fix: User checks (#139)

* check uniqueness on create and register user

* change user email, reserve release unique email

* usergrant unique aggregate

* usergrant uniqueness

* validate UserGrant

* fix tests

internal/user/repository/eventsourcing/eventstore.go

@@ -90,12 +90,11 @@ func (es *UserEventstore) UserByID(ctx context.Context, id string) (*usr_model.U
 	return model.UserToModel(user), nil
 }
 
-func (es *UserEventstore) PrepareCreateUser(ctx context.Context, user *usr_model.User, resourceOwner string) (*model.User, *es_models.Aggregate, error) {
+func (es *UserEventstore) PrepareCreateUser(ctx context.Context, user *usr_model.User, resourceOwner string) (*model.User, []*es_models.Aggregate, error) {
 	user.SetEmailAsUsername()
 	if !user.IsValid() {
 		return nil, nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-9dk45", "User is invalid")
 	}
-	//TODO: Check Uniqueness
 	id, err := es.idGenerator.NextID()
 	if err != nil {
 		return nil, nil, err
@@ -119,18 +118,18 @@ func (es *UserEventstore) PrepareCreateUser(ctx context.Context, user *usr_model
 	repoInitCode := model.InitCodeFromModel(user.InitCode)
 	repoPhoneCode := model.PhoneCodeFromModel(user.PhoneCode)
 
-	createAggregate, err := UserCreateAggregate(ctx, es.AggregateCreator(), repoUser, repoInitCode, repoPhoneCode, resourceOwner)
+	createAggregates, err := UserCreateAggregate(ctx, es.AggregateCreator(), repoUser, repoInitCode, repoPhoneCode, resourceOwner)
 
-	return repoUser, createAggregate, err
+	return repoUser, createAggregates, err
 }
 
 func (es *UserEventstore) CreateUser(ctx context.Context, user *usr_model.User) (*usr_model.User, error) {
-	repoUser, aggregate, err := es.PrepareCreateUser(ctx, user, "")
+	repoUser, aggregates, err := es.PrepareCreateUser(ctx, user, "")
 	if err != nil {
 		return nil, err
 	}
 
-	err = es_sdk.PushAggregates(ctx, es.PushAggregates, repoUser.AppendEvents, aggregate)
+	err = es_sdk.PushAggregates(ctx, es.PushAggregates, repoUser.AppendEvents, aggregates...)
 	if err != nil {
 		return nil, err
 	}
@@ -139,12 +138,11 @@ func (es *UserEventstore) CreateUser(ctx context.Context, user *usr_model.User)
 	return model.UserToModel(repoUser), nil
 }
 
-func (es *UserEventstore) PrepareRegisterUser(ctx context.Context, user *usr_model.User, resourceOwner string) (*model.User, *es_models.Aggregate, error) {
+func (es *UserEventstore) PrepareRegisterUser(ctx context.Context, user *usr_model.User, resourceOwner string) (*model.User, []*es_models.Aggregate, error) {
 	user.SetEmailAsUsername()
 	if !user.IsValid() || user.Password == nil || user.SecretString == "" {
 		return nil, nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-9dk45", "user is invalid")
 	}
-	//TODO: Check Uniqueness
 	id, err := es.idGenerator.NextID()
 	if err != nil {
 		return nil, nil, err
@@ -163,17 +161,17 @@ func (es *UserEventstore) PrepareRegisterUser(ctx context.Context, user *usr_mod
 	repoUser := model.UserFromModel(user)
 	repoEmailCode := model.EmailCodeFromModel(user.EmailCode)
 
-	aggregate, err := UserRegisterAggregate(ctx, es.AggregateCreator(), repoUser, resourceOwner, repoEmailCode)
-	return repoUser, aggregate, err
+	aggregates, err := UserRegisterAggregate(ctx, es.AggregateCreator(), repoUser, resourceOwner, repoEmailCode)
+	return repoUser, aggregates, err
 }
 
 func (es *UserEventstore) RegisterUser(ctx context.Context, user *usr_model.User, resourceOwner string) (*usr_model.User, error) {
-	repoUser, createAggregate, err := es.PrepareRegisterUser(ctx, user, resourceOwner)
+	repoUser, createAggregates, err := es.PrepareRegisterUser(ctx, user, resourceOwner)
 	if err != nil {
 		return nil, err
 	}
 
-	err = es_sdk.PushAggregates(ctx, es.PushAggregates, repoUser.AppendEvents, createAggregate)
+	err = es_sdk.PushAggregates(ctx, es.PushAggregates, repoUser.AppendEvents, createAggregates...)
 	if err != nil {
 		return nil, err
 	}
@@ -550,8 +548,11 @@ func (es *UserEventstore) ChangeEmail(ctx context.Context, email *usr_model.Emai
 	repoNew := model.EmailFromModel(email)
 	repoEmailCode := model.EmailCodeFromModel(emailCode)
 
-	updateAggregate := EmailChangeAggregate(es.AggregateCreator(), repoExisting, repoNew, repoEmailCode)
-	err = es_sdk.Push(ctx, es.PushAggregates, repoExisting.AppendEvents, updateAggregate)
+	updateAggregates, err := EmailChangeAggregate(ctx, es.AggregateCreator(), repoExisting, repoNew, repoEmailCode)
+	if err != nil {
+		return nil, err
+	}
+	err = es_sdk.PushAggregates(ctx, es.PushAggregates, repoExisting.AppendEvents, updateAggregates...)
 	if err != nil {
 		return nil, err
 	}

internal/user/repository/eventsourcing/model/types.go

@@ -21,7 +21,7 @@ const (
 	UserUnlocked    models.EventType = "user.unlocked"
 	UserDeactivated models.EventType = "user.deactivated"
 	UserReactivated models.EventType = "user.reactivated"
-	UserDeleted     models.EventType = "user.deleted"
+	UserRemoved     models.EventType = "user.removed"
 
 	UserPasswordChanged        models.EventType = "user.password.changed"
 	UserPasswordCodeAdded      models.EventType = "user.password.code.added"

internal/user/repository/eventsourcing/user.go

@@ -2,7 +2,6 @@ package eventsourcing
 
 import (
 	"context"
-
 	"github.com/caos/zitadel/internal/errors"
 	es_models "github.com/caos/zitadel/internal/eventstore/models"
 	es_sdk "github.com/caos/zitadel/internal/eventstore/sdk"
@@ -23,6 +22,22 @@ func UserQuery(latestSequence uint64) *es_models.SearchQuery {
 		LatestSequenceFilter(latestSequence)
 }
 
+func UserUserNameUniqueQuery(userName string) *es_models.SearchQuery {
+	return es_models.NewSearchQuery().
+		AggregateTypeFilter(model.UserUserNameAggregate).
+		AggregateIDFilter(userName).
+		OrderDesc().
+		SetLimit(1)
+}
+
+func UserEmailUniqueQuery(email string) *es_models.SearchQuery {
+	return es_models.NewSearchQuery().
+		AggregateTypeFilter(model.UserEmailAggregate).
+		AggregateIDFilter(email).
+		OrderDesc().
+		SetLimit(1)
+}
+
 func UserAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, user *model.User) (*es_models.Aggregate, error) {
 	if user == nil {
 		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dis83", "existing user should not be nil")
@@ -38,11 +53,12 @@ func UserAggregateOverwriteContext(ctx context.Context, aggCreator *es_models.Ag
 	return aggCreator.NewAggregate(ctx, user.AggregateID, model.UserAggregate, model.UserVersion, user.Sequence, es_models.OverwriteResourceOwner(resourceOwnerID), es_models.OverwriteEditorUser(userID))
 }
 
-func UserCreateAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, user *model.User, initCode *model.InitUserCode, phoneCode *model.PhoneCode, resourceOwner string) (agg *es_models.Aggregate, err error) {
+func UserCreateAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, user *model.User, initCode *model.InitUserCode, phoneCode *model.PhoneCode, resourceOwner string) (_ []*es_models.Aggregate, err error) {
 	if user == nil {
 		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-duxk2", "user should not be nil")
 	}
 
+	var agg *es_models.Aggregate
 	if resourceOwner != "" {
 		agg, err = UserAggregateOverwriteContext(ctx, aggCreator, user, user.AggregateID, resourceOwner)
 	} else {
@@ -80,10 +96,18 @@ func UserCreateAggregate(ctx context.Context, aggCreator *es_models.AggregateCre
 			return nil, err
 		}
 	}
-	return agg, err
+	uniqueAggregates, err := getUniqueUserAggregates(ctx, aggCreator, user, resourceOwner)
+	if err != nil {
+		return nil, err
+	}
+	return []*es_models.Aggregate{
+		agg,
+		uniqueAggregates[0],
+		uniqueAggregates[1],
+	}, nil
 }
 
-func UserRegisterAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, user *model.User, resourceOwner string, emailCode *model.EmailCode) (*es_models.Aggregate, error) {
+func UserRegisterAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, user *model.User, resourceOwner string, emailCode *model.EmailCode) ([]*es_models.Aggregate, error) {
 	if user == nil || resourceOwner == "" || emailCode == nil {
 		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-duxk2", "user, resourceowner, emailcode should not be nothing")
 	}
@@ -97,7 +121,82 @@ func UserRegisterAggregate(ctx context.Context, aggCreator *es_models.AggregateC
 	if err != nil {
 		return nil, err
 	}
-	return agg.AppendEvent(model.UserEmailCodeAdded, emailCode)
+	agg, err = agg.AppendEvent(model.UserEmailCodeAdded, emailCode)
+	if err != nil {
+		return nil, err
+	}
+	uniqueAggregates, err := getUniqueUserAggregates(ctx, aggCreator, user, resourceOwner)
+	if err != nil {
+		return nil, err
+	}
+	return []*es_models.Aggregate{
+		agg,
+		uniqueAggregates[0],
+		uniqueAggregates[1],
+	}, nil
+}
+
+func getUniqueUserAggregates(ctx context.Context, aggCreator *es_models.AggregateCreator, user *model.User, resourceOwner string) ([]*es_models.Aggregate, error) {
+	userNameAggregate, err := reservedUniqueUserNameAggregate(ctx, aggCreator, resourceOwner, user.UserName)
+	if err != nil {
+		return nil, err
+	}
+
+	emailAggregate, err := reservedUniqueEmailAggregate(ctx, aggCreator, resourceOwner, user.EmailAddress)
+	if err != nil {
+		return nil, err
+	}
+	return []*es_models.Aggregate{
+		userNameAggregate,
+		emailAggregate,
+	}, nil
+}
+func reservedUniqueUserNameAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, resourceOwner, userName string) (*es_models.Aggregate, error) {
+	aggregate, err := aggCreator.NewAggregate(ctx, userName, model.UserUserNameAggregate, model.UserVersion, 0)
+	if resourceOwner != "" {
+		aggregate, err = aggCreator.NewAggregate(ctx, userName, model.UserUserNameAggregate, model.UserVersion, 0, es_models.OverwriteResourceOwner(resourceOwner))
+	}
+	if err != nil {
+		return nil, err
+	}
+	aggregate, err = aggregate.AppendEvent(model.UserUserNameReserved, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return aggregate.SetPrecondition(UserUserNameUniqueQuery(userName), isEventValidation(aggregate, model.UserUserNameReserved)), nil
+}
+
+func reservedUniqueEmailAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, resourceOwner, email string) (aggregate *es_models.Aggregate, err error) {
+	aggregate, err = aggCreator.NewAggregate(ctx, email, model.UserEmailAggregate, model.UserVersion, 0)
+	if resourceOwner != "" {
+		aggregate, err = aggCreator.NewAggregate(ctx, email, model.UserEmailAggregate, model.UserVersion, 0, es_models.OverwriteResourceOwner(resourceOwner))
+	}
+	if err != nil {
+		return nil, err
+	}
+	aggregate, err = aggregate.AppendEvent(model.UserEmailReserved, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return aggregate.SetPrecondition(UserEmailUniqueQuery(email), isEventValidation(aggregate, model.UserEmailReserved)), nil
+}
+
+func releasedUniqueEmailAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, resourceOwner, email string) (aggregate *es_models.Aggregate, err error) {
+	aggregate, err = aggCreator.NewAggregate(ctx, email, model.UserEmailAggregate, model.UserVersion, 0)
+	if resourceOwner != "" {
+		aggregate, err = aggCreator.NewAggregate(ctx, email, model.UserEmailAggregate, model.UserVersion, 0, es_models.OverwriteResourceOwner(resourceOwner))
+	}
+	if err != nil {
+		return nil, err
+	}
+	aggregate, err = aggregate.AppendEvent(model.UserEmailReleased, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return aggregate.SetPrecondition(UserEmailUniqueQuery(email), isEventValidation(aggregate, model.UserEmailReleased)), nil
 }
 
 func UserDeactivateAggregate(aggCreator *es_models.AggregateCreator, user *model.User) func(ctx context.Context) (*es_models.Aggregate, error) {
@@ -231,38 +330,54 @@ func ProfileChangeAggregate(aggCreator *es_models.AggregateCreator, existing *mo
 	}
 }
 
-func EmailChangeAggregate(aggCreator *es_models.AggregateCreator, existing *model.User, email *model.Email, code *model.EmailCode) func(ctx context.Context) (*es_models.Aggregate, error) {
-	return func(ctx context.Context) (*es_models.Aggregate, error) {
-		if email == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dki8s", "email should not be nil")
-		}
-		if (!email.IsEmailVerified && code == nil) || (email.IsEmailVerified && code != nil) {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-id934", "email has to be verified or code must be sent")
-		}
-		agg, err := UserAggregate(ctx, aggCreator, existing)
-		if err != nil {
-			return nil, err
-		}
-		changes := existing.Email.Changes(email)
-		if len(changes) == 0 {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-s90pw", "no changes found")
-		}
-		agg, err = agg.AppendEvent(model.UserEmailChanged, changes)
-		if err != nil {
-			return nil, err
-		}
-		if existing.Email == nil {
-			existing.Email = new(model.Email)
-		}
-		if email.IsEmailVerified {
-			return agg.AppendEvent(model.UserEmailVerified, code)
-		}
-		if code != nil {
-			return agg.AppendEvent(model.UserEmailCodeAdded, code)
-		}
-		return agg, nil
+func EmailChangeAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, existing *model.User, email *model.Email, code *model.EmailCode) ([]*es_models.Aggregate, error) {
+	if email == nil {
+		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dki8s", "email should not be nil")
 	}
+	if (!email.IsEmailVerified && code == nil) || (email.IsEmailVerified && code != nil) {
+		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-id934", "email has to be verified or code must be sent")
+	}
+	changes := existing.Email.Changes(email)
+	if len(changes) == 0 {
+		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-s90pw", "no changes found")
+	}
+	aggregates := make([]*es_models.Aggregate, 0, 4)
+	reserveEmailAggregate, err := reservedUniqueEmailAggregate(ctx, aggCreator, "", email.EmailAddress)
+	if err != nil {
+		return nil, err
+	}
+	aggregates = append(aggregates, reserveEmailAggregate)
+	releaseEmailAggregate, err := releasedUniqueEmailAggregate(ctx, aggCreator, "", existing.EmailAddress)
+	if err != nil {
+		return nil, err
+	}
+	aggregates = append(aggregates, releaseEmailAggregate)
+	agg, err := UserAggregate(ctx, aggCreator, existing)
+	if err != nil {
+		return nil, err
+	}
+	agg, err = agg.AppendEvent(model.UserEmailChanged, changes)
+	if err != nil {
+		return nil, err
+	}
+	if existing.Email == nil {
+		existing.Email = new(model.Email)
+	}
+	if email.IsEmailVerified {
+		agg, err = agg.AppendEvent(model.UserEmailVerified, code)
+		if err != nil {
+			return nil, err
+		}
+	}
+	if code != nil {
+		agg, err = agg.AppendEvent(model.UserEmailCodeAdded, code)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return append(aggregates, agg), nil
 }
+
 func EmailVerifiedAggregate(aggCreator *es_models.AggregateCreator, existing *model.User) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		agg, err := UserAggregate(ctx, aggCreator, existing)
@@ -449,3 +564,17 @@ func SignOutAggregate(aggCreator *es_models.AggregateCreator, existing *model.Us
 		return agg.AppendEvent(model.SignedOut, map[string]interface{}{"agentID": agentID})
 	}
 }
+
+func isEventValidation(aggregate *es_models.Aggregate, eventType es_models.EventType) func(...*es_models.Event) error {
+	return func(events ...*es_models.Event) error {
+		if len(events) == 0 {
+			aggregate.PreviousSequence = 0
+			return nil
+		}
+		if events[0].Type == eventType {
+			return errors.ThrowPreconditionFailedf(nil, "EVENT-eJQqe", "user is already %v", eventType)
+		}
+		aggregate.PreviousSequence = events[0].Sequence
+		return nil
+	}
+}

internal/user/repository/eventsourcing/user_test.go

@@ -108,11 +108,12 @@ func TestUserCreateAggregate(t *testing.T) {
 		aggCreator *models.AggregateCreator
 	}
 	type res struct {
-		eventLen   int
-		eventTypes []models.EventType
-		checkData  []bool
-		wantErr    bool
-		errFunc    func(err error) bool
+		eventLen      int
+		eventTypes    []models.EventType
+		aggregatesLen int
+		checkData     []bool
+		wantErr       bool
+		errFunc       func(err error) bool
 	}
 	tests := []struct {
 		name string
@@ -125,13 +126,15 @@ func TestUserCreateAggregate(t *testing.T) {
 				ctx: auth.NewMockContext("orgID", "userID"),
 				new: &model.User{ObjectRoot: models.ObjectRoot{AggregateID: "ID"},
 					Profile: &model.Profile{UserName: "UserName"},
+					Email:   &model.Email{EmailAddress: "EmailAddress"},
 				},
 				aggCreator: models.NewAggregateCreator("Test"),
 			},
 			res: res{
-				eventLen:   1,
-				eventTypes: []models.EventType{model.UserAdded},
-				checkData:  []bool{true},
+				eventLen:      1,
+				eventTypes:    []models.EventType{model.UserAdded},
+				checkData:     []bool{true},
+				aggregatesLen: 3,
 			},
 		},
 		{
@@ -152,14 +155,16 @@ func TestUserCreateAggregate(t *testing.T) {
 				ctx: auth.NewMockContext("orgID", "userID"),
 				new: &model.User{ObjectRoot: models.ObjectRoot{AggregateID: "ID"},
 					Profile: &model.Profile{UserName: "UserName"},
+					Email:   &model.Email{EmailAddress: "EmailAddress"},
 				},
 				initCode:   &model.InitUserCode{},
 				aggCreator: models.NewAggregateCreator("Test"),
 			},
 			res: res{
-				eventLen:   2,
-				eventTypes: []models.EventType{model.UserAdded, model.InitializedUserCodeAdded},
-				checkData:  []bool{true, true},
+				eventLen:      2,
+				eventTypes:    []models.EventType{model.UserAdded, model.InitializedUserCodeAdded},
+				checkData:     []bool{true, true},
+				aggregatesLen: 3,
 			},
 		},
 		{
@@ -168,14 +173,16 @@ func TestUserCreateAggregate(t *testing.T) {
 				ctx: auth.NewMockContext("orgID", "userID"),
 				new: &model.User{ObjectRoot: models.ObjectRoot{AggregateID: "ID"},
 					Profile: &model.Profile{UserName: "UserName"},
+					Email:   &model.Email{EmailAddress: "EmailAddress"},
 				},
 				phoneCode:  &model.PhoneCode{},
 				aggCreator: models.NewAggregateCreator("Test"),
 			},
 			res: res{
-				eventLen:   2,
-				eventTypes: []models.EventType{model.UserAdded, model.UserPhoneCodeAdded},
-				checkData:  []bool{true, true},
+				eventLen:      2,
+				eventTypes:    []models.EventType{model.UserAdded, model.UserPhoneCodeAdded},
+				checkData:     []bool{true, true},
+				aggregatesLen: 3,
 			},
 		},
 		{
@@ -189,9 +196,10 @@ func TestUserCreateAggregate(t *testing.T) {
 				aggCreator: models.NewAggregateCreator("Test"),
 			},
 			res: res{
-				eventLen:   2,
-				eventTypes: []models.EventType{model.UserAdded, model.UserEmailVerified},
-				checkData:  []bool{true, false},
+				eventLen:      2,
+				eventTypes:    []models.EventType{model.UserAdded, model.UserEmailVerified},
+				checkData:     []bool{true, false},
+				aggregatesLen: 3,
 			},
 		},
 		{
@@ -200,32 +208,38 @@ func TestUserCreateAggregate(t *testing.T) {
 				ctx: auth.NewMockContext("orgID", "userID"),
 				new: &model.User{ObjectRoot: models.ObjectRoot{AggregateID: "ID"},
 					Profile: &model.Profile{UserName: "UserName"},
+					Email:   &model.Email{EmailAddress: "EmailAddress"},
 					Phone:   &model.Phone{PhoneNumber: "PhoneNumber", IsPhoneVerified: true},
 				},
 				aggCreator: models.NewAggregateCreator("Test"),
 			},
 			res: res{
-				eventLen:   2,
-				eventTypes: []models.EventType{model.UserAdded, model.UserPhoneVerified},
-				checkData:  []bool{true, false},
+				eventLen:      2,
+				eventTypes:    []models.EventType{model.UserAdded, model.UserPhoneVerified},
+				checkData:     []bool{true, false},
+				aggregatesLen: 3,
 			},
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			agg, err := UserCreateAggregate(tt.args.ctx, tt.args.aggCreator, tt.args.new, tt.args.initCode, tt.args.phoneCode, "")
+			aggregates, err := UserCreateAggregate(tt.args.ctx, tt.args.aggCreator, tt.args.new, tt.args.initCode, tt.args.phoneCode, "")
 
-			if !tt.res.wantErr && len(agg.Events) != tt.res.eventLen {
-				t.Errorf("got wrong event len: expected: %v, actual: %v ", tt.res.eventLen, len(agg.Events))
+			if !tt.res.wantErr && len(aggregates) != tt.res.aggregatesLen {
+				t.Errorf("got wrong event len: expected: %v, actual: %v ", tt.res.aggregatesLen, len(aggregates))
+			}
+
+			if !tt.res.wantErr && len(aggregates[0].Events) != tt.res.eventLen {
+				t.Errorf("got wrong event len: expected: %v, actual: %v ", tt.res.eventLen, len(aggregates[0].Events))
 			}
 			for i := 0; i < tt.res.eventLen; i++ {
-				if !tt.res.wantErr && agg.Events[i].Type != tt.res.eventTypes[i] {
-					t.Errorf("got wrong event type: expected: %v, actual: %v ", tt.res.eventTypes[i], agg.Events[i].Type.String())
+				if !tt.res.wantErr && aggregates[0].Events[i].Type != tt.res.eventTypes[i] {
+					t.Errorf("got wrong event type: expected: %v, actual: %v ", tt.res.eventTypes[i], aggregates[0].Events[i].Type.String())
 				}
-				if !tt.res.wantErr && tt.res.checkData[i] && agg.Events[i].Data == nil {
+				if !tt.res.wantErr && tt.res.checkData[i] && aggregates[0].Events[i].Data == nil {
 					t.Errorf("should have data in event")
 				}
-				if !tt.res.wantErr && !tt.res.checkData[i] && agg.Events[i].Data != nil {
+				if !tt.res.wantErr && !tt.res.checkData[i] && aggregates[0].Events[i].Data != nil {
 					t.Errorf("should not have data in event")
 				}
 			}
@@ -257,9 +271,10 @@ func TestUserRegisterAggregate(t *testing.T) {
 		{
 			name: "user register aggregate ok",
 			args: args{
-				ctx: auth.NewMockContext("", ""),
+				ctx: auth.NewMockContext("orgID", "userID"),
 				new: &model.User{ObjectRoot: models.ObjectRoot{AggregateID: "ID"},
 					Profile: &model.Profile{UserName: "UserName"},
+					Email:   &model.Email{EmailAddress: "EmailAddress"},
 				},
 				emailCode:     &model.EmailCode{},
 				resourceOwner: "newResourceowner",
@@ -290,6 +305,7 @@ func TestUserRegisterAggregate(t *testing.T) {
 				resourceOwner: "newResourceowner",
 				new: &model.User{ObjectRoot: models.ObjectRoot{AggregateID: "ID"},
 					Profile: &model.Profile{UserName: "UserName"},
+					Email:   &model.Email{EmailAddress: "EmailAddress"},
 				},
 				aggCreator: models.NewAggregateCreator("Test"),
 			},
@@ -303,6 +319,7 @@ func TestUserRegisterAggregate(t *testing.T) {
 				ctx: auth.NewMockContext("orgID", "userID"),
 				new: &model.User{ObjectRoot: models.ObjectRoot{AggregateID: "ID"},
 					Profile: &model.Profile{UserName: "UserName"},
+					Email:   &model.Email{EmailAddress: "EmailAddress"},
 				},
 				resourceOwner: "newResourceowner",
 				emailCode:     &model.EmailCode{},
@@ -319,6 +336,7 @@ func TestUserRegisterAggregate(t *testing.T) {
 				ctx: auth.NewMockContext("orgID", "userID"),
 				new: &model.User{ObjectRoot: models.ObjectRoot{AggregateID: "ID"},
 					Profile: &model.Profile{UserName: "UserName"},
+					Email:   &model.Email{EmailAddress: "EmailAddress"},
 				},
 				emailCode:  &model.EmailCode{},
 				aggCreator: models.NewAggregateCreator("Test"),
@@ -330,16 +348,16 @@ func TestUserRegisterAggregate(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			agg, err := UserRegisterAggregate(tt.args.ctx, tt.args.aggCreator, tt.args.new, tt.args.resourceOwner, tt.args.emailCode)
+			aggregates, err := UserRegisterAggregate(tt.args.ctx, tt.args.aggCreator, tt.args.new, tt.args.resourceOwner, tt.args.emailCode)
 
-			if tt.res.errFunc == nil && len(agg.Events) != tt.res.eventLen {
-				t.Errorf("got wrong event len: expected: %v, actual: %v ", tt.res.eventLen, len(agg.Events))
+			if tt.res.errFunc == nil && len(aggregates[0].Events) != tt.res.eventLen {
+				t.Errorf("got wrong event len: expected: %v, actual: %v ", tt.res.eventLen, len(aggregates[0].Events))
 			}
 			for i := 0; i < tt.res.eventLen; i++ {
-				if tt.res.errFunc == nil && agg.Events[i].Type != tt.res.eventTypes[i] {
-					t.Errorf("got wrong event type: expected: %v, actual: %v ", tt.res.eventTypes[i], agg.Events[i].Type.String())
+				if tt.res.errFunc == nil && aggregates[0].Events[i].Type != tt.res.eventTypes[i] {
+					t.Errorf("got wrong event type: expected: %v, actual: %v ", tt.res.eventTypes[i], aggregates[0].Events[i].Type.String())
 				}
-				if tt.res.errFunc == nil && agg.Events[i].Data == nil {
+				if tt.res.errFunc == nil && aggregates[0].Events[i].Data == nil {
 					t.Errorf("should have data in event")
 				}
 			}
@@ -1075,16 +1093,16 @@ func TestChangeEmailAggregate(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			agg, err := EmailChangeAggregate(tt.args.aggCreator, tt.args.existing, tt.args.email, tt.args.code)(tt.args.ctx)
+			aggregates, err := EmailChangeAggregate(tt.args.ctx, tt.args.aggCreator, tt.args.existing, tt.args.email, tt.args.code)
 
-			if tt.res.errFunc == nil && len(agg.Events) != tt.res.eventLen {
-				t.Errorf("got wrong event len: expected: %v, actual: %v ", tt.res.eventLen, len(agg.Events))
+			if tt.res.errFunc == nil && len(aggregates[2].Events) != tt.res.eventLen {
+				t.Errorf("got wrong event len: expected: %v, actual: %v ", tt.res.eventLen, len(aggregates[1].Events))
 			}
 			for i := 0; i < tt.res.eventLen; i++ {
-				if tt.res.errFunc == nil && agg.Events[i].Type != tt.res.eventTypes[i] {
-					t.Errorf("got wrong event type: expected: %v, actual: %v ", tt.res.eventTypes[i], agg.Events[i].Type.String())
+				if tt.res.errFunc == nil && aggregates[2].Events[i].Type != tt.res.eventTypes[i] {
+					t.Errorf("got wrong event type: expected: %v, actual: %v ", tt.res.eventTypes[i], aggregates[1].Events[i].Type.String())
 				}
-				if tt.res.errFunc == nil && agg.Events[i].Data == nil {
+				if tt.res.errFunc == nil && aggregates[2].Events[i].Data == nil {
 					t.Errorf("should have data in event")
 				}
 			}