feat: pass and handle auth request context for email links (#7815)

* pass and handle auth request context

* tests and cleanup

* cleanup

internal/command/org_test.go

@@ -1427,6 +1427,7 @@ func TestCommandSide_SetUpOrg(t *testing.T) {
 									Crypted:    []byte("userinit"),
 								},
 								1*time.Hour,
+								"",
 							),
 						),
 						eventFromEventPusher(org.NewMemberAddedEvent(context.Background(),

internal/command/user_human.go

@@ -10,7 +10,6 @@ import (
 	"github.com/zitadel/zitadel/internal/crypto"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/eventstore"
-	"github.com/zitadel/zitadel/internal/eventstore/v1/models"
 	"github.com/zitadel/zitadel/internal/repository/user"
 	"github.com/zitadel/zitadel/internal/telemetry/tracing"
 	"github.com/zitadel/zitadel/internal/zerrors"
@@ -57,7 +56,13 @@ type AddHuman struct {
 	Passwordless           bool
 	ExternalIDP            bool
 	Register               bool
-	Metadata               []*AddMetadataEntry
+	// UserAgentID is optional and can be passed in case the user registered themselves.
+	// This will be used in the login UI to handle authentication automatically.
+	UserAgentID string
+	// AuthRequestID is optional and can be passed in case the user registered themselves.
+	// This will be used to pass the information in notifications for links to the login UI.
+	AuthRequestID string
+	Metadata      []*AddMetadataEntry
 
 	// Links are optional
 	Links []*AddLink
@@ -200,6 +205,7 @@ func (c *Commands) AddHumanCommand(human *AddHuman, orgID string, hasher *crypto
 					human.Gender,
 					human.Email.Address,
 					domainPolicy.UserLoginMustBeDomain,
+					"", // no user agent id available
 				)
 			} else {
 				createCmd = user.NewHumanAddedEvent(
@@ -272,7 +278,7 @@ func (c *Commands) addHumanCommandEmail(ctx context.Context, filter preparation.
 		if err != nil {
 			return nil, err
 		}
-		return append(cmds, user.NewHumanInitialCodeAddedEvent(ctx, &a.Aggregate, initCode.Crypted, initCode.Expiry)), nil
+		return append(cmds, user.NewHumanInitialCodeAddedEvent(ctx, &a.Aggregate, initCode.Crypted, initCode.Expiry, human.AuthRequestID)), nil
 	}
 	if !human.Email.Verified {
 		emailCode, err := c.newEmailCode(ctx, filter, codeAlg)
@@ -460,61 +466,6 @@ func (c *Commands) ImportHuman(ctx context.Context, orgID string, human *domain.
 	return writeModelToHuman(addedHuman), passwordlessCode, nil
 }
 
-// Deprecated: use commands.AddUserHuman
-func (c *Commands) RegisterHuman(ctx context.Context, orgID string, human *domain.Human, link *domain.UserIDPLink, orgMemberRoles []string, initCodeGenerator, emailCodeGenerator, phoneCodeGenerator crypto.Generator) (*domain.Human, error) {
-	if orgID == "" {
-		return nil, zerrors.ThrowInvalidArgument(nil, "COMMAND-GEdf2", "Errors.ResourceOwnerMissing")
-	}
-	domainPolicy, err := c.getOrgDomainPolicy(ctx, orgID)
-	if err != nil {
-		return nil, zerrors.ThrowPreconditionFailed(err, "COMMAND-33M9f", "Errors.Org.DomainPolicy.NotFound")
-	}
-	pwPolicy, err := c.getOrgPasswordComplexityPolicy(ctx, orgID)
-	if err != nil {
-		return nil, zerrors.ThrowPreconditionFailed(err, "COMMAND-M5Fsd", "Errors.Org.PasswordComplexityPolicy.NotFound")
-	}
-	loginPolicy, err := c.getOrgLoginPolicy(ctx, orgID)
-	if err != nil {
-		return nil, zerrors.ThrowPreconditionFailed(err, "COMMAND-Dfg3g", "Errors.Org.LoginPolicy.NotFound")
-	}
-	// check only if local registration is allowed, the idp will be checked separately
-	if !loginPolicy.AllowRegister && link == nil {
-		return nil, zerrors.ThrowPreconditionFailed(err, "COMMAND-SAbr3", "Errors.Org.LoginPolicy.RegistrationNotAllowed")
-	}
-	userEvents, registeredHuman, err := c.registerHuman(ctx, orgID, human, link, domainPolicy, pwPolicy, initCodeGenerator, emailCodeGenerator, phoneCodeGenerator)
-	if err != nil {
-		return nil, err
-	}
-
-	orgMemberWriteModel := NewOrgMemberWriteModel(orgID, registeredHuman.AggregateID)
-	orgAgg := OrgAggregateFromWriteModel(&orgMemberWriteModel.WriteModel)
-	if len(orgMemberRoles) > 0 {
-		orgMember := &domain.Member{
-			ObjectRoot: models.ObjectRoot{
-				AggregateID: orgID,
-			},
-			UserID: human.AggregateID,
-			Roles:  orgMemberRoles,
-		}
-		memberEvent, err := c.addOrgMember(ctx, orgAgg, orgMemberWriteModel, orgMember)
-		if err != nil {
-			return nil, err
-		}
-		userEvents = append(userEvents, memberEvent)
-	}
-
-	pushedEvents, err := c.eventstore.Push(ctx, userEvents...)
-	if err != nil {
-		return nil, err
-	}
-
-	err = AppendAndReduce(registeredHuman, pushedEvents...)
-	if err != nil {
-		return nil, err
-	}
-	return writeModelToHuman(registeredHuman), nil
-}
-
 func (c *Commands) importHuman(ctx context.Context, orgID string, human *domain.Human, passwordless bool, links []*domain.UserIDPLink, domainPolicy *domain.DomainPolicy, pwPolicy *domain.PasswordComplexityPolicy, initCodeGenerator, emailCodeGenerator, phoneCodeGenerator, passwordlessCodeGenerator crypto.Generator) (events []eventstore.Command, humanWriteModel *HumanWriteModel, passwordlessCodeWriteModel *HumanPasswordlessInitCodeWriteModel, code string, err error) {
 	if orgID == "" {
 		return nil, nil, nil, "", zerrors.ThrowInvalidArgument(nil, "COMMAND-00p2b", "Errors.Org.Empty")
@@ -522,7 +473,7 @@ func (c *Commands) importHuman(ctx context.Context, orgID string, human *domain.
 	if err := human.Normalize(); err != nil {
 		return nil, nil, nil, "", err
 	}
-	events, humanWriteModel, err = c.createHuman(ctx, orgID, human, links, false, passwordless, domainPolicy, pwPolicy, initCodeGenerator, emailCodeGenerator, phoneCodeGenerator)
+	events, humanWriteModel, err = c.createHuman(ctx, orgID, human, links, passwordless, domainPolicy, pwPolicy, initCodeGenerator, emailCodeGenerator, phoneCodeGenerator)
 	if err != nil {
 		return nil, nil, nil, "", err
 	}
@@ -537,33 +488,8 @@ func (c *Commands) importHuman(ctx context.Context, orgID string, human *domain.
 	return events, humanWriteModel, passwordlessCodeWriteModel, code, nil
 }
 
-func (c *Commands) registerHuman(ctx context.Context, orgID string, human *domain.Human, link *domain.UserIDPLink, domainPolicy *domain.DomainPolicy, pwPolicy *domain.PasswordComplexityPolicy, initCodeGenerator, emailCodeGenerator, phoneCodeGenerator crypto.Generator) ([]eventstore.Command, *HumanWriteModel, error) {
-	if human == nil {
-		return nil, nil, zerrors.ThrowInvalidArgument(nil, "COMMAND-JKefw", "Errors.User.Invalid")
-	}
-	if human.Username = strings.TrimSpace(human.Username); human.Username == "" {
-		human.Username = string(human.EmailAddress)
-	}
-	if orgID == "" {
-		return nil, nil, zerrors.ThrowInvalidArgument(nil, "COMMAND-hYsVH", "Errors.Org.Empty")
-	}
-	if err := human.Normalize(); err != nil {
-		return nil, nil, err
-	}
-	if link == nil && (human.Password == nil || human.Password.SecretString == "") {
-		return nil, nil, zerrors.ThrowInvalidArgument(nil, "COMMAND-X23na", "Errors.User.Password.Empty")
-	}
-	if human.Password != nil && human.Password.SecretString != "" {
-		human.Password.ChangeRequired = false
-	}
-	var links []*domain.UserIDPLink
-	if link != nil {
-		links = append(links, link)
-	}
-	return c.createHuman(ctx, orgID, human, links, true, false, domainPolicy, pwPolicy, initCodeGenerator, emailCodeGenerator, phoneCodeGenerator)
-}
-
-func (c *Commands) createHuman(ctx context.Context, orgID string, human *domain.Human, links []*domain.UserIDPLink, selfregister, passwordless bool, domainPolicy *domain.DomainPolicy, pwPolicy *domain.PasswordComplexityPolicy, initCodeGenerator, emailCodeGenerator, phoneCodeGenerator crypto.Generator) (events []eventstore.Command, addedHuman *HumanWriteModel, err error) {
+//nolint:gocognit
+func (c *Commands) createHuman(ctx context.Context, orgID string, human *domain.Human, links []*domain.UserIDPLink, passwordless bool, domainPolicy *domain.DomainPolicy, pwPolicy *domain.PasswordComplexityPolicy, initCodeGenerator, emailCodeGenerator, phoneCodeGenerator crypto.Generator) (events []eventstore.Command, addedHuman *HumanWriteModel, err error) {
 	if err := human.CheckDomainPolicy(domainPolicy); err != nil {
 		return nil, nil, err
 	}
@@ -601,11 +527,7 @@ func (c *Commands) createHuman(ctx context.Context, orgID string, human *domain.
 	//TODO: adlerhurst maybe we could simplify the code below
 	userAgg := UserAggregateFromWriteModel(&addedHuman.WriteModel)
 
-	if selfregister {
-		events = append(events, createRegisterHumanEvent(ctx, userAgg, human, domainPolicy.UserLoginMustBeDomain))
-	} else {
-		events = append(events, createAddHumanEvent(ctx, userAgg, human, domainPolicy.UserLoginMustBeDomain))
-	}
+	events = append(events, createAddHumanEvent(ctx, userAgg, human, domainPolicy.UserLoginMustBeDomain))
 
 	for _, link := range links {
 		event, err := c.addUserIDPLink(ctx, userAgg, link, false)
@@ -620,7 +542,7 @@ func (c *Commands) createHuman(ctx context.Context, orgID string, human *domain.
 		if err != nil {
 			return nil, nil, err
 		}
-		events = append(events, user.NewHumanInitialCodeAddedEvent(ctx, userAgg, initCode.Code, initCode.Expiry))
+		events = append(events, user.NewHumanInitialCodeAddedEvent(ctx, userAgg, initCode.Code, initCode.Expiry, ""))
 	} else {
 		if human.Email != nil && human.EmailAddress != "" && human.IsEmailVerified {
 			events = append(events, user.NewHumanEmailVerifiedEvent(ctx, userAgg))
@@ -629,7 +551,7 @@ func (c *Commands) createHuman(ctx context.Context, orgID string, human *domain.
 			if err != nil {
 				return nil, nil, err
 			}
-			events = append(events, user.NewHumanEmailCodeAddedEvent(ctx, userAgg, emailCode.Code, emailCode.Expiry))
+			events = append(events, user.NewHumanEmailCodeAddedEvent(ctx, userAgg, emailCode.Code, emailCode.Expiry, ""))
 		}
 	}
 
@@ -699,40 +621,6 @@ func createAddHumanEvent(ctx context.Context, aggregate *eventstore.Aggregate, h
 	return addEvent
 }
 
-func createRegisterHumanEvent(ctx context.Context, aggregate *eventstore.Aggregate, human *domain.Human, userLoginMustBeDomain bool) *user.HumanRegisteredEvent {
-	addEvent := user.NewHumanRegisteredEvent(
-		ctx,
-		aggregate,
-		human.Username,
-		human.FirstName,
-		human.LastName,
-		human.NickName,
-		human.DisplayName,
-		human.PreferredLanguage,
-		human.Gender,
-		human.EmailAddress,
-		userLoginMustBeDomain,
-	)
-	if human.Phone != nil {
-		addEvent.AddPhoneData(human.PhoneNumber)
-	}
-	if human.Address != nil {
-		addEvent.AddAddressData(
-			human.Country,
-			human.Locality,
-			human.PostalCode,
-			human.Region,
-			human.StreetAddress)
-	}
-	if human.Password != nil {
-		addEvent.AddPasswordData(human.Password.EncodedSecret, human.Password.ChangeRequired)
-	}
-	if human.HashedPassword != "" {
-		addEvent.AddPasswordData(human.HashedPassword, false)
-	}
-	return addEvent
-}
-
 func (c *Commands) HumansSignOut(ctx context.Context, agentID string, userIDs []string) error {
 	if agentID == "" {
 		return zerrors.ThrowInvalidArgument(nil, "COMMAND-2M0ds", "Errors.User.UserIDMissing")
@@ -783,3 +671,53 @@ func humanWriteModelByID(ctx context.Context, filter preparation.FilterToQueryRe
 	err = humanWriteModel.Reduce()
 	return humanWriteModel, err
 }
+
+func AddHumanFromDomain(user *domain.Human, metadataList []*domain.Metadata, authRequest *domain.AuthRequest, idp *domain.UserIDPLink) *AddHuman {
+	addMetadata := make([]*AddMetadataEntry, len(metadataList))
+	for i, metadata := range metadataList {
+		addMetadata[i] = &AddMetadataEntry{
+			Key:   metadata.Key,
+			Value: metadata.Value,
+		}
+	}
+	human := new(AddHuman)
+	if user.Profile != nil {
+		human.Username = user.Username
+		human.FirstName = user.FirstName
+		human.LastName = user.LastName
+		human.NickName = user.NickName
+		human.DisplayName = user.DisplayName
+		human.PreferredLanguage = user.PreferredLanguage
+		human.Gender = user.Gender
+		human.Password = user.Password.SecretString
+		human.Register = true
+		human.Metadata = addMetadata
+		human.UserAgentID = authRequest.AgentID
+		human.AuthRequestID = authRequest.ID
+	}
+	if user.Email != nil {
+		human.Email = Email{
+			Address:  user.EmailAddress,
+			Verified: user.IsEmailVerified,
+		}
+	}
+	if user.Phone != nil {
+		human.Phone = Phone{
+			Number:   user.Phone.PhoneNumber,
+			Verified: user.Phone.IsPhoneVerified,
+		}
+	}
+	if idp != nil {
+		human.Links = []*AddLink{
+			{
+				IDPID:         idp.IDPConfigID,
+				DisplayName:   idp.DisplayName,
+				IDPExternalID: idp.ExternalUserID,
+			},
+		}
+	}
+	if human.Username = strings.TrimSpace(human.Username); human.Username == "" {
+		human.Username = string(human.Email.Address)
+	}
+	return human
+}

internal/command/user_human_email.go

@@ -50,7 +50,7 @@ func (c *Commands) ChangeHumanEmail(ctx context.Context, email *domain.Email, em
 		if err != nil {
 			return nil, err
 		}
-		events = append(events, user.NewHumanEmailCodeAddedEvent(ctx, userAgg, emailCode.Code, emailCode.Expiry))
+		events = append(events, user.NewHumanEmailCodeAddedEvent(ctx, userAgg, emailCode.Code, emailCode.Expiry, ""))
 	}
 
 	pushedEvents, err := c.eventstore.Push(ctx, events...)
@@ -99,7 +99,7 @@ func (c *Commands) VerifyHumanEmail(ctx context.Context, userID, code, resourceo
 	return nil, zerrors.ThrowInvalidArgument(err, "COMMAND-Gdsgs", "Errors.User.Code.Invalid")
 }
 
-func (c *Commands) CreateHumanEmailVerificationCode(ctx context.Context, userID, resourceOwner string, emailCodeGenerator crypto.Generator) (*domain.ObjectDetails, error) {
+func (c *Commands) CreateHumanEmailVerificationCode(ctx context.Context, userID, resourceOwner string, emailCodeGenerator crypto.Generator, authRequestID string) (*domain.ObjectDetails, error) {
 	if userID == "" {
 		return nil, zerrors.ThrowInvalidArgument(nil, "COMMAND-4M0ds", "Errors.User.UserIDMissing")
 	}
@@ -122,7 +122,10 @@ func (c *Commands) CreateHumanEmailVerificationCode(ctx context.Context, userID,
 	if err != nil {
 		return nil, err
 	}
-	pushedEvents, err := c.eventstore.Push(ctx, user.NewHumanEmailCodeAddedEvent(ctx, userAgg, emailCode.Code, emailCode.Expiry))
+	if authRequestID == "" {
+		authRequestID = existingEmail.AuthRequestID
+	}
+	pushedEvents, err := c.eventstore.Push(ctx, user.NewHumanEmailCodeAddedEvent(ctx, userAgg, emailCode.Code, emailCode.Expiry, authRequestID))
 	if err != nil {
 		return nil, err
 	}

internal/command/user_human_email_model.go

@@ -19,6 +19,7 @@ type HumanEmailWriteModel struct {
 	Code             *crypto.CryptoValue
 	CodeCreationDate time.Time
 	CodeExpiry       time.Duration
+	AuthRequestID    string
 
 	UserState domain.UserState
 }
@@ -53,6 +54,7 @@ func (wm *HumanEmailWriteModel) Reduce() error {
 			wm.Code = e.Code
 			wm.CodeCreationDate = e.CreationDate()
 			wm.CodeExpiry = e.Expiry
+			wm.AuthRequestID = e.AuthRequestID
 		case *user.HumanEmailVerifiedEvent:
 			wm.IsEmailVerified = true
 			wm.Code = nil

internal/command/user_human_email_test.go

@@ -18,7 +18,7 @@ import (
 
 func TestCommandSide_ChangeHumanEmail(t *testing.T) {
 	type fields struct {
-		eventstore *eventstore.Eventstore
+		eventstore func(*testing.T) *eventstore.Eventstore
 	}
 	type args struct {
 		ctx             context.Context
@@ -39,9 +39,7 @@ func TestCommandSide_ChangeHumanEmail(t *testing.T) {
 		{
 			name: "invalid email, invalid argument error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
-				),
+				eventstore: expectEventstore(),
 			},
 			args: args{
 				ctx: context.Background(),
@@ -59,8 +57,7 @@ func TestCommandSide_ChangeHumanEmail(t *testing.T) {
 		{
 			name: "user not existing, precondition error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(),
 				),
 			},
@@ -81,8 +78,7 @@ func TestCommandSide_ChangeHumanEmail(t *testing.T) {
 		{
 			name: "user not initialized, precondition error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -102,6 +98,7 @@ func TestCommandSide_ChangeHumanEmail(t *testing.T) {
 							user.NewHumanInitialCodeAddedEvent(context.Background(),
 								&user.NewAggregate("user1", "org1").Aggregate,
 								nil, time.Hour*1,
+								"",
 							),
 						),
 					),
@@ -124,8 +121,7 @@ func TestCommandSide_ChangeHumanEmail(t *testing.T) {
 		{
 			name: "email not changed, precondition error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -161,8 +157,7 @@ func TestCommandSide_ChangeHumanEmail(t *testing.T) {
 		{
 			name: "verified email changed, ok",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -215,8 +210,7 @@ func TestCommandSide_ChangeHumanEmail(t *testing.T) {
 		{
 			name: "email verified, ok",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -265,8 +259,7 @@ func TestCommandSide_ChangeHumanEmail(t *testing.T) {
 		{
 			name: "email verified, ok",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -315,8 +308,7 @@ func TestCommandSide_ChangeHumanEmail(t *testing.T) {
 		{
 			name: "email changed with code, ok",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -347,6 +339,7 @@ func TestCommandSide_ChangeHumanEmail(t *testing.T) {
 								Crypted:    []byte("a"),
 							},
 							time.Hour*1,
+							"",
 						),
 					),
 				),
@@ -376,7 +369,7 @@ func TestCommandSide_ChangeHumanEmail(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			r := &Commands{
-				eventstore: tt.fields.eventstore,
+				eventstore: tt.fields.eventstore(t),
 			}
 			got, err := r.ChangeHumanEmail(tt.args.ctx, tt.args.email, tt.args.secretGenerator)
 			if tt.res.err == nil {
@@ -394,7 +387,7 @@ func TestCommandSide_ChangeHumanEmail(t *testing.T) {
 
 func TestCommandSide_VerifyHumanEmail(t *testing.T) {
 	type fields struct {
-		eventstore *eventstore.Eventstore
+		eventstore func(*testing.T) *eventstore.Eventstore
 	}
 	type args struct {
 		ctx             context.Context
@@ -416,9 +409,7 @@ func TestCommandSide_VerifyHumanEmail(t *testing.T) {
 		{
 			name: "userid missing, invalid argument error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
-				),
+				eventstore: expectEventstore(),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -432,9 +423,7 @@ func TestCommandSide_VerifyHumanEmail(t *testing.T) {
 		{
 			name: "code missing, invalid argument error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
-				),
+				eventstore: expectEventstore(),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -448,8 +437,7 @@ func TestCommandSide_VerifyHumanEmail(t *testing.T) {
 		{
 			name: "user not existing, precondition error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(),
 				),
 			},
@@ -466,8 +454,7 @@ func TestCommandSide_VerifyHumanEmail(t *testing.T) {
 		{
 			name: "code not existing, precondition error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -499,8 +486,7 @@ func TestCommandSide_VerifyHumanEmail(t *testing.T) {
 		{
 			name: "invalid code, invalid argument error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -526,6 +512,7 @@ func TestCommandSide_VerifyHumanEmail(t *testing.T) {
 									Crypted:    []byte("a"),
 								},
 								time.Hour*1,
+								"",
 							),
 						),
 					),
@@ -550,8 +537,7 @@ func TestCommandSide_VerifyHumanEmail(t *testing.T) {
 		{
 			name: "valid code, ok",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -577,6 +563,7 @@ func TestCommandSide_VerifyHumanEmail(t *testing.T) {
 									Crypted:    []byte("a"),
 								},
 								time.Hour*1,
+								"",
 							),
 						),
 					),
@@ -604,7 +591,7 @@ func TestCommandSide_VerifyHumanEmail(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			r := &Commands{
-				eventstore: tt.fields.eventstore,
+				eventstore: tt.fields.eventstore(t),
 			}
 			got, err := r.VerifyHumanEmail(tt.args.ctx, tt.args.userID, tt.args.code, tt.args.resourceOwner, tt.args.secretGenerator)
 			if tt.res.err == nil {
@@ -622,13 +609,14 @@ func TestCommandSide_VerifyHumanEmail(t *testing.T) {
 
 func TestCommandSide_CreateVerificationCodeHumanEmail(t *testing.T) {
 	type fields struct {
-		eventstore *eventstore.Eventstore
+		eventstore func(*testing.T) *eventstore.Eventstore
 	}
 	type args struct {
 		ctx             context.Context
 		userID          string
 		resourceOwner   string
 		secretGenerator crypto.Generator
+		authRequestID   string
 	}
 	type res struct {
 		want *domain.ObjectDetails
@@ -643,9 +631,7 @@ func TestCommandSide_CreateVerificationCodeHumanEmail(t *testing.T) {
 		{
 			name: "userid missing, invalid argument error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
-				),
+				eventstore: expectEventstore(),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -658,8 +644,7 @@ func TestCommandSide_CreateVerificationCodeHumanEmail(t *testing.T) {
 		{
 			name: "user not existing, precondition error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(),
 				),
 			},
@@ -675,8 +660,7 @@ func TestCommandSide_CreateVerificationCodeHumanEmail(t *testing.T) {
 		{
 			name: "user not initialized, precondition error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -696,6 +680,7 @@ func TestCommandSide_CreateVerificationCodeHumanEmail(t *testing.T) {
 							user.NewHumanInitialCodeAddedEvent(context.Background(),
 								&user.NewAggregate("user1", "org1").Aggregate,
 								nil, time.Hour*1,
+								"",
 							),
 						),
 					),
@@ -713,8 +698,7 @@ func TestCommandSide_CreateVerificationCodeHumanEmail(t *testing.T) {
 		{
 			name: "email already verified, precondition error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -750,8 +734,7 @@ func TestCommandSide_CreateVerificationCodeHumanEmail(t *testing.T) {
 		{
 			name: "new code, ok",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -789,6 +772,7 @@ func TestCommandSide_CreateVerificationCodeHumanEmail(t *testing.T) {
 								Crypted:    []byte("a"),
 							},
 							time.Hour*1,
+							"",
 						),
 					),
 				),
@@ -805,13 +789,72 @@ func TestCommandSide_CreateVerificationCodeHumanEmail(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "new code with authRequestID, ok",
+			fields: fields{
+				eventstore: expectEventstore(
+					expectFilter(
+						eventFromEventPusher(
+							user.NewHumanAddedEvent(context.Background(),
+								&user.NewAggregate("user1", "org1").Aggregate,
+								"username",
+								"firstname",
+								"lastname",
+								"nickname",
+								"displayname",
+								language.German,
+								domain.GenderUnspecified,
+								"email@test.ch",
+								true,
+							),
+						),
+						eventFromEventPusher(
+							user.NewHumanEmailVerifiedEvent(context.Background(),
+								&user.NewAggregate("user1", "org1").Aggregate,
+							),
+						),
+						eventFromEventPusher(
+							user.NewHumanEmailChangedEvent(context.Background(),
+								&user.NewAggregate("user1", "org1").Aggregate,
+								"email2@test.ch",
+							),
+						),
+					),
+					expectPush(
+						user.NewHumanEmailCodeAddedEvent(context.Background(),
+							&user.NewAggregate("user1", "org1").Aggregate,
+							&crypto.CryptoValue{
+								CryptoType: crypto.TypeEncryption,
+								Algorithm:  "enc",
+								KeyID:      "id",
+								Crypted:    []byte("a"),
+							},
+							time.Hour*1,
+							"authRequestID",
+						),
+					),
+				),
+			},
+			args: args{
+				ctx:             context.Background(),
+				userID:          "user1",
+				resourceOwner:   "org1",
+				secretGenerator: GetMockSecretGenerator(t),
+				authRequestID:   "authRequestID",
+			},
+			res: res{
+				want: &domain.ObjectDetails{
+					ResourceOwner: "org1",
+				},
+			},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			r := &Commands{
-				eventstore: tt.fields.eventstore,
+				eventstore: tt.fields.eventstore(t),
 			}
-			got, err := r.CreateHumanEmailVerificationCode(tt.args.ctx, tt.args.userID, tt.args.resourceOwner, tt.args.secretGenerator)
+			got, err := r.CreateHumanEmailVerificationCode(tt.args.ctx, tt.args.userID, tt.args.resourceOwner, tt.args.secretGenerator, tt.args.authRequestID)
 			if tt.res.err == nil {
 				assert.NoError(t, err)
 			}
@@ -827,7 +870,7 @@ func TestCommandSide_CreateVerificationCodeHumanEmail(t *testing.T) {
 
 func TestCommandSide_EmailVerificationCodeSent(t *testing.T) {
 	type fields struct {
-		eventstore *eventstore.Eventstore
+		eventstore func(*testing.T) *eventstore.Eventstore
 	}
 	type args struct {
 		ctx           context.Context
@@ -846,9 +889,7 @@ func TestCommandSide_EmailVerificationCodeSent(t *testing.T) {
 		{
 			name: "userid missing, invalid argument error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
-				),
+				eventstore: expectEventstore(),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -861,8 +902,7 @@ func TestCommandSide_EmailVerificationCodeSent(t *testing.T) {
 		{
 			name: "user not existing, precondition error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(),
 				),
 			},
@@ -878,8 +918,7 @@ func TestCommandSide_EmailVerificationCodeSent(t *testing.T) {
 		{
 			name: "code sent, ok",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -925,7 +964,7 @@ func TestCommandSide_EmailVerificationCodeSent(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			r := &Commands{
-				eventstore: tt.fields.eventstore,
+				eventstore: tt.fields.eventstore(t),
 			}
 			err := r.HumanEmailVerificationCodeSent(tt.args.ctx, tt.args.resourceOwner, tt.args.userID)
 			if tt.res.err == nil {

internal/command/user_human_init.go

@@ -13,7 +13,7 @@ import (
 )
 
 // ResendInitialMail resend initial mail and changes email if provided
-func (c *Commands) ResendInitialMail(ctx context.Context, userID string, email domain.EmailAddress, resourceOwner string, initCodeGenerator crypto.Generator) (objectDetails *domain.ObjectDetails, err error) {
+func (c *Commands) ResendInitialMail(ctx context.Context, userID string, email domain.EmailAddress, resourceOwner string, initCodeGenerator crypto.Generator, authRequestID string) (objectDetails *domain.ObjectDetails, err error) {
 	if userID == "" {
 		return nil, zerrors.ThrowInvalidArgument(nil, "COMMAND-2n8vs", "Errors.User.UserIDMissing")
 	}
@@ -38,7 +38,10 @@ func (c *Commands) ResendInitialMail(ctx context.Context, userID string, email d
 	if err != nil {
 		return nil, err
 	}
-	events = append(events, user.NewHumanInitialCodeAddedEvent(ctx, userAgg, initCode.Code, initCode.Expiry))
+	if authRequestID == "" {
+		authRequestID = existingCode.AuthRequestID
+	}
+	events = append(events, user.NewHumanInitialCodeAddedEvent(ctx, userAgg, initCode.Code, initCode.Expiry, authRequestID))
 	pushedEvents, err := c.eventstore.Push(ctx, events...)
 	if err != nil {
 		return nil, err

internal/command/user_human_init_model.go

@@ -19,6 +19,7 @@ type HumanInitCodeWriteModel struct {
 	Code             *crypto.CryptoValue
 	CodeCreationDate time.Time
 	CodeExpiry       time.Duration
+	AuthRequestID    string
 
 	UserState domain.UserState
 }
@@ -50,6 +51,7 @@ func (wm *HumanInitCodeWriteModel) Reduce() error {
 			wm.Code = e.Code
 			wm.CodeCreationDate = e.CreationDate()
 			wm.CodeExpiry = e.Expiry
+			wm.AuthRequestID = e.AuthRequestID
 			wm.UserState = domain.UserStateInitial
 		case *user.HumanInitializedCheckSucceededEvent:
 			wm.Code = nil

internal/command/user_human_init_test.go

@@ -18,7 +18,7 @@ import (
 
 func TestCommandSide_ResendInitialMail(t *testing.T) {
 	type fields struct {
-		eventstore *eventstore.Eventstore
+		eventstore func(*testing.T) *eventstore.Eventstore
 	}
 	type args struct {
 		ctx             context.Context
@@ -26,6 +26,7 @@ func TestCommandSide_ResendInitialMail(t *testing.T) {
 		email           string
 		resourceOwner   string
 		secretGenerator crypto.Generator
+		authRequestID   string
 	}
 	type res struct {
 		want *domain.ObjectDetails
@@ -40,9 +41,7 @@ func TestCommandSide_ResendInitialMail(t *testing.T) {
 		{
 			name: "userid missing, invalid argument error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
-				),
+				eventstore: expectEventstore(),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -55,8 +54,7 @@ func TestCommandSide_ResendInitialMail(t *testing.T) {
 		{
 			name: "user not existing, precondition error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(),
 				),
 			},
@@ -72,8 +70,7 @@ func TestCommandSide_ResendInitialMail(t *testing.T) {
 		{
 			name: "user not initialized, precondition error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -107,8 +104,7 @@ func TestCommandSide_ResendInitialMail(t *testing.T) {
 		{
 			name: "new code email not changed, ok",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -128,6 +124,7 @@ func TestCommandSide_ResendInitialMail(t *testing.T) {
 							user.NewHumanInitialCodeAddedEvent(context.Background(),
 								&user.NewAggregate("user1", "org1").Aggregate,
 								nil, time.Hour*1,
+								"",
 							),
 						),
 					),
@@ -141,6 +138,7 @@ func TestCommandSide_ResendInitialMail(t *testing.T) {
 								Crypted:    []byte("a"),
 							},
 							time.Hour*1,
+							"",
 						),
 					),
 				),
@@ -159,10 +157,9 @@ func TestCommandSide_ResendInitialMail(t *testing.T) {
 			},
 		},
 		{
-			name: "new code, ok",
+			name: "new code email not changed with authRequestID, ok",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -182,6 +179,7 @@ func TestCommandSide_ResendInitialMail(t *testing.T) {
 							user.NewHumanInitialCodeAddedEvent(context.Background(),
 								&user.NewAggregate("user1", "org1").Aggregate,
 								nil, time.Hour*1,
+								"authRequestID",
 							),
 						),
 					),
@@ -195,6 +193,63 @@ func TestCommandSide_ResendInitialMail(t *testing.T) {
 								Crypted:    []byte("a"),
 							},
 							time.Hour*1,
+							"authRequestID",
+						),
+					),
+				),
+			},
+			args: args{
+				ctx:             context.Background(),
+				userID:          "user1",
+				resourceOwner:   "org1",
+				email:           "email@test.ch",
+				secretGenerator: GetMockSecretGenerator(t),
+				authRequestID:   "authRequestID",
+			},
+			res: res{
+				want: &domain.ObjectDetails{
+					ResourceOwner: "org1",
+				},
+			},
+		},
+		{
+			name: "new code, ok",
+			fields: fields{
+				eventstore: expectEventstore(
+					expectFilter(
+						eventFromEventPusher(
+							user.NewHumanAddedEvent(context.Background(),
+								&user.NewAggregate("user1", "org1").Aggregate,
+								"username",
+								"firstname",
+								"lastname",
+								"nickname",
+								"displayname",
+								language.German,
+								domain.GenderUnspecified,
+								"email@test.ch",
+								true,
+							),
+						),
+						eventFromEventPusher(
+							user.NewHumanInitialCodeAddedEvent(context.Background(),
+								&user.NewAggregate("user1", "org1").Aggregate,
+								nil, time.Hour*1,
+								"",
+							),
+						),
+					),
+					expectPush(
+						user.NewHumanInitialCodeAddedEvent(context.Background(),
+							&user.NewAggregate("user1", "org1").Aggregate,
+							&crypto.CryptoValue{
+								CryptoType: crypto.TypeEncryption,
+								Algorithm:  "enc",
+								KeyID:      "id",
+								Crypted:    []byte("a"),
+							},
+							time.Hour*1,
+							"",
 						),
 					),
 				),
@@ -212,10 +267,9 @@ func TestCommandSide_ResendInitialMail(t *testing.T) {
 			},
 		},
 		{
-			name: "new code with change email, ok",
+			name: "new code with authRequestID, ok",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -235,6 +289,62 @@ func TestCommandSide_ResendInitialMail(t *testing.T) {
 							user.NewHumanInitialCodeAddedEvent(context.Background(),
 								&user.NewAggregate("user1", "org1").Aggregate,
 								nil, time.Hour*1,
+								"authRequestID",
+							),
+						),
+					),
+					expectPush(
+						user.NewHumanInitialCodeAddedEvent(context.Background(),
+							&user.NewAggregate("user1", "org1").Aggregate,
+							&crypto.CryptoValue{
+								CryptoType: crypto.TypeEncryption,
+								Algorithm:  "enc",
+								KeyID:      "id",
+								Crypted:    []byte("a"),
+							},
+							time.Hour*1,
+							"authRequestID",
+						),
+					),
+				),
+			},
+			args: args{
+				ctx:             context.Background(),
+				userID:          "user1",
+				resourceOwner:   "org1",
+				secretGenerator: GetMockSecretGenerator(t),
+				authRequestID:   "authRequestID",
+			},
+			res: res{
+				want: &domain.ObjectDetails{
+					ResourceOwner: "org1",
+				},
+			},
+		},
+		{
+			name: "new code with change email, ok",
+			fields: fields{
+				eventstore: expectEventstore(
+					expectFilter(
+						eventFromEventPusher(
+							user.NewHumanAddedEvent(context.Background(),
+								&user.NewAggregate("user1", "org1").Aggregate,
+								"username",
+								"firstname",
+								"lastname",
+								"nickname",
+								"displayname",
+								language.German,
+								domain.GenderUnspecified,
+								"email@test.ch",
+								true,
+							),
+						),
+						eventFromEventPusher(
+							user.NewHumanInitialCodeAddedEvent(context.Background(),
+								&user.NewAggregate("user1", "org1").Aggregate,
+								nil, time.Hour*1,
+								"",
 							),
 						),
 					),
@@ -252,6 +362,7 @@ func TestCommandSide_ResendInitialMail(t *testing.T) {
 								Crypted:    []byte("a"),
 							},
 							time.Hour*1,
+							"",
 						),
 					),
 				),
@@ -273,9 +384,9 @@ func TestCommandSide_ResendInitialMail(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			r := &Commands{
-				eventstore: tt.fields.eventstore,
+				eventstore: tt.fields.eventstore(t),
 			}
-			got, err := r.ResendInitialMail(tt.args.ctx, tt.args.userID, domain.EmailAddress(tt.args.email), tt.args.resourceOwner, tt.args.secretGenerator)
+			got, err := r.ResendInitialMail(tt.args.ctx, tt.args.userID, domain.EmailAddress(tt.args.email), tt.args.resourceOwner, tt.args.secretGenerator, tt.args.authRequestID)
 			if tt.res.err == nil {
 				assert.NoError(t, err)
 			}
@@ -291,7 +402,7 @@ func TestCommandSide_ResendInitialMail(t *testing.T) {
 
 func TestCommandSide_VerifyInitCode(t *testing.T) {
 	type fields struct {
-		eventstore         *eventstore.Eventstore
+		eventstore         func(*testing.T) *eventstore.Eventstore
 		userPasswordHasher *crypto.Hasher
 	}
 	type args struct {
@@ -316,9 +427,7 @@ func TestCommandSide_VerifyInitCode(t *testing.T) {
 		{
 			name: "userid missing, invalid argument error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
-				),
+				eventstore: expectEventstore(),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -332,9 +441,7 @@ func TestCommandSide_VerifyInitCode(t *testing.T) {
 		{
 			name: "code missing, invalid argument error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
-				),
+				eventstore: expectEventstore(),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -348,8 +455,7 @@ func TestCommandSide_VerifyInitCode(t *testing.T) {
 		{
 			name: "user not existing, precondition error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(),
 				),
 			},
@@ -366,8 +472,7 @@ func TestCommandSide_VerifyInitCode(t *testing.T) {
 		{
 			name: "code not existing, precondition error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -399,8 +504,7 @@ func TestCommandSide_VerifyInitCode(t *testing.T) {
 		{
 			name: "invalid code, invalid argument error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -426,6 +530,7 @@ func TestCommandSide_VerifyInitCode(t *testing.T) {
 									Crypted:    []byte("a"),
 								},
 								time.Hour*1,
+								"",
 							),
 						),
 					),
@@ -450,8 +555,7 @@ func TestCommandSide_VerifyInitCode(t *testing.T) {
 		{
 			name: "valid code, ok",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -477,6 +581,7 @@ func TestCommandSide_VerifyInitCode(t *testing.T) {
 									Crypted:    []byte("a"),
 								},
 								time.Hour*1,
+								"",
 							),
 						),
 					),
@@ -506,8 +611,7 @@ func TestCommandSide_VerifyInitCode(t *testing.T) {
 		{
 			name: "valid code with password, ok",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -536,6 +640,7 @@ func TestCommandSide_VerifyInitCode(t *testing.T) {
 									Crypted:    []byte("a"),
 								},
 								time.Hour*1,
+								"",
 							),
 						),
 					),
@@ -582,8 +687,7 @@ func TestCommandSide_VerifyInitCode(t *testing.T) {
 		{
 			name: "valid code with password and userAgentID, ok",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -612,6 +716,7 @@ func TestCommandSide_VerifyInitCode(t *testing.T) {
 									Crypted:    []byte("a"),
 								},
 								time.Hour*1,
+								"",
 							),
 						),
 					),
@@ -660,7 +765,7 @@ func TestCommandSide_VerifyInitCode(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			r := &Commands{
-				eventstore:         tt.fields.eventstore,
+				eventstore:         tt.fields.eventstore(t),
 				userPasswordHasher: tt.fields.userPasswordHasher,
 			}
 			err := r.HumanVerifyInitCode(tt.args.ctx, tt.args.userID, tt.args.resourceOwner, tt.args.code, tt.args.password, tt.args.userAgentID, tt.args.secretGenerator)
@@ -676,7 +781,7 @@ func TestCommandSide_VerifyInitCode(t *testing.T) {
 
 func TestCommandSide_InitCodeSent(t *testing.T) {
 	type fields struct {
-		eventstore *eventstore.Eventstore
+		eventstore func(*testing.T) *eventstore.Eventstore
 	}
 	type args struct {
 		ctx           context.Context
@@ -695,9 +800,7 @@ func TestCommandSide_InitCodeSent(t *testing.T) {
 		{
 			name: "userid missing, invalid argument error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
-				),
+				eventstore: expectEventstore(),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -710,8 +813,7 @@ func TestCommandSide_InitCodeSent(t *testing.T) {
 		{
 			name: "user not existing, precondition error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(),
 				),
 			},
@@ -727,8 +829,7 @@ func TestCommandSide_InitCodeSent(t *testing.T) {
 		{
 			name: "code sent, ok",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -763,7 +864,7 @@ func TestCommandSide_InitCodeSent(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			r := &Commands{
-				eventstore: tt.fields.eventstore,
+				eventstore: tt.fields.eventstore(t),
 			}
 			err := r.HumanInitCodeSent(tt.args.ctx, tt.args.resourceOwner, tt.args.userID)
 			if tt.res.err == nil {

internal/command/user_human_password.go

@@ -165,7 +165,7 @@ func (c *Commands) canUpdatePassword(ctx context.Context, newPassword string, re
 }
 
 // RequestSetPassword generate and send out new code to change password for a specific user
-func (c *Commands) RequestSetPassword(ctx context.Context, userID, resourceOwner string, notifyType domain.NotificationType, passwordVerificationCode crypto.Generator) (objectDetails *domain.ObjectDetails, err error) {
+func (c *Commands) RequestSetPassword(ctx context.Context, userID, resourceOwner string, notifyType domain.NotificationType, passwordVerificationCode crypto.Generator, authRequestID string) (objectDetails *domain.ObjectDetails, err error) {
 	if userID == "" {
 		return nil, zerrors.ThrowInvalidArgument(nil, "COMMAND-M00oL", "Errors.User.UserIDMissing")
 	}
@@ -185,7 +185,7 @@ func (c *Commands) RequestSetPassword(ctx context.Context, userID, resourceOwner
 	if err != nil {
 		return nil, err
 	}
-	pushedEvents, err := c.eventstore.Push(ctx, user.NewHumanPasswordCodeAddedEvent(ctx, userAgg, passwordCode.Code, passwordCode.Expiry, notifyType))
+	pushedEvents, err := c.eventstore.Push(ctx, user.NewHumanPasswordCodeAddedEvent(ctx, userAgg, passwordCode.Code, passwordCode.Expiry, notifyType, authRequestID))
 	if err != nil {
 		return nil, err
 	}

internal/command/user_human_password_test.go

@@ -22,7 +22,7 @@ import (
 
 func TestCommandSide_SetOneTimePassword(t *testing.T) {
 	type fields struct {
-		eventstore         *eventstore.Eventstore
+		eventstore         func(*testing.T) *eventstore.Eventstore
 		userPasswordHasher *crypto.Hasher
 		checkPermission    domain.PermissionCheck
 	}
@@ -46,9 +46,7 @@ func TestCommandSide_SetOneTimePassword(t *testing.T) {
 		{
 			name: "userid missing, invalid argument error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
-				),
+				eventstore: expectEventstore(),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -61,8 +59,7 @@ func TestCommandSide_SetOneTimePassword(t *testing.T) {
 		{
 			name: "user not existing, precondition error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(),
 				),
 			},
@@ -78,8 +75,7 @@ func TestCommandSide_SetOneTimePassword(t *testing.T) {
 		{
 			name: "missing permission, error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -121,8 +117,7 @@ func TestCommandSide_SetOneTimePassword(t *testing.T) {
 		{
 			name: "change password onetime, ok",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -184,8 +179,7 @@ func TestCommandSide_SetOneTimePassword(t *testing.T) {
 		{
 			name: "change password no one time, ok",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -248,7 +242,7 @@ func TestCommandSide_SetOneTimePassword(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			r := &Commands{
-				eventstore:         tt.fields.eventstore,
+				eventstore:         tt.fields.eventstore(t),
 				userPasswordHasher: tt.fields.userPasswordHasher,
 				checkPermission:    tt.fields.checkPermission,
 			}
@@ -268,7 +262,7 @@ func TestCommandSide_SetOneTimePassword(t *testing.T) {
 
 func TestCommandSide_SetPasswordWithVerifyCode(t *testing.T) {
 	type fields struct {
-		eventstore         *eventstore.Eventstore
+		eventstore         func(*testing.T) *eventstore.Eventstore
 		userEncryption     crypto.EncryptionAlgorithm
 		userPasswordHasher *crypto.Hasher
 	}
@@ -293,9 +287,7 @@ func TestCommandSide_SetPasswordWithVerifyCode(t *testing.T) {
 		{
 			name: "userid missing, invalid argument error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
-				),
+				eventstore: expectEventstore(),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -308,9 +300,7 @@ func TestCommandSide_SetPasswordWithVerifyCode(t *testing.T) {
 		{
 			name: "password missing, invalid argument error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
-				),
+				eventstore: expectEventstore(),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -324,8 +314,7 @@ func TestCommandSide_SetPasswordWithVerifyCode(t *testing.T) {
 		{
 			name: "user not existing, precondition error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(),
 				),
 			},
@@ -342,8 +331,7 @@ func TestCommandSide_SetPasswordWithVerifyCode(t *testing.T) {
 		{
 			name: "code not existing, precondition error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -376,8 +364,7 @@ func TestCommandSide_SetPasswordWithVerifyCode(t *testing.T) {
 		{
 			name: "invalid code, invalid argument error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -404,6 +391,7 @@ func TestCommandSide_SetPasswordWithVerifyCode(t *testing.T) {
 								},
 								time.Hour*1,
 								domain.NotificationTypeEmail,
+								"",
 							),
 						),
 					),
@@ -424,8 +412,7 @@ func TestCommandSide_SetPasswordWithVerifyCode(t *testing.T) {
 		{
 			name: "set password, ok",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -457,6 +444,7 @@ func TestCommandSide_SetPasswordWithVerifyCode(t *testing.T) {
 								},
 								time.Hour*1,
 								domain.NotificationTypeEmail,
+								"",
 							),
 						),
 					),
@@ -500,8 +488,7 @@ func TestCommandSide_SetPasswordWithVerifyCode(t *testing.T) {
 		{
 			name: "set password with userAgentID, ok",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -533,6 +520,7 @@ func TestCommandSide_SetPasswordWithVerifyCode(t *testing.T) {
 								},
 								time.Hour*1,
 								domain.NotificationTypeEmail,
+								"",
 							),
 						),
 					),
@@ -578,7 +566,7 @@ func TestCommandSide_SetPasswordWithVerifyCode(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			r := &Commands{
-				eventstore:         tt.fields.eventstore,
+				eventstore:         tt.fields.eventstore(t),
 				userPasswordHasher: tt.fields.userPasswordHasher,
 				userEncryption:     tt.fields.userEncryption,
 			}
@@ -915,7 +903,7 @@ func TestCommandSide_ChangePassword(t *testing.T) {
 
 func TestCommandSide_RequestSetPassword(t *testing.T) {
 	type fields struct {
-		eventstore *eventstore.Eventstore
+		eventstore func(*testing.T) *eventstore.Eventstore
 	}
 	type args struct {
 		ctx             context.Context
@@ -923,6 +911,7 @@ func TestCommandSide_RequestSetPassword(t *testing.T) {
 		resourceOwner   string
 		notifyType      domain.NotificationType
 		secretGenerator crypto.Generator
+		authRequestID   string
 	}
 	type res struct {
 		want *domain.ObjectDetails
@@ -937,9 +926,7 @@ func TestCommandSide_RequestSetPassword(t *testing.T) {
 		{
 			name: "userid missing, invalid argument error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
-				),
+				eventstore: expectEventstore(),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -952,8 +939,7 @@ func TestCommandSide_RequestSetPassword(t *testing.T) {
 		{
 			name: "user not existing, precondition error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(),
 				),
 			},
@@ -969,8 +955,7 @@ func TestCommandSide_RequestSetPassword(t *testing.T) {
 		{
 			name: "user initial, precondition error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -990,6 +975,7 @@ func TestCommandSide_RequestSetPassword(t *testing.T) {
 							user.NewHumanInitialCodeAddedEvent(context.Background(),
 								&user.NewAggregate("user1", "org1").Aggregate,
 								nil, time.Hour*1,
+								"",
 							),
 						),
 						eventFromEventPusher(
@@ -1018,8 +1004,7 @@ func TestCommandSide_RequestSetPassword(t *testing.T) {
 		{
 			name: "new code, ok",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -1055,6 +1040,7 @@ func TestCommandSide_RequestSetPassword(t *testing.T) {
 							},
 							time.Hour*1,
 							domain.NotificationTypeEmail,
+							"",
 						),
 					),
 				),
@@ -1071,13 +1057,70 @@ func TestCommandSide_RequestSetPassword(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "new code with authRequestID, ok",
+			fields: fields{
+				eventstore: expectEventstore(
+					expectFilter(
+						eventFromEventPusher(
+							user.NewHumanAddedEvent(context.Background(),
+								&user.NewAggregate("user1", "org1").Aggregate,
+								"username",
+								"firstname",
+								"lastname",
+								"nickname",
+								"displayname",
+								language.German,
+								domain.GenderUnspecified,
+								"email@test.ch",
+								true,
+							),
+						),
+						eventFromEventPusher(
+							user.NewHumanEmailVerifiedEvent(context.Background(),
+								&user.NewAggregate("user1", "org1").Aggregate,
+							),
+						),
+						eventFromEventPusher(
+							user.NewHumanInitializedCheckSucceededEvent(context.Background(),
+								&user.NewAggregate("user1", "org1").Aggregate)),
+					),
+					expectPush(
+						user.NewHumanPasswordCodeAddedEvent(context.Background(),
+							&user.NewAggregate("user1", "org1").Aggregate,
+							&crypto.CryptoValue{
+								CryptoType: crypto.TypeEncryption,
+								Algorithm:  "enc",
+								KeyID:      "id",
+								Crypted:    []byte("a"),
+							},
+							time.Hour*1,
+							domain.NotificationTypeEmail,
+							"authRequestID",
+						),
+					),
+				),
+			},
+			args: args{
+				ctx:             context.Background(),
+				userID:          "user1",
+				resourceOwner:   "org1",
+				secretGenerator: GetMockSecretGenerator(t),
+				authRequestID:   "authRequestID",
+			},
+			res: res{
+				want: &domain.ObjectDetails{
+					ResourceOwner: "org1",
+				},
+			},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			r := &Commands{
-				eventstore: tt.fields.eventstore,
+				eventstore: tt.fields.eventstore(t),
 			}
-			got, err := r.RequestSetPassword(tt.args.ctx, tt.args.userID, tt.args.resourceOwner, tt.args.notifyType, tt.args.secretGenerator)
+			got, err := r.RequestSetPassword(tt.args.ctx, tt.args.userID, tt.args.resourceOwner, tt.args.notifyType, tt.args.secretGenerator, tt.args.authRequestID)
 			if tt.res.err == nil {
 				assert.NoError(t, err)
 			}
@@ -1093,7 +1136,7 @@ func TestCommandSide_RequestSetPassword(t *testing.T) {
 
 func TestCommandSide_PasswordCodeSent(t *testing.T) {
 	type fields struct {
-		eventstore *eventstore.Eventstore
+		eventstore func(*testing.T) *eventstore.Eventstore
 	}
 	type args struct {
 		ctx           context.Context
@@ -1112,9 +1155,7 @@ func TestCommandSide_PasswordCodeSent(t *testing.T) {
 		{
 			name: "userid missing, invalid argument error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
-				),
+				eventstore: expectEventstore(),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -1127,8 +1168,7 @@ func TestCommandSide_PasswordCodeSent(t *testing.T) {
 		{
 			name: "user not existing, precondition error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(),
 				),
 			},
@@ -1144,8 +1184,7 @@ func TestCommandSide_PasswordCodeSent(t *testing.T) {
 		{
 			name: "code sent, ok",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -1186,7 +1225,7 @@ func TestCommandSide_PasswordCodeSent(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			r := &Commands{
-				eventstore: tt.fields.eventstore,
+				eventstore: tt.fields.eventstore(t),
 			}
 			err := r.PasswordCodeSent(tt.args.ctx, tt.args.resourceOwner, tt.args.userID)
 			if tt.res.err == nil {
@@ -1201,7 +1240,7 @@ func TestCommandSide_PasswordCodeSent(t *testing.T) {
 
 func TestCommandSide_CheckPassword(t *testing.T) {
 	type fields struct {
-		eventstore         *eventstore.Eventstore
+		eventstore         func(*testing.T) *eventstore.Eventstore
 		userPasswordHasher *crypto.Hasher
 	}
 	type args struct {
@@ -1224,9 +1263,7 @@ func TestCommandSide_CheckPassword(t *testing.T) {
 		{
 			name: "userid missing, invalid argument error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
-				),
+				eventstore: expectEventstore(),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -1240,9 +1277,7 @@ func TestCommandSide_CheckPassword(t *testing.T) {
 		{
 			name: "password missing, invalid argument error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
-				),
+				eventstore: expectEventstore(),
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -1256,8 +1291,7 @@ func TestCommandSide_CheckPassword(t *testing.T) {
 		{
 			name: "login policy not found, precondition error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(),
 					expectFilter(),
 				),
@@ -1275,8 +1309,7 @@ func TestCommandSide_CheckPassword(t *testing.T) {
 		{
 			name: "login policy login password not allowed, precondition error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							org.NewLoginPolicyAddedEvent(context.Background(),
@@ -1316,8 +1349,7 @@ func TestCommandSide_CheckPassword(t *testing.T) {
 		{
 			name: "user not existing, precondition error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							org.NewLoginPolicyAddedEvent(context.Background(),
@@ -1358,8 +1390,7 @@ func TestCommandSide_CheckPassword(t *testing.T) {
 		{
 			name: "user locked, precondition error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							org.NewLoginPolicyAddedEvent(context.Background(),
@@ -1420,8 +1451,7 @@ func TestCommandSide_CheckPassword(t *testing.T) {
 		{
 			name: "existing password empty, precondition error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							org.NewLoginPolicyAddedEvent(context.Background(),
@@ -1478,8 +1508,7 @@ func TestCommandSide_CheckPassword(t *testing.T) {
 		{
 			name: "password not matching lockout policy not relevant, precondition error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							org.NewLoginPolicyAddedEvent(context.Background(),
@@ -1562,8 +1591,7 @@ func TestCommandSide_CheckPassword(t *testing.T) {
 		{
 			name: "password not matching, max password attempts reached - user locked, precondition error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							org.NewLoginPolicyAddedEvent(context.Background(),
@@ -1653,8 +1681,7 @@ func TestCommandSide_CheckPassword(t *testing.T) {
 		{
 			name: "check password, ok",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							org.NewLoginPolicyAddedEvent(context.Background(),
@@ -1734,8 +1761,7 @@ func TestCommandSide_CheckPassword(t *testing.T) {
 		{
 			name: "check password, ok, updated hash",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							org.NewLoginPolicyAddedEvent(context.Background(),
@@ -1820,8 +1846,7 @@ func TestCommandSide_CheckPassword(t *testing.T) {
 		{
 			name: "check password ok, locked in the mean time",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							org.NewLoginPolicyAddedEvent(context.Background(),
@@ -1900,8 +1925,7 @@ func TestCommandSide_CheckPassword(t *testing.T) {
 		{
 			name: "regression test old version event",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							org.NewLoginPolicyAddedEvent(context.Background(),
@@ -1996,7 +2020,7 @@ func TestCommandSide_CheckPassword(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			r := &Commands{
-				eventstore:         tt.fields.eventstore,
+				eventstore:         tt.fields.eventstore(t),
 				userPasswordHasher: tt.fields.userPasswordHasher,
 			}
 			err := r.HumanCheckPassword(tt.args.ctx, tt.args.resourceOwner, tt.args.userID, tt.args.password, tt.args.authReq, tt.args.lockoutPolicy)

internal/command/user_test.go

@@ -1797,6 +1797,7 @@ func TestExistsUser(t *testing.T) {
 							domain.GenderFemale,
 							"support@zitadel.com",
 							true,
+							"userAgentID",
 						),
 					}, nil
 				},

internal/command/user_v2_email_test.go

@@ -1838,7 +1838,7 @@ func TestCommands_verifyUserEmailWithGenerator(t *testing.T) {
 
 func TestCommands_NewUserEmailEvents(t *testing.T) {
 	type fields struct {
-		eventstore *eventstore.Eventstore
+		eventstore func(*testing.T) *eventstore.Eventstore
 	}
 	type args struct {
 		userID string
@@ -1852,7 +1852,7 @@ func TestCommands_NewUserEmailEvents(t *testing.T) {
 		{
 			name: "missing userID",
 			fields: fields{
-				eventstore: eventstoreExpect(t),
+				eventstore: expectEventstore(),
 			},
 			args: args{
 				userID: "",
@@ -1862,7 +1862,7 @@ func TestCommands_NewUserEmailEvents(t *testing.T) {
 		{
 			name: "not found",
 			fields: fields{
-				eventstore: eventstoreExpect(t, expectFilter()),
+				eventstore: expectEventstore(expectFilter()),
 			},
 			args: args{
 				userID: "user1",
@@ -1872,8 +1872,7 @@ func TestCommands_NewUserEmailEvents(t *testing.T) {
 		{
 			name: "user not initialized",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -1893,6 +1892,7 @@ func TestCommands_NewUserEmailEvents(t *testing.T) {
 							user.NewHumanInitialCodeAddedEvent(context.Background(),
 								&user.NewAggregate("user1", "org1").Aggregate,
 								nil, time.Hour*1,
+								"",
 							),
 						),
 					),
@@ -1907,7 +1907,7 @@ func TestCommands_NewUserEmailEvents(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			c := &Commands{
-				eventstore: tt.fields.eventstore,
+				eventstore: tt.fields.eventstore(t),
 			}
 			_, err := c.NewUserEmailEvents(context.Background(), tt.args.userID)
 			require.ErrorIs(t, err, tt.wantErr)

internal/command/user_v2_human.go

@@ -131,8 +131,10 @@ func (c *Commands) AddUserHuman(ctx context.Context, resourceOwner string, human
 		return zerrors.ThrowPreconditionFailed(nil, "COMMAND-7yiox1isql", "Errors.User.AlreadyExisting")
 	}
 	// check for permission to create user on resourceOwner
-	if err := c.checkPermission(ctx, domain.PermissionUserWrite, resourceOwner, human.ID); err != nil {
-		return err
+	if !human.Register {
+		if err := c.checkPermission(ctx, domain.PermissionUserWrite, resourceOwner, human.ID); err != nil {
+			return err
+		}
 	}
 	// add resourceowner for the events with the aggregate
 	existingHuman.ResourceOwner = resourceOwner
@@ -159,6 +161,7 @@ func (c *Commands) AddUserHuman(ctx context.Context, resourceOwner string, human
 			human.Gender,
 			human.Email.Address,
 			domainPolicy.UserLoginMustBeDomain,
+			human.UserAgentID,
 		)
 	} else {
 		createCmd = user.NewHumanAddedEvent(

internal/command/user_v2_human_test.go

@@ -232,6 +232,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 							domain.GenderUnspecified,
 							"email@test.ch",
 							true,
+							"userAgentID",
 						),
 						user.NewHumanInitialCodeAddedEvent(context.Background(),
 							&userAgg.Aggregate,
@@ -242,6 +243,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 								Crypted:    []byte("userinit"),
 							},
 							time.Hour*1,
+							"authRequestID",
 						),
 					),
 				),
@@ -261,6 +263,8 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 					},
 					PreferredLanguage: language.English,
 					Register:          true,
+					UserAgentID:       "userAgentID",
+					AuthRequestID:     "authRequestID",
 				},
 				secretGenerator: GetMockSecretGenerator(t),
 				allowInitMail:   true,
@@ -344,6 +348,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 								Crypted:    []byte("userinit"),
 							},
 							time.Hour*1,
+							"",
 						),
 					),
 				),
@@ -414,6 +419,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 								Crypted:    []byte("userinit"),
 							},
 							1*time.Hour,
+							"",
 						),
 					),
 				),
@@ -1031,6 +1037,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 								Crypted:    []byte("userinit"),
 							},
 							1*time.Hour,
+							"",
 						),
 						user.NewHumanPhoneVerifiedEvent(
 							context.Background(),
@@ -1174,6 +1181,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 								Crypted:    []byte("userinit"),
 							},
 							1*time.Hour,
+							"",
 						),
 						user.NewMetadataSetEvent(
 							context.Background(),
@@ -1993,6 +2001,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 							user.NewHumanInitialCodeAddedEvent(context.Background(),
 								&userAgg.Aggregate,
 								nil, time.Hour*1,
+								"",
 							),
 						),
 					),

internal/command/user_v2_model_test.go

@@ -167,6 +167,7 @@ func TestCommandSide_userExistsWriteModel(t *testing.T) {
 									Crypted:    []byte("a"),
 								},
 								time.Hour*1,
+								"authRequestID",
 							),
 						),
 					),
@@ -225,6 +226,7 @@ func TestCommandSide_userExistsWriteModel(t *testing.T) {
 									Crypted:    []byte("a"),
 								},
 								time.Hour*1,
+								"authRequestID",
 							),
 						),
 						eventFromEventPusher(
@@ -280,6 +282,7 @@ func TestCommandSide_userExistsWriteModel(t *testing.T) {
 									Crypted:    []byte("a"),
 								},
 								time.Hour*1,
+								"authRequestID",
 							),
 						),
 						eventFromEventPusher(

internal/command/user_v2_password_test.go

@@ -10,6 +10,7 @@ import (
 	"github.com/muhlemmer/gu"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+
 	"github.com/zitadel/zitadel/internal/crypto"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/eventstore"
@@ -69,7 +70,7 @@ func TestCommands_RequestPasswordReset(t *testing.T) {
 						),
 						eventFromEventPusher(
 							user.NewHumanInitialCodeAddedEvent(context.Background(), &user.NewAggregate("userID", "org1").Aggregate,
-								&crypto.CryptoValue{CryptoType: crypto.TypeEncryption, Algorithm: "enc", KeyID: "keyID", Crypted: []byte("code")}, 10*time.Second),
+								&crypto.CryptoValue{CryptoType: crypto.TypeEncryption, Algorithm: "enc", KeyID: "keyID", Crypted: []byte("code")}, 10*time.Second, ""),
 						),
 					),
 				),
@@ -167,7 +168,7 @@ func TestCommands_RequestPasswordResetReturnCode(t *testing.T) {
 						),
 						eventFromEventPusher(
 							user.NewHumanInitialCodeAddedEvent(context.Background(), &user.NewAggregate("userID", "org1").Aggregate,
-								&crypto.CryptoValue{CryptoType: crypto.TypeEncryption, Algorithm: "enc", KeyID: "keyID", Crypted: []byte("code")}, 10*time.Second),
+								&crypto.CryptoValue{CryptoType: crypto.TypeEncryption, Algorithm: "enc", KeyID: "keyID", Crypted: []byte("code")}, 10*time.Second, ""),
 						),
 					),
 				),
@@ -279,7 +280,7 @@ func TestCommands_RequestPasswordResetURLTemplate(t *testing.T) {
 						),
 						eventFromEventPusher(
 							user.NewHumanInitialCodeAddedEvent(context.Background(), &user.NewAggregate("userID", "org1").Aggregate,
-								&crypto.CryptoValue{CryptoType: crypto.TypeEncryption, Algorithm: "enc", KeyID: "keyID", Crypted: []byte("code")}, 10*time.Second),
+								&crypto.CryptoValue{CryptoType: crypto.TypeEncryption, Algorithm: "enc", KeyID: "keyID", Crypted: []byte("code")}, 10*time.Second, ""),
 						),
 					),
 				),
@@ -390,7 +391,7 @@ func TestCommands_requestPasswordReset(t *testing.T) {
 						),
 						eventFromEventPusher(
 							user.NewHumanInitialCodeAddedEvent(context.Background(), &user.NewAggregate("userID", "org1").Aggregate,
-								&crypto.CryptoValue{CryptoType: crypto.TypeEncryption, Algorithm: "enc", KeyID: "keyID", Crypted: []byte("code")}, 10*time.Second),
+								&crypto.CryptoValue{CryptoType: crypto.TypeEncryption, Algorithm: "enc", KeyID: "keyID", Crypted: []byte("code")}, 10*time.Second, ""),
 						),
 					),
 				),

internal/command/user_v2_test.go

@@ -18,7 +18,7 @@ import (
 
 func TestCommandSide_LockUserV2(t *testing.T) {
 	type fields struct {
-		eventstore      *eventstore.Eventstore
+		eventstore      func(*testing.T) *eventstore.Eventstore
 		checkPermission domain.PermissionCheck
 	}
 	type (
@@ -40,9 +40,7 @@ func TestCommandSide_LockUserV2(t *testing.T) {
 		{
 			name: "userid missing, invalid argument error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
-				),
+				eventstore:      expectEventstore(),
 				checkPermission: newMockPermissionCheckAllowed(),
 			},
 			args: args{
@@ -58,8 +56,7 @@ func TestCommandSide_LockUserV2(t *testing.T) {
 		{
 			name: "user not existing, not found error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(),
 				),
 				checkPermission: newMockPermissionCheckAllowed(),
@@ -77,8 +74,7 @@ func TestCommandSide_LockUserV2(t *testing.T) {
 		{
 			name: "user already locked, precondition error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -116,8 +112,7 @@ func TestCommandSide_LockUserV2(t *testing.T) {
 		{
 			name: "user already locked, precondition error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewMachineAddedEvent(context.Background(),
@@ -151,8 +146,7 @@ func TestCommandSide_LockUserV2(t *testing.T) {
 		{
 			name: "lock user, ok",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -190,8 +184,7 @@ func TestCommandSide_LockUserV2(t *testing.T) {
 		{
 			name: "lock user, no permission",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -224,8 +217,7 @@ func TestCommandSide_LockUserV2(t *testing.T) {
 		{
 			name: "lock user machine, ok",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewMachineAddedEvent(context.Background(),
@@ -260,7 +252,7 @@ func TestCommandSide_LockUserV2(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			r := &Commands{
-				eventstore:      tt.fields.eventstore,
+				eventstore:      tt.fields.eventstore(t),
 				checkPermission: tt.fields.checkPermission,
 			}
 			got, err := r.LockUserV2(tt.args.ctx, tt.args.userID)
@@ -279,7 +271,7 @@ func TestCommandSide_LockUserV2(t *testing.T) {
 
 func TestCommandSide_UnlockUserV2(t *testing.T) {
 	type fields struct {
-		eventstore      *eventstore.Eventstore
+		eventstore      func(*testing.T) *eventstore.Eventstore
 		checkPermission domain.PermissionCheck
 	}
 	type (
@@ -301,9 +293,7 @@ func TestCommandSide_UnlockUserV2(t *testing.T) {
 		{
 			name: "userid missing, invalid argument error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
-				),
+				eventstore:      expectEventstore(),
 				checkPermission: newMockPermissionCheckAllowed(),
 			},
 			args: args{
@@ -319,8 +309,7 @@ func TestCommandSide_UnlockUserV2(t *testing.T) {
 		{
 			name: "user not existing, not found error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(),
 				),
 				checkPermission: newMockPermissionCheckAllowed(),
@@ -338,8 +327,7 @@ func TestCommandSide_UnlockUserV2(t *testing.T) {
 		{
 			name: "user already active, precondition error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -372,8 +360,7 @@ func TestCommandSide_UnlockUserV2(t *testing.T) {
 		{
 			name: "user already active, precondition error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						user.NewMachineAddedEvent(context.Background(),
 							&user.NewAggregate("user1", "org1").Aggregate,
@@ -400,8 +387,7 @@ func TestCommandSide_UnlockUserV2(t *testing.T) {
 		{
 			name: "unlock user, ok",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -443,8 +429,7 @@ func TestCommandSide_UnlockUserV2(t *testing.T) {
 		{
 			name: "unlock user, no permission",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -481,8 +466,7 @@ func TestCommandSide_UnlockUserV2(t *testing.T) {
 		{
 			name: "unlock user machine, ok",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewMachineAddedEvent(context.Background(),
@@ -521,7 +505,7 @@ func TestCommandSide_UnlockUserV2(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			r := &Commands{
-				eventstore:      tt.fields.eventstore,
+				eventstore:      tt.fields.eventstore(t),
 				checkPermission: tt.fields.checkPermission,
 			}
 			got, err := r.UnlockUserV2(tt.args.ctx, tt.args.userID)
@@ -540,7 +524,7 @@ func TestCommandSide_UnlockUserV2(t *testing.T) {
 
 func TestCommandSide_DeactivateUserV2(t *testing.T) {
 	type fields struct {
-		eventstore      *eventstore.Eventstore
+		eventstore      func(*testing.T) *eventstore.Eventstore
 		checkPermission domain.PermissionCheck
 	}
 	type (
@@ -562,9 +546,7 @@ func TestCommandSide_DeactivateUserV2(t *testing.T) {
 		{
 			name: "userid missing, invalid argument error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
-				),
+				eventstore:      expectEventstore(),
 				checkPermission: newMockPermissionCheckAllowed(),
 			},
 			args: args{
@@ -580,8 +562,7 @@ func TestCommandSide_DeactivateUserV2(t *testing.T) {
 		{
 			name: "user not existing, not found error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(),
 				),
 				checkPermission: newMockPermissionCheckAllowed(),
@@ -599,8 +580,7 @@ func TestCommandSide_DeactivateUserV2(t *testing.T) {
 		{
 			name: "user initial, precondition error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -620,6 +600,7 @@ func TestCommandSide_DeactivateUserV2(t *testing.T) {
 							user.NewHumanInitialCodeAddedEvent(context.Background(),
 								&user.NewAggregate("user1", "org1").Aggregate,
 								nil, time.Hour*1,
+								"",
 							),
 						),
 					),
@@ -639,8 +620,7 @@ func TestCommandSide_DeactivateUserV2(t *testing.T) {
 		{
 			name: "user already inactive, precondition error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -678,8 +658,7 @@ func TestCommandSide_DeactivateUserV2(t *testing.T) {
 		{
 			name: "deactivate user, ok",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -722,8 +701,7 @@ func TestCommandSide_DeactivateUserV2(t *testing.T) {
 		{
 			name: "deactivate user, no permission",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -761,8 +739,7 @@ func TestCommandSide_DeactivateUserV2(t *testing.T) {
 		{
 			name: "user machine already inactive, precondition error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewMachineAddedEvent(context.Background(),
@@ -796,8 +773,7 @@ func TestCommandSide_DeactivateUserV2(t *testing.T) {
 		{
 			name: "deactivate user machine, ok",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewMachineAddedEvent(context.Background(),
@@ -832,7 +808,7 @@ func TestCommandSide_DeactivateUserV2(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			r := &Commands{
-				eventstore:      tt.fields.eventstore,
+				eventstore:      tt.fields.eventstore(t),
 				checkPermission: tt.fields.checkPermission,
 			}
 			got, err := r.DeactivateUserV2(tt.args.ctx, tt.args.userID)
@@ -851,7 +827,7 @@ func TestCommandSide_DeactivateUserV2(t *testing.T) {
 
 func TestCommandSide_ReactivateUserV2(t *testing.T) {
 	type fields struct {
-		eventstore      *eventstore.Eventstore
+		eventstore      func(*testing.T) *eventstore.Eventstore
 		checkPermission domain.PermissionCheck
 	}
 	type (
@@ -873,9 +849,7 @@ func TestCommandSide_ReactivateUserV2(t *testing.T) {
 		{
 			name: "userid missing, invalid argument error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
-				),
+				eventstore:      expectEventstore(),
 				checkPermission: newMockPermissionCheckAllowed(),
 			},
 			args: args{
@@ -891,8 +865,7 @@ func TestCommandSide_ReactivateUserV2(t *testing.T) {
 		{
 			name: "user not existing, not found error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(),
 				),
 				checkPermission: newMockPermissionCheckAllowed(),
@@ -910,8 +883,7 @@ func TestCommandSide_ReactivateUserV2(t *testing.T) {
 		{
 			name: "user already active, precondition error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -944,8 +916,7 @@ func TestCommandSide_ReactivateUserV2(t *testing.T) {
 		{
 			name: "user machine already active, precondition error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewMachineAddedEvent(context.Background(),
@@ -974,8 +945,7 @@ func TestCommandSide_ReactivateUserV2(t *testing.T) {
 		{
 			name: "reactivate user, ok",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -1017,8 +987,7 @@ func TestCommandSide_ReactivateUserV2(t *testing.T) {
 		{
 			name: "reactivate user, no permission",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -1055,8 +1024,7 @@ func TestCommandSide_ReactivateUserV2(t *testing.T) {
 		{
 			name: "reactivate user machine, ok",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewMachineAddedEvent(context.Background(),
@@ -1095,7 +1063,7 @@ func TestCommandSide_ReactivateUserV2(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			r := &Commands{
-				eventstore:      tt.fields.eventstore,
+				eventstore:      tt.fields.eventstore(t),
 				checkPermission: tt.fields.checkPermission,
 			}
 			got, err := r.ReactivateUserV2(tt.args.ctx, tt.args.userID)
@@ -1114,7 +1082,7 @@ func TestCommandSide_ReactivateUserV2(t *testing.T) {
 
 func TestCommandSide_RemoveUserV2(t *testing.T) {
 	type fields struct {
-		eventstore      *eventstore.Eventstore
+		eventstore      func(*testing.T) *eventstore.Eventstore
 		checkPermission domain.PermissionCheck
 	}
 	type (
@@ -1138,9 +1106,7 @@ func TestCommandSide_RemoveUserV2(t *testing.T) {
 		{
 			name: "userid missing, invalid argument error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
-				),
+				eventstore:      expectEventstore(),
 				checkPermission: newMockPermissionCheckAllowed(),
 			},
 			args: args{
@@ -1156,8 +1122,7 @@ func TestCommandSide_RemoveUserV2(t *testing.T) {
 		{
 			name: "user not existing, not found error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(),
 				),
 				checkPermission: newMockPermissionCheckAllowed(),
@@ -1175,8 +1140,7 @@ func TestCommandSide_RemoveUserV2(t *testing.T) {
 		{
 			name: "user removed, notfound error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -1217,8 +1181,7 @@ func TestCommandSide_RemoveUserV2(t *testing.T) {
 		{
 			name: "remove user, ok",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -1269,8 +1232,7 @@ func TestCommandSide_RemoveUserV2(t *testing.T) {
 		{
 			name: "remove user, no permission",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -1308,8 +1270,7 @@ func TestCommandSide_RemoveUserV2(t *testing.T) {
 		{
 			name: "user machine already removed, notfound error",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewMachineAddedEvent(context.Background(),
@@ -1346,8 +1307,7 @@ func TestCommandSide_RemoveUserV2(t *testing.T) {
 		{
 			name: "remove user machine, ok",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewMachineAddedEvent(context.Background(),
@@ -1395,7 +1355,7 @@ func TestCommandSide_RemoveUserV2(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			r := &Commands{
-				eventstore:      tt.fields.eventstore,
+				eventstore:      tt.fields.eventstore(t),
 				checkPermission: tt.fields.checkPermission,
 			}
 			got, err := r.RemoveUserV2(tt.args.ctx, tt.args.userID, tt.args.cascadingMemberships, tt.args.grantIDs...)