feat: idp and login policy configurations (#619)

* feat: oidc config * fix: oidc configurations * feat: oidc idp config * feat: add oidc config test * fix: tests * fix: tests * feat: translate new events * feat: idp eventstore * feat: idp eventstore * fix: tests * feat: command side idp * feat: query side idp * feat: idp config on org * fix: tests * feat: authz idp on org * feat: org idps * feat: login policy * feat: login policy * feat: login policy * feat: add idp func on login policy * feat: add validation to loginpolicy and idp provider * feat: add default login policy * feat: login policy on org * feat: login policy on org * fix: id config handlers * fix: id config handlers * fix: create idp on org * fix: create idp on org * fix: not existing idp config * fix: default login policy * fix: add login policy on org * fix: idp provider search on org * fix: test * fix: remove idp on org * fix: test * fix: test * fix: remove admin idp * fix: logo src as byte * fix: migration * fix: tests * Update internal/iam/repository/eventsourcing/iam.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * Update internal/iam/repository/eventsourcing/iam_test.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * Update internal/iam/repository/eventsourcing/iam_test.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * Update internal/iam/repository/eventsourcing/model/login_policy.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * Update internal/iam/repository/eventsourcing/model/login_policy.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * Update internal/org/repository/eventsourcing/org_test.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * Update internal/iam/repository/eventsourcing/model/login_policy_test.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * Update internal/iam/repository/eventsourcing/model/login_policy_test.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * fix: pr comments * fix: tests * Update types.go * fix: merge request changes * fix: reduce optimization Co-authored-by: Silvan <silvan.reusser@gmail.com> Co-authored-by: Livio Amstutz <livio.a@gmail.com>
2025-12-06 19:36:41 +00:00 · 2020-08-26 09:56:23 +02:00
parent f05c5bae24
commit db1d8f4efe
157 changed files with 37510 additions and 15698 deletions
--- a/internal/management/repository/eventsourcing/eventstore/iam.go
+++ b/internal/management/repository/eventsourcing/eventstore/iam.go
@@ -6,10 +6,10 @@ import (
 	"github.com/caos/zitadel/internal/iam/repository/eventsourcing"
 )

-type IamRepository struct {
-	IamEvents *eventsourcing.IamEventstore
+type IAMRepository struct {
+	IAMEvents *eventsourcing.IAMEventstore
 }

-func (repo *IamRepository) IamByID(ctx context.Context, id string) (*iam_model.Iam, error) {
-	return repo.IamEvents.IamByID(ctx, id)
+func (repo *IAMRepository) IAMByID(ctx context.Context, id string) (*iam_model.IAM, error) {
+	return repo.IAMEvents.IAMByID(ctx, id)
 }
--- a/internal/management/repository/eventsourcing/eventstore/org.go
+++ b/internal/management/repository/eventsourcing/eventstore/org.go
@@ -3,6 +3,11 @@ package eventstore
 import (
 	"context"
 	"github.com/caos/logging"
+	"github.com/caos/zitadel/internal/config/systemdefaults"
+	"github.com/caos/zitadel/internal/eventstore/models"
+	iam_model "github.com/caos/zitadel/internal/iam/model"
+	iam_es_model "github.com/caos/zitadel/internal/iam/repository/view/model"
+	iam_view_model "github.com/caos/zitadel/internal/iam/repository/view/model"
 	"strings"

 	"github.com/caos/zitadel/internal/api/authz"
@@ -25,9 +30,10 @@ const (
 type OrgRepository struct {
 	SearchLimit uint64
 	*org_es.OrgEventstore
-	UserEvents *usr_es.UserEventstore
-	View       *mgmt_view.View
-	Roles      []string
+	UserEvents     *usr_es.UserEventstore
+	View           *mgmt_view.View
+	Roles          []string
+	SystemDefaults systemdefaults.SystemDefaults
 }

 func (repo *OrgRepository) OrgByID(ctx context.Context, id string) (*org_model.OrgView, error) {
@@ -79,15 +85,15 @@ func (repo *OrgRepository) ReactivateOrg(ctx context.Context, id string) (*org_m
 	return repo.OrgEventstore.ReactivateOrg(ctx, id)
 }

-func (repo *OrgRepository) GetMyOrgIamPolicy(ctx context.Context) (*org_model.OrgIamPolicy, error) {
-	return repo.OrgEventstore.GetOrgIamPolicy(ctx, authz.GetCtxData(ctx).OrgID)
+func (repo *OrgRepository) GetMyOrgIamPolicy(ctx context.Context) (*org_model.OrgIAMPolicy, error) {
+	return repo.OrgEventstore.GetOrgIAMPolicy(ctx, authz.GetCtxData(ctx).OrgID)
 }

 func (repo *OrgRepository) SearchMyOrgDomains(ctx context.Context, request *org_model.OrgDomainSearchRequest) (*org_model.OrgDomainSearchResponse, error) {
 	request.EnsureLimit(repo.SearchLimit)
 	request.Queries = append(request.Queries, &org_model.OrgDomainSearchQuery{Key: org_model.OrgDomainSearchKeyOrgID, Method: global_model.SearchMethodEquals, Value: authz.GetCtxData(ctx).OrgID})
-	sequence, err := repo.View.GetLatestOrgDomainSequence()
-	logging.Log("EVENT-SLowp").OnError(err).Warn("could not read latest org domain sequence")
+	sequence, sequenceErr := repo.View.GetLatestOrgDomainSequence()
+	logging.Log("EVENT-SLowp").OnError(sequenceErr).Warn("could not read latest org domain sequence")
 	domains, count, err := repo.View.SearchOrgDomains(request)
 	if err != nil {
 		return nil, err
@@ -98,7 +104,7 @@ func (repo *OrgRepository) SearchMyOrgDomains(ctx context.Context, request *org_
 		TotalResult: uint64(count),
 		Result:      model.OrgDomainsToModel(domains),
 	}
-	if err == nil {
+	if sequenceErr == nil {
 		result.Sequence = sequence.CurrentSequence
 		result.Timestamp = sequence.CurrentTimestamp
 	}
@@ -178,8 +184,8 @@ func (repo *OrgRepository) RemoveMyOrgMember(ctx context.Context, userID string)
 func (repo *OrgRepository) SearchMyOrgMembers(ctx context.Context, request *org_model.OrgMemberSearchRequest) (*org_model.OrgMemberSearchResponse, error) {
 	request.EnsureLimit(repo.SearchLimit)
 	request.Queries[len(request.Queries)-1] = &org_model.OrgMemberSearchQuery{Key: org_model.OrgMemberSearchKeyOrgID, Method: global_model.SearchMethodEquals, Value: authz.GetCtxData(ctx).OrgID}
-	sequence, err := repo.View.GetLatestOrgMemberSequence()
-	logging.Log("EVENT-Smu3d").OnError(err).Warn("could not read latest org member sequence")
+	sequence, sequenceErr := repo.View.GetLatestOrgMemberSequence()
+	logging.Log("EVENT-Smu3d").OnError(sequenceErr).Warn("could not read latest org member sequence")
 	members, count, err := repo.View.SearchOrgMembers(request)
 	if err != nil {
 		return nil, err
@@ -187,10 +193,10 @@ func (repo *OrgRepository) SearchMyOrgMembers(ctx context.Context, request *org_
 	result := &org_model.OrgMemberSearchResponse{
 		Offset:      request.Offset,
 		Limit:       request.Limit,
-		TotalResult: uint64(count),
+		TotalResult: count,
 		Result:      model.OrgMembersToModel(members),
 	}
-	if err == nil {
+	if sequenceErr == nil {
 		result.Sequence = sequence.CurrentSequence
 		result.Timestamp = sequence.CurrentTimestamp
 	}
@@ -206,3 +212,132 @@ func (repo *OrgRepository) GetOrgMemberRoles() []string {
 	}
 	return roles
 }
+
+func (repo *OrgRepository) IDPConfigByID(ctx context.Context, idpConfigID string) (*iam_model.IDPConfigView, error) {
+	idp, err := repo.View.IDPConfigByID(idpConfigID)
+	if err != nil {
+		return nil, err
+	}
+	return iam_view_model.IdpConfigViewToModel(idp), nil
+}
+func (repo *OrgRepository) AddOIDCIDPConfig(ctx context.Context, idp *iam_model.IDPConfig) (*iam_model.IDPConfig, error) {
+	idp.AggregateID = authz.GetCtxData(ctx).OrgID
+	return repo.OrgEventstore.AddIDPConfig(ctx, idp)
+}
+
+func (repo *OrgRepository) ChangeIDPConfig(ctx context.Context, idp *iam_model.IDPConfig) (*iam_model.IDPConfig, error) {
+	idp.AggregateID = authz.GetCtxData(ctx).OrgID
+	return repo.OrgEventstore.ChangeIDPConfig(ctx, idp)
+}
+
+func (repo *OrgRepository) DeactivateIDPConfig(ctx context.Context, idpConfigID string) (*iam_model.IDPConfig, error) {
+	return repo.OrgEventstore.DeactivateIDPConfig(ctx, authz.GetCtxData(ctx).OrgID, idpConfigID)
+}
+
+func (repo *OrgRepository) ReactivateIDPConfig(ctx context.Context, idpConfigID string) (*iam_model.IDPConfig, error) {
+	return repo.OrgEventstore.ReactivateIDPConfig(ctx, authz.GetCtxData(ctx).OrgID, idpConfigID)
+}
+
+func (repo *OrgRepository) RemoveIDPConfig(ctx context.Context, idpConfigID string) error {
+	idp := iam_model.NewIDPConfig(authz.GetCtxData(ctx).OrgID, idpConfigID)
+	return repo.OrgEventstore.RemoveIDPConfig(ctx, idp)
+}
+
+func (repo *OrgRepository) ChangeOIDCIDPConfig(ctx context.Context, oidcConfig *iam_model.OIDCIDPConfig) (*iam_model.OIDCIDPConfig, error) {
+	oidcConfig.AggregateID = authz.GetCtxData(ctx).OrgID
+	return repo.OrgEventstore.ChangeIDPOIDCConfig(ctx, oidcConfig)
+}
+
+func (repo *OrgRepository) SearchIDPConfigs(ctx context.Context, request *iam_model.IDPConfigSearchRequest) (*iam_model.IDPConfigSearchResponse, error) {
+	request.EnsureLimit(repo.SearchLimit)
+	request.AppendMyOrgQuery(authz.GetCtxData(ctx).OrgID, repo.SystemDefaults.IamID)
+
+	sequence, sequenceErr := repo.View.GetLatestIDPConfigSequence()
+	logging.Log("EVENT-Dk8si").OnError(sequenceErr).Warn("could not read latest idp config sequence")
+	idps, count, err := repo.View.SearchIDPConfigs(request)
+	if err != nil {
+		return nil, err
+	}
+	result := &iam_model.IDPConfigSearchResponse{
+		Offset:      request.Offset,
+		Limit:       request.Limit,
+		TotalResult: count,
+		Result:      iam_view_model.IdpConfigViewsToModel(idps),
+	}
+	if sequenceErr == nil {
+		result.Sequence = sequence.CurrentSequence
+		result.Timestamp = sequence.CurrentTimestamp
+	}
+	return result, nil
+}
+
+func (repo *OrgRepository) GetLoginPolicy(ctx context.Context) (*iam_model.LoginPolicyView, error) {
+	policy, err := repo.View.LoginPolicyByAggregateID(authz.GetCtxData(ctx).OrgID)
+	if errors.IsNotFound(err) {
+		policy, err = repo.View.LoginPolicyByAggregateID(repo.SystemDefaults.IamID)
+		if err != nil {
+			return nil, err
+		}
+		policy.Default = true
+	}
+	if err != nil {
+		return nil, err
+	}
+	return iam_es_model.LoginPolicyViewToModel(policy), err
+}
+
+func (repo *OrgRepository) AddLoginPolicy(ctx context.Context, policy *iam_model.LoginPolicy) (*iam_model.LoginPolicy, error) {
+	policy.AggregateID = authz.GetCtxData(ctx).OrgID
+	return repo.OrgEventstore.AddLoginPolicy(ctx, policy)
+}
+
+func (repo *OrgRepository) ChangeLoginPolicy(ctx context.Context, policy *iam_model.LoginPolicy) (*iam_model.LoginPolicy, error) {
+	policy.AggregateID = authz.GetCtxData(ctx).OrgID
+	return repo.OrgEventstore.ChangeLoginPolicy(ctx, policy)
+}
+
+func (repo *OrgRepository) RemoveLoginPolicy(ctx context.Context) error {
+	policy := &iam_model.LoginPolicy{ObjectRoot: models.ObjectRoot{
+		AggregateID: authz.GetCtxData(ctx).OrgID,
+	}}
+	return repo.OrgEventstore.RemoveLoginPolicy(ctx, policy)
+}
+
+func (repo *OrgRepository) SearchIDPProviders(ctx context.Context, request *iam_model.IDPProviderSearchRequest) (*iam_model.IDPProviderSearchResponse, error) {
+	_, err := repo.View.LoginPolicyByAggregateID(authz.GetCtxData(ctx).OrgID)
+	if err != nil {
+		if errors.IsNotFound(err) {
+			request.AppendAggregateIDQuery(repo.SystemDefaults.IamID)
+		}
+	} else {
+		request.AppendAggregateIDQuery(authz.GetCtxData(ctx).OrgID)
+	}
+	request.EnsureLimit(repo.SearchLimit)
+	sequence, sequenceErr := repo.View.GetLatestIdpProviderSequence()
+	logging.Log("EVENT-Tuiks").OnError(sequenceErr).Warn("could not read latest iam sequence")
+	providers, count, err := repo.View.SearchIdpProviders(request)
+	if err != nil {
+		return nil, err
+	}
+	result := &iam_model.IDPProviderSearchResponse{
+		Offset:      request.Offset,
+		Limit:       request.Limit,
+		TotalResult: count,
+		Result:      iam_es_model.IDPProviderViewsToModel(providers),
+	}
+	if sequenceErr == nil {
+		result.Sequence = sequence.CurrentSequence
+		result.Timestamp = sequence.CurrentTimestamp
+	}
+	return result, nil
+}
+
+func (repo *OrgRepository) AddIDPProviderToLoginPolicy(ctx context.Context, provider *iam_model.IDPProvider) (*iam_model.IDPProvider, error) {
+	provider.AggregateID = authz.GetCtxData(ctx).OrgID
+	return repo.OrgEventstore.AddIDPProviderToLoginPolicy(ctx, provider)
+}
+
+func (repo *OrgRepository) RemoveIDPProviderFromIdpProvider(ctx context.Context, provider *iam_model.IDPProvider) error {
+	provider.AggregateID = authz.GetCtxData(ctx).OrgID
+	return repo.OrgEventstore.RemoveIDPProviderFromLoginPolicy(ctx, provider)
+}
--- a/internal/management/repository/eventsourcing/eventstore/project.go
+++ b/internal/management/repository/eventsourcing/eventstore/project.go
@@ -109,8 +109,8 @@ func (repo *ProjectRepo) RemoveProject(ctx context.Context, projectID string) er

 func (repo *ProjectRepo) SearchProjects(ctx context.Context, request *proj_model.ProjectViewSearchRequest) (*proj_model.ProjectViewSearchResponse, error) {
 	request.EnsureLimit(repo.SearchLimit)
-	sequence, err := repo.View.GetLatestProjectSequence()
-	logging.Log("EVENT-Edc56").OnError(err).Warn("could not read latest project sequence")
+	sequence, sequenceErr := repo.View.GetLatestProjectSequence()
+	logging.Log("EVENT-Edc56").OnError(sequenceErr).Warn("could not read latest project sequence")

 	permissions := authz.GetRequestPermissionsFromCtx(ctx)
 	if !authz.HasGlobalPermission(permissions) {
@@ -130,7 +130,7 @@ func (repo *ProjectRepo) SearchProjects(ctx context.Context, request *proj_model
 					TotalResult: uint64(0),
 					Result:      []*proj_model.ProjectView{},
 				}
-				if err == nil {
+				if sequenceErr == nil {
 					result.Sequence = sequence.CurrentSequence
 					result.Timestamp = sequence.CurrentTimestamp
 				}
@@ -151,7 +151,7 @@ func (repo *ProjectRepo) SearchProjects(ctx context.Context, request *proj_model
 		TotalResult: uint64(count),
 		Result:      model.ProjectsToModel(projects),
 	}
-	if err == nil {
+	if sequenceErr == nil {
 		result.Sequence = sequence.CurrentSequence
 		result.Timestamp = sequence.CurrentTimestamp
 	}
@@ -189,8 +189,8 @@ func (repo *ProjectRepo) RemoveProjectMember(ctx context.Context, projectID, use

 func (repo *ProjectRepo) SearchProjectMembers(ctx context.Context, request *proj_model.ProjectMemberSearchRequest) (*proj_model.ProjectMemberSearchResponse, error) {
 	request.EnsureLimit(repo.SearchLimit)
-	sequence, err := repo.View.GetLatestProjectMemberSequence()
-	logging.Log("EVENT-3dgt6").OnError(err).Warn("could not read latest project member sequence")
+	sequence, sequenceErr := repo.View.GetLatestProjectMemberSequence()
+	logging.Log("EVENT-3dgt6").OnError(sequenceErr).Warn("could not read latest project member sequence")
 	members, count, err := repo.View.SearchProjectMembers(request)
 	if err != nil {
 		return nil, err
@@ -201,7 +201,7 @@ func (repo *ProjectRepo) SearchProjectMembers(ctx context.Context, request *proj
 		TotalResult: uint64(count),
 		Result:      model.ProjectMembersToModel(members),
 	}
-	if err == nil {
+	if sequenceErr == nil {
 		result.Sequence = sequence.CurrentSequence
 		result.Timestamp = sequence.CurrentTimestamp
 	}
@@ -261,8 +261,8 @@ func (repo *ProjectRepo) RemoveProjectRole(ctx context.Context, projectID, key s
 func (repo *ProjectRepo) SearchProjectRoles(ctx context.Context, projectID string, request *proj_model.ProjectRoleSearchRequest) (*proj_model.ProjectRoleSearchResponse, error) {
 	request.EnsureLimit(repo.SearchLimit)
 	request.AppendProjectQuery(projectID)
-	sequence, err := repo.View.GetLatestProjectRoleSequence()
-	logging.Log("LSp0d-47suf").OnError(err).Warn("could not read latest project role sequence")
+	sequence, sequenceErr := repo.View.GetLatestProjectRoleSequence()
+	logging.Log("LSp0d-47suf").OnError(sequenceErr).Warn("could not read latest project role sequence")
 	roles, count, err := repo.View.SearchProjectRoles(request)
 	if err != nil {
 		return nil, err
@@ -271,10 +271,10 @@ func (repo *ProjectRepo) SearchProjectRoles(ctx context.Context, projectID strin
 	result := &proj_model.ProjectRoleSearchResponse{
 		Offset:      request.Offset,
 		Limit:       request.Limit,
-		TotalResult: uint64(count),
+		TotalResult: count,
 		Result:      model.ProjectRolesToModel(roles),
 	}
-	if err == nil {
+	if sequenceErr == nil {
 		result.Sequence = sequence.CurrentSequence
 		result.Timestamp = sequence.CurrentTimestamp
 	}
@@ -352,8 +352,8 @@ func (repo *ProjectRepo) RemoveApplication(ctx context.Context, projectID, appID

 func (repo *ProjectRepo) SearchApplications(ctx context.Context, request *proj_model.ApplicationSearchRequest) (*proj_model.ApplicationSearchResponse, error) {
 	request.EnsureLimit(repo.SearchLimit)
-	sequence, err := repo.View.GetLatestApplicationSequence()
-	logging.Log("EVENT-SKe8s").OnError(err).Warn("could not read latest application sequence")
+	sequence, sequenceErr := repo.View.GetLatestApplicationSequence()
+	logging.Log("EVENT-SKe8s").OnError(sequenceErr).Warn("could not read latest application sequence")
 	apps, count, err := repo.View.SearchApplications(request)
 	if err != nil {
 		return nil, err
@@ -361,10 +361,10 @@ func (repo *ProjectRepo) SearchApplications(ctx context.Context, request *proj_m
 	result := &proj_model.ApplicationSearchResponse{
 		Offset:      request.Offset,
 		Limit:       request.Limit,
-		TotalResult: uint64(count),
+		TotalResult: count,
 		Result:      model.ApplicationViewsToModel(apps),
 	}
-	if err == nil {
+	if sequenceErr == nil {
 		result.Sequence = sequence.CurrentSequence
 		result.Timestamp = sequence.CurrentTimestamp
 	}
@@ -404,8 +404,8 @@ func (repo *ProjectRepo) ProjectGrantByID(ctx context.Context, grantID string) (

 func (repo *ProjectRepo) SearchProjectGrants(ctx context.Context, request *proj_model.ProjectGrantViewSearchRequest) (*proj_model.ProjectGrantViewSearchResponse, error) {
 	request.EnsureLimit(repo.SearchLimit)
-	sequence, err := repo.View.GetLatestProjectGrantSequence()
-	logging.Log("EVENT-Skw9f").OnError(err).Warn("could not read latest project grant sequence")
+	sequence, sequenceErr := repo.View.GetLatestProjectGrantSequence()
+	logging.Log("EVENT-Skw9f").OnError(sequenceErr).Warn("could not read latest project grant sequence")
 	projects, count, err := repo.View.SearchProjectGrants(request)
 	if err != nil {
 		return nil, err
@@ -413,10 +413,10 @@ func (repo *ProjectRepo) SearchProjectGrants(ctx context.Context, request *proj_
 	result := &proj_model.ProjectGrantViewSearchResponse{
 		Offset:      request.Offset,
 		Limit:       request.Limit,
-		TotalResult: uint64(count),
+		TotalResult: count,
 		Result:      model.ProjectGrantsToModel(projects),
 	}
-	if err == nil {
+	if sequenceErr == nil {
 		result.Sequence = sequence.CurrentSequence
 		result.Timestamp = sequence.CurrentTimestamp
 	}
@@ -425,8 +425,8 @@ func (repo *ProjectRepo) SearchProjectGrants(ctx context.Context, request *proj_

 func (repo *ProjectRepo) SearchGrantedProjects(ctx context.Context, request *proj_model.ProjectGrantViewSearchRequest) (*proj_model.ProjectGrantViewSearchResponse, error) {
 	request.EnsureLimit(repo.SearchLimit)
-	sequence, err := repo.View.GetLatestProjectGrantSequence()
-	logging.Log("EVENT-Skw9f").OnError(err).Warn("could not read latest project grant sequence")
+	sequence, sequenceErr := repo.View.GetLatestProjectGrantSequence()
+	logging.Log("EVENT-Skw9f").OnError(sequenceErr).Warn("could not read latest project grant sequence")

 	permissions := authz.GetRequestPermissionsFromCtx(ctx)
 	if !authz.HasGlobalPermission(permissions) {
@@ -446,7 +446,7 @@ func (repo *ProjectRepo) SearchGrantedProjects(ctx context.Context, request *pro
 					TotalResult: uint64(0),
 					Result:      []*proj_model.ProjectGrantView{},
 				}
-				if err == nil {
+				if sequenceErr == nil {
 					result.Sequence = sequence.CurrentSequence
 					result.Timestamp = sequence.CurrentTimestamp
 				}
@@ -464,10 +464,10 @@ func (repo *ProjectRepo) SearchGrantedProjects(ctx context.Context, request *pro
 	result := &proj_model.ProjectGrantViewSearchResponse{
 		Offset:      request.Offset,
 		Limit:       request.Limit,
-		TotalResult: uint64(count),
+		TotalResult: count,
 		Result:      model.ProjectGrantsToModel(projects),
 	}
-	if err == nil {
+	if sequenceErr == nil {
 		result.Sequence = sequence.CurrentSequence
 		result.Timestamp = sequence.CurrentTimestamp
 	}
@@ -593,8 +593,8 @@ func (repo *ProjectRepo) RemoveProjectGrantMember(ctx context.Context, projectID

 func (repo *ProjectRepo) SearchProjectGrantMembers(ctx context.Context, request *proj_model.ProjectGrantMemberSearchRequest) (*proj_model.ProjectGrantMemberSearchResponse, error) {
 	request.EnsureLimit(repo.SearchLimit)
-	sequence, err := repo.View.GetLatestProjectGrantMemberSequence()
-	logging.Log("EVENT-Du8sk").OnError(err).Warn("could not read latest project grant sequence")
+	sequence, sequenceErr := repo.View.GetLatestProjectGrantMemberSequence()
+	logging.Log("EVENT-Du8sk").OnError(sequenceErr).Warn("could not read latest project grant sequence")
 	members, count, err := repo.View.SearchProjectGrantMembers(request)
 	if err != nil {
 		return nil, err
@@ -605,7 +605,7 @@ func (repo *ProjectRepo) SearchProjectGrantMembers(ctx context.Context, request
 		TotalResult: uint64(count),
 		Result:      model.ProjectGrantMembersToModel(members),
 	}
-	if err == nil {
+	if sequenceErr == nil {
 		result.Sequence = sequence.CurrentSequence
 		result.Timestamp = sequence.CurrentTimestamp
 	}
--- a/internal/management/repository/eventsourcing/eventstore/user.go
+++ b/internal/management/repository/eventsourcing/eventstore/user.go
@@ -57,7 +57,7 @@ func (repo *UserRepo) CreateUser(ctx context.Context, user *usr_model.User) (*us
 	if err != nil {
 		return nil, err
 	}
-	orgPolicy, err := repo.OrgEvents.GetOrgIamPolicy(ctx, authz.GetCtxData(ctx).OrgID)
+	orgPolicy, err := repo.OrgEvents.GetOrgIAMPolicy(ctx, authz.GetCtxData(ctx).OrgID)
 	if err != nil {
 		return nil, err
 	}
@@ -73,7 +73,7 @@ func (repo *UserRepo) RegisterUser(ctx context.Context, user *usr_model.User, re
 	if err != nil {
 		return nil, err
 	}
-	orgPolicy, err := repo.OrgEvents.GetOrgIamPolicy(ctx, authz.GetCtxData(ctx).OrgID)
+	orgPolicy, err := repo.OrgEvents.GetOrgIAMPolicy(ctx, authz.GetCtxData(ctx).OrgID)
 	if err != nil {
 		return nil, err
 	}
@@ -98,8 +98,8 @@ func (repo *UserRepo) UnlockUser(ctx context.Context, id string) (*usr_model.Use

 func (repo *UserRepo) SearchUsers(ctx context.Context, request *usr_model.UserSearchRequest) (*usr_model.UserSearchResponse, error) {
 	request.EnsureLimit(repo.SearchLimit)
-	sequence, err := repo.View.GetLatestUserSequence()
-	logging.Log("EVENT-Lcn7d").OnError(err).Warn("could not read latest user sequence")
+	sequence, sequenceErr := repo.View.GetLatestUserSequence()
+	logging.Log("EVENT-Lcn7d").OnError(sequenceErr).Warn("could not read latest user sequence")
 	users, count, err := repo.View.SearchUsers(request)
 	if err != nil {
 		return nil, err
@@ -110,7 +110,7 @@ func (repo *UserRepo) SearchUsers(ctx context.Context, request *usr_model.UserSe
 		TotalResult: uint64(count),
 		Result:      model.UsersToModel(users),
 	}
-	if err == nil {
+	if sequenceErr == nil {
 		result.Sequence = sequence.CurrentSequence
 		result.Timestamp = sequence.CurrentTimestamp
 	}
@@ -222,9 +222,8 @@ func (repo *UserRepo) ChangeAddress(ctx context.Context, address *usr_model.Addr

 func (repo *UserRepo) SearchUserMemberships(ctx context.Context, request *usr_model.UserMembershipSearchRequest) (*usr_model.UserMembershipSearchResponse, error) {
 	request.EnsureLimit(repo.SearchLimit)
-	request.AppendResourceOwnerAndIamQuery(authz.GetCtxData(ctx).OrgID, repo.SystemDefaults.IamID)
-	sequence, err := repo.View.GetLatestUserMembershipSequence()
-	logging.Log("EVENT-Dn7sf").OnError(err).Warn("could not read latest user sequence")
+	sequence, sequenceErr := repo.View.GetLatestUserMembershipSequence()
+	logging.Log("EVENT-Dn7sf").OnError(sequenceErr).Warn("could not read latest user sequence")

 	result := handleSearchUserMembershipsPermissions(ctx, request, sequence)
 	if result != nil {
@@ -241,7 +240,7 @@ func (repo *UserRepo) SearchUserMemberships(ctx context.Context, request *usr_mo
 		TotalResult: count,
 		Result:      model.UserMembershipsToModel(memberships),
 	}
-	if err == nil {
+	if sequenceErr == nil {
 		result.Sequence = sequence.CurrentSequence
 		result.Timestamp = sequence.CurrentTimestamp
 	}
--- a/internal/management/repository/eventsourcing/eventstore/user_grant.go
+++ b/internal/management/repository/eventsourcing/eventstore/user_grant.go
@@ -115,8 +115,8 @@ func (repo *UserGrantRepo) BulkRemoveUserGrant(ctx context.Context, grantIDs ...

 func (repo *UserGrantRepo) SearchUserGrants(ctx context.Context, request *grant_model.UserGrantSearchRequest) (*grant_model.UserGrantSearchResponse, error) {
 	request.EnsureLimit(repo.SearchLimit)
-	sequence, err := repo.View.GetLatestUserGrantSequence()
-	logging.Log("EVENT-5Viwf").OnError(err).Warn("could not read latest user grant sequence")
+	sequence, sequenceErr := repo.View.GetLatestUserGrantSequence()
+	logging.Log("EVENT-5Viwf").OnError(sequenceErr).Warn("could not read latest user grant sequence")

 	result := handleSearchUserGrantPermissions(ctx, request, sequence)
 	if result != nil {
@@ -134,7 +134,7 @@ func (repo *UserGrantRepo) SearchUserGrants(ctx context.Context, request *grant_
 		TotalResult: uint64(count),
 		Result:      model.UserGrantsToModel(grants),
 	}
-	if err == nil {
+	if sequenceErr == nil {
 		result.Sequence = sequence.CurrentSequence
 		result.Timestamp = sequence.CurrentTimestamp
 	}