityProviderAddedEvent{
+		IdentityProviderAddedEvent: *e.(*policy.IdentityProviderAddedEvent),
+	}, nil
+}
+
+type IdentityProviderRemovedEvent struct {
+	policy.IdentityProviderRemovedEvent
+}
+
+func NewIdentityProviderRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	idpConfigID string,
+) *IdentityProviderRemovedEvent {
+	return &IdentityProviderRemovedEvent{
+		IdentityProviderRemovedEvent: *policy.NewIdentityProviderRemovedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LoginPolicyIDPProviderRemovedEventType),
+			idpConfigID),
+	}
+}
+
+func IdentityProviderRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.IdentityProviderRemovedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &IdentityProviderRemovedEvent{
+		IdentityProviderRemovedEvent: *e.(*policy.IdentityProviderRemovedEvent),
+	}, nil
+}
+
+type IdentityProviderCascadeRemovedEvent struct {
+	policy.IdentityProviderCascadeRemovedEvent
+}
+
+func NewIdentityProviderCascadeRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	idpConfigID string,
+) *IdentityProviderCascadeRemovedEvent {
+	return &IdentityProviderCascadeRemovedEvent{
+		IdentityProviderCascadeRemovedEvent: *policy.NewIdentityProviderCascadeRemovedEvent(
+			eventstore.NewBaseEventForPush(ctx, aggregate, LoginPolicyIDPProviderCascadeRemovedEventType),
+			idpConfigID),
+	}
+}
+
+func IdentityProviderCascadeRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.IdentityProviderCascadeRemovedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &IdentityProviderCascadeRemovedEvent{
+		IdentityProviderCascadeRemovedEvent: *e.(*policy.IdentityProviderCascadeRemovedEvent),
+	}, nil
+}

apps/api/internal/repository/instance/policy_mail_template.go

@@ -0,0 +1,66 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/policy"
+)
+
+var (
+	MailTemplateAddedEventType   = instanceEventTypePrefix + policy.MailTemplatePolicyAddedEventType
+	MailTemplateChangedEventType = instanceEventTypePrefix + policy.MailTemplatePolicyChangedEventType
+)
+
+type MailTemplateAddedEvent struct {
+	policy.MailTemplateAddedEvent
+}
+
+func NewMailTemplateAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	template []byte,
+) *MailTemplateAddedEvent {
+	return &MailTemplateAddedEvent{
+		MailTemplateAddedEvent: *policy.NewMailTemplateAddedEvent(
+			eventstore.NewBaseEventForPush(ctx, aggregate, MailTemplateAddedEventType),
+			template),
+	}
+}
+
+func MailTemplateAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.MailTemplateAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &MailTemplateAddedEvent{MailTemplateAddedEvent: *e.(*policy.MailTemplateAddedEvent)}, nil
+}
+
+type MailTemplateChangedEvent struct {
+	policy.MailTemplateChangedEvent
+}
+
+func NewMailTemplateChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	changes []policy.MailTemplateChanges,
+) (*MailTemplateChangedEvent, error) {
+	changedEvent, err := policy.NewMailTemplateChangedEvent(
+		eventstore.NewBaseEventForPush(ctx, aggregate, MailTemplateChangedEventType),
+		changes,
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &MailTemplateChangedEvent{MailTemplateChangedEvent: *changedEvent}, nil
+}
+
+func MailTemplateChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.MailTemplateChangedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &MailTemplateChangedEvent{MailTemplateChangedEvent: *e.(*policy.MailTemplateChangedEvent)}, nil
+}

apps/api/internal/repository/instance/policy_mail_text.go

@@ -0,0 +1,84 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/policy"
+)
+
+var (
+	MailTextAddedEventType   = instanceEventTypePrefix + policy.MailTextPolicyAddedEventType
+	MailTextChangedEventType = instanceEventTypePrefix + policy.MailTextPolicyChangedEventType
+)
+
+type MailTextAddedEvent struct {
+	policy.MailTextAddedEvent
+}
+
+func NewMailTextAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	mailTextType,
+	language,
+	title,
+	preHeader,
+	subject,
+	greeting,
+	text,
+	buttonText string,
+) *MailTextAddedEvent {
+	return &MailTextAddedEvent{
+		MailTextAddedEvent: *policy.NewMailTextAddedEvent(
+			eventstore.NewBaseEventForPush(ctx, aggregate, MailTextAddedEventType),
+			mailTextType,
+			language,
+			title,
+			preHeader,
+			subject,
+			greeting,
+			text,
+			buttonText),
+	}
+}
+
+func MailTextAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.MailTextAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &MailTextAddedEvent{MailTextAddedEvent: *e.(*policy.MailTextAddedEvent)}, nil
+}
+
+type MailTextChangedEvent struct {
+	policy.MailTextChangedEvent
+}
+
+func NewMailTextChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	mailTextType,
+	language string,
+	changes []policy.MailTextChanges,
+) (*MailTextChangedEvent, error) {
+	changedEvent, err := policy.NewMailTextChangedEvent(
+		eventstore.NewBaseEventForPush(ctx, aggregate, MailTextChangedEventType),
+		mailTextType,
+		language,
+		changes,
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &MailTextChangedEvent{MailTextChangedEvent: *changedEvent}, nil
+}
+
+func MailTextChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.MailTextChangedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &MailTextChangedEvent{MailTextChangedEvent: *e.(*policy.MailTextChangedEvent)}, nil
+}

apps/api/internal/repository/instance/policy_notification.go

@@ -0,0 +1,72 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/policy"
+)
+
+const (
+	NotificationPolicyAddedEventType   = instanceEventTypePrefix + policy.NotificationPolicyAddedEventType
+	NotificationPolicyChangedEventType = instanceEventTypePrefix + policy.NotificationPolicyChangedEventType
+)
+
+type NotificationPolicyAddedEvent struct {
+	policy.NotificationPolicyAddedEvent
+}
+
+func NewNotificationPolicyAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	passwordChange bool,
+) *NotificationPolicyAddedEvent {
+	return &NotificationPolicyAddedEvent{
+		NotificationPolicyAddedEvent: *policy.NewNotificationPolicyAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				NotificationPolicyAddedEventType),
+			passwordChange),
+	}
+}
+
+func NotificationPolicyAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.NotificationPolicyAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &NotificationPolicyAddedEvent{NotificationPolicyAddedEvent: *e.(*policy.NotificationPolicyAddedEvent)}, nil
+}
+
+type NotificationPolicyChangedEvent struct {
+	policy.NotificationPolicyChangedEvent
+}
+
+func NewNotificationPolicyChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	changes []policy.NotificationPolicyChanges,
+) (*NotificationPolicyChangedEvent, error) {
+	changedEvent, err := policy.NewNotificationPolicyChangedEvent(
+		eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			NotificationPolicyChangedEventType),
+		changes,
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &NotificationPolicyChangedEvent{NotificationPolicyChangedEvent: *changedEvent}, nil
+}
+
+func NotificationPolicyChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.NotificationPolicyChangedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &NotificationPolicyChangedEvent{NotificationPolicyChangedEvent: *e.(*policy.NotificationPolicyChangedEvent)}, nil
+}

apps/api/internal/repository/instance/policy_password_age.go

@@ -0,0 +1,74 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/policy"
+)
+
+var (
+	PasswordAgePolicyAddedEventType   = instanceEventTypePrefix + policy.PasswordAgePolicyAddedEventType
+	PasswordAgePolicyChangedEventType = instanceEventTypePrefix + policy.PasswordAgePolicyChangedEventType
+)
+
+type PasswordAgePolicyAddedEvent struct {
+	policy.PasswordAgePolicyAddedEvent
+}
+
+func NewPasswordAgePolicyAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	expireWarnDays,
+	maxAgeDays uint64,
+) *PasswordAgePolicyAddedEvent {
+	return &PasswordAgePolicyAddedEvent{
+		PasswordAgePolicyAddedEvent: *policy.NewPasswordAgePolicyAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				PasswordAgePolicyAddedEventType),
+			expireWarnDays,
+			maxAgeDays),
+	}
+}
+
+func PasswordAgePolicyAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.PasswordAgePolicyAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &PasswordAgePolicyAddedEvent{PasswordAgePolicyAddedEvent: *e.(*policy.PasswordAgePolicyAddedEvent)}, nil
+}
+
+type PasswordAgePolicyChangedEvent struct {
+	policy.PasswordAgePolicyChangedEvent
+}
+
+func NewPasswordAgePolicyChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	changes []policy.PasswordAgePolicyChanges,
+) (*PasswordAgePolicyChangedEvent, error) {
+	changedEvent, err := policy.NewPasswordAgePolicyChangedEvent(
+		eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			PasswordAgePolicyChangedEventType),
+		changes,
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &PasswordAgePolicyChangedEvent{PasswordAgePolicyChangedEvent: *changedEvent}, nil
+}
+
+func PasswordAgePolicyChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.PasswordAgePolicyChangedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &PasswordAgePolicyChangedEvent{PasswordAgePolicyChangedEvent: *e.(*policy.PasswordAgePolicyChangedEvent)}, nil
+}

apps/api/internal/repository/instance/policy_password_complexity.go

@@ -0,0 +1,80 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/policy"
+)
+
+const (
+	PasswordComplexityPolicyAddedEventType   = instanceEventTypePrefix + policy.PasswordComplexityPolicyAddedEventType
+	PasswordComplexityPolicyChangedEventType = instanceEventTypePrefix + policy.PasswordComplexityPolicyChangedEventType
+)
+
+type PasswordComplexityPolicyAddedEvent struct {
+	policy.PasswordComplexityPolicyAddedEvent
+}
+
+func NewPasswordComplexityPolicyAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	minLength uint64,
+	hasLowercase,
+	hasUppercase,
+	hasNumber,
+	hasSymbol bool,
+) *PasswordComplexityPolicyAddedEvent {
+	return &PasswordComplexityPolicyAddedEvent{
+		PasswordComplexityPolicyAddedEvent: *policy.NewPasswordComplexityPolicyAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				PasswordComplexityPolicyAddedEventType),
+			minLength,
+			hasLowercase,
+			hasUppercase,
+			hasNumber,
+			hasSymbol),
+	}
+}
+
+func PasswordComplexityPolicyAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.PasswordComplexityPolicyAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &PasswordComplexityPolicyAddedEvent{PasswordComplexityPolicyAddedEvent: *e.(*policy.PasswordComplexityPolicyAddedEvent)}, nil
+}
+
+type PasswordComplexityPolicyChangedEvent struct {
+	policy.PasswordComplexityPolicyChangedEvent
+}
+
+func NewPasswordComplexityPolicyChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	changes []policy.PasswordComplexityPolicyChanges,
+) (*PasswordComplexityPolicyChangedEvent, error) {
+	changedEvent, err := policy.NewPasswordComplexityPolicyChangedEvent(
+		eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			PasswordComplexityPolicyChangedEventType),
+		changes,
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &PasswordComplexityPolicyChangedEvent{PasswordComplexityPolicyChangedEvent: *changedEvent}, nil
+}
+
+func PasswordComplexityPolicyChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.PasswordComplexityPolicyChangedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &PasswordComplexityPolicyChangedEvent{PasswordComplexityPolicyChangedEvent: *e.(*policy.PasswordComplexityPolicyChangedEvent)}, nil
+}

apps/api/internal/repository/instance/policy_password_lockout.go

@@ -0,0 +1,76 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/policy"
+)
+
+var (
+	LockoutPolicyAddedEventType   = instanceEventTypePrefix + policy.LockoutPolicyAddedEventType
+	LockoutPolicyChangedEventType = instanceEventTypePrefix + policy.LockoutPolicyChangedEventType
+)
+
+type LockoutPolicyAddedEvent struct {
+	policy.LockoutPolicyAddedEvent
+}
+
+func NewLockoutPolicyAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	maxPasswordAttempts,
+	maxOTPAttempts uint64,
+	showLockoutFailure bool,
+) *LockoutPolicyAddedEvent {
+	return &LockoutPolicyAddedEvent{
+		LockoutPolicyAddedEvent: *policy.NewLockoutPolicyAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LockoutPolicyAddedEventType),
+			maxPasswordAttempts,
+			maxOTPAttempts,
+			showLockoutFailure),
+	}
+}
+
+func LockoutPolicyAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.LockoutPolicyAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LockoutPolicyAddedEvent{LockoutPolicyAddedEvent: *e.(*policy.LockoutPolicyAddedEvent)}, nil
+}
+
+type LockoutPolicyChangedEvent struct {
+	policy.LockoutPolicyChangedEvent
+}
+
+func NewLockoutPolicyChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	changes []policy.LockoutPolicyChanges,
+) (*LockoutPolicyChangedEvent, error) {
+	changedEvent, err := policy.NewLockoutPolicyChangedEvent(
+		eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			LockoutPolicyChangedEventType),
+		changes,
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &LockoutPolicyChangedEvent{LockoutPolicyChangedEvent: *changedEvent}, nil
+}
+
+func LockoutPolicyChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.LockoutPolicyChangedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LockoutPolicyChangedEvent{LockoutPolicyChangedEvent: *e.(*policy.LockoutPolicyChangedEvent)}, nil
+}

apps/api/internal/repository/instance/policy_privacy.go

@@ -0,0 +1,83 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/domain"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/policy"
+)
+
+const (
+	PrivacyPolicyAddedEventType   = instanceEventTypePrefix + policy.PrivacyPolicyAddedEventType
+	PrivacyPolicyChangedEventType = instanceEventTypePrefix + policy.PrivacyPolicyChangedEventType
+)
+
+type PrivacyPolicyAddedEvent struct {
+	policy.PrivacyPolicyAddedEvent
+}
+
+func NewPrivacyPolicyAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	tosLink,
+	privacyLink,
+	helpLink string,
+	supportEmail domain.EmailAddress,
+	docsLink, customLink, customLinkText string,
+) *PrivacyPolicyAddedEvent {
+	return &PrivacyPolicyAddedEvent{
+		PrivacyPolicyAddedEvent: *policy.NewPrivacyPolicyAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				PrivacyPolicyAddedEventType),
+			tosLink,
+			privacyLink,
+			helpLink,
+			supportEmail,
+			docsLink,
+			customLink,
+			customLinkText),
+	}
+}
+
+func PrivacyPolicyAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.PrivacyPolicyAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &PrivacyPolicyAddedEvent{PrivacyPolicyAddedEvent: *e.(*policy.PrivacyPolicyAddedEvent)}, nil
+}
+
+type PrivacyPolicyChangedEvent struct {
+	policy.PrivacyPolicyChangedEvent
+}
+
+func NewPrivacyPolicyChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	changes []policy.PrivacyPolicyChanges,
+) (*PrivacyPolicyChangedEvent, error) {
+	changedEvent, err := policy.NewPrivacyPolicyChangedEvent(
+		eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			PrivacyPolicyChangedEventType),
+		changes,
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &PrivacyPolicyChangedEvent{PrivacyPolicyChangedEvent: *changedEvent}, nil
+}
+
+func PrivacyPolicyChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.PrivacyPolicyChangedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &PrivacyPolicyChangedEvent{PrivacyPolicyChangedEvent: *e.(*policy.PrivacyPolicyChangedEvent)}, nil
+}

apps/api/internal/repository/instance/policy_security.go

@@ -0,0 +1,88 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	securityPolicyPrefix       = "policy.security."
+	SecurityPolicySetEventType = instanceEventTypePrefix + securityPolicyPrefix + "set"
+)
+
+type SecurityPolicySetEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	// Enabled is a legacy field which was used before for Iframe Embedding.
+	// It is kept so older events can still be reduced.
+	Enabled               *bool     `json:"enabled,omitempty"`
+	EnableIframeEmbedding *bool     `json:"enable_iframe_embedding,omitempty"`
+	AllowedOrigins        *[]string `json:"allowedOrigins,omitempty"`
+	EnableImpersonation   *bool     `json:"enable_impersonation,omitempty"`
+}
+
+func NewSecurityPolicySetEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	changes []SecurityPolicyChanges,
+) (*SecurityPolicySetEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "POLICY-EWsf3", "Errors.NoChangesFound")
+	}
+	event := &SecurityPolicySetEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SecurityPolicySetEventType,
+		),
+	}
+	for _, change := range changes {
+		change(event)
+	}
+	return event, nil
+}
+
+type SecurityPolicyChanges func(event *SecurityPolicySetEvent)
+
+func ChangeSecurityPolicyEnableIframeEmbedding(enabled bool) func(event *SecurityPolicySetEvent) {
+	return func(e *SecurityPolicySetEvent) {
+		e.EnableIframeEmbedding = &enabled
+	}
+}
+
+func ChangeSecurityPolicyAllowedOrigins(allowedOrigins []string) func(event *SecurityPolicySetEvent) {
+	return func(e *SecurityPolicySetEvent) {
+		if len(allowedOrigins) == 0 {
+			allowedOrigins = []string{}
+		}
+		e.AllowedOrigins = &allowedOrigins
+	}
+}
+
+func ChangeSecurityPolicyEnableImpersonation(enabled bool) func(event *SecurityPolicySetEvent) {
+	return func(e *SecurityPolicySetEvent) {
+		e.EnableImpersonation = &enabled
+	}
+}
+
+func (e *SecurityPolicySetEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SecurityPolicySetEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func SecurityPolicySetEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	securityPolicyAdded := &SecurityPolicySetEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(securityPolicyAdded)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IAM-soiwj", "unable to unmarshal oidc config added")
+	}
+
+	return securityPolicyAdded, nil
+}

apps/api/internal/repository/instance/secret_generator.go

@@ -0,0 +1,226 @@
+package instance
+
+import (
+	"context"
+	"time"
+
+	"github.com/zitadel/zitadel/internal/domain"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	UniqueSecretGeneratorType       = "secret_generator"
+	secretGeneratorPrefix           = "secret.generator."
+	SecretGeneratorAddedEventType   = instanceEventTypePrefix + secretGeneratorPrefix + "added"
+	SecretGeneratorChangedEventType = instanceEventTypePrefix + secretGeneratorPrefix + "changed"
+	SecretGeneratorRemovedEventType = instanceEventTypePrefix + secretGeneratorPrefix + "removed"
+)
+
+func NewAddSecretGeneratorTypeUniqueConstraint(generatorType domain.SecretGeneratorType) *eventstore.UniqueConstraint {
+	return eventstore.NewAddEventUniqueConstraint(
+		UniqueSecretGeneratorType,
+		string(generatorType),
+		"Errors.SecretGenerator.AlreadyExists")
+}
+
+func NewRemoveSecretGeneratorTypeUniqueConstraint(generatorType domain.SecretGeneratorType) *eventstore.UniqueConstraint {
+	return eventstore.NewRemoveUniqueConstraint(
+		UniqueSecretGeneratorType,
+		string(generatorType))
+}
+
+type SecretGeneratorAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	GeneratorType       domain.SecretGeneratorType `json:"generatorType"`
+	Length              uint                       `json:"length,omitempty"`
+	Expiry              time.Duration              `json:"expiry,omitempty"`
+	IncludeLowerLetters bool                       `json:"includeLowerLetters,omitempty"`
+	IncludeUpperLetters bool                       `json:"includeUpperLetters,omitempty"`
+	IncludeDigits       bool                       `json:"includeDigits,omitempty"`
+	IncludeSymbols      bool                       `json:"includeSymbols,omitempty"`
+}
+
+func NewSecretGeneratorAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	generatorType domain.SecretGeneratorType,
+	length uint,
+	expiry time.Duration,
+	includeLowerLetters,
+	includeUpperLetters,
+	includeDigits,
+	includeSymbols bool,
+) *SecretGeneratorAddedEvent {
+	return &SecretGeneratorAddedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SecretGeneratorAddedEventType,
+		),
+		GeneratorType:       generatorType,
+		Length:              length,
+		Expiry:              expiry,
+		IncludeLowerLetters: includeLowerLetters,
+		IncludeUpperLetters: includeUpperLetters,
+		IncludeDigits:       includeDigits,
+		IncludeSymbols:      includeSymbols,
+	}
+}
+
+func (e *SecretGeneratorAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SecretGeneratorAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return []*eventstore.UniqueConstraint{NewAddSecretGeneratorTypeUniqueConstraint(e.GeneratorType)}
+}
+
+func SecretGeneratorAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	secretGeneratorAdded := &SecretGeneratorAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(secretGeneratorAdded)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IAM-en9f4", "unable to unmarshal secret generator added")
+	}
+
+	return secretGeneratorAdded, nil
+}
+
+type SecretGeneratorChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	GeneratorType       domain.SecretGeneratorType `json:"generatorType"`
+	Length              *uint                      `json:"length,omitempty"`
+	Expiry              *time.Duration             `json:"expiry,omitempty"`
+	IncludeLowerLetters *bool                      `json:"includeLowerLetters,omitempty"`
+	IncludeUpperLetters *bool                      `json:"includeUpperLetters,omitempty"`
+	IncludeDigits       *bool                      `json:"includeDigits,omitempty"`
+	IncludeSymbols      *bool                      `json:"includeSymbols,omitempty"`
+}
+
+func (e *SecretGeneratorChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SecretGeneratorChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewSecretGeneratorChangeEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	generatorType domain.SecretGeneratorType,
+	changes []SecretGeneratorChanges,
+) (*SecretGeneratorChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IAM-j2jfw", "Errors.NoChangesFound")
+	}
+	changeEvent := &SecretGeneratorChangedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SecretGeneratorChangedEventType,
+		),
+		GeneratorType: generatorType,
+	}
+	for _, change := range changes {
+		change(changeEvent)
+	}
+	return changeEvent, nil
+}
+
+type SecretGeneratorChanges func(event *SecretGeneratorChangedEvent)
+
+func ChangeSecretGeneratorLength(length uint) func(event *SecretGeneratorChangedEvent) {
+	return func(e *SecretGeneratorChangedEvent) {
+		e.Length = &length
+	}
+}
+
+func ChangeSecretGeneratorExpiry(expiry time.Duration) func(event *SecretGeneratorChangedEvent) {
+	return func(e *SecretGeneratorChangedEvent) {
+		e.Expiry = &expiry
+	}
+}
+
+func ChangeSecretGeneratorIncludeLowerLetters(includeLowerLetters bool) func(event *SecretGeneratorChangedEvent) {
+	return func(e *SecretGeneratorChangedEvent) {
+		e.IncludeLowerLetters = &includeLowerLetters
+	}
+}
+
+func ChangeSecretGeneratorIncludeUpperLetters(includeUpperLetters bool) func(event *SecretGeneratorChangedEvent) {
+	return func(e *SecretGeneratorChangedEvent) {
+		e.IncludeUpperLetters = &includeUpperLetters
+	}
+}
+
+func ChangeSecretGeneratorIncludeDigits(includeDigits bool) func(event *SecretGeneratorChangedEvent) {
+	return func(e *SecretGeneratorChangedEvent) {
+		e.IncludeDigits = &includeDigits
+	}
+}
+
+func ChangeSecretGeneratorIncludeSymbols(includeSymbols bool) func(event *SecretGeneratorChangedEvent) {
+	return func(e *SecretGeneratorChangedEvent) {
+		e.IncludeSymbols = &includeSymbols
+	}
+}
+
+func SecretGeneratorChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &SecretGeneratorChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IAM-2m09e", "unable to unmarshal secret generator changed")
+	}
+
+	return e, nil
+}
+
+type SecretGeneratorRemovedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	GeneratorType domain.SecretGeneratorType `json:"generatorType"`
+}
+
+func (e *SecretGeneratorRemovedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SecretGeneratorRemovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return []*eventstore.UniqueConstraint{NewRemoveSecretGeneratorTypeUniqueConstraint(e.GeneratorType)}
+}
+
+func NewSecretGeneratorRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	generatorType domain.SecretGeneratorType,
+) *SecretGeneratorRemovedEvent {
+	return &SecretGeneratorRemovedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SecretGeneratorRemovedEventType,
+		),
+		GeneratorType: generatorType,
+	}
+}
+
+func SecretGeneratorRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &SecretGeneratorRemovedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IAM-m09ke", "unable to unmarshal secret generator removed")
+	}
+
+	return e, nil
+}

apps/api/internal/repository/instance/sms.go

@@ -0,0 +1,423 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	smsConfigPrefix                      = "sms.config"
+	smsConfigTwilioPrefix                = "twilio."
+	smsConfigHTTPPrefix                  = "http."
+	SMSConfigTwilioAddedEventType        = instanceEventTypePrefix + smsConfigPrefix + smsConfigTwilioPrefix + "added"
+	SMSConfigTwilioChangedEventType      = instanceEventTypePrefix + smsConfigPrefix + smsConfigTwilioPrefix + "changed"
+	SMSConfigHTTPAddedEventType          = instanceEventTypePrefix + smsConfigPrefix + smsConfigHTTPPrefix + "added"
+	SMSConfigHTTPChangedEventType        = instanceEventTypePrefix + smsConfigPrefix + smsConfigHTTPPrefix + "changed"
+	SMSConfigTwilioTokenChangedEventType = instanceEventTypePrefix + smsConfigPrefix + smsConfigTwilioPrefix + "token.changed"
+	SMSConfigTwilioActivatedEventType    = instanceEventTypePrefix + smsConfigPrefix + smsConfigTwilioPrefix + "activated"
+	SMSConfigTwilioDeactivatedEventType  = instanceEventTypePrefix + smsConfigPrefix + smsConfigTwilioPrefix + "deactivated"
+	SMSConfigTwilioRemovedEventType      = instanceEventTypePrefix + smsConfigPrefix + smsConfigTwilioPrefix + "removed"
+	SMSConfigActivatedEventType          = instanceEventTypePrefix + smsConfigPrefix + "activated"
+	SMSConfigDeactivatedEventType        = instanceEventTypePrefix + smsConfigPrefix + "deactivated"
+	SMSConfigRemovedEventType            = instanceEventTypePrefix + smsConfigPrefix + "removed"
+)
+
+type SMSConfigTwilioAddedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+
+	ID               string              `json:"id,omitempty"`
+	Description      string              `json:"description,omitempty"`
+	SID              string              `json:"sid,omitempty"`
+	Token            *crypto.CryptoValue `json:"token,omitempty"`
+	SenderNumber     string              `json:"senderNumber,omitempty"`
+	VerifyServiceSID string              `json:"verifyServiceSid,omitempty"`
+}
+
+func NewSMSConfigTwilioAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	id,
+	description string,
+	sid,
+	senderNumber string,
+	token *crypto.CryptoValue,
+	verifyServiceSid string,
+) *SMSConfigTwilioAddedEvent {
+	return &SMSConfigTwilioAddedEvent{
+		BaseEvent: eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SMSConfigTwilioAddedEventType,
+		),
+		ID:               id,
+		Description:      description,
+		SID:              sid,
+		Token:            token,
+		SenderNumber:     senderNumber,
+		VerifyServiceSID: verifyServiceSid,
+	}
+}
+
+func (e *SMSConfigTwilioAddedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+
+func (e *SMSConfigTwilioAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMSConfigTwilioAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+type SMSConfigTwilioChangedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+
+	ID               string  `json:"id,omitempty"`
+	Description      *string `json:"description,omitempty"`
+	SID              *string `json:"sid,omitempty"`
+	SenderNumber     *string `json:"senderNumber,omitempty"`
+	VerifyServiceSID *string `json:"verifyServiceSid,omitempty"`
+}
+
+func NewSMSConfigTwilioChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	id string,
+	changes []SMSConfigTwilioChanges,
+) (*SMSConfigTwilioChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IAM-smn8e", "Errors.NoChangesFound")
+	}
+	changeEvent := &SMSConfigTwilioChangedEvent{
+		BaseEvent: eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SMSConfigTwilioChangedEventType,
+		),
+		ID: id,
+	}
+	for _, change := range changes {
+		change(changeEvent)
+	}
+	return changeEvent, nil
+}
+
+type SMSConfigTwilioChanges func(event *SMSConfigTwilioChangedEvent)
+
+func ChangeSMSConfigTwilioSID(sid string) func(event *SMSConfigTwilioChangedEvent) {
+	return func(e *SMSConfigTwilioChangedEvent) {
+		e.SID = &sid
+	}
+}
+
+func ChangeSMSConfigTwilioDescription(description string) func(event *SMSConfigTwilioChangedEvent) {
+	return func(e *SMSConfigTwilioChangedEvent) {
+		e.Description = &description
+	}
+}
+
+func ChangeSMSConfigTwilioSenderNumber(senderNumber string) func(event *SMSConfigTwilioChangedEvent) {
+	return func(e *SMSConfigTwilioChangedEvent) {
+		e.SenderNumber = &senderNumber
+	}
+}
+
+func ChangeSMSConfigTwilioVerifyServiceSID(verifyServiceSID string) func(event *SMSConfigTwilioChangedEvent) {
+	return func(e *SMSConfigTwilioChangedEvent) {
+		e.VerifyServiceSID = &verifyServiceSID
+	}
+}
+
+func (e *SMSConfigTwilioChangedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+
+func (e *SMSConfigTwilioChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMSConfigTwilioChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+type SMSConfigTwilioTokenChangedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+
+	ID    string              `json:"id,omitempty"`
+	Token *crypto.CryptoValue `json:"token,omitempty"`
+}
+
+func NewSMSConfigTokenChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	id string,
+	token *crypto.CryptoValue,
+) *SMSConfigTwilioTokenChangedEvent {
+	return &SMSConfigTwilioTokenChangedEvent{
+		BaseEvent: eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SMSConfigTwilioTokenChangedEventType,
+		),
+		ID:    id,
+		Token: token,
+	}
+}
+
+func (e *SMSConfigTwilioTokenChangedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+
+func (e *SMSConfigTwilioTokenChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMSConfigTwilioTokenChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+type SMSConfigHTTPAddedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+
+	ID          string `json:"id,omitempty"`
+	Description string `json:"description,omitempty"`
+	Endpoint    string `json:"endpoint,omitempty"`
+}
+
+func NewSMSConfigHTTPAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	id,
+	description,
+	endpoint string,
+) *SMSConfigHTTPAddedEvent {
+	return &SMSConfigHTTPAddedEvent{
+		BaseEvent: eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SMSConfigHTTPAddedEventType,
+		),
+		ID:          id,
+		Description: description,
+		Endpoint:    endpoint,
+	}
+}
+
+func (e *SMSConfigHTTPAddedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+
+func (e *SMSConfigHTTPAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMSConfigHTTPAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+type SMSConfigHTTPChangedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+
+	ID          string  `json:"id,omitempty"`
+	Description *string `json:"description,omitempty"`
+	Endpoint    *string `json:"endpoint,omitempty"`
+}
+
+func NewSMSConfigHTTPChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	id string,
+	changes []SMSConfigHTTPChanges,
+) (*SMSConfigHTTPChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IAM-smn8e", "Errors.NoChangesFound")
+	}
+	changeEvent := &SMSConfigHTTPChangedEvent{
+		BaseEvent: eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SMSConfigHTTPChangedEventType,
+		),
+		ID: id,
+	}
+	for _, change := range changes {
+		change(changeEvent)
+	}
+	return changeEvent, nil
+}
+
+type SMSConfigHTTPChanges func(event *SMSConfigHTTPChangedEvent)
+
+func ChangeSMSConfigHTTPDescription(description string) func(event *SMSConfigHTTPChangedEvent) {
+	return func(e *SMSConfigHTTPChangedEvent) {
+		e.Description = &description
+	}
+}
+func ChangeSMSConfigHTTPEndpoint(endpoint string) func(event *SMSConfigHTTPChangedEvent) {
+	return func(e *SMSConfigHTTPChangedEvent) {
+		e.Endpoint = &endpoint
+	}
+}
+
+func (e *SMSConfigHTTPChangedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+
+func (e *SMSConfigHTTPChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMSConfigHTTPChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+type SMSConfigTwilioActivatedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+	ID                    string `json:"id,omitempty"`
+}
+
+func (e *SMSConfigTwilioActivatedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+
+func (e *SMSConfigTwilioActivatedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMSConfigTwilioActivatedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+type SMSConfigActivatedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+	ID                    string `json:"id,omitempty"`
+}
+
+func NewSMSConfigActivatedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	id string,
+) *SMSConfigActivatedEvent {
+	return &SMSConfigActivatedEvent{
+		BaseEvent: eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SMSConfigActivatedEventType,
+		),
+		ID: id,
+	}
+}
+
+func (e *SMSConfigActivatedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+
+func (e *SMSConfigActivatedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMSConfigActivatedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+type SMSConfigTwilioDeactivatedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+	ID                    string `json:"id,omitempty"`
+}
+
+func (e *SMSConfigTwilioDeactivatedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+
+func (e *SMSConfigTwilioDeactivatedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMSConfigTwilioDeactivatedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+type SMSConfigDeactivatedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+	ID                    string `json:"id,omitempty"`
+}
+
+func NewSMSConfigDeactivatedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	id string,
+) *SMSConfigDeactivatedEvent {
+	return &SMSConfigDeactivatedEvent{
+		BaseEvent: eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SMSConfigDeactivatedEventType,
+		),
+		ID: id,
+	}
+}
+
+func (e *SMSConfigDeactivatedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+
+func (e *SMSConfigDeactivatedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMSConfigDeactivatedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+type SMSConfigTwilioRemovedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+	ID                    string `json:"id,omitempty"`
+}
+
+func (e *SMSConfigTwilioRemovedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+
+func (e *SMSConfigTwilioRemovedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMSConfigTwilioRemovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+type SMSConfigRemovedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+	ID                    string `json:"id,omitempty"`
+}
+
+func NewSMSConfigRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	id string,
+) *SMSConfigRemovedEvent {
+	return &SMSConfigRemovedEvent{
+		BaseEvent: eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SMSConfigRemovedEventType,
+		),
+		ID: id,
+	}
+}
+
+func (e *SMSConfigRemovedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+
+func (e *SMSConfigRemovedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMSConfigRemovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}

apps/api/internal/repository/instance/smtp_config.go

@@ -0,0 +1,410 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	smtpConfigPrefix                   = "smtp.config."
+	httpConfigPrefix                   = "http."
+	SMTPConfigAddedEventType           = instanceEventTypePrefix + smtpConfigPrefix + "added"
+	SMTPConfigChangedEventType         = instanceEventTypePrefix + smtpConfigPrefix + "changed"
+	SMTPConfigPasswordChangedEventType = instanceEventTypePrefix + smtpConfigPrefix + "password.changed"
+	SMTPConfigHTTPAddedEventType       = instanceEventTypePrefix + smtpConfigPrefix + httpConfigPrefix + "added"
+	SMTPConfigHTTPChangedEventType     = instanceEventTypePrefix + smtpConfigPrefix + httpConfigPrefix + "changed"
+	SMTPConfigRemovedEventType         = instanceEventTypePrefix + smtpConfigPrefix + "removed"
+	SMTPConfigActivatedEventType       = instanceEventTypePrefix + smtpConfigPrefix + "activated"
+	SMTPConfigDeactivatedEventType     = instanceEventTypePrefix + smtpConfigPrefix + "deactivated"
+)
+
+type SMTPConfigAddedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+
+	ID             string              `json:"id,omitempty"`
+	Description    string              `json:"description,omitempty"`
+	SenderAddress  string              `json:"senderAddress,omitempty"`
+	SenderName     string              `json:"senderName,omitempty"`
+	ReplyToAddress string              `json:"replyToAddress,omitempty"`
+	TLS            bool                `json:"tls,omitempty"`
+	Host           string              `json:"host,omitempty"`
+	User           string              `json:"user,omitempty"`
+	Password       *crypto.CryptoValue `json:"password,omitempty"`
+}
+
+func NewSMTPConfigAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	id, description string,
+	tls bool,
+	senderAddress,
+	senderName,
+	replyToAddress,
+	host,
+	user string,
+	password *crypto.CryptoValue,
+) *SMTPConfigAddedEvent {
+	return &SMTPConfigAddedEvent{
+		BaseEvent: eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SMTPConfigAddedEventType,
+		),
+		ID:             id,
+		Description:    description,
+		TLS:            tls,
+		SenderAddress:  senderAddress,
+		SenderName:     senderName,
+		ReplyToAddress: replyToAddress,
+		Host:           host,
+		User:           user,
+		Password:       password,
+	}
+}
+func (e *SMTPConfigAddedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+
+func (e *SMTPConfigAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMTPConfigAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+type SMTPConfigChangedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+	ID                    string              `json:"id,omitempty"`
+	Description           *string             `json:"description,omitempty"`
+	FromAddress           *string             `json:"senderAddress,omitempty"`
+	FromName              *string             `json:"senderName,omitempty"`
+	ReplyToAddress        *string             `json:"replyToAddress,omitempty"`
+	TLS                   *bool               `json:"tls,omitempty"`
+	Host                  *string             `json:"host,omitempty"`
+	User                  *string             `json:"user,omitempty"`
+	Password              *crypto.CryptoValue `json:"password,omitempty"`
+}
+
+func (e *SMTPConfigChangedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+
+func (e *SMTPConfigChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMTPConfigChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewSMTPConfigChangeEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	id string,
+	changes []SMTPConfigChanges,
+) (*SMTPConfigChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IAM-o0pWf", "Errors.NoChangesFound")
+	}
+	changeEvent := &SMTPConfigChangedEvent{
+		BaseEvent: eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SMTPConfigChangedEventType,
+		),
+		ID: id,
+	}
+	for _, change := range changes {
+		change(changeEvent)
+	}
+	return changeEvent, nil
+}
+
+type SMTPConfigChanges func(event *SMTPConfigChangedEvent)
+
+func ChangeSMTPConfigID(id string) func(event *SMTPConfigChangedEvent) {
+	return func(e *SMTPConfigChangedEvent) {
+		e.ID = id
+	}
+}
+
+func ChangeSMTPConfigDescription(description string) func(event *SMTPConfigChangedEvent) {
+	return func(e *SMTPConfigChangedEvent) {
+		e.Description = &description
+	}
+}
+
+func ChangeSMTPConfigTLS(tls bool) func(event *SMTPConfigChangedEvent) {
+	return func(e *SMTPConfigChangedEvent) {
+		e.TLS = &tls
+	}
+}
+
+func ChangeSMTPConfigFromAddress(senderAddress string) func(event *SMTPConfigChangedEvent) {
+	return func(e *SMTPConfigChangedEvent) {
+		e.FromAddress = &senderAddress
+	}
+}
+
+func ChangeSMTPConfigFromName(senderName string) func(event *SMTPConfigChangedEvent) {
+	return func(e *SMTPConfigChangedEvent) {
+		e.FromName = &senderName
+	}
+}
+
+func ChangeSMTPConfigReplyToAddress(replyToAddress string) func(event *SMTPConfigChangedEvent) {
+	return func(e *SMTPConfigChangedEvent) {
+		e.ReplyToAddress = &replyToAddress
+	}
+}
+
+func ChangeSMTPConfigSMTPHost(smtpHost string) func(event *SMTPConfigChangedEvent) {
+	return func(e *SMTPConfigChangedEvent) {
+		e.Host = &smtpHost
+	}
+}
+
+func ChangeSMTPConfigSMTPUser(smtpUser string) func(event *SMTPConfigChangedEvent) {
+	return func(e *SMTPConfigChangedEvent) {
+		e.User = &smtpUser
+	}
+}
+
+func ChangeSMTPConfigSMTPPassword(password *crypto.CryptoValue) func(event *SMTPConfigChangedEvent) {
+	return func(e *SMTPConfigChangedEvent) {
+		e.Password = password
+	}
+}
+
+type SMTPConfigPasswordChangedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+	ID                    string              `json:"id,omitempty"`
+	Password              *crypto.CryptoValue `json:"password,omitempty"`
+}
+
+func NewSMTPConfigPasswordChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	id string,
+	password *crypto.CryptoValue,
+) *SMTPConfigPasswordChangedEvent {
+	return &SMTPConfigPasswordChangedEvent{
+		BaseEvent: eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SMTPConfigPasswordChangedEventType,
+		),
+		Password: password,
+	}
+}
+
+func (e *SMTPConfigPasswordChangedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+
+func (e *SMTPConfigPasswordChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMTPConfigPasswordChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+type SMTPConfigHTTPAddedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+
+	ID          string `json:"id,omitempty"`
+	Description string `json:"description,omitempty"`
+	Endpoint    string `json:"endpoint,omitempty"`
+}
+
+func NewSMTPConfigHTTPAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	id, description string,
+	endpoint string,
+) *SMTPConfigHTTPAddedEvent {
+	return &SMTPConfigHTTPAddedEvent{
+		BaseEvent: eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SMTPConfigHTTPAddedEventType,
+		),
+		ID:          id,
+		Description: description,
+		Endpoint:    endpoint,
+	}
+}
+
+func (e *SMTPConfigHTTPAddedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+
+func (e *SMTPConfigHTTPAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMTPConfigHTTPAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+type SMTPConfigHTTPChangedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+	ID                    string  `json:"id,omitempty"`
+	Description           *string `json:"description,omitempty"`
+	Endpoint              *string `json:"endpoint,omitempty"`
+}
+
+func (e *SMTPConfigHTTPChangedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+
+func (e *SMTPConfigHTTPChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMTPConfigHTTPChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewSMTPConfigHTTPChangeEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	id string,
+	changes []SMTPConfigHTTPChanges,
+) (*SMTPConfigHTTPChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IAM-o0pWf", "Errors.NoChangesFound")
+	}
+	changeEvent := &SMTPConfigHTTPChangedEvent{
+		BaseEvent: eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SMTPConfigHTTPChangedEventType,
+		),
+		ID: id,
+	}
+	for _, change := range changes {
+		change(changeEvent)
+	}
+	return changeEvent, nil
+}
+
+type SMTPConfigHTTPChanges func(event *SMTPConfigHTTPChangedEvent)
+
+func ChangeSMTPConfigHTTPID(id string) func(event *SMTPConfigHTTPChangedEvent) {
+	return func(e *SMTPConfigHTTPChangedEvent) {
+		e.ID = id
+	}
+}
+
+func ChangeSMTPConfigHTTPDescription(description string) func(event *SMTPConfigHTTPChangedEvent) {
+	return func(e *SMTPConfigHTTPChangedEvent) {
+		e.Description = &description
+	}
+}
+
+func ChangeSMTPConfigHTTPEndpoint(endpoint string) func(event *SMTPConfigHTTPChangedEvent) {
+	return func(e *SMTPConfigHTTPChangedEvent) {
+		e.Endpoint = &endpoint
+	}
+}
+
+type SMTPConfigActivatedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+	ID                    string `json:"id,omitempty"`
+}
+
+func NewSMTPConfigActivatedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	id string,
+) *SMTPConfigActivatedEvent {
+	return &SMTPConfigActivatedEvent{
+		BaseEvent: eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SMTPConfigActivatedEventType,
+		),
+		ID: id,
+	}
+}
+
+func (e *SMTPConfigActivatedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+
+func (e *SMTPConfigActivatedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMTPConfigActivatedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+type SMTPConfigDeactivatedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+	ID                    string `json:"id,omitempty"`
+}
+
+func NewSMTPConfigDeactivatedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	id string,
+) *SMTPConfigDeactivatedEvent {
+	return &SMTPConfigDeactivatedEvent{
+		BaseEvent: eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SMTPConfigDeactivatedEventType,
+		),
+		ID: id,
+	}
+}
+
+func (e *SMTPConfigDeactivatedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+
+func (e *SMTPConfigDeactivatedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMTPConfigDeactivatedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+type SMTPConfigRemovedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+	ID                    string `json:"id,omitempty"`
+}
+
+func NewSMTPConfigRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	id string,
+) *SMTPConfigRemovedEvent {
+	return &SMTPConfigRemovedEvent{
+		BaseEvent: eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SMTPConfigRemovedEventType,
+		),
+		ID: id,
+	}
+}
+
+func (e *SMTPConfigRemovedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+func (e *SMTPConfigRemovedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMTPConfigRemovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}

apps/api/internal/repository/instance/trusted_domain.go

@@ -0,0 +1,95 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+)
+
+const (
+	trustedDomainPrefix           = "trusted_domains."
+	UniqueTrustedDomain           = "trusted_domain"
+	TrustedDomainAddedEventType   = instanceEventTypePrefix + trustedDomainPrefix + "added"
+	TrustedDomainRemovedEventType = instanceEventTypePrefix + trustedDomainPrefix + "removed"
+)
+
+func NewAddTrustedDomainUniqueConstraint(trustedDomain string) *eventstore.UniqueConstraint {
+	return eventstore.NewAddEventUniqueConstraint(
+		UniqueTrustedDomain,
+		trustedDomain,
+		"Errors.Instance.Domain.AlreadyExists")
+}
+
+func NewRemoveTrustedDomainUniqueConstraint(trustedDomain string) *eventstore.UniqueConstraint {
+	return eventstore.NewRemoveUniqueConstraint(
+		UniqueTrustedDomain,
+		trustedDomain)
+}
+
+type TrustedDomainAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	Domain string `json:"domain"`
+}
+
+func (e *TrustedDomainAddedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = *event
+}
+
+func NewTrustedDomainAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	trustedDomain string,
+) *TrustedDomainAddedEvent {
+	event := &TrustedDomainAddedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			TrustedDomainAddedEventType,
+		),
+		Domain: trustedDomain,
+	}
+	return event
+}
+
+func (e *TrustedDomainAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *TrustedDomainAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return []*eventstore.UniqueConstraint{NewAddTrustedDomainUniqueConstraint(e.Domain)}
+}
+
+type TrustedDomainRemovedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	Domain string `json:"domain"`
+}
+
+func (e *TrustedDomainRemovedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = *event
+}
+
+func NewTrustedDomainRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	trustedDomain string,
+) *TrustedDomainRemovedEvent {
+	event := &TrustedDomainRemovedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			TrustedDomainRemovedEventType,
+		),
+		Domain: trustedDomain,
+	}
+	return event
+}
+
+func (e *TrustedDomainRemovedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *TrustedDomainRemovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return []*eventstore.UniqueConstraint{NewRemoveTrustedDomainUniqueConstraint(e.Domain)}
+}

apps/api/internal/repository/keypair/aggregate.go

@@ -0,0 +1,14 @@
+package keypair
+
+import (
+	"github.com/zitadel/zitadel/internal/eventstore"
+)
+
+const (
+	AggregateType    = "key_pair"
+	AggregateVersion = "v1"
+)
+
+type Aggregate struct {
+	eventstore.Aggregate
+}

apps/api/internal/repository/keypair/certificate.go

@@ -0,0 +1,59 @@
+package keypair
+
+import (
+	"context"
+	"time"
+
+	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	AddedCertificateEventType = eventTypePrefix + "certificate.added"
+)
+
+type AddedCertificateEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	Certificate *Key `json:"certificate"`
+}
+
+func (e *AddedCertificateEvent) Payload() interface{} {
+	return e
+}
+
+func (e *AddedCertificateEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewAddedCertificateEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	certificateCrypto *crypto.CryptoValue,
+	certificateExpiration time.Time) *AddedCertificateEvent {
+	return &AddedCertificateEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			AddedCertificateEventType,
+		),
+		Certificate: &Key{
+			Key:    certificateCrypto,
+			Expiry: certificateExpiration,
+		},
+	}
+}
+
+func AddedCertificateEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &AddedCertificateEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "KEY-4n9vs", "unable to unmarshal certificate added")
+	}
+
+	return e, nil
+}

apps/api/internal/repository/keypair/eventstore.go

@@ -0,0 +1,10 @@
+package keypair
+
+import (
+	"github.com/zitadel/zitadel/internal/eventstore"
+)
+
+func init() {
+	eventstore.RegisterFilterEventMapper(AggregateType, AddedEventType, AddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, AddedCertificateEventType, AddedCertificateEventMapper)
+}

apps/api/internal/repository/keypair/key_pair.go

@@ -0,0 +1,78 @@
+package keypair
+
+import (
+	"context"
+	"time"
+
+	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	eventTypePrefix = eventstore.EventType("key_pair.")
+	AddedEventType  = eventTypePrefix + "added"
+)
+
+type AddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	Usage      crypto.KeyUsage `json:"usage"`
+	Algorithm  string          `json:"algorithm"`
+	PrivateKey *Key            `json:"privateKey"`
+	PublicKey  *Key            `json:"publicKey"`
+}
+
+type Key struct {
+	Key    *crypto.CryptoValue `json:"key"`
+	Expiry time.Time           `json:"expiry"`
+}
+
+func (e *AddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *AddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	usage crypto.KeyUsage,
+	algorithm string,
+	privateCrypto,
+	publicCrypto *crypto.CryptoValue,
+	privateKeyExpiration,
+	publicKeyExpiration time.Time) *AddedEvent {
+	return &AddedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			AddedEventType,
+		),
+		Usage:     usage,
+		Algorithm: algorithm,
+		PrivateKey: &Key{
+			Key:    privateCrypto,
+			Expiry: privateKeyExpiration,
+		},
+		PublicKey: &Key{
+			Key:    publicCrypto,
+			Expiry: publicKeyExpiration,
+		},
+	}
+}
+
+func AddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &AddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "KEY-4n8vs", "unable to unmarshal key pair added")
+	}
+
+	return e, nil
+}

apps/api/internal/repository/limits/aggregate.go

@@ -0,0 +1,26 @@
+package limits
+
+import (
+	"github.com/zitadel/zitadel/internal/eventstore"
+)
+
+const (
+	AggregateType    = "limits"
+	AggregateVersion = "v1"
+)
+
+type Aggregate struct {
+	eventstore.Aggregate
+}
+
+func NewAggregate(id, instanceId string) *Aggregate {
+	return &Aggregate{
+		Aggregate: eventstore.Aggregate{
+			Type:          AggregateType,
+			Version:       AggregateVersion,
+			ID:            id,
+			InstanceID:    instanceId,
+			ResourceOwner: instanceId,
+		},
+	}
+}

apps/api/internal/repository/limits/events.go

@@ -0,0 +1,93 @@
+package limits
+
+import (
+	"context"
+	"time"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+)
+
+const (
+	eventTypePrefix = eventstore.EventType("limits.")
+	SetEventType    = eventTypePrefix + "set"
+	ResetEventType  = eventTypePrefix + "reset"
+)
+
+// SetEvent describes that limits are added or modified and contains only changed properties
+type SetEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+	AuditLogRetention     *time.Duration `json:"auditLogRetention,omitempty"`
+	Block                 *bool          `json:"block,omitempty"`
+}
+
+func (e *SetEvent) Payload() any {
+	return e
+}
+
+func (e *SetEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func (e *SetEvent) SetBaseEvent(b *eventstore.BaseEvent) {
+	e.BaseEvent = b
+}
+
+func NewSetEvent(
+	base *eventstore.BaseEvent,
+	changes ...LimitsChange,
+) *SetEvent {
+	changedEvent := &SetEvent{
+		BaseEvent: base,
+	}
+	for _, change := range changes {
+		change(changedEvent)
+	}
+	return changedEvent
+}
+
+type LimitsChange func(*SetEvent)
+
+func ChangeAuditLogRetention(auditLogRetention *time.Duration) LimitsChange {
+	return func(e *SetEvent) {
+		e.AuditLogRetention = auditLogRetention
+	}
+}
+
+func ChangeBlock(block *bool) LimitsChange {
+	return func(e *SetEvent) {
+		e.Block = block
+	}
+}
+
+var SetEventMapper = eventstore.GenericEventMapper[SetEvent]
+
+type ResetEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+}
+
+func (e *ResetEvent) Payload() any {
+	return e
+}
+
+func (e *ResetEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func (e *ResetEvent) SetBaseEvent(b *eventstore.BaseEvent) {
+	e.BaseEvent = b
+}
+
+func NewResetEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+) *ResetEvent {
+	return &ResetEvent{
+		BaseEvent: eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			ResetEventType,
+		),
+	}
+}
+
+var ResetEventMapper = eventstore.GenericEventMapper[ResetEvent]

apps/api/internal/repository/limits/eventstore.go

@@ -0,0 +1,10 @@
+package limits
+
+import (
+	"github.com/zitadel/zitadel/internal/eventstore"
+)
+
+func init() {
+	eventstore.RegisterFilterEventMapper(AggregateType, SetEventType, SetEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, ResetEventType, ResetEventMapper)
+}

apps/api/internal/repository/member/events.go

@@ -0,0 +1,279 @@
+package member
+
+import (
+	"fmt"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+// Event types
+const (
+	UniqueMember            = "member"
+	AddedEventType          = "member.added"
+	ChangedEventType        = "member.changed"
+	RemovedEventType        = "member.removed"
+	CascadeRemovedEventType = "member.cascade.removed"
+)
+
+// Field table and unique types
+const (
+	memberRoleTypeSuffix  string = "_member_role"
+	MemberRoleRevision    uint8  = 1
+	roleSearchFieldSuffix string = "_role"
+)
+
+func NewAddMemberUniqueConstraint(aggregateID, userID string) *eventstore.UniqueConstraint {
+	return eventstore.NewAddEventUniqueConstraint(
+		UniqueMember,
+		fmt.Sprintf("%s:%s", aggregateID, userID),
+		"Errors.Member.AlreadyExists")
+}
+
+func NewRemoveMemberUniqueConstraint(aggregateID, userID string) *eventstore.UniqueConstraint {
+	return eventstore.NewRemoveUniqueConstraint(
+		UniqueMember,
+		fmt.Sprintf("%s:%s", aggregateID, userID),
+	)
+}
+
+type MemberAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	Roles  []string `json:"roles"`
+	UserID string   `json:"userId"`
+}
+
+func (e *MemberAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *MemberAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return []*eventstore.UniqueConstraint{NewAddMemberUniqueConstraint(e.Aggregate().ID, e.UserID)}
+}
+
+func (e *MemberAddedEvent) FieldOperations(prefix string) []*eventstore.FieldOperation {
+	ops := make([]*eventstore.FieldOperation, len(e.Roles))
+	for i, role := range e.Roles {
+		ops[i] = eventstore.SetField(
+			e.Aggregate(),
+			memberSearchObject(prefix, e.UserID),
+			prefix+roleSearchFieldSuffix,
+			&eventstore.Value{
+				Value:        role,
+				MustBeUnique: false,
+				ShouldIndex:  true,
+			},
+
+			eventstore.FieldTypeInstanceID,
+			eventstore.FieldTypeResourceOwner,
+			eventstore.FieldTypeAggregateType,
+			eventstore.FieldTypeAggregateID,
+			eventstore.FieldTypeObjectType,
+			eventstore.FieldTypeObjectID,
+			eventstore.FieldTypeFieldName,
+			eventstore.FieldTypeValue,
+		)
+	}
+	return ops
+}
+
+func NewMemberAddedEvent(
+	base *eventstore.BaseEvent,
+	userID string,
+	roles ...string,
+) *MemberAddedEvent {
+
+	return &MemberAddedEvent{
+		BaseEvent: *base,
+		Roles:     roles,
+		UserID:    userID,
+	}
+}
+
+func MemberAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &MemberAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "POLIC-puqv4", "unable to unmarshal label policy")
+	}
+
+	return e, nil
+}
+
+type MemberChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	Roles  []string `json:"roles,omitempty"`
+	UserID string   `json:"userId,omitempty"`
+}
+
+func (e *MemberChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *MemberChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+// FieldOperations removes the existing membership role fields first and sets the new roles after.
+func (e *MemberChangedEvent) FieldOperations(prefix string) []*eventstore.FieldOperation {
+	ops := make([]*eventstore.FieldOperation, len(e.Roles)+1)
+	ops[0] = eventstore.RemoveSearchFieldsByAggregateAndObject(
+		e.Aggregate(),
+		memberSearchObject(prefix, e.UserID),
+	)
+
+	for i, role := range e.Roles {
+		ops[i+1] = eventstore.SetField(
+			e.Aggregate(),
+			memberSearchObject(prefix, e.UserID),
+			prefix+roleSearchFieldSuffix,
+			&eventstore.Value{
+				Value:        role,
+				MustBeUnique: false,
+				ShouldIndex:  true,
+			},
+
+			eventstore.FieldTypeInstanceID,
+			eventstore.FieldTypeResourceOwner,
+			eventstore.FieldTypeAggregateType,
+			eventstore.FieldTypeAggregateID,
+			eventstore.FieldTypeObjectType,
+			eventstore.FieldTypeObjectID,
+			eventstore.FieldTypeFieldName,
+			eventstore.FieldTypeValue,
+		)
+	}
+	return ops
+}
+
+func NewMemberChangedEvent(
+	base *eventstore.BaseEvent,
+	userID string,
+	roles ...string,
+) *MemberChangedEvent {
+	return &MemberChangedEvent{
+		BaseEvent: *base,
+		Roles:     roles,
+		UserID:    userID,
+	}
+}
+
+func ChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &MemberChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "POLIC-puqv4", "unable to unmarshal label policy")
+	}
+
+	return e, nil
+}
+
+type MemberRemovedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	UserID string `json:"userId"`
+}
+
+func (e *MemberRemovedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *MemberRemovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return []*eventstore.UniqueConstraint{NewRemoveMemberUniqueConstraint(e.Aggregate().ID, e.UserID)}
+}
+
+func (e *MemberRemovedEvent) FieldOperations(prefix string) []*eventstore.FieldOperation {
+	return []*eventstore.FieldOperation{
+		eventstore.RemoveSearchFieldsByAggregateAndObject(
+			e.Aggregate(),
+			memberSearchObject(prefix, e.UserID),
+		),
+	}
+}
+
+func NewRemovedEvent(
+	base *eventstore.BaseEvent,
+	userID string,
+) *MemberRemovedEvent {
+
+	return &MemberRemovedEvent{
+		BaseEvent: *base,
+		UserID:    userID,
+	}
+}
+
+func RemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &MemberRemovedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "MEMBER-Ep4ip", "unable to unmarshal label policy")
+	}
+
+	return e, nil
+}
+
+type MemberCascadeRemovedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	UserID string `json:"userId"`
+}
+
+func (e *MemberCascadeRemovedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *MemberCascadeRemovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return []*eventstore.UniqueConstraint{NewRemoveMemberUniqueConstraint(e.Aggregate().ID, e.UserID)}
+}
+
+func (e *MemberCascadeRemovedEvent) FieldOperations(prefix string) []*eventstore.FieldOperation {
+	return []*eventstore.FieldOperation{
+		eventstore.RemoveSearchFieldsByAggregateAndObject(
+			e.Aggregate(),
+			memberSearchObject(prefix, e.UserID),
+		),
+	}
+}
+
+func NewCascadeRemovedEvent(
+	base *eventstore.BaseEvent,
+	userID string,
+) *MemberCascadeRemovedEvent {
+
+	return &MemberCascadeRemovedEvent{
+		BaseEvent: *base,
+		UserID:    userID,
+	}
+}
+
+func CascadeRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &MemberCascadeRemovedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "MEMBER-3j9sf", "unable to unmarshal label policy")
+	}
+
+	return e, nil
+}
+
+func memberSearchObject(prefix, userID string) eventstore.Object {
+	return eventstore.Object{
+		Type:     prefix + memberRoleTypeSuffix,
+		ID:       userID,
+		Revision: MemberRoleRevision,
+	}
+}

apps/api/internal/repository/metadata/metadata.go

@@ -0,0 +1,117 @@
+package metadata
+
+import (
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	SetEventType        = "metadata.set"
+	RemovedEventType    = "metadata.removed"
+	RemovedAllEventType = "metadata.removed.all"
+)
+
+type SetEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	Key   string `json:"key"`
+	Value []byte `json:"value"`
+}
+
+func (e *SetEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SetEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewSetEvent(
+	base *eventstore.BaseEvent,
+	key string,
+	value []byte,
+) *SetEvent {
+	return &SetEvent{
+		BaseEvent: *base,
+		Key:       key,
+		Value:     value,
+	}
+}
+
+func SetEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &SetEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "META-3n9fs", "unable to unmarshal metadata set")
+	}
+
+	return e, nil
+}
+
+type RemovedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	Key string `json:"key"`
+}
+
+func (e *RemovedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *RemovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewRemovedEvent(
+	base *eventstore.BaseEvent,
+	key string,
+) *RemovedEvent {
+
+	return &RemovedEvent{
+		BaseEvent: *base,
+		Key:       key,
+	}
+}
+
+func RemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &RemovedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "META-2m99f", "unable to unmarshal metadata removed")
+	}
+
+	return e, nil
+}
+
+type RemovedAllEvent struct {
+	eventstore.BaseEvent `json:"-"`
+}
+
+func (e *RemovedAllEvent) Payload() interface{} {
+	return nil
+}
+
+func (e *RemovedAllEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewRemovedAllEvent(
+	base *eventstore.BaseEvent,
+) *RemovedAllEvent {
+
+	return &RemovedAllEvent{
+		BaseEvent: *base,
+	}
+}
+
+func RemovedAllEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	return &RemovedAllEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}, nil
+}

apps/api/internal/repository/milestone/aggregate.go

@@ -0,0 +1,33 @@
+package milestone
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/api/authz"
+	"github.com/zitadel/zitadel/internal/eventstore"
+)
+
+const (
+	AggregateType    = "milestone"
+	AggregateVersion = "v2"
+)
+
+type Aggregate struct {
+	eventstore.Aggregate
+}
+
+func NewAggregate(ctx context.Context) *Aggregate {
+	return NewInstanceAggregate(authz.GetInstance(ctx).InstanceID())
+}
+
+func NewInstanceAggregate(instanceID string) *Aggregate {
+	return &Aggregate{
+		Aggregate: eventstore.Aggregate{
+			Type:          AggregateType,
+			Version:       AggregateVersion,
+			ID:            instanceID,
+			ResourceOwner: instanceID,
+			InstanceID:    instanceID,
+		},
+	}
+}

apps/api/internal/repository/milestone/events.go

@@ -0,0 +1,139 @@
+package milestone
+
+import (
+	"context"
+	"time"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+)
+
+//go:generate enumer -type Type -json -linecomment
+type Type int
+
+const (
+	InstanceCreated Type = iota + 1
+	AuthenticationSucceededOnInstance
+	ProjectCreated
+	ApplicationCreated
+	AuthenticationSucceededOnApplication
+	InstanceDeleted
+)
+
+const (
+	eventTypePrefix  = "milestone.v2."
+	ReachedEventType = eventTypePrefix + "reached"
+	PushedEventType  = eventTypePrefix + "pushed"
+)
+
+type ReachedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+	MilestoneType         Type       `json:"type"`
+	ReachedDate           *time.Time `json:"reachedDate,omitempty"` // Defaults to [eventstore.BaseEvent.Creation] when empty
+}
+
+// Payload implements eventstore.Command.
+func (e *ReachedEvent) Payload() any {
+	return e
+}
+
+func (e *ReachedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func (e *ReachedEvent) SetBaseEvent(b *eventstore.BaseEvent) {
+	e.BaseEvent = b
+}
+
+func (e *ReachedEvent) GetReachedDate() time.Time {
+	if e.ReachedDate != nil {
+		return *e.ReachedDate
+	}
+	return e.Creation
+}
+
+func NewReachedEvent(
+	ctx context.Context,
+	aggregate *Aggregate,
+	typ Type,
+) *ReachedEvent {
+	return NewReachedEventWithDate(ctx, aggregate, typ, nil)
+}
+
+// NewReachedEventWithDate creates a [ReachedEvent] with a fixed Reached Date.
+func NewReachedEventWithDate(
+	ctx context.Context,
+	aggregate *Aggregate,
+	typ Type,
+	reachedDate *time.Time,
+) *ReachedEvent {
+	return &ReachedEvent{
+		BaseEvent: eventstore.NewBaseEventForPush(
+			ctx,
+			&aggregate.Aggregate,
+			ReachedEventType,
+		),
+		MilestoneType: typ,
+		ReachedDate:   reachedDate,
+	}
+}
+
+type PushedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+	MilestoneType         Type       `json:"type"`
+	ExternalDomain        string     `json:"externalDomain"`
+	PrimaryDomain         string     `json:"primaryDomain"`
+	Endpoints             []string   `json:"endpoints"`
+	PushedDate            *time.Time `json:"pushedDate,omitempty"` // Defaults to [eventstore.BaseEvent.Creation] when empty
+}
+
+// Payload implements eventstore.Command.
+func (p *PushedEvent) Payload() any {
+	return p
+}
+
+func (p *PushedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func (p *PushedEvent) SetBaseEvent(b *eventstore.BaseEvent) {
+	p.BaseEvent = b
+}
+
+func (e *PushedEvent) GetPushedDate() time.Time {
+	if e.PushedDate != nil {
+		return *e.PushedDate
+	}
+	return e.Creation
+}
+
+func NewPushedEvent(
+	ctx context.Context,
+	aggregate *Aggregate,
+	typ Type,
+	endpoints []string,
+	externalDomain string,
+) *PushedEvent {
+	return NewPushedEventWithDate(ctx, aggregate, typ, endpoints, externalDomain, nil)
+}
+
+// NewPushedEventWithDate creates a [PushedEvent] with a fixed Pushed Date.
+func NewPushedEventWithDate(
+	ctx context.Context,
+	aggregate *Aggregate,
+	typ Type,
+	endpoints []string,
+	externalDomain string,
+	pushedDate *time.Time,
+) *PushedEvent {
+	return &PushedEvent{
+		BaseEvent: eventstore.NewBaseEventForPush(
+			ctx,
+			&aggregate.Aggregate,
+			PushedEventType,
+		),
+		MilestoneType:  typ,
+		Endpoints:      endpoints,
+		ExternalDomain: externalDomain,
+		PushedDate:     pushedDate,
+	}
+}

apps/api/internal/repository/milestone/eventstore.go

@@ -0,0 +1,15 @@
+package milestone
+
+import (
+	"github.com/zitadel/zitadel/internal/eventstore"
+)
+
+var (
+	ReachedEventMapper = eventstore.GenericEventMapper[ReachedEvent]
+	PushedEventMapper  = eventstore.GenericEventMapper[PushedEvent]
+)
+
+func init() {
+	eventstore.RegisterFilterEventMapper(AggregateType, ReachedEventType, ReachedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, PushedEventType, PushedEventMapper)
+}

apps/api/internal/repository/milestone/type_enumer.go

@@ -0,0 +1,113 @@
+// Code generated by "enumer -type Type -json -linecomment"; DO NOT EDIT.
+
+package milestone
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+)
+
+const _TypeName = "InstanceCreatedAuthenticationSucceededOnInstanceProjectCreatedApplicationCreatedAuthenticationSucceededOnApplicationInstanceDeleted"
+
+var _TypeIndex = [...]uint8{0, 15, 48, 62, 80, 116, 131}
+
+const _TypeLowerName = "instancecreatedauthenticationsucceededoninstanceprojectcreatedapplicationcreatedauthenticationsucceededonapplicationinstancedeleted"
+
+func (i Type) String() string {
+	i -= 1
+	if i < 0 || i >= Type(len(_TypeIndex)-1) {
+		return fmt.Sprintf("Type(%d)", i+1)
+	}
+	return _TypeName[_TypeIndex[i]:_TypeIndex[i+1]]
+}
+
+// An "invalid array index" compiler error signifies that the constant values have changed.
+// Re-run the stringer command to generate them again.
+func _TypeNoOp() {
+	var x [1]struct{}
+	_ = x[InstanceCreated-(1)]
+	_ = x[AuthenticationSucceededOnInstance-(2)]
+	_ = x[ProjectCreated-(3)]
+	_ = x[ApplicationCreated-(4)]
+	_ = x[AuthenticationSucceededOnApplication-(5)]
+	_ = x[InstanceDeleted-(6)]
+}
+
+var _TypeValues = []Type{InstanceCreated, AuthenticationSucceededOnInstance, ProjectCreated, ApplicationCreated, AuthenticationSucceededOnApplication, InstanceDeleted}
+
+var _TypeNameToValueMap = map[string]Type{
+	_TypeName[0:15]:         InstanceCreated,
+	_TypeLowerName[0:15]:    InstanceCreated,
+	_TypeName[15:48]:        AuthenticationSucceededOnInstance,
+	_TypeLowerName[15:48]:   AuthenticationSucceededOnInstance,
+	_TypeName[48:62]:        ProjectCreated,
+	_TypeLowerName[48:62]:   ProjectCreated,
+	_TypeName[62:80]:        ApplicationCreated,
+	_TypeLowerName[62:80]:   ApplicationCreated,
+	_TypeName[80:116]:       AuthenticationSucceededOnApplication,
+	_TypeLowerName[80:116]:  AuthenticationSucceededOnApplication,
+	_TypeName[116:131]:      InstanceDeleted,
+	_TypeLowerName[116:131]: InstanceDeleted,
+}
+
+var _TypeNames = []string{
+	_TypeName[0:15],
+	_TypeName[15:48],
+	_TypeName[48:62],
+	_TypeName[62:80],
+	_TypeName[80:116],
+	_TypeName[116:131],
+}
+
+// TypeString retrieves an enum value from the enum constants string name.
+// Throws an error if the param is not part of the enum.
+func TypeString(s string) (Type, error) {
+	if val, ok := _TypeNameToValueMap[s]; ok {
+		return val, nil
+	}
+
+	if val, ok := _TypeNameToValueMap[strings.ToLower(s)]; ok {
+		return val, nil
+	}
+	return 0, fmt.Errorf("%s does not belong to Type values", s)
+}
+
+// TypeValues returns all values of the enum
+func TypeValues() []Type {
+	return _TypeValues
+}
+
+// TypeStrings returns a slice of all String values of the enum
+func TypeStrings() []string {
+	strs := make([]string, len(_TypeNames))
+	copy(strs, _TypeNames)
+	return strs
+}
+
+// IsAType returns "true" if the value is listed in the enum definition. "false" otherwise
+func (i Type) IsAType() bool {
+	for _, v := range _TypeValues {
+		if i == v {
+			return true
+		}
+	}
+	return false
+}
+
+// MarshalJSON implements the json.Marshaler interface for Type
+func (i Type) MarshalJSON() ([]byte, error) {
+	return json.Marshal(i.String())
+}
+
+// UnmarshalJSON implements the json.Unmarshaler interface for Type
+func (i *Type) UnmarshalJSON(data []byte) error {
+	var s string
+	if err := json.Unmarshal(data, &s); err != nil {
+		return fmt.Errorf("Type should be a string, got %s", data)
+	}
+
+	var err error
+	*i, err = TypeString(s)
+	return err
+}

apps/api/internal/repository/notification/notification.go

@@ -0,0 +1,34 @@
+package notification
+
+import (
+	"time"
+
+	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/domain"
+	"github.com/zitadel/zitadel/internal/eventstore"
+)
+
+const (
+	QueueName = "notification"
+)
+
+type Request struct {
+	Aggregate                     *eventstore.Aggregate         `json:"aggregate"`
+	UserID                        string                        `json:"userID"`
+	UserResourceOwner             string                        `json:"userResourceOwner"`
+	TriggeredAtOrigin             string                        `json:"triggeredAtOrigin"`
+	EventType                     eventstore.EventType          `json:"eventType"`
+	MessageType                   string                        `json:"messageType"`
+	NotificationType              domain.NotificationType       `json:"notificationType"`
+	URLTemplate                   string                        `json:"urlTemplate,omitempty"`
+	CodeExpiry                    time.Duration                 `json:"codeExpiry,omitempty"`
+	Code                          *crypto.CryptoValue           `json:"code,omitempty"`
+	UnverifiedNotificationChannel bool                          `json:"unverifiedNotificationChannel,omitempty"`
+	IsOTP                         bool                          `json:"isOTP,omitempty"`
+	RequiresPreviousDomain        bool                          `json:"requiresPreviousDomain,omitempty"`
+	Args                          *domain.NotificationArguments `json:"args,omitempty"`
+}
+
+func (e *Request) Kind() string {
+	return "notification_request"
+}

apps/api/internal/repository/oidcsession/aggregate.go

@@ -0,0 +1,25 @@
+package oidcsession
+
+import (
+	"github.com/zitadel/zitadel/internal/eventstore"
+)
+
+const (
+	AggregateType    = "oidc_session"
+	AggregateVersion = "v1"
+)
+
+type Aggregate struct {
+	eventstore.Aggregate
+}
+
+func NewAggregate(id, resourceOwner string) *Aggregate {
+	return &Aggregate{
+		Aggregate: eventstore.Aggregate{
+			Type:          AggregateType,
+			Version:       AggregateVersion,
+			ID:            id,
+			ResourceOwner: resourceOwner,
+		},
+	}
+}

apps/api/internal/repository/oidcsession/eventstore.go

@@ -0,0 +1,15 @@
+package oidcsession
+
+import (
+	"github.com/zitadel/zitadel/internal/eventstore"
+)
+
+func init() {
+	eventstore.RegisterFilterEventMapper(AggregateType, AddedType, eventstore.GenericEventMapper[AddedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, AccessTokenAddedType, eventstore.GenericEventMapper[AccessTokenAddedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, AccessTokenRevokedType, eventstore.GenericEventMapper[AccessTokenRevokedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, RefreshTokenAddedType, eventstore.GenericEventMapper[RefreshTokenAddedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, RefreshTokenRenewedType, eventstore.GenericEventMapper[RefreshTokenRenewedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, RefreshTokenRevokedType, eventstore.GenericEventMapper[RefreshTokenRevokedEvent])
+
+}

apps/api/internal/repository/oidcsession/oidc_session.go

@@ -0,0 +1,261 @@
+package oidcsession
+
+import (
+	"context"
+	"time"
+
+	"golang.org/x/text/language"
+
+	"github.com/zitadel/zitadel/internal/domain"
+	"github.com/zitadel/zitadel/internal/eventstore"
+)
+
+const (
+	oidcSessionEventPrefix  = "oidc_session."
+	AddedType               = oidcSessionEventPrefix + "added"
+	AccessTokenAddedType    = oidcSessionEventPrefix + "access_token.added"
+	AccessTokenRevokedType  = oidcSessionEventPrefix + "access_token.revoked"
+	RefreshTokenAddedType   = oidcSessionEventPrefix + "refresh_token.added"
+	RefreshTokenRenewedType = oidcSessionEventPrefix + "refresh_token.renewed"
+	RefreshTokenRevokedType = oidcSessionEventPrefix + "refresh_token.revoked"
+)
+
+type AddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	UserID            string                      `json:"userID"`
+	UserResourceOwner string                      `json:"userResourceOwner"`
+	SessionID         string                      `json:"sessionID"`
+	ClientID          string                      `json:"clientID"`
+	Audience          []string                    `json:"audience"`
+	Scope             []string                    `json:"scope"`
+	AuthMethods       []domain.UserAuthMethodType `json:"authMethods"`
+	AuthTime          time.Time                   `json:"authTime"`
+	Nonce             string                      `json:"nonce,omitempty"`
+	PreferredLanguage *language.Tag               `json:"preferredLanguage,omitempty"`
+	UserAgent         *domain.UserAgent           `json:"userAgent,omitempty"`
+}
+
+func (e *AddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *AddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func (e *AddedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = *event
+}
+
+func NewAddedEvent(ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	userID,
+	userResourceOwner,
+	sessionID,
+	clientID string,
+	audience,
+	scope []string,
+	authMethods []domain.UserAuthMethodType,
+	authTime time.Time,
+	nonce string,
+	preferredLanguage *language.Tag,
+	userAgent *domain.UserAgent,
+) *AddedEvent {
+	return &AddedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			AddedType,
+		),
+		UserID:            userID,
+		UserResourceOwner: userResourceOwner,
+		SessionID:         sessionID,
+		ClientID:          clientID,
+		Audience:          audience,
+		Scope:             scope,
+		AuthMethods:       authMethods,
+		AuthTime:          authTime,
+		Nonce:             nonce,
+		PreferredLanguage: preferredLanguage,
+		UserAgent:         userAgent,
+	}
+}
+
+type AccessTokenAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID       string             `json:"id,omitempty"`
+	Scope    []string           `json:"scope,omitempty"`
+	Lifetime time.Duration      `json:"lifetime,omitempty"`
+	Reason   domain.TokenReason `json:"reason,omitempty"`
+	Actor    *domain.TokenActor `json:"actor,omitempty"`
+}
+
+func (e *AccessTokenAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *AccessTokenAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func (e *AccessTokenAddedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = *event
+}
+
+func NewAccessTokenAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	id string,
+	scope []string,
+	lifetime time.Duration,
+	reason domain.TokenReason,
+	actor *domain.TokenActor,
+) *AccessTokenAddedEvent {
+	return &AccessTokenAddedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			AccessTokenAddedType,
+		),
+		ID:       id,
+		Scope:    scope,
+		Lifetime: lifetime,
+		Reason:   reason,
+		Actor:    actor,
+	}
+}
+
+type AccessTokenRevokedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+}
+
+func (e *AccessTokenRevokedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *AccessTokenRevokedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func (e *AccessTokenRevokedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = *event
+}
+
+func NewAccessTokenRevokedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+) *AccessTokenAddedEvent {
+	return &AccessTokenAddedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			AccessTokenRevokedType,
+		),
+	}
+}
+
+type RefreshTokenAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID           string        `json:"id"`
+	Lifetime     time.Duration `json:"lifetime"`
+	IdleLifetime time.Duration `json:"idleLifetime"`
+}
+
+func (e *RefreshTokenAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *RefreshTokenAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func (e *RefreshTokenAddedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = *event
+}
+
+func NewRefreshTokenAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	id string,
+	lifetime,
+	idleLifetime time.Duration,
+) *RefreshTokenAddedEvent {
+	return &RefreshTokenAddedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			RefreshTokenAddedType,
+		),
+		ID:           id,
+		Lifetime:     lifetime,
+		IdleLifetime: idleLifetime,
+	}
+}
+
+type RefreshTokenRenewedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID           string        `json:"id"`
+	IdleLifetime time.Duration `json:"idleLifetime"`
+}
+
+func (e *RefreshTokenRenewedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *RefreshTokenRenewedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func (e *RefreshTokenRenewedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = *event
+}
+
+func NewRefreshTokenRenewedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	id string,
+	idleLifetime time.Duration,
+) *RefreshTokenRenewedEvent {
+	return &RefreshTokenRenewedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			RefreshTokenRenewedType,
+		),
+		ID:           id,
+		IdleLifetime: idleLifetime,
+	}
+}
+
+type RefreshTokenRevokedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+}
+
+func (e *RefreshTokenRevokedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *RefreshTokenRevokedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func (e *RefreshTokenRevokedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = *event
+}
+
+func NewRefreshTokenRevokedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+) *RefreshTokenRevokedEvent {
+	return &RefreshTokenRevokedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			RefreshTokenRevokedType,
+		),
+	}
+}

apps/api/internal/repository/org/aggregate.go

@@ -0,0 +1,35 @@
+package org
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+)
+
+const (
+	orgEventTypePrefix = eventstore.EventType("org.")
+)
+
+const (
+	AggregateType    = "org"
+	AggregateVersion = "v1"
+)
+
+type Aggregate struct {
+	eventstore.Aggregate
+}
+
+func NewAggregate(id string) *Aggregate {
+	return &Aggregate{
+		Aggregate: eventstore.Aggregate{
+			Type:          AggregateType,
+			Version:       AggregateVersion,
+			ID:            id,
+			ResourceOwner: id,
+		},
+	}
+}
+
+func AggregateFromWriteModel(ctx context.Context, wm *eventstore.WriteModel) *eventstore.Aggregate {
+	return eventstore.AggregateFromWriteModelCtx(ctx, wm, AggregateType, AggregateVersion)
+}

apps/api/internal/repository/org/custom_text.go

@@ -0,0 +1,105 @@
+package org
+
+import (
+	"context"
+
+	"golang.org/x/text/language"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/policy"
+)
+
+var (
+	CustomTextSetEventType             = orgEventTypePrefix + policy.CustomTextSetEventType
+	CustomTextRemovedEventType         = orgEventTypePrefix + policy.CustomTextRemovedEventType
+	CustomTextTemplateRemovedEventType = orgEventTypePrefix + policy.CustomTextTemplateRemovedEventType
+)
+
+type CustomTextSetEvent struct {
+	policy.CustomTextSetEvent
+}
+
+func NewCustomTextSetEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	template,
+	key,
+	text string,
+	language language.Tag,
+) *CustomTextSetEvent {
+	return &CustomTextSetEvent{
+		CustomTextSetEvent: *policy.NewCustomTextSetEvent(
+			eventstore.NewBaseEventForPush(ctx, aggregate, CustomTextSetEventType),
+			template,
+			key,
+			text,
+			language),
+	}
+}
+
+func CustomTextSetEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.CustomTextSetEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &CustomTextSetEvent{CustomTextSetEvent: *e.(*policy.CustomTextSetEvent)}, nil
+}
+
+type CustomTextRemovedEvent struct {
+	policy.CustomTextRemovedEvent
+}
+
+func NewCustomTextRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	template,
+	key string,
+	language language.Tag,
+) *CustomTextRemovedEvent {
+	return &CustomTextRemovedEvent{
+		CustomTextRemovedEvent: *policy.NewCustomTextRemovedEvent(
+			eventstore.NewBaseEventForPush(ctx, aggregate, CustomTextRemovedEventType),
+			template,
+			key,
+			language,
+		),
+	}
+}
+
+func CustomTextRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.CustomTextRemovedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &CustomTextRemovedEvent{CustomTextRemovedEvent: *e.(*policy.CustomTextRemovedEvent)}, nil
+}
+
+type CustomTextTemplateRemovedEvent struct {
+	policy.CustomTextTemplateRemovedEvent
+}
+
+func NewCustomTextTemplateRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	template string,
+	language language.Tag,
+) *CustomTextTemplateRemovedEvent {
+	return &CustomTextTemplateRemovedEvent{
+		CustomTextTemplateRemovedEvent: *policy.NewCustomTextTemplateRemovedEvent(
+			eventstore.NewBaseEventForPush(ctx, aggregate, CustomTextTemplateRemovedEventType),
+			template,
+			language,
+		),
+	}
+}
+
+func CustomTextTemplateRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.CustomTextTemplateRemovedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &CustomTextTemplateRemovedEvent{CustomTextTemplateRemovedEvent: *e.(*policy.CustomTextTemplateRemovedEvent)}, nil
+}

apps/api/internal/repository/org/domain.go

@@ -0,0 +1,348 @@
+package org
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/domain"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	UniqueOrgDomain                      = "org_domain"
+	domainEventPrefix                    = orgEventTypePrefix + "domain."
+	OrgDomainAddedEventType              = domainEventPrefix + "added"
+	OrgDomainVerificationAddedEventType  = domainEventPrefix + "verification.added"
+	OrgDomainVerificationFailedEventType = domainEventPrefix + "verification.failed"
+	OrgDomainVerifiedEventType           = domainEventPrefix + "verified"
+	OrgDomainPrimarySetEventType         = domainEventPrefix + "primary.set"
+	OrgDomainRemovedEventType            = domainEventPrefix + "removed"
+
+	OrgDomainSearchType          = "org_domain"
+	OrgDomainVerifiedSearchField = "verified"
+	OrgDomainObjectRevision      = uint8(1)
+)
+
+func NewAddOrgDomainUniqueConstraint(orgDomain string) *eventstore.UniqueConstraint {
+	return eventstore.NewAddEventUniqueConstraint(
+		UniqueOrgDomain,
+		orgDomain,
+		"Errors.Org.Domain.AlreadyExists")
+}
+
+func NewRemoveOrgDomainUniqueConstraint(orgDomain string) *eventstore.UniqueConstraint {
+	return eventstore.NewRemoveUniqueConstraint(
+		UniqueOrgDomain,
+		orgDomain)
+}
+
+type DomainAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	Domain string `json:"domain,omitempty"`
+}
+
+func (e *DomainAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *DomainAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func (e *DomainAddedEvent) Fields() []*eventstore.FieldOperation {
+	return []*eventstore.FieldOperation{
+		eventstore.SetField(
+			e.Aggregate(),
+			domainSearchObject(e.Domain),
+			OrgDomainVerifiedSearchField,
+			&eventstore.Value{
+				Value:       false,
+				ShouldIndex: false,
+			},
+
+			eventstore.FieldTypeInstanceID,
+			eventstore.FieldTypeResourceOwner,
+			eventstore.FieldTypeAggregateType,
+			eventstore.FieldTypeAggregateID,
+			eventstore.FieldTypeObjectType,
+			eventstore.FieldTypeObjectID,
+			eventstore.FieldTypeFieldName,
+		),
+	}
+}
+
+func NewDomainAddedEvent(ctx context.Context, aggregate *eventstore.Aggregate, domain string) *DomainAddedEvent {
+	return &DomainAddedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			OrgDomainAddedEventType,
+		),
+		Domain: domain,
+	}
+}
+
+func DomainAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	orgDomainAdded := &DomainAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(orgDomainAdded)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "ORG-GBr52", "unable to unmarshal org domain added")
+	}
+
+	return orgDomainAdded, nil
+}
+
+type DomainVerificationAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	Domain         string                         `json:"domain,omitempty"`
+	ValidationType domain.OrgDomainValidationType `json:"validationType,omitempty"`
+	ValidationCode *crypto.CryptoValue            `json:"validationCode,omitempty"`
+}
+
+func (e *DomainVerificationAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *DomainVerificationAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewDomainVerificationAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	domain string,
+	validationType domain.OrgDomainValidationType,
+	validationCode *crypto.CryptoValue) *DomainVerificationAddedEvent {
+	return &DomainVerificationAddedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			OrgDomainVerificationAddedEventType,
+		),
+		Domain:         domain,
+		ValidationType: validationType,
+		ValidationCode: validationCode,
+	}
+}
+
+func DomainVerificationAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	orgDomainVerificationAdded := &DomainVerificationAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(orgDomainVerificationAdded)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "ORG-NRN32", "unable to unmarshal org domain verification added")
+	}
+
+	return orgDomainVerificationAdded, nil
+}
+
+type DomainVerificationFailedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	Domain string `json:"domain,omitempty"`
+}
+
+func (e *DomainVerificationFailedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *DomainVerificationFailedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewDomainVerificationFailedEvent(ctx context.Context, aggregate *eventstore.Aggregate, domain string) *DomainVerificationFailedEvent {
+	return &DomainVerificationFailedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			OrgDomainVerificationFailedEventType,
+		),
+		Domain: domain,
+	}
+}
+
+func DomainVerificationFailedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	orgDomainVerificationFailed := &DomainVerificationFailedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(orgDomainVerificationFailed)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "ORG-Bhm37", "unable to unmarshal org domain verification failed")
+	}
+
+	return orgDomainVerificationFailed, nil
+}
+
+type DomainVerifiedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	Domain string `json:"domain,omitempty"`
+}
+
+func (e *DomainVerifiedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *DomainVerifiedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return []*eventstore.UniqueConstraint{NewAddOrgDomainUniqueConstraint(e.Domain)}
+}
+
+func (e *DomainVerifiedEvent) Fields() []*eventstore.FieldOperation {
+	return []*eventstore.FieldOperation{
+		eventstore.SetField(
+			e.Aggregate(),
+			domainSearchObject(e.Domain),
+			OrgDomainVerifiedSearchField,
+			&eventstore.Value{
+				Value:       true,
+				ShouldIndex: false,
+			},
+
+			eventstore.FieldTypeInstanceID,
+			eventstore.FieldTypeResourceOwner,
+			eventstore.FieldTypeAggregateType,
+			eventstore.FieldTypeAggregateID,
+			eventstore.FieldTypeObjectType,
+			eventstore.FieldTypeObjectID,
+			eventstore.FieldTypeFieldName,
+		),
+	}
+}
+
+func NewDomainVerifiedEvent(ctx context.Context, aggregate *eventstore.Aggregate, domain string) *DomainVerifiedEvent {
+	return &DomainVerifiedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			OrgDomainVerifiedEventType,
+		),
+		Domain: domain,
+	}
+}
+
+func DomainVerifiedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	orgDomainVerified := &DomainVerifiedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(orgDomainVerified)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "ORG-BFSwt", "unable to unmarshal org domain verified")
+	}
+
+	return orgDomainVerified, nil
+}
+
+type DomainPrimarySetEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	Domain string `json:"domain,omitempty"`
+}
+
+func (e *DomainPrimarySetEvent) Payload() interface{} {
+	return e
+}
+
+func (e *DomainPrimarySetEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewDomainPrimarySetEvent(ctx context.Context, aggregate *eventstore.Aggregate, domain string) *DomainPrimarySetEvent {
+	return &DomainPrimarySetEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			OrgDomainPrimarySetEventType,
+		),
+		Domain: domain,
+	}
+}
+
+func DomainPrimarySetEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	orgDomainPrimarySet := &DomainPrimarySetEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(orgDomainPrimarySet)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "ORG-N5787", "unable to unmarshal org domain primary set")
+	}
+
+	return orgDomainPrimarySet, nil
+}
+
+type DomainRemovedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	Domain     string `json:"domain,omitempty"`
+	isVerified bool
+}
+
+func (e *DomainRemovedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *DomainRemovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	if !e.isVerified {
+		return nil
+	}
+	return []*eventstore.UniqueConstraint{NewRemoveOrgDomainUniqueConstraint(e.Domain)}
+}
+
+func (e *DomainRemovedEvent) Fields() []*eventstore.FieldOperation {
+	return []*eventstore.FieldOperation{
+		eventstore.SetField(
+			e.Aggregate(),
+			domainSearchObject(e.Domain),
+			OrgDomainVerifiedSearchField,
+			&eventstore.Value{
+				Value:       false,
+				ShouldIndex: false,
+			},
+
+			eventstore.FieldTypeInstanceID,
+			eventstore.FieldTypeResourceOwner,
+			eventstore.FieldTypeAggregateType,
+			eventstore.FieldTypeAggregateID,
+			eventstore.FieldTypeObjectType,
+			eventstore.FieldTypeObjectID,
+			eventstore.FieldTypeFieldName,
+		),
+	}
+}
+
+func NewDomainRemovedEvent(ctx context.Context, aggregate *eventstore.Aggregate, domain string, verified bool) *DomainRemovedEvent {
+	return &DomainRemovedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			OrgDomainRemovedEventType,
+		),
+		Domain:     domain,
+		isVerified: verified,
+	}
+}
+
+func DomainRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	orgDomainRemoved := &DomainRemovedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(orgDomainRemoved)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "ORG-BngB2", "unable to unmarshal org domain removed")
+	}
+
+	return orgDomainRemoved, nil
+}
+
+func domainSearchObject(domain string) eventstore.Object {
+	return eventstore.Object{
+		Type:     OrgDomainSearchType,
+		ID:       domain,
+		Revision: OrgDomainObjectRevision,
+	}
+}

apps/api/internal/repository/org/eventstore.go

@@ -0,0 +1,118 @@
+package org
+
+import (
+	"github.com/zitadel/zitadel/internal/eventstore"
+)
+
+func init() {
+	eventstore.RegisterFilterEventMapper(AggregateType, OrgAddedEventType, OrgAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, OrgChangedEventType, OrgChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, OrgDeactivatedEventType, OrgDeactivatedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, OrgReactivatedEventType, OrgReactivatedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, OrgRemovedEventType, OrgRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, OrgDomainAddedEventType, DomainAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, OrgDomainVerificationAddedEventType, DomainVerificationAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, OrgDomainVerificationFailedEventType, DomainVerificationFailedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, OrgDomainVerifiedEventType, DomainVerifiedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, OrgDomainPrimarySetEventType, DomainPrimarySetEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, OrgDomainRemovedEventType, DomainRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, MemberAddedEventType, MemberAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, MemberChangedEventType, MemberChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, MemberRemovedEventType, MemberRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, MemberCascadeRemovedEventType, MemberCascadeRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyAddedEventType, LabelPolicyAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyChangedEventType, LabelPolicyChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyActivatedEventType, LabelPolicyActivatedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyRemovedEventType, LabelPolicyRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyLogoAddedEventType, LabelPolicyLogoAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyLogoRemovedEventType, LabelPolicyLogoRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyIconAddedEventType, LabelPolicyIconAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyIconRemovedEventType, LabelPolicyIconRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyLogoDarkAddedEventType, LabelPolicyLogoDarkAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyLogoDarkRemovedEventType, LabelPolicyLogoDarkRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyIconDarkAddedEventType, LabelPolicyIconDarkAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyIconDarkRemovedEventType, LabelPolicyIconDarkRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyFontAddedEventType, LabelPolicyFontAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyFontRemovedEventType, LabelPolicyFontRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyAssetsRemovedEventType, LabelPolicyAssetsRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LoginPolicyAddedEventType, LoginPolicyAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LoginPolicyChangedEventType, LoginPolicyChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LoginPolicyRemovedEventType, LoginPolicyRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LoginPolicySecondFactorAddedEventType, SecondFactorAddedEventEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LoginPolicySecondFactorRemovedEventType, SecondFactorRemovedEventEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LoginPolicyMultiFactorAddedEventType, MultiFactorAddedEventEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LoginPolicyMultiFactorRemovedEventType, MultiFactorRemovedEventEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LoginPolicyIDPProviderAddedEventType, IdentityProviderAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LoginPolicyIDPProviderRemovedEventType, IdentityProviderRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LoginPolicyIDPProviderCascadeRemovedEventType, IdentityProviderCascadeRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, DomainPolicyAddedEventType, DomainPolicyAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, DomainPolicyChangedEventType, DomainPolicyChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, DomainPolicyRemovedEventType, DomainPolicyRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, PasswordAgePolicyAddedEventType, PasswordAgePolicyAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, PasswordAgePolicyChangedEventType, PasswordAgePolicyChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, PasswordAgePolicyRemovedEventType, PasswordAgePolicyRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, PasswordComplexityPolicyAddedEventType, PasswordComplexityPolicyAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, PasswordComplexityPolicyChangedEventType, PasswordComplexityPolicyChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, PasswordComplexityPolicyRemovedEventType, PasswordComplexityPolicyRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LockoutPolicyAddedEventType, LockoutPolicyAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LockoutPolicyChangedEventType, LockoutPolicyChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LockoutPolicyRemovedEventType, LockoutPolicyRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, PrivacyPolicyAddedEventType, PrivacyPolicyAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, PrivacyPolicyChangedEventType, PrivacyPolicyChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, PrivacyPolicyRemovedEventType, PrivacyPolicyRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, MailTemplateAddedEventType, MailTemplateAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, MailTemplateChangedEventType, MailTemplateChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, MailTemplateRemovedEventType, MailTemplateRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, MailTextAddedEventType, MailTextAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, MailTextChangedEventType, MailTextChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, MailTextRemovedEventType, MailTextRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, CustomTextSetEventType, CustomTextSetEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, CustomTextRemovedEventType, CustomTextRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, CustomTextTemplateRemovedEventType, CustomTextTemplateRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, IDPConfigAddedEventType, IDPConfigAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, IDPConfigChangedEventType, IDPConfigChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, IDPConfigRemovedEventType, IDPConfigRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, IDPConfigDeactivatedEventType, IDPConfigDeactivatedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, IDPConfigReactivatedEventType, IDPConfigReactivatedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, IDPOIDCConfigAddedEventType, IDPOIDCConfigAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, IDPOIDCConfigChangedEventType, IDPOIDCConfigChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, IDPJWTConfigAddedEventType, IDPJWTConfigAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, IDPJWTConfigChangedEventType, IDPJWTConfigChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, OAuthIDPAddedEventType, OAuthIDPAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, OAuthIDPChangedEventType, OAuthIDPChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, OIDCIDPAddedEventType, OIDCIDPAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, OIDCIDPChangedEventType, OIDCIDPChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, OIDCIDPMigratedAzureADEventType, OIDCIDPMigratedAzureADEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, OIDCIDPMigratedGoogleEventType, OIDCIDPMigratedGoogleEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, JWTIDPAddedEventType, JWTIDPAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, JWTIDPChangedEventType, JWTIDPChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, AzureADIDPAddedEventType, AzureADIDPAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, AzureADIDPChangedEventType, AzureADIDPChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, GitHubIDPAddedEventType, GitHubIDPAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, GitHubIDPChangedEventType, GitHubIDPChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, GitHubEnterpriseIDPAddedEventType, GitHubEnterpriseIDPAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, GitHubEnterpriseIDPChangedEventType, GitHubEnterpriseIDPChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, GitLabIDPAddedEventType, GitLabIDPAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, GitLabIDPChangedEventType, GitLabIDPChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, GitLabSelfHostedIDPAddedEventType, GitLabSelfHostedIDPAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, GitLabSelfHostedIDPChangedEventType, GitLabSelfHostedIDPChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, GoogleIDPAddedEventType, GoogleIDPAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, GoogleIDPChangedEventType, GoogleIDPChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LDAPIDPAddedEventType, LDAPIDPAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LDAPIDPChangedEventType, LDAPIDPChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, AppleIDPAddedEventType, AppleIDPAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, AppleIDPChangedEventType, AppleIDPChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, SAMLIDPAddedEventType, SAMLIDPAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, SAMLIDPChangedEventType, SAMLIDPChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, IDPRemovedEventType, IDPRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, TriggerActionsSetEventType, TriggerActionsSetEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, TriggerActionsCascadeRemovedEventType, TriggerActionsCascadeRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, FlowClearedEventType, FlowClearedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, MetadataSetType, MetadataSetEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, MetadataRemovedType, MetadataRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, MetadataRemovedAllType, MetadataRemovedAllEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, NotificationPolicyAddedEventType, NotificationPolicyAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, NotificationPolicyChangedEventType, NotificationPolicyChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, NotificationPolicyRemovedEventType, NotificationPolicyRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, HostedLoginTranslationSet, HostedLoginTranslationSetEventMapper)
+}

apps/api/internal/repository/org/flow.go

@@ -0,0 +1,105 @@
+package org
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/domain"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/flow"
+)
+
+var (
+	TriggerActionsSetEventType            = orgEventTypePrefix + flow.TriggerActionsSetEventType
+	TriggerActionsCascadeRemovedEventType = orgEventTypePrefix + flow.TriggerActionsCascadeRemovedEventType
+	FlowClearedEventType                  = orgEventTypePrefix + flow.FlowClearedEventType
+)
+
+type TriggerActionsSetEvent struct {
+	flow.TriggerActionsSetEvent
+}
+
+func NewTriggerActionsSetEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	flowType domain.FlowType,
+	triggerType domain.TriggerType,
+	actionIDs []string,
+) *TriggerActionsSetEvent {
+	return &TriggerActionsSetEvent{
+		TriggerActionsSetEvent: *flow.NewTriggerActionsSetEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				TriggerActionsSetEventType),
+			flowType,
+			triggerType,
+			actionIDs),
+	}
+}
+
+func TriggerActionsSetEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := flow.TriggerActionsSetEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &TriggerActionsSetEvent{TriggerActionsSetEvent: *e.(*flow.TriggerActionsSetEvent)}, nil
+}
+
+type TriggerActionsCascadeRemovedEvent struct {
+	flow.TriggerActionsCascadeRemovedEvent
+}
+
+func NewTriggerActionsCascadeRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	flowType domain.FlowType,
+	actionID string,
+) *TriggerActionsCascadeRemovedEvent {
+	return &TriggerActionsCascadeRemovedEvent{
+		TriggerActionsCascadeRemovedEvent: *flow.NewTriggerActionsCascadeRemovedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				TriggerActionsCascadeRemovedEventType),
+			flowType,
+			actionID),
+	}
+}
+
+func TriggerActionsCascadeRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := flow.TriggerActionsCascadeRemovedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &TriggerActionsCascadeRemovedEvent{TriggerActionsCascadeRemovedEvent: *e.(*flow.TriggerActionsCascadeRemovedEvent)}, nil
+}
+
+type FlowClearedEvent struct {
+	flow.FlowClearedEvent
+}
+
+func NewFlowClearedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	flowType domain.FlowType,
+) *FlowClearedEvent {
+	return &FlowClearedEvent{
+		FlowClearedEvent: *flow.NewFlowClearedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				FlowClearedEventType),
+			flowType),
+	}
+}
+
+func FlowClearedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := flow.FlowClearedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &FlowClearedEvent{FlowClearedEvent: *e.(*flow.FlowClearedEvent)}, nil
+}

apps/api/internal/repository/org/hosted_login_translation.go

@@ -0,0 +1,55 @@
+package org
+
+import (
+	"context"
+
+	"golang.org/x/text/language"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	HostedLoginTranslationSet = orgEventTypePrefix + "hosted_login_translation.set"
+)
+
+type HostedLoginTranslationSetEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	Translation map[string]any `json:"translation,omitempty"`
+	Language    language.Tag   `json:"language,omitempty"`
+	Level       string         `json:"level,omitempty"`
+}
+
+func NewHostedLoginTranslationSetEvent(ctx context.Context, aggregate *eventstore.Aggregate, translation map[string]any, language language.Tag) *HostedLoginTranslationSetEvent {
+	return &HostedLoginTranslationSetEvent{
+		BaseEvent:   *eventstore.NewBaseEventForPush(ctx, aggregate, HostedLoginTranslationSet),
+		Translation: translation,
+		Language:    language,
+		Level:       string(aggregate.Type),
+	}
+}
+
+func (e *HostedLoginTranslationSetEvent) Payload() any {
+	return e
+}
+
+func (e *HostedLoginTranslationSetEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func (e *HostedLoginTranslationSetEvent) Fields() []*eventstore.FieldOperation {
+	return nil
+}
+
+func HostedLoginTranslationSetEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	translationSet := &HostedLoginTranslationSetEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(translationSet)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "ORG-BH82Eb", "unable to unmarshal hosted login translation set event")
+	}
+
+	return translationSet, nil
+}