fix: use domain models for v2 eventstore (#1151)

* fix: use domain models for v2 eventstore

* fix: user domain model

* Update internal/api/grpc/admin/login_policy_converter.go

Co-authored-by: Livio Amstutz <livio.a@gmail.com>

* fix: converter

Co-authored-by: Livio Amstutz <livio.a@gmail.com>

internal/api/grpc/admin/iam_member.go

@@ -21,23 +21,23 @@ func (s *Server) SearchIamMembers(ctx context.Context, in *admin.IamMemberSearch
 }
 
 func (s *Server) AddIamMember(ctx context.Context, member *admin.AddIamMemberRequest) (*admin.IamMember, error) {
-	addedMember, err := s.iam.AddIAMMember(ctx, addIamMemberToModel(member))
+	addedMember, err := s.command.AddIAMMember(ctx, addIamMemberToDomain(member))
 	if err != nil {
 		return nil, err
 	}
 
-	return iamMemberFromModel(addedMember), nil
+	return iamMemberFromDomain(addedMember), nil
 }
 
 func (s *Server) ChangeIamMember(ctx context.Context, member *admin.ChangeIamMemberRequest) (*admin.IamMember, error) {
-	changedMember, err := s.iam.ChangeIAMMember(ctx, changeIamMemberToModel(member))
+	changedMember, err := s.command.ChangeIAMMember(ctx, changeIamMemberToDomain(member))
 	if err != nil {
 		return nil, err
 	}
-	return iamMemberFromModel(changedMember), nil
+	return iamMemberFromDomain(changedMember), nil
 }
 
 func (s *Server) RemoveIamMember(ctx context.Context, member *admin.RemoveIamMemberRequest) (*empty.Empty, error) {
-	err := s.iam.RemoveIAMMember(ctx, member.UserId)
+	err := s.command.RemoveIAMMember(ctx, member.UserId)
 	return &empty.Empty{}, err
 }

internal/api/grpc/admin/iam_member_converter.go

@@ -2,6 +2,7 @@ package admin
 
 import (
 	"github.com/caos/logging"
+	"github.com/caos/zitadel/internal/v2/domain"
 	"github.com/golang/protobuf/ptypes"
 
 	iam_model "github.com/caos/zitadel/internal/iam/model"
@@ -9,25 +10,21 @@ import (
 	"github.com/caos/zitadel/pkg/grpc/admin"
 )
 
-func addIamMemberToModel(member *admin.AddIamMemberRequest) *iam_model.IAMMember {
-	memberModel := &iam_model.IAMMember{
+func addIamMemberToDomain(member *admin.AddIamMemberRequest) *domain.IAMMember {
+	return &domain.IAMMember{
 		UserID: member.UserId,
+		Roles:  member.Roles,
 	}
-	memberModel.Roles = member.Roles
-
-	return memberModel
 }
 
-func changeIamMemberToModel(member *admin.ChangeIamMemberRequest) *iam_model.IAMMember {
-	memberModel := &iam_model.IAMMember{
+func changeIamMemberToDomain(member *admin.ChangeIamMemberRequest) *domain.IAMMember {
+	return &domain.IAMMember{
 		UserID: member.UserId,
+		Roles:  member.Roles,
 	}
-	memberModel.Roles = member.Roles
-
-	return memberModel
 }
 
-func iamMemberFromModel(member *iam_model.IAMMember) *admin.IamMember {
+func iamMemberFromDomain(member *domain.IAMMember) *admin.IamMember {
 	creationDate, err := ptypes.TimestampProto(member.CreationDate)
 	logging.Log("GRPC-Lsp76").OnError(err).Debug("date parse failed")
 

internal/api/grpc/admin/idp_config.go

@@ -8,56 +8,57 @@ import (
 )
 
 func (s *Server) IdpByID(ctx context.Context, id *admin.IdpID) (*admin.IdpView, error) {
-	config, err := s.iam.IDPConfigByID(ctx, id.Id)
+	config, err := s.query.DefaultIDPConfigByID(ctx, id.Id)
 	if err != nil {
 		return nil, err
 	}
-	return idpViewFromModel(config), nil
+	return idpViewFromDomain(config), nil
 }
 
 func (s *Server) CreateOidcIdp(ctx context.Context, oidcIdpConfig *admin.OidcIdpConfigCreate) (*admin.Idp, error) {
-	config, err := s.iam.AddOIDCIDPConfig(ctx, createOidcIdpToModel(oidcIdpConfig))
+	config, err := s.command.AddDefaultIDPConfig(ctx, createOIDCIDPToDomain(oidcIdpConfig))
 	if err != nil {
 		return nil, err
 	}
-	return idpFromModel(config), nil
+	return idpFromDomain(config), nil
 }
 
 func (s *Server) UpdateIdpConfig(ctx context.Context, idpConfig *admin.IdpUpdate) (*admin.Idp, error) {
-	config, err := s.iam.ChangeIDPConfig(ctx, updateIdpToModel(idpConfig))
+	config, err := s.command.ChangeDefaultIDPConfig(ctx, updateIdpToDomain(idpConfig))
 	if err != nil {
 		return nil, err
 	}
-	return idpFromModel(config), nil
+	return idpFromDomain(config), nil
 }
 
 func (s *Server) DeactivateIdpConfig(ctx context.Context, id *admin.IdpID) (*admin.Idp, error) {
-	config, err := s.iam.DeactivateIDPConfig(ctx, id.Id)
+	config, err := s.command.DeactivateDefaultIDPConfig(ctx, id.Id)
 	if err != nil {
 		return nil, err
 	}
-	return idpFromModel(config), nil
+	return idpFromDomain(config), nil
 }
 
 func (s *Server) ReactivateIdpConfig(ctx context.Context, id *admin.IdpID) (*admin.Idp, error) {
-	config, err := s.iam.ReactivateIDPConfig(ctx, id.Id)
+	config, err := s.command.ReactivateDefaultIDPConfig(ctx, id.Id)
 	if err != nil {
 		return nil, err
 	}
-	return idpFromModel(config), nil
+	return idpFromDomain(config), nil
 }
 
+//TODO: Change To V2
 func (s *Server) RemoveIdpConfig(ctx context.Context, id *admin.IdpID) (*empty.Empty, error) {
 	err := s.iam.RemoveIDPConfig(ctx, id.Id)
 	return &empty.Empty{}, err
 }
 
 func (s *Server) UpdateOidcIdpConfig(ctx context.Context, request *admin.OidcIdpConfigUpdate) (*admin.OidcIdpConfig, error) {
-	config, err := s.iam.ChangeOidcIDPConfig(ctx, updateOidcIdpToModel(request))
+	config, err := s.command.ChangeDefaultIDPOIDCConfig(ctx, updateOIDCIDPToDomain(request))
 	if err != nil {
 		return nil, err
 	}
-	return oidcIdpConfigFromModel(config), nil
+	return oidcIDPConfigFromDomain(config), nil
 }
 
 func (s *Server) SearchIdps(ctx context.Context, request *admin.IdpSearchRequest) (*admin.IdpSearchResponse, error) {

internal/api/grpc/admin/idp_config_converter.go

@@ -3,47 +3,48 @@ package admin
 import (
 	"github.com/caos/logging"
 	iam_model "github.com/caos/zitadel/internal/iam/model"
+	"github.com/caos/zitadel/internal/v2/domain"
 	"github.com/caos/zitadel/pkg/grpc/admin"
 	"github.com/golang/protobuf/ptypes"
 )
 
-func createOidcIdpToModel(idp *admin.OidcIdpConfigCreate) *iam_model.IDPConfig {
-	return &iam_model.IDPConfig{
+func createOIDCIDPToDomain(idp *admin.OidcIdpConfigCreate) *domain.IDPConfig {
+	return &domain.IDPConfig{
 		Name:        idp.Name,
-		StylingType: idpConfigStylingTypeToModel(idp.StylingType),
-		Type:        iam_model.IDPConfigTypeOIDC,
-		OIDCConfig: &iam_model.OIDCIDPConfig{
+		StylingType: idpConfigStylingTypeToDomain(idp.StylingType),
+		Type:        domain.IDPConfigTypeOIDC,
+		OIDCConfig: &domain.OIDCIDPConfig{
 			ClientID:              idp.ClientId,
 			ClientSecretString:    idp.ClientSecret,
 			Issuer:                idp.Issuer,
 			Scopes:                idp.Scopes,
-			IDPDisplayNameMapping: oidcMappingFieldToModel(idp.IdpDisplayNameMapping),
-			UsernameMapping:       oidcMappingFieldToModel(idp.UsernameMapping),
+			IDPDisplayNameMapping: oidcMappingFieldToDomain(idp.IdpDisplayNameMapping),
+			UsernameMapping:       oidcMappingFieldToDomain(idp.UsernameMapping),
 		},
 	}
 }
 
-func updateIdpToModel(idp *admin.IdpUpdate) *iam_model.IDPConfig {
-	return &iam_model.IDPConfig{
+func updateIdpToDomain(idp *admin.IdpUpdate) *domain.IDPConfig {
+	return &domain.IDPConfig{
 		IDPConfigID: idp.Id,
 		Name:        idp.Name,
-		StylingType: idpConfigStylingTypeToModel(idp.StylingType),
+		StylingType: idpConfigStylingTypeToDomain(idp.StylingType),
 	}
 }
 
-func updateOidcIdpToModel(idp *admin.OidcIdpConfigUpdate) *iam_model.OIDCIDPConfig {
-	return &iam_model.OIDCIDPConfig{
+func updateOIDCIDPToDomain(idp *admin.OidcIdpConfigUpdate) *domain.OIDCIDPConfig {
+	return &domain.OIDCIDPConfig{
 		IDPConfigID:           idp.IdpId,
 		ClientID:              idp.ClientId,
 		ClientSecretString:    idp.ClientSecret,
 		Issuer:                idp.Issuer,
 		Scopes:                idp.Scopes,
-		IDPDisplayNameMapping: oidcMappingFieldToModel(idp.IdpDisplayNameMapping),
-		UsernameMapping:       oidcMappingFieldToModel(idp.UsernameMapping),
+		IDPDisplayNameMapping: oidcMappingFieldToDomain(idp.IdpDisplayNameMapping),
+		UsernameMapping:       oidcMappingFieldToDomain(idp.UsernameMapping),
 	}
 }
 
-func idpFromModel(idp *iam_model.IDPConfig) *admin.Idp {
+func idpFromDomain(idp *domain.IDPConfig) *admin.Idp {
 	creationDate, err := ptypes.TimestampProto(idp.CreationDate)
 	logging.Log("GRPC-8dju8").OnError(err).Debug("date parse failed")
 
@@ -56,9 +57,28 @@ func idpFromModel(idp *iam_model.IDPConfig) *admin.Idp {
 		ChangeDate:   changeDate,
 		Sequence:     idp.Sequence,
 		Name:         idp.Name,
-		StylingType:  idpConfigStylingTypeFromModel(idp.StylingType),
-		State:        idpConfigStateFromModel(idp.State),
-		IdpConfig:    idpConfigFromModel(idp),
+		StylingType:  idpConfigStylingTypeFromDomain(idp.StylingType),
+		State:        idpConfigStateFromDomain(idp.State),
+		IdpConfig:    idpConfigFromDomain(idp),
+	}
+}
+
+func idpViewFromDomain(idp *domain.IDPConfigView) *admin.IdpView {
+	creationDate, err := ptypes.TimestampProto(idp.CreationDate)
+	logging.Log("GRPC-8dju8").OnError(err).Debug("date parse failed")
+
+	changeDate, err := ptypes.TimestampProto(idp.ChangeDate)
+	logging.Log("GRPC-Dsj8i").OnError(err).Debug("date parse failed")
+
+	return &admin.IdpView{
+		Id:            idp.IDPConfigID,
+		CreationDate:  creationDate,
+		ChangeDate:    changeDate,
+		Sequence:      idp.Sequence,
+		Name:          idp.Name,
+		StylingType:   admin.IdpStylingType(idp.StylingType),
+		State:         admin.IdpState(idp.State),
+		IdpConfigView: idpConfigViewFromDomain(idp),
 	}
 }
 
@@ -75,22 +95,22 @@ func idpViewFromModel(idp *iam_model.IDPConfigView) *admin.IdpView {
 		ChangeDate:    changeDate,
 		Sequence:      idp.Sequence,
 		Name:          idp.Name,
-		StylingType:   idpConfigStylingTypeFromModel(idp.StylingType),
-		State:         idpConfigStateFromModel(idp.State),
+		StylingType:   admin.IdpStylingType(idp.StylingType),
+		State:         admin.IdpState(idp.State),
 		IdpConfigView: idpConfigViewFromModel(idp),
 	}
 }
 
-func idpConfigFromModel(idp *iam_model.IDPConfig) *admin.Idp_OidcConfig {
-	if idp.Type == iam_model.IDPConfigTypeOIDC {
+func idpConfigFromDomain(idp *domain.IDPConfig) *admin.Idp_OidcConfig {
+	if idp.Type == domain.IDPConfigTypeOIDC {
 		return &admin.Idp_OidcConfig{
-			OidcConfig: oidcIdpConfigFromModel(idp.OIDCConfig),
+			OidcConfig: oidcIDPConfigFromDomain(idp.OIDCConfig),
 		}
 	}
 	return nil
 }
 
-func oidcIdpConfigFromModel(idp *iam_model.OIDCIDPConfig) *admin.OidcIdpConfig {
+func oidcIDPConfigFromDomain(idp *domain.OIDCIDPConfig) *admin.OidcIdpConfig {
 	return &admin.OidcIdpConfig{
 		ClientId: idp.ClientID,
 		Issuer:   idp.Issuer,
@@ -98,6 +118,15 @@ func oidcIdpConfigFromModel(idp *iam_model.OIDCIDPConfig) *admin.OidcIdpConfig {
 	}
 }
 
+func idpConfigViewFromDomain(idp *domain.IDPConfigView) *admin.IdpView_OidcConfig {
+	if idp.IsOIDC {
+		return &admin.IdpView_OidcConfig{
+			OidcConfig: oidcIdpConfigViewFromDomain(idp),
+		}
+	}
+	return nil
+}
+
 func idpConfigViewFromModel(idp *iam_model.IDPConfigView) *admin.IdpView_OidcConfig {
 	if idp.IsOIDC {
 		return &admin.IdpView_OidcConfig{
@@ -107,46 +136,56 @@ func idpConfigViewFromModel(idp *iam_model.IDPConfigView) *admin.IdpView_OidcCon
 	return nil
 }
 
+func oidcIdpConfigViewFromDomain(idp *domain.IDPConfigView) *admin.OidcIdpConfigView {
+	return &admin.OidcIdpConfigView{
+		ClientId:              idp.OIDCClientID,
+		Issuer:                idp.OIDCIssuer,
+		Scopes:                idp.OIDCScopes,
+		IdpDisplayNameMapping: oidcMappingFieldFromDomain(idp.OIDCIDPDisplayNameMapping),
+		UsernameMapping:       oidcMappingFieldFromDomain(idp.OIDCUsernameMapping),
+	}
+}
+
 func oidcIdpConfigViewFromModel(idp *iam_model.IDPConfigView) *admin.OidcIdpConfigView {
 	return &admin.OidcIdpConfigView{
 		ClientId:              idp.OIDCClientID,
 		Issuer:                idp.OIDCIssuer,
 		Scopes:                idp.OIDCScopes,
-		IdpDisplayNameMapping: oidcMappingFieldFromModel(idp.OIDCIDPDisplayNameMapping),
-		UsernameMapping:       oidcMappingFieldFromModel(idp.OIDCUsernameMapping),
+		IdpDisplayNameMapping: admin.OIDCMappingField(idp.OIDCIDPDisplayNameMapping),
+		UsernameMapping:       admin.OIDCMappingField(idp.OIDCUsernameMapping),
 	}
 }
 
-func idpConfigStateFromModel(state iam_model.IDPConfigState) admin.IdpState {
+func idpConfigStateFromDomain(state domain.IDPConfigState) admin.IdpState {
 	switch state {
-	case iam_model.IDPConfigStateActive:
+	case domain.IDPConfigStateActive:
 		return admin.IdpState_IDPCONFIGSTATE_ACTIVE
-	case iam_model.IDPConfigStateInactive:
+	case domain.IDPConfigStateInactive:
 		return admin.IdpState_IDPCONFIGSTATE_INACTIVE
 	default:
 		return admin.IdpState_IDPCONFIGSTATE_UNSPECIFIED
 	}
 }
 
-func oidcMappingFieldFromModel(field iam_model.OIDCMappingField) admin.OIDCMappingField {
+func oidcMappingFieldFromDomain(field domain.OIDCMappingField) admin.OIDCMappingField {
 	switch field {
-	case iam_model.OIDCMappingFieldPreferredLoginName:
+	case domain.OIDCMappingFieldPreferredLoginName:
 		return admin.OIDCMappingField_OIDCMAPPINGFIELD_PREFERRED_USERNAME
-	case iam_model.OIDCMappingFieldEmail:
+	case domain.OIDCMappingFieldEmail:
 		return admin.OIDCMappingField_OIDCMAPPINGFIELD_EMAIL
 	default:
 		return admin.OIDCMappingField_OIDCMAPPINGFIELD_UNSPECIFIED
 	}
 }
 
-func oidcMappingFieldToModel(field admin.OIDCMappingField) iam_model.OIDCMappingField {
+func oidcMappingFieldToDomain(field admin.OIDCMappingField) domain.OIDCMappingField {
 	switch field {
 	case admin.OIDCMappingField_OIDCMAPPINGFIELD_PREFERRED_USERNAME:
-		return iam_model.OIDCMappingFieldPreferredLoginName
+		return domain.OIDCMappingFieldPreferredLoginName
 	case admin.OIDCMappingField_OIDCMAPPINGFIELD_EMAIL:
-		return iam_model.OIDCMappingFieldEmail
+		return domain.OIDCMappingFieldEmail
 	default:
-		return iam_model.OIDCMappingFieldUnspecified
+		return domain.OIDCMappingFieldPreferredLoginName
 	}
 }
 
@@ -207,20 +246,20 @@ func idpConfigsFromView(viewIdps []*iam_model.IDPConfigView) []*admin.IdpView {
 	return idps
 }
 
-func idpConfigStylingTypeFromModel(stylingType iam_model.IDPStylingType) admin.IdpStylingType {
+func idpConfigStylingTypeFromDomain(stylingType domain.IDPConfigStylingType) admin.IdpStylingType {
 	switch stylingType {
-	case iam_model.IDPStylingTypeGoogle:
+	case domain.IDPConfigStylingTypeGoogle:
 		return admin.IdpStylingType_IDPSTYLINGTYPE_GOOGLE
 	default:
 		return admin.IdpStylingType_IDPSTYLINGTYPE_UNSPECIFIED
 	}
 }
 
-func idpConfigStylingTypeToModel(stylingType admin.IdpStylingType) iam_model.IDPStylingType {
+func idpConfigStylingTypeToDomain(stylingType admin.IdpStylingType) domain.IDPConfigStylingType {
 	switch stylingType {
 	case admin.IdpStylingType_IDPSTYLINGTYPE_GOOGLE:
-		return iam_model.IDPStylingTypeGoogle
+		return domain.IDPConfigStylingTypeGoogle
 	default:
-		return iam_model.IDPStylingTypeUnspecified
+		return domain.IDPConfigStylingTypeUnspecified
 	}
 }

internal/api/grpc/admin/label_policy.go

@@ -16,9 +16,9 @@ func (s *Server) GetDefaultLabelPolicy(ctx context.Context, _ *empty.Empty) (*ad
 }
 
 func (s *Server) UpdateDefaultLabelPolicy(ctx context.Context, policy *admin.DefaultLabelPolicyUpdate) (*admin.DefaultLabelPolicy, error) {
-	result, err := s.iam.ChangeDefaultLabelPolicy(ctx, labelPolicyToModel(policy))
+	result, err := s.command.ChangeDefaultLabelPolicy(ctx, labelPolicyToDomain(policy))
 	if err != nil {
 		return nil, err
 	}
-	return labelPolicyFromModel(result), nil
+	return labelPolicyFromDomain(result), nil
 }

internal/api/grpc/admin/label_policy_converter.go

@@ -3,18 +3,19 @@ package admin
 import (
 	"github.com/caos/logging"
 	iam_model "github.com/caos/zitadel/internal/iam/model"
+	"github.com/caos/zitadel/internal/v2/domain"
 	"github.com/caos/zitadel/pkg/grpc/admin"
 	"github.com/golang/protobuf/ptypes"
 )
 
-func labelPolicyToModel(policy *admin.DefaultLabelPolicyUpdate) *iam_model.LabelPolicy {
-	return &iam_model.LabelPolicy{
+func labelPolicyToDomain(policy *admin.DefaultLabelPolicyUpdate) *domain.LabelPolicy {
+	return &domain.LabelPolicy{
 		PrimaryColor:   policy.PrimaryColor,
 		SecondaryColor: policy.SecondaryColor,
 	}
 }
 
-func labelPolicyFromModel(policy *iam_model.LabelPolicy) *admin.DefaultLabelPolicy {
+func labelPolicyFromDomain(policy *domain.LabelPolicy) *admin.DefaultLabelPolicy {
 	creationDate, err := ptypes.TimestampProto(policy.CreationDate)
 	logging.Log("ADMIN-QwQG9").OnError(err).Debug("date parse failed")
 

internal/api/grpc/admin/login_policy.go

@@ -15,11 +15,11 @@ func (s *Server) GetDefaultLoginPolicy(ctx context.Context, _ *empty.Empty) (*ad
 }
 
 func (s *Server) UpdateDefaultLoginPolicy(ctx context.Context, policy *admin.DefaultLoginPolicyRequest) (*admin.DefaultLoginPolicy, error) {
-	result, err := s.iam.ChangeDefaultLoginPolicy(ctx, loginPolicyToModel(policy))
+	result, err := s.command.ChangeDefaultLoginPolicy(ctx, loginPolicyToDomain(policy))
 	if err != nil {
 		return nil, err
 	}
-	return loginPolicyFromModel(result), nil
+	return loginPolicyFromDomain(result), nil
 }
 
 func (s *Server) GetDefaultLoginPolicyIdpProviders(ctx context.Context, request *admin.IdpProviderSearchRequest) (*admin.IdpProviderSearchResponse, error) {
@@ -31,13 +31,14 @@ func (s *Server) GetDefaultLoginPolicyIdpProviders(ctx context.Context, request
 }
 
 func (s *Server) AddIdpProviderToDefaultLoginPolicy(ctx context.Context, provider *admin.IdpProviderID) (*admin.IdpProviderID, error) {
-	result, err := s.iam.AddIDPProviderToLoginPolicy(ctx, idpProviderToModel(provider))
+	result, err := s.command.AddIDPProviderToDefaultLoginPolicy(ctx, idpProviderToDomain(provider))
 	if err != nil {
 		return nil, err
 	}
-	return idpProviderFromModel(result), nil
+	return idpProviderFromDomain(result), nil
 }
 
+//TODO: Change to v2
 func (s *Server) RemoveIdpProviderFromDefaultLoginPolicy(ctx context.Context, provider *admin.IdpProviderID) (*empty.Empty, error) {
 	err := s.iam.RemoveIDPProviderFromLoginPolicy(ctx, idpProviderToModel(provider))
 	return &empty.Empty{}, err
@@ -52,7 +53,7 @@ func (s *Server) GetDefaultLoginPolicySecondFactors(ctx context.Context, _ *empt
 }
 
 func (s *Server) AddSecondFactorToDefaultLoginPolicy(ctx context.Context, mfa *admin.SecondFactor) (*admin.SecondFactor, error) {
-	result, err := s.iam.AddSecondFactorToLoginPolicy(ctx, secondFactorTypeToModel(mfa))
+	result, err := s.command.AddSecondFactorToDefaultLoginPolicy(ctx, secondFactorTypeToModel(mfa))
 	if err != nil {
 		return nil, err
 	}
@@ -60,7 +61,7 @@ func (s *Server) AddSecondFactorToDefaultLoginPolicy(ctx context.Context, mfa *a
 }
 
 func (s *Server) RemoveSecondFactorFromDefaultLoginPolicy(ctx context.Context, mfa *admin.SecondFactor) (*empty.Empty, error) {
-	err := s.iam.RemoveSecondFactorFromLoginPolicy(ctx, secondFactorTypeToModel(mfa))
+	err := s.command.RemoveSecondFactorFromDefaultLoginPolicy(ctx, secondFactorTypeToModel(mfa))
 	return &empty.Empty{}, err
 }
 
@@ -73,7 +74,7 @@ func (s *Server) GetDefaultLoginPolicyMultiFactors(ctx context.Context, _ *empty
 }
 
 func (s *Server) AddMultiFactorToDefaultLoginPolicy(ctx context.Context, mfa *admin.MultiFactor) (*admin.MultiFactor, error) {
-	result, err := s.iam.AddMultiFactorToLoginPolicy(ctx, multiFactorTypeToModel(mfa))
+	result, err := s.command.AddMultiFactorToDefaultLoginPolicy(ctx, multiFactorTypeToModel(mfa))
 	if err != nil {
 		return nil, err
 	}
@@ -81,6 +82,6 @@ func (s *Server) AddMultiFactorToDefaultLoginPolicy(ctx context.Context, mfa *ad
 }
 
 func (s *Server) RemoveMultiFactorFromDefaultLoginPolicy(ctx context.Context, mfa *admin.MultiFactor) (*empty.Empty, error) {
-	err := s.iam.RemoveMultiFactorFromLoginPolicy(ctx, multiFactorTypeToModel(mfa))
+	err := s.command.RemoveMultiFactorFromDefaultLoginPolicy(ctx, multiFactorTypeToModel(mfa))
 	return &empty.Empty{}, err
 }

internal/api/grpc/admin/login_policy_converter.go

@@ -3,21 +3,22 @@ package admin
 import (
 	"github.com/caos/logging"
 	iam_model "github.com/caos/zitadel/internal/iam/model"
+	"github.com/caos/zitadel/internal/v2/domain"
 	"github.com/caos/zitadel/pkg/grpc/admin"
 	"github.com/golang/protobuf/ptypes"
 )
 
-func loginPolicyToModel(policy *admin.DefaultLoginPolicyRequest) *iam_model.LoginPolicy {
-	return &iam_model.LoginPolicy{
+func loginPolicyToDomain(policy *admin.DefaultLoginPolicyRequest) *domain.LoginPolicy {
+	return &domain.LoginPolicy{
 		AllowUsernamePassword: policy.AllowUsernamePassword,
 		AllowExternalIdp:      policy.AllowExternalIdp,
 		AllowRegister:         policy.AllowRegister,
 		ForceMFA:              policy.ForceMfa,
-		PasswordlessType:      passwordlessTypeToModel(policy.PasswordlessType),
+		PasswordlessType:      passwordlessTypeToDomain(policy.PasswordlessType),
 	}
 }
 
-func loginPolicyFromModel(policy *iam_model.LoginPolicy) *admin.DefaultLoginPolicy {
+func loginPolicyFromDomain(policy *domain.LoginPolicy) *admin.DefaultLoginPolicy {
 	creationDate, err := ptypes.TimestampProto(policy.CreationDate)
 	logging.Log("GRPC-3Fsm9").OnError(err).Debug("date parse failed")
 
@@ -29,7 +30,7 @@ func loginPolicyFromModel(policy *iam_model.LoginPolicy) *admin.DefaultLoginPoli
 		AllowExternalIdp:      policy.AllowExternalIdp,
 		AllowRegister:         policy.AllowRegister,
 		ForceMfa:              policy.ForceMFA,
-		PasswordlessType:      passwordlessTypeFromModel(policy.PasswordlessType),
+		PasswordlessType:      passwordlessTypeFromDomain(policy.PasswordlessType),
 		CreationDate:          creationDate,
 		ChangeDate:            changeDate,
 	}
@@ -47,7 +48,7 @@ func loginPolicyViewFromModel(policy *iam_model.LoginPolicyView) *admin.DefaultL
 		AllowExternalIdp:      policy.AllowExternalIDP,
 		AllowRegister:         policy.AllowRegister,
 		ForceMfa:              policy.ForceMFA,
-		PasswordlessType:      passwordlessTypeFromModel(policy.PasswordlessType),
+		PasswordlessType:      passwordlessTypeFromDomain(policy.PasswordlessType),
 		CreationDate:          creationDate,
 		ChangeDate:            changeDate,
 	}
@@ -69,6 +70,13 @@ func idpProviderSearchResponseFromModel(response *iam_model.IDPProviderSearchRes
 	}
 }
 
+func idpProviderToDomain(provider *admin.IdpProviderID) *domain.IDPProvider {
+	return &domain.IDPProvider{
+		IDPConfigID: provider.IdpConfigId,
+		Type:        domain.IdentityProviderTypeSystem,
+	}
+}
+
 func idpProviderToModel(provider *admin.IdpProviderID) *iam_model.IDPProvider {
 	return &iam_model.IDPProvider{
 		IDPConfigID: provider.IdpConfigId,
@@ -76,7 +84,7 @@ func idpProviderToModel(provider *admin.IdpProviderID) *iam_model.IDPProvider {
 	}
 }
 
-func idpProviderFromModel(provider *iam_model.IDPProvider) *admin.IdpProviderID {
+func idpProviderFromDomain(provider *domain.IDPProvider) *admin.IdpProviderID {
 	return &admin.IdpProviderID{
 		IdpConfigId: provider.IDPConfigID,
 	}
@@ -148,21 +156,21 @@ func secondFactorTypeToModel(mfaType *admin.SecondFactor) iam_model.SecondFactor
 	}
 }
 
-func passwordlessTypeFromModel(passwordlessType iam_model.PasswordlessType) admin.PasswordlessType {
+func passwordlessTypeFromDomain(passwordlessType domain.PasswordlessType) admin.PasswordlessType {
 	switch passwordlessType {
-	case iam_model.PasswordlessTypeAllowed:
+	case domain.PasswordlessTypeAllowed:
 		return admin.PasswordlessType_PASSWORDLESSTYPE_ALLOWED
 	default:
 		return admin.PasswordlessType_PASSWORDLESSTYPE_NOT_ALLOWED
 	}
 }
 
-func passwordlessTypeToModel(passwordlessType admin.PasswordlessType) iam_model.PasswordlessType {
+func passwordlessTypeToDomain(passwordlessType admin.PasswordlessType) domain.PasswordlessType {
 	switch passwordlessType {
 	case admin.PasswordlessType_PASSWORDLESSTYPE_ALLOWED:
-		return iam_model.PasswordlessTypeAllowed
+		return domain.PasswordlessTypeAllowed
 	default:
-		return iam_model.PasswordlessTypeNotAllowed
+		return domain.PasswordlessTypeNotAllowed
 	}
 }
 

internal/api/grpc/admin/org.go

@@ -47,11 +47,11 @@ func (s *Server) GetDefaultOrgIamPolicy(ctx context.Context, _ *empty.Empty) (_
 }
 
 func (s *Server) UpdateDefaultOrgIamPolicy(ctx context.Context, in *admin.OrgIamPolicyRequest) (_ *admin.OrgIamPolicy, err error) {
-	policy, err := s.iam.ChangeDefaultOrgIAMPolicy(ctx, orgIAMPolicyRequestToModel(in))
+	policy, err := s.command.ChangeDefaultOrgIAMPolicy(ctx, orgIAMPolicyRequestToDomain(in))
 	if err != nil {
 		return nil, err
 	}
-	return orgIAMPolicyFromModel(policy), err
+	return orgIAMPolicyFromDomain(policy), err
 }
 
 func (s *Server) GetOrgIamPolicy(ctx context.Context, in *admin.OrgIamPolicyID) (_ *admin.OrgIamPolicyView, err error) {
@@ -63,19 +63,19 @@ func (s *Server) GetOrgIamPolicy(ctx context.Context, in *admin.OrgIamPolicyID)
 }
 
 func (s *Server) CreateOrgIamPolicy(ctx context.Context, in *admin.OrgIamPolicyRequest) (_ *admin.OrgIamPolicy, err error) {
-	policy, err := s.org.CreateOrgIAMPolicy(ctx, orgIAMPolicyRequestToModel(in))
+	policy, err := s.command.AddOrgIAMPolicy(ctx, orgIAMPolicyRequestToDomain(in))
 	if err != nil {
 		return nil, err
 	}
-	return orgIAMPolicyFromModel(policy), err
+	return orgIAMPolicyFromDomain(policy), err
 }
 
 func (s *Server) UpdateOrgIamPolicy(ctx context.Context, in *admin.OrgIamPolicyRequest) (_ *admin.OrgIamPolicy, err error) {
-	policy, err := s.org.ChangeOrgIAMPolicy(ctx, orgIAMPolicyRequestToModel(in))
+	policy, err := s.command.ChangeOrgIAMPolicy(ctx, orgIAMPolicyRequestToDomain(in))
 	if err != nil {
 		return nil, err
 	}
-	return orgIAMPolicyFromModel(policy), err
+	return orgIAMPolicyFromDomain(policy), err
 }
 
 func (s *Server) RemoveOrgIamPolicy(ctx context.Context, in *admin.OrgIamPolicyID) (_ *empty.Empty, err error) {

internal/api/grpc/admin/org_converter.go

@@ -3,6 +3,7 @@ package admin
 import (
 	"github.com/caos/logging"
 	iam_model "github.com/caos/zitadel/internal/iam/model"
+	"github.com/caos/zitadel/internal/v2/domain"
 	"github.com/golang/protobuf/ptypes"
 
 	admin_model "github.com/caos/zitadel/internal/admin/model"
@@ -197,7 +198,7 @@ func orgQueryMethodToModel(method admin.OrgSearchMethod) model.SearchMethod {
 	}
 }
 
-func orgIAMPolicyFromModel(policy *iam_model.OrgIAMPolicy) *admin.OrgIamPolicy {
+func orgIAMPolicyFromDomain(policy *domain.OrgIAMPolicy) *admin.OrgIamPolicy {
 	creationDate, err := ptypes.TimestampProto(policy.CreationDate)
 	logging.Log("GRPC-ush36").OnError(err).Debug("unable to get timestamp from time")
 
@@ -227,8 +228,8 @@ func orgIAMPolicyViewFromModel(policy *iam_model.OrgIAMPolicyView) *admin.OrgIam
 	}
 }
 
-func orgIAMPolicyRequestToModel(policy *admin.OrgIamPolicyRequest) *iam_model.OrgIAMPolicy {
-	return &iam_model.OrgIAMPolicy{
+func orgIAMPolicyRequestToDomain(policy *admin.OrgIamPolicyRequest) *domain.OrgIAMPolicy {
+	return &domain.OrgIAMPolicy{
 		ObjectRoot: models.ObjectRoot{
 			AggregateID: policy.OrgId,
 		},

internal/api/grpc/admin/password_age_policy.go

@@ -15,9 +15,9 @@ func (s *Server) GetDefaultPasswordAgePolicy(ctx context.Context, _ *empty.Empty
 }
 
 func (s *Server) UpdateDefaultPasswordAgePolicy(ctx context.Context, policy *admin.DefaultPasswordAgePolicyRequest) (*admin.DefaultPasswordAgePolicy, error) {
-	result, err := s.iam.ChangeDefaultPasswordAgePolicy(ctx, passwordAgePolicyToModel(policy))
+	result, err := s.command.ChangeDefaultPasswordAgePolicy(ctx, passwordAgePolicyToDomain(policy))
 	if err != nil {
 		return nil, err
 	}
-	return passwordAgePolicyFromModel(result), nil
+	return passwordAgePolicyFromDomain(result), nil
 }

internal/api/grpc/admin/password_age_policy_converter.go

@@ -3,18 +3,19 @@ package admin
 import (
 	"github.com/caos/logging"
 	iam_model "github.com/caos/zitadel/internal/iam/model"
+	"github.com/caos/zitadel/internal/v2/domain"
 	"github.com/caos/zitadel/pkg/grpc/admin"
 	"github.com/golang/protobuf/ptypes"
 )
 
-func passwordAgePolicyToModel(policy *admin.DefaultPasswordAgePolicyRequest) *iam_model.PasswordAgePolicy {
-	return &iam_model.PasswordAgePolicy{
+func passwordAgePolicyToDomain(policy *admin.DefaultPasswordAgePolicyRequest) *domain.PasswordAgePolicy {
+	return &domain.PasswordAgePolicy{
 		MaxAgeDays:     policy.MaxAgeDays,
 		ExpireWarnDays: policy.ExpireWarnDays,
 	}
 }
 
-func passwordAgePolicyFromModel(policy *iam_model.PasswordAgePolicy) *admin.DefaultPasswordAgePolicy {
+func passwordAgePolicyFromDomain(policy *domain.PasswordAgePolicy) *admin.DefaultPasswordAgePolicy {
 	creationDate, err := ptypes.TimestampProto(policy.CreationDate)
 	logging.Log("GRPC-mH9os").OnError(err).Debug("date parse failed")
 

internal/api/grpc/admin/password_complexity_policy.go

@@ -15,9 +15,9 @@ func (s *Server) GetDefaultPasswordComplexityPolicy(ctx context.Context, _ *empt
 }
 
 func (s *Server) UpdateDefaultPasswordComplexityPolicy(ctx context.Context, policy *admin.DefaultPasswordComplexityPolicyRequest) (*admin.DefaultPasswordComplexityPolicy, error) {
-	result, err := s.iam.ChangeDefaultPasswordComplexityPolicy(ctx, passwordComplexityPolicyToModel(policy))
+	result, err := s.command.ChangeDefaultPasswordComplexityPolicy(ctx, passwordComplexityPolicyToDomain(policy))
 	if err != nil {
 		return nil, err
 	}
-	return passwordComplexityPolicyFromModel(result), nil
+	return passwordComplexityPolicyFromDomain(result), nil
 }

internal/api/grpc/admin/password_complexity_policy_converter.go

@@ -3,12 +3,13 @@ package admin
 import (
 	"github.com/caos/logging"
 	iam_model "github.com/caos/zitadel/internal/iam/model"
+	"github.com/caos/zitadel/internal/v2/domain"
 	"github.com/caos/zitadel/pkg/grpc/admin"
 	"github.com/golang/protobuf/ptypes"
 )
 
-func passwordComplexityPolicyToModel(policy *admin.DefaultPasswordComplexityPolicyRequest) *iam_model.PasswordComplexityPolicy {
-	return &iam_model.PasswordComplexityPolicy{
+func passwordComplexityPolicyToDomain(policy *admin.DefaultPasswordComplexityPolicyRequest) *domain.PasswordComplexityPolicy {
+	return &domain.PasswordComplexityPolicy{
 		MinLength:    policy.MinLength,
 		HasUppercase: policy.HasUppercase,
 		HasLowercase: policy.HasLowercase,
@@ -17,7 +18,7 @@ func passwordComplexityPolicyToModel(policy *admin.DefaultPasswordComplexityPoli
 	}
 }
 
-func passwordComplexityPolicyFromModel(policy *iam_model.PasswordComplexityPolicy) *admin.DefaultPasswordComplexityPolicy {
+func passwordComplexityPolicyFromDomain(policy *domain.PasswordComplexityPolicy) *admin.DefaultPasswordComplexityPolicy {
 	creationDate, err := ptypes.TimestampProto(policy.CreationDate)
 	logging.Log("GRPC-6Zhs9").OnError(err).Debug("date parse failed")
 

internal/api/grpc/admin/password_lockout_policy.go

@@ -15,9 +15,9 @@ func (s *Server) GetDefaultPasswordLockoutPolicy(ctx context.Context, _ *empty.E
 }
 
 func (s *Server) UpdateDefaultPasswordLockoutPolicy(ctx context.Context, policy *admin.DefaultPasswordLockoutPolicyRequest) (*admin.DefaultPasswordLockoutPolicy, error) {
-	result, err := s.iam.ChangeDefaultPasswordLockoutPolicy(ctx, passwordLockoutPolicyToModel(policy))
+	result, err := s.command.ChangeDefaultPasswordLockoutPolicy(ctx, passwordLockoutPolicyToDomain(policy))
 	if err != nil {
 		return nil, err
 	}
-	return passwordLockoutPolicyFromModel(result), nil
+	return passwordLockoutPolicyFromDomain(result), nil
 }

internal/api/grpc/admin/password_lockout_policy_converter.go

@@ -3,18 +3,19 @@ package admin
 import (
 	"github.com/caos/logging"
 	iam_model "github.com/caos/zitadel/internal/iam/model"
+	"github.com/caos/zitadel/internal/v2/domain"
 	"github.com/caos/zitadel/pkg/grpc/admin"
 	"github.com/golang/protobuf/ptypes"
 )
 
-func passwordLockoutPolicyToModel(policy *admin.DefaultPasswordLockoutPolicyRequest) *iam_model.PasswordLockoutPolicy {
-	return &iam_model.PasswordLockoutPolicy{
+func passwordLockoutPolicyToDomain(policy *admin.DefaultPasswordLockoutPolicyRequest) *domain.PasswordLockoutPolicy {
+	return &domain.PasswordLockoutPolicy{
 		MaxAttempts:         policy.MaxAttempts,
 		ShowLockOutFailures: policy.ShowLockoutFailure,
 	}
 }
 
-func passwordLockoutPolicyFromModel(policy *iam_model.PasswordLockoutPolicy) *admin.DefaultPasswordLockoutPolicy {
+func passwordLockoutPolicyFromDomain(policy *domain.PasswordLockoutPolicy) *admin.DefaultPasswordLockoutPolicy {
 	creationDate, err := ptypes.TimestampProto(policy.CreationDate)
 	logging.Log("GRPC-4Gsm9f").OnError(err).Debug("date parse failed")
 

internal/api/grpc/admin/server.go

@@ -1,6 +1,8 @@
 package admin
 
 import (
+	"github.com/caos/zitadel/internal/v2/command"
+	"github.com/caos/zitadel/internal/v2/query"
 	"google.golang.org/grpc"
 
 	"github.com/caos/zitadel/internal/admin/repository"
@@ -17,6 +19,8 @@ const (
 var _ admin.AdminServiceServer = (*Server)(nil)
 
 type Server struct {
+	command       *command.CommandSide
+	query         *query.QuerySide
 	org           repository.OrgRepository
 	iam           repository.IAMRepository
 	administrator repository.AdministratorRepository
@@ -27,8 +31,10 @@ type Config struct {
 	Repository eventsourcing.Config
 }
 
-func CreateServer(repo repository.Repository) *Server {
+func CreateServer(command *command.CommandSide, query *query.QuerySide, repo repository.Repository) *Server {
 	return &Server{
+		command:       command,
+		query:         query,
 		org:           repo,
 		iam:           repo,
 		administrator: repo,