fix: correctly send links to login v2 in email notifications (#10711)

# Which Problems Are Solved

There were still some emails (passkey registration and domain claimed)
sent with links pointing to login v1 even when the login v2 was enabled
for the instance.
Also while looking into the issue, it was discovered that some links
pointing to login V2 were not correctly generated.


# How the Problems Are Solved

- Added default paths for passkey registration and domain claimed
notifications
- Fixed the existing paths to properly handle concatenation (resp. use
`url.ResolveReference`)
  - Change their go types (from string) to `*url.URL` 
  - Added a mapstructure hook for string to url
- Removed unnecessary `InstanceSetupFeatures` and corresponding
conversions
- Refactored the methods on the `login.DefaultPaths` struct and added an
interface to the `Commands` to only need to pass a single config (and
not every method)
- Added an `OriginURL` method to the `DomainCtx` to prevent going from
url to string and back
- Added the use of the templates in case of enabled login v2 for passkey
registration and domain claimed)

# Additional Changes

None

# Additional Context

closes #10643

---------

Co-authored-by: Max Peintner <[email protected]>
Co-authored-by: Livio Spring <[email protected]>
Co-authored-by: Livio Spring <[email protected]>
Co-authored-by: Max Peintner <[email protected]>
Co-authored-by: Gayathri Vijayan <[email protected]>

internal/command/command.go

@@ -98,11 +98,18 @@ type Commands struct {
 	caches *Caches
 	// Store instance IDs where all milestones are reached (except InstanceDeleted).
 	// These instance's milestones never need to be invalidated,
-	// so the query and cache overhead can completely eliminated.
+	// so the query and cache overhead can be completely eliminated.
 	milestonesCompleted sync.Map
 
-	defaultEmailCodeURLTemplate   func(ctx context.Context) string
-	defaultPasswordSetURLTemplate func(ctx context.Context) string
+	loginPaths LoginPaths
+}
+
+//go:generate mockgen -package command -destination ./mock_login_paths.go . LoginPaths
+type LoginPaths interface {
+	DefaultEmailCodeURLTemplate(ctx context.Context) string
+	DefaultPasswordSetURLTemplate(ctx context.Context) string
+	DefaultPasskeySetURLTemplate(ctx context.Context) string
+	DefaultDomainClaimedURLTemplate(ctx context.Context) string
 }
 
 func StartCommands(
@@ -120,12 +127,9 @@ func StartCommands(
 	httpClient *http.Client,
 	permissionCheck domain.PermissionCheck,
 	sessionTokenVerifier func(ctx context.Context, sessionToken string, sessionID string, tokenID string) (err error),
-	defaultAccessTokenLifetime,
-	defaultRefreshTokenLifetime,
-	defaultRefreshTokenIdleLifetime time.Duration,
+	defaultAccessTokenLifetime, defaultRefreshTokenLifetime, defaultRefreshTokenIdleLifetime time.Duration,
 	defaultSecretGenerators *SecretGenerators,
-	defaultEmailCodeURLTemplate func(ctx context.Context) string,
-	defaultPasswordSetURLTemplate func(ctx context.Context) string,
+	loginPaths LoginPaths,
 ) (repo *Commands, err error) {
 	if externalDomain == "" {
 		return nil, zerrors.ThrowInvalidArgument(nil, "COMMAND-Df21s", "no external domain specified")
@@ -211,10 +215,9 @@ func StartCommands(
 				WithHyphen: defaults.Multifactors.RecoveryCodes.WithHyphen,
 			},
 		},
-		GenerateDomain:                domain.NewGeneratedInstanceDomain,
-		caches:                        caches,
-		defaultEmailCodeURLTemplate:   defaultEmailCodeURLTemplate,
-		defaultPasswordSetURLTemplate: defaultPasswordSetURLTemplate,
+		GenerateDomain: domain.NewGeneratedInstanceDomain,
+		caches:         caches,
+		loginPaths:     loginPaths,
 	}
 
 	if defaultSecretGenerators != nil && defaultSecretGenerators.ClientSecret != nil {

internal/command/command_test.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 	"golang.org/x/text/language"
 
 	"github.com/zitadel/zitadel/internal/eventstore"
@@ -144,3 +145,39 @@ func TestCommands_asyncPush(t *testing.T) {
 		})
 	}
 }
+
+func expectLoginPathsNoCall(t *testing.T) LoginPaths {
+	return NewMockLoginPaths(gomock.NewController(t))
+}
+
+func expectLoginPathsDefaultEmailCodeURLTemplate(tmpl string) func(t *testing.T) LoginPaths {
+	return func(t *testing.T) LoginPaths {
+		m := NewMockLoginPaths(gomock.NewController(t))
+		m.EXPECT().DefaultEmailCodeURLTemplate(gomock.Any()).Return(tmpl)
+		return m
+	}
+}
+
+func expectLoginPathsDefaultDomainClaimedURLTemplate(tmpl string) func(t *testing.T) LoginPaths {
+	return func(t *testing.T) LoginPaths {
+		m := NewMockLoginPaths(gomock.NewController(t))
+		m.EXPECT().DefaultDomainClaimedURLTemplate(gomock.Any()).Return(tmpl)
+		return m
+	}
+}
+
+func expectLoginPathsDefaultPasswordSetURLTemplate(tmpl string) func(t *testing.T) LoginPaths {
+	return func(t *testing.T) LoginPaths {
+		m := NewMockLoginPaths(gomock.NewController(t))
+		m.EXPECT().DefaultPasswordSetURLTemplate(gomock.Any()).Return(tmpl)
+		return m
+	}
+}
+
+func expectLoginPathsDefaultPasskeySetURLTemplate(tmpl string) func(t *testing.T) LoginPaths {
+	return func(t *testing.T) LoginPaths {
+		m := NewMockLoginPaths(gomock.NewController(t))
+		m.EXPECT().DefaultPasskeySetURLTemplate(gomock.Any()).Return(tmpl)
+		return m
+	}
+}

internal/command/instance.go

@@ -2,7 +2,6 @@ package command
 
 import (
 	"context"
-	"net/url"
 	"strings"
 	"time"
 
@@ -15,7 +14,6 @@ import (
 	"github.com/zitadel/zitadel/internal/crypto"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/eventstore"
-	"github.com/zitadel/zitadel/internal/feature"
 	"github.com/zitadel/zitadel/internal/i18n"
 	"github.com/zitadel/zitadel/internal/id"
 	"github.com/zitadel/zitadel/internal/notification/channels/smtp"
@@ -124,57 +122,12 @@ type InstanceSetup struct {
 	SMTPConfiguration      *SMTPConfiguration
 	OIDCSettings           *OIDCSettings
 	Quotas                 *SetQuotas
-	Features               *InstanceSetupFeatures
+	Features               *InstanceFeatures
 	Limits                 *SetLimits
 	Restrictions           *SetRestrictions
 	RolePermissionMappings []authz.RoleMapping
 }
 
-type InstanceSetupFeatures struct {
-	LoginDefaultOrg                *bool
-	UserSchema                     *bool
-	ImprovedPerformance            []feature.ImprovedPerformanceType
-	DebugOIDCParentError           *bool
-	OIDCSingleV1SessionTermination *bool
-	LoginV2                        *InstanceSetupFeatureLoginV2
-	PermissionCheckV2              *bool
-	ManagementConsoleUseV2UserApi  *bool
-	EnableRelationalTables         *bool
-}
-
-type InstanceSetupFeatureLoginV2 struct {
-	Required bool    `json:"required,omitempty"`
-	BaseURI  *string `json:"base_uri,omitempty"`
-}
-
-func (f *InstanceSetupFeatures) ToInstanceFeatures() (_ *InstanceFeatures, err error) {
-	if f == nil {
-		return nil, nil
-	}
-	var loginV2 *feature.LoginV2
-	if f.LoginV2 != nil {
-		loginV2 = &feature.LoginV2{Required: f.LoginV2.Required}
-		if f.LoginV2.BaseURI != nil {
-			loginV2.BaseURI, err = url.Parse(*f.LoginV2.BaseURI)
-			if err != nil {
-				return nil, err
-			}
-		}
-	}
-
-	return &InstanceFeatures{
-		LoginDefaultOrg:                f.LoginDefaultOrg,
-		UserSchema:                     f.UserSchema,
-		ImprovedPerformance:            f.ImprovedPerformance,
-		DebugOIDCParentError:           f.DebugOIDCParentError,
-		OIDCSingleV1SessionTermination: f.OIDCSingleV1SessionTermination,
-		LoginV2:                        loginV2,
-		PermissionCheckV2:              f.PermissionCheckV2,
-		ManagementConsoleUseV2UserApi:  f.ManagementConsoleUseV2UserApi,
-		EnableRelationalTables:         f.EnableRelationalTables,
-	}, nil
-}
-
 type SMTPConfiguration struct {
 	Description    string
 	SMTP           smtp.SMTP
@@ -468,7 +421,7 @@ func setupQuotas(commands *Commands, validations *[]preparation.Validation, setQ
 	return nil
 }
 
-func setupFeatures(validations *[]preparation.Validation, features *InstanceSetupFeatures, instanceID string) {
+func setupFeatures(validations *[]preparation.Validation, features *InstanceFeatures, instanceID string) {
 	if features != nil {
 		*validations = append(*validations, prepareSetFeatures(instanceID, features))
 	}

internal/command/instance_features.go

@@ -56,16 +56,11 @@ func (c *Commands) SetInstanceFeatures(ctx context.Context, f *InstanceFeatures)
 	return pushedEventsToObjectDetails(events), nil
 }
 
-func prepareSetFeatures(instanceID string, f *InstanceSetupFeatures) preparation.Validation {
+func prepareSetFeatures(instanceID string, f *InstanceFeatures) preparation.Validation {
 	return func() (preparation.CreateCommands, error) {
-		features, err := f.ToInstanceFeatures()
-		if err != nil {
-			return nil, err
-		}
-
 		return func(ctx context.Context, _ preparation.FilterToQueryReducer) ([]eventstore.Command, error) {
 			wm := NewInstanceFeaturesWriteModel(instanceID)
-			return wm.setCommands(ctx, features), nil
+			return wm.setCommands(ctx, f), nil
 		}, nil
 	}
 }

internal/command/instance_test.go

@@ -3,15 +3,12 @@ package command
 import (
 	"context"
 	"encoding/json"
-	"net/url"
 	"slices"
 	"strings"
 	"testing"
 	"time"
 
-	"github.com/muhlemmer/gu"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 	"go.uber.org/mock/gomock"
 	"golang.org/x/text/language"
 
@@ -21,7 +18,6 @@ import (
 	"github.com/zitadel/zitadel/internal/crypto"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/eventstore"
-	"github.com/zitadel/zitadel/internal/feature"
 	"github.com/zitadel/zitadel/internal/id"
 	id_mock "github.com/zitadel/zitadel/internal/id/mock"
 	"github.com/zitadel/zitadel/internal/repository/instance"
@@ -1769,118 +1765,3 @@ func TestCommandSide_RemoveInstance(t *testing.T) {
 		})
 	}
 }
-
-func TestInstanceSetupFeatures_ToInstanceFeatures(t *testing.T) {
-	t.Parallel()
-
-	type fields struct {
-		LoginDefaultOrg                *bool
-		UserSchema                     *bool
-		ImprovedPerformance            []feature.ImprovedPerformanceType
-		DebugOIDCParentError           *bool
-		OIDCSingleV1SessionTermination *bool
-		LoginV2                        *InstanceSetupFeatureLoginV2
-		PermissionCheckV2              *bool
-		ManagementConsoleUseV2UserApi  *bool
-		EnableRelationalTables         *bool
-	}
-
-	correctlyParsedURI, err := url.Parse("https://example.com")
-	require.NoError(t, err)
-
-	tt := []struct {
-		name    string
-		fields  fields
-		want    *InstanceFeatures
-		wantErr bool
-	}{
-		{
-			name:   "nil features returns nil",
-			fields: fields{},
-			want:   &InstanceFeatures{},
-		},
-		{
-			name: "all fields no login v2",
-			fields: fields{
-				LoginDefaultOrg:                gu.Ptr(true),
-				UserSchema:                     gu.Ptr(false),
-				ImprovedPerformance:            []feature.ImprovedPerformanceType{feature.ImprovedPerformanceTypeOrgDomainVerified},
-				DebugOIDCParentError:           gu.Ptr(true),
-				OIDCSingleV1SessionTermination: gu.Ptr(false),
-				PermissionCheckV2:              gu.Ptr(true),
-				ManagementConsoleUseV2UserApi:  gu.Ptr(false),
-				EnableRelationalTables:         gu.Ptr(true),
-			},
-			want: &InstanceFeatures{
-				LoginDefaultOrg:                gu.Ptr(true),
-				UserSchema:                     gu.Ptr(false),
-				ImprovedPerformance:            []feature.ImprovedPerformanceType{feature.ImprovedPerformanceTypeOrgDomainVerified},
-				DebugOIDCParentError:           gu.Ptr(true),
-				OIDCSingleV1SessionTermination: gu.Ptr(false),
-				LoginV2:                        nil,
-				PermissionCheckV2:              gu.Ptr(true),
-				ManagementConsoleUseV2UserApi:  gu.Ptr(false),
-				EnableRelationalTables:         gu.Ptr(true),
-			},
-		},
-		{
-			name: "with login v2 no base uri",
-			fields: fields{
-				LoginV2: &InstanceSetupFeatureLoginV2{
-					Required: true,
-				},
-			},
-			want: &InstanceFeatures{
-				LoginV2: &feature.LoginV2{
-					Required: true,
-				},
-			},
-		},
-		{
-			name: "with login v2 valid base uri",
-			fields: fields{
-				LoginV2: &InstanceSetupFeatureLoginV2{
-					Required: true,
-					BaseURI:  gu.Ptr("https://example.com"),
-				},
-			},
-			want: &InstanceFeatures{
-				LoginV2: &feature.LoginV2{
-					Required: true,
-					BaseURI:  correctlyParsedURI,
-				},
-			},
-		},
-		{
-			name: "with login v2 invalid base uri",
-			fields: fields{
-				LoginV2: &InstanceSetupFeatureLoginV2{
-					Required: true,
-					BaseURI:  gu.Ptr("://invalid"),
-				},
-			},
-			wantErr: true,
-		},
-	}
-	for _, tc := range tt {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			f := &InstanceSetupFeatures{
-				LoginDefaultOrg:                tc.fields.LoginDefaultOrg,
-				UserSchema:                     tc.fields.UserSchema,
-				ImprovedPerformance:            tc.fields.ImprovedPerformance,
-				DebugOIDCParentError:           tc.fields.DebugOIDCParentError,
-				OIDCSingleV1SessionTermination: tc.fields.OIDCSingleV1SessionTermination,
-				LoginV2:                        tc.fields.LoginV2,
-				PermissionCheckV2:              tc.fields.PermissionCheckV2,
-				ManagementConsoleUseV2UserApi:  tc.fields.ManagementConsoleUseV2UserApi,
-				EnableRelationalTables:         tc.fields.EnableRelationalTables,
-			}
-			got, err := f.ToInstanceFeatures()
-
-			require.Equal(t, tc.wantErr, err != nil)
-			assert.Equal(t, tc.want, got)
-		})
-	}
-}

internal/command/mock_login_paths.go

@@ -0,0 +1,96 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/zitadel/zitadel/internal/command (interfaces: LoginPaths)
+//
+// Generated by this command:
+//
+//	mockgen -package command -destination ./mock_login_paths.go . LoginPaths
+//
+
+// Package command is a generated GoMock package.
+package command
+
+import (
+	context "context"
+	reflect "reflect"
+
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockLoginPaths is a mock of LoginPaths interface.
+type MockLoginPaths struct {
+	ctrl     *gomock.Controller
+	recorder *MockLoginPathsMockRecorder
+}
+
+// MockLoginPathsMockRecorder is the mock recorder for MockLoginPaths.
+type MockLoginPathsMockRecorder struct {
+	mock *MockLoginPaths
+}
+
+// NewMockLoginPaths creates a new mock instance.
+func NewMockLoginPaths(ctrl *gomock.Controller) *MockLoginPaths {
+	mock := &MockLoginPaths{ctrl: ctrl}
+	mock.recorder = &MockLoginPathsMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockLoginPaths) EXPECT() *MockLoginPathsMockRecorder {
+	return m.recorder
+}
+
+// DefaultDomainClaimedURLTemplate mocks base method.
+func (m *MockLoginPaths) DefaultDomainClaimedURLTemplate(arg0 context.Context) string {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DefaultDomainClaimedURLTemplate", arg0)
+	ret0, _ := ret[0].(string)
+	return ret0
+}
+
+// DefaultDomainClaimedURLTemplate indicates an expected call of DefaultDomainClaimedURLTemplate.
+func (mr *MockLoginPathsMockRecorder) DefaultDomainClaimedURLTemplate(arg0 any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DefaultDomainClaimedURLTemplate", reflect.TypeOf((*MockLoginPaths)(nil).DefaultDomainClaimedURLTemplate), arg0)
+}
+
+// DefaultEmailCodeURLTemplate mocks base method.
+func (m *MockLoginPaths) DefaultEmailCodeURLTemplate(arg0 context.Context) string {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DefaultEmailCodeURLTemplate", arg0)
+	ret0, _ := ret[0].(string)
+	return ret0
+}
+
+// DefaultEmailCodeURLTemplate indicates an expected call of DefaultEmailCodeURLTemplate.
+func (mr *MockLoginPathsMockRecorder) DefaultEmailCodeURLTemplate(arg0 any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DefaultEmailCodeURLTemplate", reflect.TypeOf((*MockLoginPaths)(nil).DefaultEmailCodeURLTemplate), arg0)
+}
+
+// DefaultPasskeySetURLTemplate mocks base method.
+func (m *MockLoginPaths) DefaultPasskeySetURLTemplate(arg0 context.Context) string {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DefaultPasskeySetURLTemplate", arg0)
+	ret0, _ := ret[0].(string)
+	return ret0
+}
+
+// DefaultPasskeySetURLTemplate indicates an expected call of DefaultPasskeySetURLTemplate.
+func (mr *MockLoginPathsMockRecorder) DefaultPasskeySetURLTemplate(arg0 any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DefaultPasskeySetURLTemplate", reflect.TypeOf((*MockLoginPaths)(nil).DefaultPasskeySetURLTemplate), arg0)
+}
+
+// DefaultPasswordSetURLTemplate mocks base method.
+func (m *MockLoginPaths) DefaultPasswordSetURLTemplate(arg0 context.Context) string {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DefaultPasswordSetURLTemplate", arg0)
+	ret0, _ := ret[0].(string)
+	return ret0
+}
+
+// DefaultPasswordSetURLTemplate indicates an expected call of DefaultPasswordSetURLTemplate.
+func (mr *MockLoginPathsMockRecorder) DefaultPasswordSetURLTemplate(arg0 any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DefaultPasswordSetURLTemplate", reflect.TypeOf((*MockLoginPaths)(nil).DefaultPasswordSetURLTemplate), arg0)
+}

internal/command/org_domain_test.go

@@ -29,6 +29,7 @@ func TestAddDomain(t *testing.T) {
 		idGenerator     id.Generator
 		filter          preparation.FilterToQueryReducer
 		eventstore      func(*testing.T) *eventstore.Eventstore
+		loginPaths      func(*testing.T) LoginPaths
 		permissionCheck OrganizationPermissionCheck
 	}
 
@@ -45,6 +46,7 @@ func TestAddDomain(t *testing.T) {
 				a:          agg,
 				domain:     "",
 				eventstore: expectEventstore(),
+				loginPaths: expectLoginPathsNoCall,
 			},
 			want: Want{
 				ValidationErr: zerrors.ThrowInvalidArgument(nil, "ORG-r3h4J", "Errors.Invalid.Argument"),
@@ -69,6 +71,7 @@ func TestAddDomain(t *testing.T) {
 						),
 					),
 				),
+				loginPaths: expectLoginPathsNoCall,
 			},
 			want: Want{
 				Commands: []eventstore.Command{
@@ -118,12 +121,13 @@ func TestAddDomain(t *testing.T) {
 						),
 					),
 				),
+				loginPaths: expectLoginPathsDefaultDomainClaimedURLTemplate(""),
 			},
 			want: Want{
 				Commands: []eventstore.Command{
 					org.NewDomainAddedEvent(context.Background(), &agg.Aggregate, "domain"),
 					org.NewDomainVerifiedEvent(context.Background(), &agg.Aggregate, "domain"),
-					user.NewDomainClaimedEvent(http.WithRequestedHost(context.Background(), "domain"), &user.NewAggregate("userID1", "org2").Aggregate, "[email protected]", "username", false),
+					user.NewDomainClaimedEvent(http.WithRequestedHost(context.Background(), "domain"), &user.NewAggregate("userID1", "org2").Aggregate, "[email protected]", "username", false, ""),
 				},
 			},
 		},
@@ -148,6 +152,7 @@ func TestAddDomain(t *testing.T) {
 						),
 					),
 				),
+				loginPaths: expectLoginPathsNoCall,
 			},
 			want: Want{
 				CreateErr: zerrors.ThrowAlreadyExists(nil, "", ""),
@@ -161,6 +166,7 @@ func TestAddDomain(t *testing.T) {
 				claimedUserIDs:  []string{"userID1"},
 				filter:          nil,
 				eventstore:      expectEventstore(),
+				loginPaths:      expectLoginPathsNoCall,
 				permissionCheck: newMockOrganizationPermissionCheckNotAllowed(),
 			},
 			want: Want{
@@ -186,6 +192,7 @@ func TestAddDomain(t *testing.T) {
 						),
 					),
 				),
+				loginPaths:      expectLoginPathsNoCall,
 				permissionCheck: newMockOrganizationPermissionCheckAllowed(),
 			},
 			want: Want{
@@ -200,7 +207,7 @@ func TestAddDomain(t *testing.T) {
 			AssertValidation(
 				t,
 				http.WithRequestedHost(context.Background(), "domain"),
-				(&Commands{idGenerator: tt.args.idGenerator, eventstore: tt.args.eventstore(t)}).prepareAddOrgDomain(tt.args.a, tt.args.domain, tt.args.claimedUserIDs, tt.args.permissionCheck),
+				(&Commands{idGenerator: tt.args.idGenerator, eventstore: tt.args.eventstore(t), loginPaths: tt.args.loginPaths(t)}).prepareAddOrgDomain(tt.args.a, tt.args.domain, tt.args.claimedUserIDs, tt.args.permissionCheck),
 				tt.args.filter,
 				tt.want,
 			)
@@ -879,6 +886,7 @@ func TestCommandSide_ValidateOrgDomain(t *testing.T) {
 		secretGenerator      crypto.Generator
 		alg                  crypto.EncryptionAlgorithm
 		domainValidationFunc func(domain, token, verifier string, checkType http.CheckType) error
+		loginPaths           func(*testing.T) LoginPaths
 	}
 	type args struct {
 		ctx             context.Context
@@ -900,6 +908,7 @@ func TestCommandSide_ValidateOrgDomain(t *testing.T) {
 			name: "invalid domain, error",
 			fields: fields{
 				eventstore: expectEventstore(),
+				loginPaths: expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx: context.Background(),
@@ -917,6 +926,7 @@ func TestCommandSide_ValidateOrgDomain(t *testing.T) {
 			name: "missing aggregateid, error",
 			fields: fields{
 				eventstore: expectEventstore(),
+				loginPaths: expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx: context.Background(),
@@ -941,6 +951,7 @@ func TestCommandSide_ValidateOrgDomain(t *testing.T) {
 						),
 					),
 				),
+				loginPaths: expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx: context.Background(),
@@ -981,6 +992,7 @@ func TestCommandSide_ValidateOrgDomain(t *testing.T) {
 						),
 					),
 				),
+				loginPaths: expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx: context.Background(),
@@ -1015,6 +1027,7 @@ func TestCommandSide_ValidateOrgDomain(t *testing.T) {
 						),
 					),
 				),
+				loginPaths: expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx: context.Background(),
@@ -1070,6 +1083,7 @@ func TestCommandSide_ValidateOrgDomain(t *testing.T) {
 				),
 				alg:                  crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
 				domainValidationFunc: invalidDomainVerification,
+				loginPaths:           expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx: context.Background(),
@@ -1125,6 +1139,7 @@ func TestCommandSide_ValidateOrgDomain(t *testing.T) {
 				),
 				alg:                  crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
 				domainValidationFunc: validDomainVerification,
+				loginPaths:           expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx: context.Background(),
@@ -1183,6 +1198,7 @@ func TestCommandSide_ValidateOrgDomain(t *testing.T) {
 				),
 				alg:                  crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
 				domainValidationFunc: validDomainVerification,
+				loginPaths:           expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx: context.Background(),
@@ -1264,12 +1280,14 @@ func TestCommandSide_ValidateOrgDomain(t *testing.T) {
 							"[email protected]",
 							"[email protected]",
 							false,
+							"",
 						),
 					),
 				),
 				alg:                  crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
 				domainValidationFunc: validDomainVerification,
 				idGenerator:          id_mock.NewIDGeneratorExpectIDs(t, "tempid"),
+				loginPaths:           expectLoginPathsDefaultDomainClaimedURLTemplate(""),
 			},
 			args: args{
 				ctx: context.Background(),
@@ -1351,12 +1369,14 @@ func TestCommandSide_ValidateOrgDomain(t *testing.T) {
 							"[email protected]",
 							"[email protected]",
 							true,
+							"",
 						),
 					),
 				),
 				alg:                  crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
 				domainValidationFunc: validDomainVerification,
 				idGenerator:          id_mock.NewIDGeneratorExpectIDs(t, "tempid"),
+				loginPaths:           expectLoginPathsDefaultDomainClaimedURLTemplate(""),
 			},
 			args: args{
 				ctx: context.Background(),
@@ -1415,6 +1435,7 @@ func TestCommandSide_ValidateOrgDomain(t *testing.T) {
 				),
 				alg:                  crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
 				domainValidationFunc: validDomainVerification,
+				loginPaths:           expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx: context.Background(),
@@ -1439,6 +1460,7 @@ func TestCommandSide_ValidateOrgDomain(t *testing.T) {
 				eventstore:           expectEventstore(),
 				alg:                  crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
 				domainValidationFunc: validDomainVerification,
+				loginPaths:           expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx: context.Background(),
@@ -1464,6 +1486,7 @@ func TestCommandSide_ValidateOrgDomain(t *testing.T) {
 				domainVerificationAlg:       tt.fields.alg,
 				domainVerificationValidator: tt.fields.domainValidationFunc,
 				idGenerator:                 tt.fields.idGenerator,
+				loginPaths:                  tt.fields.loginPaths(t),
 			}
 			got, err := r.ValidateOrgDomain(http.WithRequestedHost(tt.args.ctx, "zitadel.ch"), tt.args.domain, tt.args.claimedUserIDs, tt.args.permissionCheck)
 			if tt.res.err == nil {

internal/command/user.go

@@ -303,6 +303,7 @@ func (c *Commands) userDomainClaimed(ctx context.Context, userID string) (events
 			fmt.Sprintf("%s@temporary.%s", id, http_util.DomainContext(ctx).RequestedDomain()),
 			existingUser.UserName,
 			domainPolicy.UserLoginMustBeDomain || organizationScopedUsername,
+			c.loginPaths.DefaultDomainClaimedURLTemplate(ctx),
 		),
 	}, changedUserGrant, nil
 }
@@ -338,6 +339,7 @@ func (c *Commands) prepareUserDomainClaimed(ctx context.Context, filter preparat
 		fmt.Sprintf("%s@temporary.%s", id, http_util.DomainContext(ctx).RequestedDomain()),
 		userWriteModel.UserName,
 		domainPolicy.UserLoginMustBeDomain || organizationScopedUsername,
+		c.loginPaths.DefaultDomainClaimedURLTemplate(ctx),
 	), nil
 }
 

internal/command/user_human.go

@@ -306,10 +306,10 @@ func (c *Commands) addHumanCommandEmail(ctx context.Context, filter preparation.
 		}
 
 		if human.Email.URLTemplate == "" {
-			human.Email.URLTemplate = c.defaultEmailCodeURLTemplate(ctx)
+			human.Email.URLTemplate = c.loginPaths.DefaultEmailCodeURLTemplate(ctx)
 		}
 
-		return append(cmds, user.NewHumanEmailCodeAddedEventV2(ctx, &a.Aggregate, emailCode.Crypted, emailCode.Expiry, human.Email.URLTemplate, human.Email.ReturnCode, human.AuthRequestID)), nil
+		return append(cmds, user.NewHumanEmailCodeAddedEvent(ctx, &a.Aggregate, emailCode.Crypted, emailCode.Expiry, human.Email.URLTemplate, human.Email.ReturnCode, human.AuthRequestID)), nil
 	}
 	return cmds, nil
 }
@@ -599,7 +599,7 @@ func (c *Commands) createHuman(ctx context.Context, orgID string, human *domain.
 			if err != nil {
 				return nil, nil, nil, err
 			}
-			events = append(events, user.NewHumanEmailCodeAddedEvent(ctx, userAgg, emailCode.Code, emailCode.Expiry, ""))
+			events = append(events, user.NewHumanEmailCodeAddedEvent(ctx, userAgg, emailCode.Code, emailCode.Expiry, c.loginPaths.DefaultEmailCodeURLTemplate(ctx), false, ""))
 		}
 	}
 

internal/command/user_human_email.go

@@ -50,7 +50,7 @@ func (c *Commands) ChangeHumanEmail(ctx context.Context, email *domain.Email, em
 		if err != nil {
 			return nil, err
 		}
-		events = append(events, user.NewHumanEmailCodeAddedEvent(ctx, userAgg, emailCode.Code, emailCode.Expiry, ""))
+		events = append(events, user.NewHumanEmailCodeAddedEvent(ctx, userAgg, emailCode.Code, emailCode.Expiry, c.loginPaths.DefaultEmailCodeURLTemplate(ctx), false, ""))
 	}
 
 	pushedEvents, err := c.eventstore.Push(ctx, events...)
@@ -134,7 +134,7 @@ func (c *Commands) CreateHumanEmailVerificationCode(ctx context.Context, userID,
 	if authRequestID == "" {
 		authRequestID = existingEmail.AuthRequestID
 	}
-	pushedEvents, err := c.eventstore.Push(ctx, user.NewHumanEmailCodeAddedEvent(ctx, userAgg, emailCode.Code, emailCode.Expiry, authRequestID))
+	pushedEvents, err := c.eventstore.Push(ctx, user.NewHumanEmailCodeAddedEvent(ctx, userAgg, emailCode.Code, emailCode.Expiry, c.loginPaths.DefaultEmailCodeURLTemplate(ctx), false, authRequestID))
 	if err != nil {
 		return nil, err
 	}

internal/command/user_human_email_test.go

@@ -20,6 +20,7 @@ import (
 func TestCommandSide_ChangeHumanEmail(t *testing.T) {
 	type fields struct {
 		eventstore func(*testing.T) *eventstore.Eventstore
+		loginPaths func(*testing.T) LoginPaths
 	}
 	type args struct {
 		ctx             context.Context
@@ -41,6 +42,7 @@ func TestCommandSide_ChangeHumanEmail(t *testing.T) {
 			name: "invalid email, invalid argument error",
 			fields: fields{
 				eventstore: expectEventstore(),
+				loginPaths: expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx: context.Background(),
@@ -61,6 +63,7 @@ func TestCommandSide_ChangeHumanEmail(t *testing.T) {
 				eventstore: expectEventstore(
 					expectFilter(),
 				),
+				loginPaths: expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx: context.Background(),
@@ -104,6 +107,7 @@ func TestCommandSide_ChangeHumanEmail(t *testing.T) {
 						),
 					),
 				),
+				loginPaths: expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx: context.Background(),
@@ -140,6 +144,7 @@ func TestCommandSide_ChangeHumanEmail(t *testing.T) {
 						),
 					),
 				),
+				loginPaths: expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx: context.Background(),
@@ -185,6 +190,7 @@ func TestCommandSide_ChangeHumanEmail(t *testing.T) {
 						),
 					),
 				),
+				loginPaths: expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx: context.Background(),
@@ -234,6 +240,7 @@ func TestCommandSide_ChangeHumanEmail(t *testing.T) {
 						),
 					),
 				),
+				loginPaths: expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx: context.Background(),
@@ -283,6 +290,7 @@ func TestCommandSide_ChangeHumanEmail(t *testing.T) {
 						),
 					),
 				),
+				loginPaths: expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx: context.Background(),
@@ -341,9 +349,75 @@ func TestCommandSide_ChangeHumanEmail(t *testing.T) {
 							},
 							time.Hour*1,
 							"",
+							false,
+							"",
 						),
 					),
 				),
+				loginPaths: expectLoginPathsDefaultEmailCodeURLTemplate(""),
+			},
+			args: args{
+				ctx: context.Background(),
+				email: &domain.Email{
+					ObjectRoot: models.ObjectRoot{
+						AggregateID: "user1",
+					},
+					EmailAddress: "[email protected]",
+				},
+				resourceOwner:   "org1",
+				secretGenerator: GetMockSecretGenerator(t),
+			},
+			res: res{
+				want: &domain.Email{
+					ObjectRoot: models.ObjectRoot{
+						AggregateID:   "user1",
+						ResourceOwner: "org1",
+					},
+					EmailAddress: "[email protected]",
+				},
+			},
+		},
+		{
+			name: "email changed with code, ok",
+			fields: fields{
+				eventstore: expectEventstore(
+					expectFilter(
+						eventFromEventPusher(
+							user.NewHumanAddedEvent(context.Background(),
+								&user.NewAggregate("user1", "org1").Aggregate,
+								"username",
+								"firstname",
+								"lastname",
+								"nickname",
+								"displayname",
+								language.German,
+								domain.GenderUnspecified,
+								"[email protected]",
+								true,
+							),
+						),
+					),
+					expectPush(
+						user.NewHumanEmailChangedEvent(context.Background(),
+							&user.NewAggregate("user1", "org1").Aggregate,
+							"[email protected]",
+						),
+						user.NewHumanEmailCodeAddedEvent(context.Background(),
+							&user.NewAggregate("user1", "org1").Aggregate,
+							&crypto.CryptoValue{
+								CryptoType: crypto.TypeEncryption,
+								Algorithm:  "enc",
+								KeyID:      "id",
+								Crypted:    []byte("a"),
+							},
+							time.Hour*1,
+							"http://example.com/{{.user}}/email/{{.code}}",
+							false,
+							"",
+						),
+					),
+				),
+				loginPaths: expectLoginPathsDefaultEmailCodeURLTemplate("http://example.com/{{.user}}/email/{{.code}}"),
 			},
 			args: args{
 				ctx: context.Background(),
@@ -371,6 +445,7 @@ func TestCommandSide_ChangeHumanEmail(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			r := &Commands{
 				eventstore: tt.fields.eventstore(t),
+				loginPaths: tt.fields.loginPaths(t),
 			}
 			got, err := r.ChangeHumanEmail(tt.args.ctx, tt.args.email, tt.args.secretGenerator)
 			if tt.res.err == nil {
@@ -389,6 +464,7 @@ func TestCommandSide_ChangeHumanEmail(t *testing.T) {
 func TestCommandSide_VerifyHumanEmail(t *testing.T) {
 	type fields struct {
 		eventstore         func(*testing.T) *eventstore.Eventstore
+		loginPaths         func(*testing.T) LoginPaths
 		userPasswordHasher *crypto.Hasher
 	}
 	type args struct {
@@ -414,6 +490,7 @@ func TestCommandSide_VerifyHumanEmail(t *testing.T) {
 			name: "userid missing, invalid argument error",
 			fields: fields{
 				eventstore: expectEventstore(),
+				loginPaths: expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -428,6 +505,7 @@ func TestCommandSide_VerifyHumanEmail(t *testing.T) {
 			name: "code missing, invalid argument error",
 			fields: fields{
 				eventstore: expectEventstore(),
+				loginPaths: expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -444,6 +522,7 @@ func TestCommandSide_VerifyHumanEmail(t *testing.T) {
 				eventstore: expectEventstore(
 					expectFilter(),
 				),
+				loginPaths: expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -476,6 +555,7 @@ func TestCommandSide_VerifyHumanEmail(t *testing.T) {
 						),
 					),
 				),
+				loginPaths: expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -517,6 +597,8 @@ func TestCommandSide_VerifyHumanEmail(t *testing.T) {
 								},
 								time.Hour*1,
 								"",
+								false,
+								"",
 							),
 						),
 					),
@@ -526,6 +608,7 @@ func TestCommandSide_VerifyHumanEmail(t *testing.T) {
 						),
 					),
 				),
+				loginPaths: expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:             context.Background(),
@@ -568,6 +651,8 @@ func TestCommandSide_VerifyHumanEmail(t *testing.T) {
 								},
 								time.Hour*1,
 								"",
+								false,
+								"",
 							),
 						),
 					),
@@ -577,6 +662,7 @@ func TestCommandSide_VerifyHumanEmail(t *testing.T) {
 						),
 					),
 				),
+				loginPaths: expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:             context.Background(),
@@ -621,6 +707,8 @@ func TestCommandSide_VerifyHumanEmail(t *testing.T) {
 								},
 								time.Hour*1,
 								"",
+								false,
+								"",
 							),
 						),
 					),
@@ -649,6 +737,84 @@ func TestCommandSide_VerifyHumanEmail(t *testing.T) {
 					),
 				),
 				userPasswordHasher: mockPasswordHasher("x"),
+				loginPaths:         expectLoginPathsNoCall,
+			},
+			args: args{
+				ctx:                 context.Background(),
+				userID:              "user1",
+				code:                "a",
+				resourceOwner:       "org1",
+				optionalPassword:    "password",
+				optionalUserAgentID: "userAgentID",
+				secretGenerator:     GetMockSecretGenerator(t),
+			},
+			res: res{
+				want: &domain.ObjectDetails{
+					ResourceOwner: "org1",
+				},
+			},
+		},
+		{
+			name: "valid code (with password and user agent), url template, ok",
+			fields: fields{
+				eventstore: expectEventstore(
+					expectFilter(
+						eventFromEventPusher(
+							user.NewHumanAddedEvent(context.Background(),
+								&user.NewAggregate("user1", "org1").Aggregate,
+								"username",
+								"firstname",
+								"lastname",
+								"nickname",
+								"displayname",
+								language.German,
+								domain.GenderUnspecified,
+								"[email protected]",
+								true,
+							),
+						),
+						eventFromEventPusherWithCreationDateNow(
+							user.NewHumanEmailCodeAddedEvent(context.Background(),
+								&user.NewAggregate("user1", "org1").Aggregate,
+								&crypto.CryptoValue{
+									CryptoType: crypto.TypeEncryption,
+									Algorithm:  "enc",
+									KeyID:      "id",
+									Crypted:    []byte("a"),
+								},
+								time.Hour*1,
+								"http://example.com/{{.user}}/email/{{.code}}",
+								false,
+								"",
+							),
+						),
+					),
+					expectFilter(
+						eventFromEventPusher(
+							org.NewPasswordComplexityPolicyAddedEvent(context.Background(),
+								&user.NewAggregate("user1", "org1").Aggregate,
+								1,
+								false,
+								false,
+								false,
+								false,
+							),
+						),
+					),
+					expectPush(
+						user.NewHumanEmailVerifiedEvent(context.Background(),
+							&user.NewAggregate("user1", "org1").Aggregate,
+						),
+						user.NewHumanPasswordChangedEvent(context.Background(),
+							&user.NewAggregate("user1", "org1").Aggregate,
+							"$plain$x$password",
+							false,
+							"userAgentID",
+						),
+					),
+				),
+				userPasswordHasher: mockPasswordHasher("x"),
+				loginPaths:         expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:                 context.Background(),
@@ -671,6 +837,7 @@ func TestCommandSide_VerifyHumanEmail(t *testing.T) {
 			r := &Commands{
 				eventstore:         tt.fields.eventstore(t),
 				userPasswordHasher: tt.fields.userPasswordHasher,
+				loginPaths:         tt.fields.loginPaths(t),
 			}
 			got, err := r.VerifyHumanEmail(
 				tt.args.ctx,
@@ -697,6 +864,7 @@ func TestCommandSide_VerifyHumanEmail(t *testing.T) {
 func TestCommandSide_CreateVerificationCodeHumanEmail(t *testing.T) {
 	type fields struct {
 		eventstore func(*testing.T) *eventstore.Eventstore
+		loginPaths func(*testing.T) LoginPaths
 	}
 	type args struct {
 		ctx             context.Context
@@ -719,6 +887,7 @@ func TestCommandSide_CreateVerificationCodeHumanEmail(t *testing.T) {
 			name: "userid missing, invalid argument error",
 			fields: fields{
 				eventstore: expectEventstore(),
+				loginPaths: expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -734,6 +903,7 @@ func TestCommandSide_CreateVerificationCodeHumanEmail(t *testing.T) {
 				eventstore: expectEventstore(
 					expectFilter(),
 				),
+				loginPaths: expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -772,6 +942,7 @@ func TestCommandSide_CreateVerificationCodeHumanEmail(t *testing.T) {
 						),
 					),
 				),
+				loginPaths: expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -808,6 +979,7 @@ func TestCommandSide_CreateVerificationCodeHumanEmail(t *testing.T) {
 						),
 					),
 				),
+				loginPaths: expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:           context.Background(),
@@ -860,9 +1032,12 @@ func TestCommandSide_CreateVerificationCodeHumanEmail(t *testing.T) {
 							},
 							time.Hour*1,
 							"",
+							false,
+							"",
 						),
 					),
 				),
+				loginPaths: expectLoginPathsDefaultEmailCodeURLTemplate(""),
 			},
 			args: args{
 				ctx:             context.Background(),
@@ -917,10 +1092,75 @@ func TestCommandSide_CreateVerificationCodeHumanEmail(t *testing.T) {
 								Crypted:    []byte("a"),
 							},
 							time.Hour*1,
+							"",
+							false,
 							"authRequestID",
 						),
 					),
 				),
+				loginPaths: expectLoginPathsDefaultEmailCodeURLTemplate(""),
+			},
+			args: args{
+				ctx:             context.Background(),
+				userID:          "user1",
+				resourceOwner:   "org1",
+				secretGenerator: GetMockSecretGenerator(t),
+				authRequestID:   "authRequestID",
+			},
+			res: res{
+				want: &domain.ObjectDetails{
+					ResourceOwner: "org1",
+				},
+			},
+		},
+		{
+			name: "new code with authRequestID, url template, ok",
+			fields: fields{
+				eventstore: expectEventstore(
+					expectFilter(
+						eventFromEventPusher(
+							user.NewHumanAddedEvent(context.Background(),
+								&user.NewAggregate("user1", "org1").Aggregate,
+								"username",
+								"firstname",
+								"lastname",
+								"nickname",
+								"displayname",
+								language.German,
+								domain.GenderUnspecified,
+								"[email protected]",
+								true,
+							),
+						),
+						eventFromEventPusher(
+							user.NewHumanEmailVerifiedEvent(context.Background(),
+								&user.NewAggregate("user1", "org1").Aggregate,
+							),
+						),
+						eventFromEventPusher(
+							user.NewHumanEmailChangedEvent(context.Background(),
+								&user.NewAggregate("user1", "org1").Aggregate,
+								"[email protected]",
+							),
+						),
+					),
+					expectPush(
+						user.NewHumanEmailCodeAddedEvent(context.Background(),
+							&user.NewAggregate("user1", "org1").Aggregate,
+							&crypto.CryptoValue{
+								CryptoType: crypto.TypeEncryption,
+								Algorithm:  "enc",
+								KeyID:      "id",
+								Crypted:    []byte("a"),
+							},
+							time.Hour*1,
+							"http://example.com/{{.user}}/email/{{.code}}",
+							false,
+							"authRequestID",
+						),
+					),
+				),
+				loginPaths: expectLoginPathsDefaultEmailCodeURLTemplate("http://example.com/{{.user}}/email/{{.code}}"),
 			},
 			args: args{
 				ctx:             context.Background(),
@@ -940,6 +1180,7 @@ func TestCommandSide_CreateVerificationCodeHumanEmail(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			r := &Commands{
 				eventstore: tt.fields.eventstore(t),
+				loginPaths: tt.fields.loginPaths(t),
 			}
 			got, err := r.CreateHumanEmailVerificationCode(tt.args.ctx, tt.args.userID, tt.args.resourceOwner, tt.args.secretGenerator, tt.args.authRequestID)
 			if tt.res.err == nil {

internal/command/user_human_test.go

@@ -45,7 +45,7 @@ func TestCommandSide_AddHuman(t *testing.T) {
 		newCode                     encrypedCodeFunc
 		newEncryptedCodeWithDefault encryptedCodeWithDefaultFunc
 		defaultSecretGenerators     *SecretGenerators
-		defaultEmailCodeURLTemplate func(ctx context.Context) string
+		loginPaths                  func(*testing.T) LoginPaths
 	}
 	type args struct {
 		ctx             context.Context
@@ -73,6 +73,7 @@ func TestCommandSide_AddHuman(t *testing.T) {
 			name: "orgid missing, invalid argument error",
 			fields: fields{
 				eventstore: expectEventstore(),
+				loginPaths: expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -97,6 +98,7 @@ func TestCommandSide_AddHuman(t *testing.T) {
 			name: "user invalid, invalid argument error",
 			fields: fields{
 				eventstore: expectEventstore(),
+				loginPaths: expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -123,6 +125,7 @@ func TestCommandSide_AddHuman(t *testing.T) {
 						),
 					),
 				),
+				loginPaths: expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -155,6 +158,7 @@ func TestCommandSide_AddHuman(t *testing.T) {
 					expectFilter(),
 					expectFilter(),
 				),
+				loginPaths: expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -196,6 +200,7 @@ func TestCommandSide_AddHuman(t *testing.T) {
 					expectFilter(),
 					expectFilter(),
 				),
+				loginPaths: expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -264,6 +269,7 @@ func TestCommandSide_AddHuman(t *testing.T) {
 				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "user1"),
 				codeAlg:     crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
 				newCode:     mockEncryptedCode("userinit", time.Hour),
+				loginPaths:  expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -333,6 +339,7 @@ func TestCommandSide_AddHuman(t *testing.T) {
 				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "user1"),
 				codeAlg:     crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
 				newCode:     mockEncryptedCode("userinit", time.Hour),
+				loginPaths:  expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -403,6 +410,7 @@ func TestCommandSide_AddHuman(t *testing.T) {
 				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "user1"),
 				codeAlg:     crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
 				newCode:     mockEncryptedCode("userinit", time.Hour),
+				loginPaths:  expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -473,6 +481,7 @@ func TestCommandSide_AddHuman(t *testing.T) {
 				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "user1"),
 				codeAlg:     crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
 				newCode:     mockEncryptedCode("userinit", time.Hour),
+				loginPaths:  expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -541,11 +550,11 @@ func TestCommandSide_AddHuman(t *testing.T) {
 						),
 					),
 				),
-				idGenerator:                 id_mock.NewIDGeneratorExpectIDs(t, "user1"),
-				userPasswordHasher:          mockPasswordHasher("x"),
-				codeAlg:                     crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
-				newCode:                     mockEncryptedCode("userinit", time.Hour),
-				defaultEmailCodeURLTemplate: func(_ context.Context) string { return "" },
+				idGenerator:        id_mock.NewIDGeneratorExpectIDs(t, "user1"),
+				userPasswordHasher: mockPasswordHasher("x"),
+				codeAlg:            crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				newCode:            mockEncryptedCode("userinit", time.Hour),
+				loginPaths:         expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -600,7 +609,7 @@ func TestCommandSide_AddHuman(t *testing.T) {
 					),
 					expectPush(
 						newAddHumanEvent("$plain$x$password", false, true, "", AllowedLanguage),
-						user.NewHumanEmailCodeAddedEventV2(context.Background(),
+						user.NewHumanEmailCodeAddedEvent(context.Background(),
 							&user.NewAggregate("user1", "org1").Aggregate,
 							&crypto.CryptoValue{
 								CryptoType: crypto.TypeEncryption,
@@ -619,6 +628,7 @@ func TestCommandSide_AddHuman(t *testing.T) {
 				userPasswordHasher: mockPasswordHasher("x"),
 				codeAlg:            crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
 				newCode:            mockEncryptedCode("emailCode", time.Hour),
+				loginPaths:         expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -674,7 +684,7 @@ func TestCommandSide_AddHuman(t *testing.T) {
 					),
 					expectPush(
 						newAddHumanEvent("$plain$x$password", false, true, "", AllowedLanguage),
-						user.NewHumanEmailCodeAddedEventV2(context.Background(),
+						user.NewHumanEmailCodeAddedEvent(context.Background(),
 							&user.NewAggregate("user1", "org1").Aggregate,
 							&crypto.CryptoValue{
 								CryptoType: crypto.TypeEncryption,
@@ -689,11 +699,11 @@ func TestCommandSide_AddHuman(t *testing.T) {
 						),
 					),
 				),
-				idGenerator:                 id_mock.NewIDGeneratorExpectIDs(t, "user1"),
-				userPasswordHasher:          mockPasswordHasher("x"),
-				codeAlg:                     crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
-				newCode:                     mockEncryptedCode("emailCode", time.Hour),
-				defaultEmailCodeURLTemplate: func(_ context.Context) string { return "http://example.com/{{.user}}/email/{{.code}}" },
+				idGenerator:        id_mock.NewIDGeneratorExpectIDs(t, "user1"),
+				userPasswordHasher: mockPasswordHasher("x"),
+				codeAlg:            crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				newCode:            mockEncryptedCode("emailCode", time.Hour),
+				loginPaths:         expectLoginPathsDefaultEmailCodeURLTemplate("http://example.com/{{.user}}/email/{{.code}}"),
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -755,6 +765,7 @@ func TestCommandSide_AddHuman(t *testing.T) {
 				idGenerator:        id_mock.NewIDGeneratorExpectIDs(t, "user1"),
 				userPasswordHasher: mockPasswordHasher("x"),
 				codeAlg:            crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				loginPaths:         expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -819,6 +830,7 @@ func TestCommandSide_AddHuman(t *testing.T) {
 				idGenerator:        id_mock.NewIDGeneratorExpectIDs(t, "user1"),
 				userPasswordHasher: mockPasswordHasher("x"),
 				codeAlg:            crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				loginPaths:         expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -883,6 +895,7 @@ func TestCommandSide_AddHuman(t *testing.T) {
 				idGenerator:        id_mock.NewIDGeneratorExpectIDs(t, "user1"),
 				userPasswordHasher: mockPasswordHasher("x"),
 				codeAlg:            crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				loginPaths:         expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -947,6 +960,7 @@ func TestCommandSide_AddHuman(t *testing.T) {
 				idGenerator:        id_mock.NewIDGeneratorExpectIDs(t, "user1"),
 				userPasswordHasher: mockPasswordHasher("x"),
 				codeAlg:            crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				loginPaths:         expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -1000,6 +1014,7 @@ func TestCommandSide_AddHuman(t *testing.T) {
 				idGenerator:        id_mock.NewIDGeneratorExpectIDs(t, "user1"),
 				userPasswordHasher: mockPasswordHasher("x"),
 				codeAlg:            crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				loginPaths:         expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -1086,6 +1101,7 @@ func TestCommandSide_AddHuman(t *testing.T) {
 				idGenerator:        id_mock.NewIDGeneratorExpectIDs(t, "user1"),
 				userPasswordHasher: mockPasswordHasher("x"),
 				codeAlg:            crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
+				loginPaths:         expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -1195,6 +1211,7 @@ func TestCommandSide_AddHuman(t *testing.T) {
 				codeAlg:                     crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
 				newEncryptedCodeWithDefault: mockEncryptedCodeWithDefault("phonecode", time.Hour),
 				defaultSecretGenerators:     defaultGenerators,
+				loginPaths:                  expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -1262,6 +1279,7 @@ func TestCommandSide_AddHuman(t *testing.T) {
 				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "user1"),
 				codeAlg:     crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
 				newCode:     mockEncryptedCode("userinit", time.Hour),
+				loginPaths:  expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -1371,6 +1389,7 @@ func TestCommandSide_AddHuman(t *testing.T) {
 				codeAlg:                     crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
 				newEncryptedCodeWithDefault: mockEncryptedCodeWithDefault("phoneCode", time.Hour),
 				defaultSecretGenerators:     defaultGenerators,
+				loginPaths:                  expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -1441,6 +1460,7 @@ func TestCommandSide_AddHuman(t *testing.T) {
 				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "user1"),
 				codeAlg:     crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
 				newCode:     mockEncryptedCode("userinit", time.Hour),
+				loginPaths:  expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -1481,7 +1501,7 @@ func TestCommandSide_AddHuman(t *testing.T) {
 				newEncryptedCode:            tt.fields.newCode,
 				newEncryptedCodeWithDefault: tt.fields.newEncryptedCodeWithDefault,
 				defaultSecretGenerators:     tt.fields.defaultSecretGenerators,
-				defaultEmailCodeURLTemplate: tt.fields.defaultEmailCodeURLTemplate,
+				loginPaths:                  tt.fields.loginPaths(t),
 			}
 			err := r.AddHuman(tt.args.ctx, tt.args.orgID, tt.args.human, tt.args.allowInitMail)
 			if tt.res.err == nil {

internal/command/user_v2_email.go

@@ -156,7 +156,7 @@ func (c *Commands) changeUserEmailWithGeneratorEvents(ctx context.Context, userI
 	}
 
 	if urlTmpl == "" {
-		urlTmpl = c.defaultEmailCodeURLTemplate(ctx)
+		urlTmpl = c.loginPaths.DefaultEmailCodeURLTemplate(ctx)
 	}
 
 	if err = cmd.AddGeneratedCode(ctx, gen, urlTmpl, returnCode); err != nil {
@@ -178,7 +178,7 @@ func (c *Commands) sendUserEmailCodeWithGeneratorEvents(ctx context.Context, use
 	}
 
 	if urlTmpl == "" {
-		urlTmpl = c.defaultEmailCodeURLTemplate(ctx)
+		urlTmpl = c.loginPaths.DefaultEmailCodeURLTemplate(ctx)
 	}
 
 	if err = cmd.AddGeneratedCode(ctx, gen, urlTmpl, returnCode); err != nil {
@@ -286,7 +286,7 @@ func generateCodeCommand(ctx context.Context, agg *eventstore.Aggregate, gen cry
 		return nil, "", err
 	}
 
-	cmd := user.NewHumanEmailCodeAddedEventV2(ctx, agg, value, gen.Expiry(), urlTmpl, returnCode, "")
+	cmd := user.NewHumanEmailCodeAddedEvent(ctx, agg, value, gen.Expiry(), urlTmpl, returnCode, "")
 	if returnCode {
 		return cmd, plain, nil
 	}

internal/command/user_v2_email_test.go

@@ -439,7 +439,7 @@ func TestCommands_ResendUserEmailCode(t *testing.T) {
 							),
 						),
 						eventFromEventPusher(
-							user.NewHumanEmailCodeAddedEventV2(context.Background(),
+							user.NewHumanEmailCodeAddedEvent(context.Background(),
 								&user.NewAggregate("user1", "org1").Aggregate,
 								&crypto.CryptoValue{
 									CryptoType: crypto.TypeEncryption,
@@ -556,7 +556,7 @@ func TestCommands_SendUserEmailCode(t *testing.T) {
 							),
 						),
 						eventFromEventPusher(
-							user.NewHumanEmailCodeAddedEventV2(context.Background(),
+							user.NewHumanEmailCodeAddedEvent(context.Background(),
 								&user.NewAggregate("user1", "org1").Aggregate,
 								&crypto.CryptoValue{
 									CryptoType: crypto.TypeEncryption,
@@ -647,7 +647,7 @@ func TestCommands_ResendUserEmailCodeURLTemplate(t *testing.T) {
 							),
 						),
 						eventFromEventPusher(
-							user.NewHumanEmailCodeAddedEventV2(context.Background(),
+							user.NewHumanEmailCodeAddedEvent(context.Background(),
 								&user.NewAggregate("user1", "org1").Aggregate,
 								&crypto.CryptoValue{
 									CryptoType: crypto.TypeEncryption,
@@ -778,7 +778,7 @@ func TestCommands_SendUserEmailCodeURLTemplate(t *testing.T) {
 							),
 						),
 						eventFromEventPusher(
-							user.NewHumanEmailCodeAddedEventV2(context.Background(),
+							user.NewHumanEmailCodeAddedEvent(context.Background(),
 								&user.NewAggregate("user1", "org1").Aggregate,
 								&crypto.CryptoValue{
 									CryptoType: crypto.TypeEncryption,
@@ -858,7 +858,7 @@ func TestCommands_ResendUserEmailReturnCode(t *testing.T) {
 							),
 						),
 						eventFromEventPusher(
-							user.NewHumanEmailCodeAddedEventV2(context.Background(),
+							user.NewHumanEmailCodeAddedEvent(context.Background(),
 								&user.NewAggregate("user1", "org1").Aggregate,
 								&crypto.CryptoValue{
 									CryptoType: crypto.TypeEncryption,
@@ -975,7 +975,7 @@ func TestCommands_SendUserEmailReturnCode(t *testing.T) {
 							),
 						),
 						eventFromEventPusher(
-							user.NewHumanEmailCodeAddedEventV2(context.Background(),
+							user.NewHumanEmailCodeAddedEvent(context.Background(),
 								&user.NewAggregate("user1", "org1").Aggregate,
 								&crypto.CryptoValue{
 									CryptoType: crypto.TypeEncryption,
@@ -1160,9 +1160,9 @@ func TestCommands_ChangeUserEmailVerified(t *testing.T) {
 
 func TestCommands_changeUserEmailWithGenerator(t *testing.T) {
 	type fields struct {
-		eventstore                  *eventstore.Eventstore
-		checkPermission             domain.PermissionCheck
-		defaultEmailCodeURLTemplate func(ctx context.Context) string
+		eventstore      func(*testing.T) *eventstore.Eventstore
+		checkPermission domain.PermissionCheck
+		loginPaths      func(*testing.T) LoginPaths
 	}
 	type args struct {
 		userID     string
@@ -1180,7 +1180,8 @@ func TestCommands_changeUserEmailWithGenerator(t *testing.T) {
 		{
 			name: "missing user",
 			fields: fields{
-				eventstore: eventstoreExpect(t),
+				eventstore: expectEventstore(),
+				loginPaths: expectLoginPathsNoCall,
 			},
 			args: args{
 				userID:     "",
@@ -1193,8 +1194,7 @@ func TestCommands_changeUserEmailWithGenerator(t *testing.T) {
 		{
 			name: "missing permission",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -1213,6 +1213,7 @@ func TestCommands_changeUserEmailWithGenerator(t *testing.T) {
 					),
 				),
 				checkPermission: newMockPermissionCheckNotAllowed(),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				userID:     "user1",
@@ -1225,8 +1226,7 @@ func TestCommands_changeUserEmailWithGenerator(t *testing.T) {
 		{
 			name: "missing email",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -1245,6 +1245,7 @@ func TestCommands_changeUserEmailWithGenerator(t *testing.T) {
 					),
 				),
 				checkPermission: newMockPermissionCheckAllowed(),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				userID:     "user1",
@@ -1257,8 +1258,7 @@ func TestCommands_changeUserEmailWithGenerator(t *testing.T) {
 		{
 			name: "not changed",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -1277,6 +1277,7 @@ func TestCommands_changeUserEmailWithGenerator(t *testing.T) {
 					),
 				),
 				checkPermission: newMockPermissionCheckAllowed(),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				userID:     "user1",
@@ -1289,8 +1290,7 @@ func TestCommands_changeUserEmailWithGenerator(t *testing.T) {
 		{
 			name: "email changed",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -1312,7 +1312,7 @@ func TestCommands_changeUserEmailWithGenerator(t *testing.T) {
 							&user.NewAggregate("user1", "org1").Aggregate,
 							"[email protected]",
 						),
-						user.NewHumanEmailCodeAddedEventV2(context.Background(),
+						user.NewHumanEmailCodeAddedEvent(context.Background(),
 							&user.NewAggregate("user1", "org1").Aggregate,
 							&crypto.CryptoValue{
 								CryptoType: crypto.TypeEncryption,
@@ -1326,8 +1326,8 @@ func TestCommands_changeUserEmailWithGenerator(t *testing.T) {
 						),
 					),
 				),
-				checkPermission:             newMockPermissionCheckAllowed(),
-				defaultEmailCodeURLTemplate: func(ctx context.Context) string { return "http://example.com/{{.user}}/email/{{.code}}" },
+				checkPermission: newMockPermissionCheckAllowed(),
+				loginPaths:      expectLoginPathsDefaultEmailCodeURLTemplate("http://example.com/{{.user}}/email/{{.code}}"),
 			},
 			args: args{
 				userID:     "user1",
@@ -1347,8 +1347,7 @@ func TestCommands_changeUserEmailWithGenerator(t *testing.T) {
 		{
 			name: "email changed, return code",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -1370,7 +1369,7 @@ func TestCommands_changeUserEmailWithGenerator(t *testing.T) {
 							&user.NewAggregate("user1", "org1").Aggregate,
 							"[email protected]",
 						),
-						user.NewHumanEmailCodeAddedEventV2(context.Background(),
+						user.NewHumanEmailCodeAddedEvent(context.Background(),
 							&user.NewAggregate("user1", "org1").Aggregate,
 							&crypto.CryptoValue{
 								CryptoType: crypto.TypeEncryption,
@@ -1383,8 +1382,8 @@ func TestCommands_changeUserEmailWithGenerator(t *testing.T) {
 						),
 					),
 				),
-				checkPermission:             newMockPermissionCheckAllowed(),
-				defaultEmailCodeURLTemplate: func(ctx context.Context) string { return "http://example.com/{{.user}}/email/{{.code2}}" },
+				checkPermission: newMockPermissionCheckAllowed(),
+				loginPaths:      expectLoginPathsDefaultEmailCodeURLTemplate("http://example.com/{{.user}}/email/{{.code2}}"),
 			},
 			args: args{
 				userID:     "user1",
@@ -1405,8 +1404,7 @@ func TestCommands_changeUserEmailWithGenerator(t *testing.T) {
 		{
 			name: "email changed, URL template",
 			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
+				eventstore: expectEventstore(
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -1428,7 +1426,7 @@ func TestCommands_changeUserEmailWithGenerator(t *testing.T) {
 							&user.NewAggregate("user1", "org1").Aggregate,
 							"[email protected]",
 						),
-						user.NewHumanEmailCodeAddedEventV2(context.Background(),
+						user.NewHumanEmailCodeAddedEvent(context.Background(),
 							&user.NewAggregate("user1", "org1").Aggregate,
 							&crypto.CryptoValue{
 								CryptoType: crypto.TypeEncryption,
@@ -1442,6 +1440,7 @@ func TestCommands_changeUserEmailWithGenerator(t *testing.T) {
 					),
 				),
 				checkPermission: newMockPermissionCheckAllowed(),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				userID:     "user1",
@@ -1462,9 +1461,9 @@ func TestCommands_changeUserEmailWithGenerator(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			c := &Commands{
-				eventstore:                  tt.fields.eventstore,
-				checkPermission:             tt.fields.checkPermission,
-				defaultEmailCodeURLTemplate: tt.fields.defaultEmailCodeURLTemplate,
+				eventstore:      tt.fields.eventstore(t),
+				checkPermission: tt.fields.checkPermission,
+				loginPaths:      tt.fields.loginPaths(t),
 			}
 			got, err := c.changeUserEmailWithGenerator(context.Background(), tt.args.userID, tt.args.email, GetMockSecretGenerator(t), tt.args.returnCode, tt.args.urlTmpl)
 			require.ErrorIs(t, tt.wantErr, err)
@@ -1475,9 +1474,9 @@ func TestCommands_changeUserEmailWithGenerator(t *testing.T) {
 
 func TestCommands_sendUserEmailCodeWithGeneratorEvents(t *testing.T) {
 	type fields struct {
-		eventstore                  *eventstore.Eventstore
-		checkPermission             domain.PermissionCheck
-		defaultEmailCodeURLTemplate func(ctx context.Context) string
+		eventstore      *eventstore.Eventstore
+		checkPermission domain.PermissionCheck
+		loginPaths      func(*testing.T) LoginPaths
 	}
 	type args struct {
 		userID        string
@@ -1496,6 +1495,7 @@ func TestCommands_sendUserEmailCodeWithGeneratorEvents(t *testing.T) {
 			name: "missing user",
 			fields: fields{
 				eventstore: eventstoreExpect(t),
+				loginPaths: expectLoginPathsNoCall,
 			},
 			args: args{
 				userID:     "",
@@ -1525,7 +1525,7 @@ func TestCommands_sendUserEmailCodeWithGeneratorEvents(t *testing.T) {
 							),
 						),
 						eventFromEventPusher(
-							user.NewHumanEmailCodeAddedEventV2(context.Background(),
+							user.NewHumanEmailCodeAddedEvent(context.Background(),
 								&user.NewAggregate("user1", "org1").Aggregate,
 								&crypto.CryptoValue{
 									CryptoType: crypto.TypeEncryption,
@@ -1540,6 +1540,7 @@ func TestCommands_sendUserEmailCodeWithGeneratorEvents(t *testing.T) {
 					),
 				),
 				checkPermission: newMockPermissionCheckNotAllowed(),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				userID:     "user1",
@@ -1570,7 +1571,7 @@ func TestCommands_sendUserEmailCodeWithGeneratorEvents(t *testing.T) {
 						),
 					),
 					expectPush(
-						user.NewHumanEmailCodeAddedEventV2(context.Background(),
+						user.NewHumanEmailCodeAddedEvent(context.Background(),
 							&user.NewAggregate("user1", "org1").Aggregate,
 							&crypto.CryptoValue{
 								CryptoType: crypto.TypeEncryption,
@@ -1583,8 +1584,8 @@ func TestCommands_sendUserEmailCodeWithGeneratorEvents(t *testing.T) {
 						),
 					),
 				),
-				checkPermission:             newMockPermissionCheckAllowed(),
-				defaultEmailCodeURLTemplate: func(ctx context.Context) string { return "http://example.com/{{.user}}/email/{{.code}}" },
+				checkPermission: newMockPermissionCheckAllowed(),
+				loginPaths:      expectLoginPathsDefaultEmailCodeURLTemplate("http://example.com/{{.user}}/email/{{.code}}"),
 			},
 			args: args{
 				userID:        "user1",
@@ -1622,7 +1623,7 @@ func TestCommands_sendUserEmailCodeWithGeneratorEvents(t *testing.T) {
 							),
 						),
 						eventFromEventPusher(
-							user.NewHumanEmailCodeAddedEventV2(context.Background(),
+							user.NewHumanEmailCodeAddedEvent(context.Background(),
 								&user.NewAggregate("user1", "org1").Aggregate,
 								&crypto.CryptoValue{
 									CryptoType: crypto.TypeEncryption,
@@ -1636,7 +1637,7 @@ func TestCommands_sendUserEmailCodeWithGeneratorEvents(t *testing.T) {
 						),
 					),
 					expectPush(
-						user.NewHumanEmailCodeAddedEventV2(context.Background(),
+						user.NewHumanEmailCodeAddedEvent(context.Background(),
 							&user.NewAggregate("user1", "org1").Aggregate,
 							&crypto.CryptoValue{
 								CryptoType: crypto.TypeEncryption,
@@ -1649,8 +1650,8 @@ func TestCommands_sendUserEmailCodeWithGeneratorEvents(t *testing.T) {
 						),
 					),
 				),
-				checkPermission:             newMockPermissionCheckAllowed(),
-				defaultEmailCodeURLTemplate: func(ctx context.Context) string { return "http://example.com/{{.user}}/email/{{.code2}}" },
+				checkPermission: newMockPermissionCheckAllowed(),
+				loginPaths:      expectLoginPathsDefaultEmailCodeURLTemplate("http://example.com/{{.user}}/email/{{.code2}}"),
 			},
 			args: args{
 				userID:        "user1",
@@ -1690,6 +1691,7 @@ func TestCommands_sendUserEmailCodeWithGeneratorEvents(t *testing.T) {
 					),
 				),
 				checkPermission: newMockPermissionCheckAllowed(),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				userID:        "user1",
@@ -1721,7 +1723,7 @@ func TestCommands_sendUserEmailCodeWithGeneratorEvents(t *testing.T) {
 						),
 					),
 					expectPush(
-						user.NewHumanEmailCodeAddedEventV2(context.Background(),
+						user.NewHumanEmailCodeAddedEvent(context.Background(),
 							&user.NewAggregate("user1", "org1").Aggregate,
 							&crypto.CryptoValue{
 								CryptoType: crypto.TypeEncryption,
@@ -1734,8 +1736,8 @@ func TestCommands_sendUserEmailCodeWithGeneratorEvents(t *testing.T) {
 						),
 					),
 				),
-				checkPermission:             newMockPermissionCheckAllowed(),
-				defaultEmailCodeURLTemplate: func(ctx context.Context) string { return "http://example.com/{{.user}}/email/{{.code}}" },
+				checkPermission: newMockPermissionCheckAllowed(),
+				loginPaths:      expectLoginPathsDefaultEmailCodeURLTemplate("http://example.com/{{.user}}/email/{{.code}}"),
 			},
 			args: args{
 				userID:        "user1",
@@ -1775,7 +1777,7 @@ func TestCommands_sendUserEmailCodeWithGeneratorEvents(t *testing.T) {
 						),
 					),
 					expectPush(
-						user.NewHumanEmailCodeAddedEventV2(context.Background(),
+						user.NewHumanEmailCodeAddedEvent(context.Background(),
 							&user.NewAggregate("user1", "org1").Aggregate,
 							&crypto.CryptoValue{
 								CryptoType: crypto.TypeEncryption,
@@ -1789,6 +1791,7 @@ func TestCommands_sendUserEmailCodeWithGeneratorEvents(t *testing.T) {
 					),
 				),
 				checkPermission: newMockPermissionCheckAllowed(),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				userID:        "user1",
@@ -1809,9 +1812,9 @@ func TestCommands_sendUserEmailCodeWithGeneratorEvents(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			c := &Commands{
-				eventstore:                  tt.fields.eventstore,
-				checkPermission:             tt.fields.checkPermission,
-				defaultEmailCodeURLTemplate: tt.fields.defaultEmailCodeURLTemplate,
+				eventstore:      tt.fields.eventstore,
+				checkPermission: tt.fields.checkPermission,
+				loginPaths:      tt.fields.loginPaths(t),
 			}
 			got, err := c.sendUserEmailCodeWithGenerator(context.Background(), tt.args.userID, GetMockSecretGenerator(t), tt.args.returnCode, tt.args.urlTmpl, tt.args.checkExisting)
 			require.ErrorIs(t, err, tt.wantErr)
@@ -1924,7 +1927,7 @@ func TestCommands_VerifyUserEmail(t *testing.T) {
 							),
 						),
 						eventFromEventPusher(
-							user.NewHumanEmailCodeAddedEventV2(context.Background(),
+							user.NewHumanEmailCodeAddedEvent(context.Background(),
 								&user.NewAggregate("user1", "org1").Aggregate,
 								&crypto.CryptoValue{
 									CryptoType: crypto.TypeEncryption,
@@ -2039,7 +2042,7 @@ func TestCommands_verifyUserEmailWithGenerator(t *testing.T) {
 							),
 						),
 						eventFromEventPusher(
-							user.NewHumanEmailCodeAddedEventV2(context.Background(),
+							user.NewHumanEmailCodeAddedEvent(context.Background(),
 								&user.NewAggregate("user1", "org1").Aggregate,
 								&crypto.CryptoValue{
 									CryptoType: crypto.TypeEncryption,
@@ -2086,7 +2089,7 @@ func TestCommands_verifyUserEmailWithGenerator(t *testing.T) {
 							),
 						),
 						eventFromEventPusherWithCreationDateNow(
-							user.NewHumanEmailCodeAddedEventV2(context.Background(),
+							user.NewHumanEmailCodeAddedEvent(context.Background(),
 								&user.NewAggregate("user1", "org1").Aggregate,
 								&crypto.CryptoValue{
 									CryptoType: crypto.TypeEncryption,

internal/command/user_v2_human.go

@@ -413,10 +413,10 @@ func (c *Commands) changeUserEmail(ctx context.Context, cmds []eventstore.Comman
 				return cmds, code, err
 			}
 			if email.URLTemplate == "" {
-				email.URLTemplate = c.defaultEmailCodeURLTemplate(ctx)
+				email.URLTemplate = c.loginPaths.DefaultEmailCodeURLTemplate(ctx)
 			}
 
-			cmds = append(cmds, user.NewHumanEmailCodeAddedEventV2(ctx, &wm.Aggregate().Aggregate, cryptoCode.Crypted, cryptoCode.Expiry, email.URLTemplate, email.ReturnCode, ""))
+			cmds = append(cmds, user.NewHumanEmailCodeAddedEvent(ctx, &wm.Aggregate().Aggregate, cryptoCode.Crypted, cryptoCode.Expiry, email.URLTemplate, email.ReturnCode, ""))
 			if email.ReturnCode {
 				code = &cryptoCode.Plain
 			}

internal/command/user_v2_human_test.go

@@ -43,7 +43,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 		newEncryptedCodeWithDefault encryptedCodeWithDefaultFunc
 		checkPermission             domain.PermissionCheck
 		defaultSecretGenerators     *SecretGenerators
-		defaultEmailCodeURLTemplate func(ctx context.Context) string
+		loginPaths                  func(*testing.T) LoginPaths
 	}
 	type args struct {
 		ctx             context.Context
@@ -79,6 +79,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 			fields: fields{
 				eventstore:      expectEventstore(),
 				checkPermission: newMockPermissionCheckAllowed(),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -104,6 +105,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 			fields: fields{
 				eventstore:      expectEventstore(),
 				checkPermission: newMockPermissionCheckAllowed(),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -131,6 +133,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 					),
 				),
 				checkPermission: newMockPermissionCheckAllowed(),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -163,6 +166,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 					expectFilter(),
 				),
 				checkPermission: newMockPermissionCheckAllowed(),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -205,6 +209,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 					expectFilter(),
 				),
 				checkPermission: newMockPermissionCheckAllowed(),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -274,6 +279,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 				checkPermission: newMockPermissionCheckAllowed(),
 				idGenerator:     id_mock.NewIDGeneratorExpectIDs(t, "user1"),
 				newCode:         mockEncryptedCode("userinit", time.Hour),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -310,6 +316,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 				checkPermission: newMockPermissionCheckNotAllowed(),
 				idGenerator:     id_mock.NewIDGeneratorExpectIDs(t, "user1"),
 				newCode:         mockEncryptedCode("userinit", time.Hour),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -376,6 +383,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 				checkPermission: newMockPermissionCheckAllowed(),
 				idGenerator:     id_mock.NewIDGeneratorExpectIDs(t, "user1"),
 				newCode:         mockEncryptedCode("userinit", time.Hour),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -449,6 +457,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 				idGenerator:        id_mock.NewIDGeneratorExpectIDs(t, "user1"),
 				userPasswordHasher: mockPasswordHasher("x"),
 				newCode:            mockEncryptedCode("userinit", time.Hour),
+				loginPaths:         expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -492,7 +501,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 					expectFilterOrganizationSettings("org1", false, false),
 					expectPush(
 						newAddHumanEvent("", false, true, "", language.English),
-						user.NewHumanEmailCodeAddedEventV2(context.Background(),
+						user.NewHumanEmailCodeAddedEvent(context.Background(),
 							&user.NewAggregate("user1", "org1").Aggregate,
 							&crypto.CryptoValue{
 								CryptoType: crypto.TypeEncryption,
@@ -507,10 +516,10 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 						),
 					),
 				),
-				checkPermission:             newMockPermissionCheckAllowed(),
-				idGenerator:                 id_mock.NewIDGeneratorExpectIDs(t, "user1"),
-				newCode:                     mockEncryptedCode("emailverify", time.Hour),
-				defaultEmailCodeURLTemplate: func(ctx context.Context) string { return "http://example.com/{{.user}}/email/{{.code}}" },
+				checkPermission: newMockPermissionCheckAllowed(),
+				idGenerator:     id_mock.NewIDGeneratorExpectIDs(t, "user1"),
+				newCode:         mockEncryptedCode("emailverify", time.Hour),
+				loginPaths:      expectLoginPathsDefaultEmailCodeURLTemplate("http://example.com/{{.user}}/email/{{.code}}"),
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -565,7 +574,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 					),
 					expectPush(
 						newAddHumanEvent("$plain$x$password", false, true, "", language.English),
-						user.NewHumanEmailCodeAddedEventV2(context.Background(),
+						user.NewHumanEmailCodeAddedEvent(context.Background(),
 							&user.NewAggregate("user1", "org1").Aggregate,
 							&crypto.CryptoValue{
 								CryptoType: crypto.TypeEncryption,
@@ -584,6 +593,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 				idGenerator:        id_mock.NewIDGeneratorExpectIDs(t, "user1"),
 				userPasswordHasher: mockPasswordHasher("x"),
 				newCode:            mockEncryptedCode("emailCode", time.Hour),
+				loginPaths:         expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -640,7 +650,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 					),
 					expectPush(
 						newAddHumanEvent("$plain$x$password", false, true, "", language.English),
-						user.NewHumanEmailCodeAddedEventV2(context.Background(),
+						user.NewHumanEmailCodeAddedEvent(context.Background(),
 							&user.NewAggregate("user1", "org1").Aggregate,
 							&crypto.CryptoValue{
 								CryptoType: crypto.TypeEncryption,
@@ -655,11 +665,11 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 						),
 					),
 				),
-				checkPermission:             newMockPermissionCheckAllowed(),
-				idGenerator:                 id_mock.NewIDGeneratorExpectIDs(t, "user1"),
-				userPasswordHasher:          mockPasswordHasher("x"),
-				newCode:                     mockEncryptedCode("emailCode", time.Hour),
-				defaultEmailCodeURLTemplate: func(ctx context.Context) string { return "http://example.com/{{.user}}/email/{{.code}}" },
+				checkPermission:    newMockPermissionCheckAllowed(),
+				idGenerator:        id_mock.NewIDGeneratorExpectIDs(t, "user1"),
+				userPasswordHasher: mockPasswordHasher("x"),
+				newCode:            mockEncryptedCode("emailCode", time.Hour),
+				loginPaths:         expectLoginPathsDefaultEmailCodeURLTemplate("http://example.com/{{.user}}/email/{{.code}}"),
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -725,6 +735,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 				checkPermission:    newMockPermissionCheckAllowed(),
 				idGenerator:        id_mock.NewIDGeneratorExpectIDs(t, "user1"),
 				userPasswordHasher: mockPasswordHasher("x"),
+				loginPaths:         expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -790,6 +801,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 				checkPermission:    newMockPermissionCheckAllowed(),
 				idGenerator:        id_mock.NewIDGeneratorExpectIDs(t, "user1"),
 				userPasswordHasher: mockPasswordHasher("x"),
+				loginPaths:         expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -855,6 +867,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 				checkPermission:    newMockPermissionCheckAllowed(),
 				idGenerator:        id_mock.NewIDGeneratorExpectIDs(t, "user1"),
 				userPasswordHasher: mockPasswordHasher("x"),
+				loginPaths:         expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -909,6 +922,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 				checkPermission:    newMockPermissionCheckAllowed(),
 				idGenerator:        id_mock.NewIDGeneratorExpectIDs(t, "user1"),
 				userPasswordHasher: mockPasswordHasher("x"),
+				loginPaths:         expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -996,6 +1010,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 				checkPermission:    newMockPermissionCheckAllowed(),
 				idGenerator:        id_mock.NewIDGeneratorExpectIDs(t, "user1"),
 				userPasswordHasher: mockPasswordHasher("x"),
+				loginPaths:         expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -1106,6 +1121,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 				userPasswordHasher:          mockPasswordHasher("x"),
 				newEncryptedCodeWithDefault: mockEncryptedCodeWithDefault("phonecode", time.Hour),
 				defaultSecretGenerators:     defaultGenerators,
+				loginPaths:                  expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -1212,6 +1228,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 				userPasswordHasher:          mockPasswordHasher("x"),
 				newEncryptedCodeWithDefault: mockEncryptedCodeWithDefault("phonecode", time.Hour),
 				defaultSecretGenerators:     defaultGenerators,
+				loginPaths:                  expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -1280,6 +1297,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 				checkPermission: newMockPermissionCheckAllowed(),
 				idGenerator:     id_mock.NewIDGeneratorExpectIDs(t, "user1"),
 				newCode:         mockEncryptedCode("userinit", time.Hour),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -1390,6 +1408,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 				userPasswordHasher:          mockPasswordHasher("x"),
 				newEncryptedCodeWithDefault: mockEncryptedCodeWithDefault("phoneCode", time.Hour),
 				defaultSecretGenerators:     defaultGenerators,
+				loginPaths:                  expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -1461,6 +1480,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 				checkPermission: newMockPermissionCheckAllowed(),
 				idGenerator:     id_mock.NewIDGeneratorExpectIDs(t, "user1"),
 				newCode:         mockEncryptedCode("userinit", time.Hour),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -1522,7 +1542,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 					),
 					expectPush(
 						newRegisterHumanEvent("[email protected]", "", false, true, "", language.English),
-						user.NewHumanEmailCodeAddedEventV2(
+						user.NewHumanEmailCodeAddedEvent(
 							context.Background(),
 							&userAgg.Aggregate,
 							&crypto.CryptoValue{
@@ -1545,10 +1565,10 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 						),
 					),
 				),
-				checkPermission:             newMockPermissionCheckAllowed(),
-				idGenerator:                 id_mock.NewIDGeneratorExpectIDs(t, "user1"),
-				newCode:                     mockEncryptedCode("mailVerify", time.Hour),
-				defaultEmailCodeURLTemplate: func(ctx context.Context) string { return "http://example.com/{{.user}}/email/{{.code}}" },
+				checkPermission: newMockPermissionCheckAllowed(),
+				idGenerator:     id_mock.NewIDGeneratorExpectIDs(t, "user1"),
+				newCode:         mockEncryptedCode("mailVerify", time.Hour),
+				loginPaths:      expectLoginPathsDefaultEmailCodeURLTemplate("http://example.com/{{.user}}/email/{{.code}}"),
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -1629,6 +1649,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 				checkPermission: newMockPermissionCheckAllowed(),
 				idGenerator:     id_mock.NewIDGeneratorExpectIDs(t, "user1"),
 				newCode:         mockEncryptedCode("mailVerify", time.Hour),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -1717,6 +1738,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 				checkPermission: newMockPermissionCheckAllowed(),
 				idGenerator:     id_mock.NewIDGeneratorExpectIDs(t, "user1"),
 				newCode:         mockEncryptedCode("userinit", time.Hour),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -1801,6 +1823,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 				checkPermission: newMockPermissionCheckAllowed(),
 				idGenerator:     id_mock.NewIDGeneratorExpectIDs(t, "user1"),
 				newCode:         mockEncryptedCode("userinit", time.Hour),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -1858,6 +1881,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 				checkPermission: newMockPermissionCheckAllowed(),
 				idGenerator:     id_mock.NewIDGeneratorExpectIDs(t, "user1"),
 				newCode:         mockEncryptedCode("userinit", time.Hour),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -1938,6 +1962,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 				checkPermission: newMockPermissionCheckAllowed(),
 				idGenerator:     id_mock.NewIDGeneratorExpectIDs(t, "user1"),
 				newCode:         mockEncryptedCode("userinit", time.Hour),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -2028,6 +2053,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 				checkPermission: newMockPermissionCheckAllowed(),
 				idGenerator:     id_mock.NewIDGeneratorExpectIDs(t, "user1"),
 				newCode:         mockEncryptedCode("userinit", time.Hour),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -2122,6 +2148,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 				checkPermission: newMockPermissionCheckAllowed(),
 				idGenerator:     id_mock.NewIDGeneratorExpectIDs(t, "user1"),
 				newCode:         mockEncryptedCode("userinit", time.Hour),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -2168,7 +2195,7 @@ func TestCommandSide_AddUserHuman(t *testing.T) {
 						CryptoMFA: cryptoAlg,
 					},
 				},
-				defaultEmailCodeURLTemplate: tt.fields.defaultEmailCodeURLTemplate,
+				loginPaths: tt.fields.loginPaths(t),
 			}
 			err := r.AddUserHuman(tt.args.ctx, tt.args.orgID, tt.args.human, tt.args.allowInitMail, tt.args.codeAlg)
 			if tt.res.err == nil {
@@ -2206,7 +2233,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 		newEncryptedCodeWithDefault encryptedCodeWithDefaultFunc
 		checkPermission             domain.PermissionCheck
 		defaultSecretGenerators     *SecretGenerators
-		defaultEmailCodeURLTemplate func(ctx context.Context) string
+		loginPaths                  func(*testing.T) LoginPaths
 		tarpit                      Tarpit
 	}
 	type args struct {
@@ -2245,6 +2272,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 				),
 				checkPermission: newMockPermissionCheckAllowed(),
 				tarpit:          expectTarpit(0),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -2271,6 +2299,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 				),
 				checkPermission: newMockPermissionCheckNotAllowed(),
 				tarpit:          expectTarpit(0),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -2293,6 +2322,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 				),
 				checkPermission: newMockPermissionCheckAllowed(),
 				tarpit:          expectTarpit(0),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -2339,6 +2369,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 				),
 				checkPermission: newMockPermissionCheckAllowed(),
 				tarpit:          expectTarpit(0),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -2387,6 +2418,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 				),
 				checkPermission: newMockPermissionCheckAllowed(),
 				tarpit:          expectTarpit(0),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -2415,6 +2447,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 				),
 				checkPermission: newMockPermissionCheckAllowed(),
 				tarpit:          expectTarpit(0),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -2443,6 +2476,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 				),
 				checkPermission: newMockPermissionCheckNotAllowed(),
 				tarpit:          expectTarpit(0),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -2492,6 +2526,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 				),
 				checkPermission: newMockPermissionCheckAllowed(),
 				tarpit:          expectTarpit(0),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -2527,6 +2562,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 				),
 				checkPermission: newMockPermissionCheckAllowed(),
 				tarpit:          expectTarpit(0),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -2564,7 +2600,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 							&userAgg.Aggregate,
 							"[email protected]",
 						),
-						user.NewHumanEmailCodeAddedEventV2(context.Background(),
+						user.NewHumanEmailCodeAddedEvent(context.Background(),
 							&user.NewAggregate("user1", "org1").Aggregate,
 							&crypto.CryptoValue{
 								CryptoType: crypto.TypeEncryption,
@@ -2579,10 +2615,10 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 						),
 					),
 				),
-				checkPermission:             newMockPermissionCheckAllowed(),
-				newCode:                     mockEncryptedCode("emailCode", time.Hour),
-				defaultEmailCodeURLTemplate: func(ctx context.Context) string { return "http://example.com/{{.user}}/email/{{.code}}" },
-				tarpit:                      expectTarpit(0),
+				checkPermission: newMockPermissionCheckAllowed(),
+				newCode:         mockEncryptedCode("emailCode", time.Hour),
+				loginPaths:      expectLoginPathsDefaultEmailCodeURLTemplate("http://example.com/{{.user}}/email/{{.code}}"),
+				tarpit:          expectTarpit(0),
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -2614,6 +2650,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 				),
 				checkPermission: newMockPermissionCheckAllowed(),
 				tarpit:          expectTarpit(0),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -2644,6 +2681,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 				),
 				checkPermission: newMockPermissionCheckNotAllowed(),
 				tarpit:          expectTarpit(0),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -2682,6 +2720,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 				),
 				checkPermission: newMockPermissionCheckAllowed(),
 				tarpit:          expectTarpit(0),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -2718,6 +2757,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 				),
 				checkPermission: newMockPermissionCheckAllowed(),
 				tarpit:          expectTarpit(0),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -2750,7 +2790,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 							&userAgg.Aggregate,
 							"[email protected]",
 						),
-						user.NewHumanEmailCodeAddedEventV2(context.Background(),
+						user.NewHumanEmailCodeAddedEvent(context.Background(),
 							&user.NewAggregate("user1", "org1").Aggregate,
 							&crypto.CryptoValue{
 								CryptoType: crypto.TypeEncryption,
@@ -2765,10 +2805,10 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 						),
 					),
 				),
-				checkPermission:             newMockPermissionCheckAllowed(),
-				newCode:                     mockEncryptedCode("emailCode", time.Hour),
-				defaultEmailCodeURLTemplate: func(ctx context.Context) string { return "http://example.com/{{.user}}/email/{{.code}}" },
-				tarpit:                      expectTarpit(0),
+				checkPermission: newMockPermissionCheckAllowed(),
+				newCode:         mockEncryptedCode("emailCode", time.Hour),
+				loginPaths:      expectLoginPathsDefaultEmailCodeURLTemplate("http://example.com/{{.user}}/email/{{.code}}"),
+				tarpit:          expectTarpit(0),
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -2852,6 +2892,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 				newEncryptedCodeWithDefault: mockEncryptedCodeWithDefault("phoneCode", time.Hour),
 				defaultSecretGenerators:     defaultGenerators,
 				tarpit:                      expectTarpit(0),
+				loginPaths:                  expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -2928,6 +2969,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 				newEncryptedCodeWithDefault: mockEncryptedCodeWithDefault("phoneCode", time.Hour),
 				defaultSecretGenerators:     defaultGenerators,
 				tarpit:                      expectTarpit(0),
+				loginPaths:                  expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -2959,6 +3001,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 				),
 				checkPermission: newMockPermissionCheckNotAllowed(),
 				tarpit:          expectTarpit(0),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -2997,6 +3040,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 				),
 				checkPermission: newMockPermissionCheckAllowed(),
 				tarpit:          expectTarpit(0),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -3033,6 +3077,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 				),
 				checkPermission: newMockPermissionCheckAllowed(),
 				tarpit:          expectTarpit(0),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -3113,6 +3158,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 				newEncryptedCodeWithDefault: mockEncryptedCodeWithDefault("phoneCode", time.Hour),
 				defaultSecretGenerators:     defaultGenerators,
 				tarpit:                      expectTarpit(0),
+				loginPaths:                  expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -3141,6 +3187,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 				checkPermission:    newMockPermissionCheckAllowed(),
 				userPasswordHasher: mockPasswordHasher("x"),
 				tarpit:             expectTarpit(0),
+				loginPaths:         expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -3175,6 +3222,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 				checkPermission:    newMockPermissionCheckAllowed(),
 				userPasswordHasher: mockPasswordHasher("x"),
 				tarpit:             expectTarpit(0),
+				loginPaths:         expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -3224,6 +3272,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 				checkPermission:    newMockPermissionCheckAllowed(),
 				userPasswordHasher: mockPasswordHasher("x"),
 				tarpit:             expectTarpit(0),
+				loginPaths:         expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -3249,6 +3298,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 				checkPermission:    newMockPermissionCheckAllowed(),
 				userPasswordHasher: mockPasswordHasher("x"),
 				tarpit:             expectTarpit(0),
+				loginPaths:         expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -3284,6 +3334,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 				userPasswordHasher: mockPasswordHasher("x"),
 				checkPermission:    newMockPermissionCheckNotAllowed(),
 				tarpit:             expectTarpit(0),
+				loginPaths:         expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -3339,6 +3390,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 				userPasswordHasher: mockPasswordHasher("x"),
 				checkPermission:    newMockPermissionCheckAllowed(),
 				tarpit:             expectTarpit(0),
+				loginPaths:         expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -3397,6 +3449,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 				checkPermission:    newMockPermissionCheckAllowed(),
 				userPasswordHasher: mockPasswordHasher("x"),
 				tarpit:             expectTarpit(0),
+				loginPaths:         expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -3452,6 +3505,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 				checkPermission:    newMockPermissionCheckAllowed(),
 				userPasswordHasher: mockPasswordHasher("x"),
 				tarpit:             expectTarpit(1),
+				loginPaths:         expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -3524,6 +3578,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 				checkPermission:    newMockPermissionCheckAllowed(),
 				userPasswordHasher: mockPasswordHasher("x"),
 				tarpit:             expectTarpit(0),
+				loginPaths:         expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -3579,6 +3634,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 				checkPermission:    newMockPermissionCheckAllowed(),
 				userPasswordHasher: mockPasswordHasher("x"),
 				tarpit:             expectTarpit(0),
+				loginPaths:         expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -3644,6 +3700,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 				checkPermission:    newMockPermissionCheckAllowed(),
 				userPasswordHasher: mockPasswordHasher("x"),
 				tarpit:             expectTarpit(0),
+				loginPaths:         expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -3703,6 +3760,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 				checkPermission:    newMockPermissionCheckAllowed(),
 				userPasswordHasher: mockPasswordHasher("x"),
 				tarpit:             expectTarpit(0),
+				loginPaths:         expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -3778,6 +3836,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 				checkPermission:    newMockPermissionCheckAllowed(),
 				userPasswordHasher: mockPasswordHasher("x"),
 				tarpit:             expectTarpit(0),
+				loginPaths:         expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:   context.Background(),
@@ -3810,7 +3869,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
 				checkPermission:             tt.fields.checkPermission,
 				defaultSecretGenerators:     tt.fields.defaultSecretGenerators,
 				userEncryption:              tt.args.codeAlg,
-				defaultEmailCodeURLTemplate: tt.fields.defaultEmailCodeURLTemplate,
+				loginPaths:                  tt.fields.loginPaths(t),
 				tarpit:                      tt.fields.tarpit.tarpit,
 			}
 			err := r.ChangeUserHuman(tt.args.ctx, tt.args.human, tt.args.codeAlg)

internal/command/user_v2_model_test.go

@@ -662,7 +662,7 @@ func TestCommandSide_userHumanWriteModel_email(t *testing.T) {
 							newRegisterHumanEvent("username", "$plain$x$password", true, true, "", language.English),
 						),
 						eventFromEventPusher(
-							user.NewHumanEmailCodeAddedEventV2(context.Background(),
+							user.NewHumanEmailCodeAddedEvent(context.Background(),
 								&userAgg.Aggregate,
 								&crypto.CryptoValue{
 									CryptoType: crypto.TypeEncryption,
@@ -724,7 +724,7 @@ func TestCommandSide_userHumanWriteModel_email(t *testing.T) {
 							newRegisterHumanEvent("username", "$plain$x$password", true, true, "", language.English),
 						),
 						eventFromEventPusher(
-							user.NewHumanEmailCodeAddedEventV2(context.Background(),
+							user.NewHumanEmailCodeAddedEvent(context.Background(),
 								&userAgg.Aggregate,
 								&crypto.CryptoValue{
 									CryptoType: crypto.TypeEncryption,
@@ -783,7 +783,7 @@ func TestCommandSide_userHumanWriteModel_email(t *testing.T) {
 							newRegisterHumanEvent("username", "$plain$x$password", true, true, "", language.English),
 						),
 						eventFromEventPusher(
-							user.NewHumanEmailCodeAddedEventV2(context.Background(),
+							user.NewHumanEmailCodeAddedEvent(context.Background(),
 								&userAgg.Aggregate,
 								&crypto.CryptoValue{
 									CryptoType: crypto.TypeEncryption,
@@ -851,7 +851,7 @@ func TestCommandSide_userHumanWriteModel_email(t *testing.T) {
 							newRegisterHumanEvent("username", "$plain$x$password", true, true, "", language.English),
 						),
 						eventFromEventPusher(
-							user.NewHumanEmailCodeAddedEventV2(context.Background(),
+							user.NewHumanEmailCodeAddedEvent(context.Background(),
 								&userAgg.Aggregate,
 								&crypto.CryptoValue{
 									CryptoType: crypto.TypeEncryption,

internal/command/user_v2_passkey.go

@@ -143,6 +143,10 @@ func (c *Commands) addUserPasskeyCode(ctx context.Context, userID, resourceOwner
 	}
 	agg := UserAggregateFromWriteModel(&wm.WriteModel)
 
+	if urlTmpl == "" {
+		urlTmpl = c.loginPaths.DefaultPasskeySetURLTemplate(ctx)
+	}
+
 	cmd := user.NewHumanPasswordlessInitCodeRequestedEvent(ctx, agg, codeID, code.Crypted, code.Expiry, urlTmpl, returnCode)
 	err = c.pushAppendAndReduce(ctx, wm, cmd)
 	if err != nil {

internal/command/user_v2_passkey_test.go

@@ -142,9 +142,9 @@ func TestCommands_RegisterUserPasskeyWithCode(t *testing.T) {
 		ExternalSecure: true,
 	}
 	alg := crypto.CreateMockEncryptionAlg(gomock.NewController(t))
-	es := eventstoreExpect(t,
+	es := expectEventstore(
 		expectFilter(eventFromEventPusher(testSecretGeneratorAddedEvent(domain.SecretGeneratorTypePasswordlessInitCode))),
-	)
+	)(t)
 	code, err := newEncryptedCode(ctx, es.Filter, domain.SecretGeneratorTypePasswordlessInitCode, alg) //nolint:staticcheck
 	require.NoError(t, err)
 	userAgg := &user.NewAggregate("user1", "org1").Aggregate
@@ -238,9 +238,9 @@ func TestCommands_RegisterUserPasskeyWithCode(t *testing.T) {
 func TestCommands_verifyUserPasskeyCode(t *testing.T) {
 	ctx := http_util.WithRequestedHost(context.Background(), "example.com")
 	alg := crypto.CreateMockEncryptionAlg(gomock.NewController(t))
-	es := eventstoreExpect(t,
+	es := expectEventstore(
 		expectFilter(eventFromEventPusher(testSecretGeneratorAddedEvent(domain.SecretGeneratorTypePasswordlessInitCode))),
-	)
+	)(t)
 	code, err := newEncryptedCode(ctx, es.Filter, domain.SecretGeneratorTypePasswordlessInitCode, alg) //nolint:staticcheck
 	require.NoError(t, err)
 	userAgg := &user.NewAggregate("user1", "org1").Aggregate
@@ -436,14 +436,14 @@ func TestCommands_pushUserPasskey(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			c := &Commands{
-				eventstore:     eventstoreExpect(t, prep...),
+				eventstore:     expectEventstore(prep...)(t),
 				webauthnConfig: webauthnConfig,
 				idGenerator:    id_mock.NewIDGeneratorExpectIDs(t, "123"),
 			}
 			wm, userAgg, webAuthN, err := c.createUserPasskey(ctx, "user1", "org1", "rpID", domain.AuthenticatorAttachmentCrossPlattform)
 			require.NoError(t, err)
 
-			c.eventstore = eventstoreExpect(t, tt.expectPush(webAuthN.Challenge))
+			c.eventstore = expectEventstore(tt.expectPush(webAuthN.Challenge))(t)
 
 			got, err := c.pushUserPasskey(ctx, wm, userAgg, webAuthN, tt.args.events...)
 			require.ErrorIs(t, err, tt.wantErr)
@@ -463,6 +463,7 @@ func TestCommands_AddUserPasskeyCode(t *testing.T) {
 		newCode     encrypedCodeFunc
 		eventstore  func(t *testing.T) *eventstore.Eventstore
 		idGenerator id.Generator
+		loginPaths  func(*testing.T) LoginPaths
 	}
 	type args struct {
 		userID        string
@@ -481,6 +482,7 @@ func TestCommands_AddUserPasskeyCode(t *testing.T) {
 				newCode:     mockEncryptedCode("passkey1", time.Hour),
 				eventstore:  expectEventstore(),
 				idGenerator: id_mock.NewIDGeneratorExpectError(t, io.ErrClosedPipe),
+				loginPaths:  expectLoginPathsNoCall,
 			},
 			args: args{
 				userID:        "user1",
@@ -519,6 +521,49 @@ func TestCommands_AddUserPasskeyCode(t *testing.T) {
 						),
 					),
 				),
+				loginPaths:  expectLoginPathsDefaultPasskeySetURLTemplate(""),
+				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "123"),
+			},
+			args: args{
+				userID:        "user1",
+				resourceOwner: "org1",
+			},
+			want: &domain.ObjectDetails{
+				ResourceOwner: "org1",
+			},
+		},
+		{
+			name: "success, url template",
+			fields: fields{
+				newCode: mockEncryptedCode("passkey1", time.Minute),
+				eventstore: expectEventstore(
+					expectFilter(eventFromEventPusher(
+						user.NewHumanAddedEvent(context.Background(),
+							userAgg,
+							"username",
+							"firstname",
+							"lastname",
+							"nickname",
+							"displayname",
+							language.German,
+							domain.GenderUnspecified,
+							"[email protected]",
+							true,
+						),
+					)),
+					expectPush(
+						user.NewHumanPasswordlessInitCodeRequestedEvent(context.Background(),
+							userAgg,
+							"123", &crypto.CryptoValue{
+								CryptoType: crypto.TypeEncryption,
+								Algorithm:  "enc",
+								KeyID:      "id",
+								Crypted:    []byte("passkey1"),
+							}, time.Minute, "http://example.com/{{.user}}/email/{{.code}}", false,
+						),
+					),
+				),
+				loginPaths:  expectLoginPathsDefaultPasskeySetURLTemplate("http://example.com/{{.user}}/email/{{.code}}"),
 				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "123"),
 			},
 			args: args{
@@ -536,6 +581,7 @@ func TestCommands_AddUserPasskeyCode(t *testing.T) {
 				newEncryptedCode: tt.fields.newCode,
 				eventstore:       tt.fields.eventstore(t),
 				idGenerator:      tt.fields.idGenerator,
+				loginPaths:       tt.fields.loginPaths(t),
 			}
 			got, err := c.AddUserPasskeyCode(context.Background(), tt.args.userID, tt.args.resourceOwner, alg)
 			require.ErrorIs(t, err, tt.wantErr)
@@ -550,7 +596,7 @@ func TestCommands_AddUserPasskeyCodeURLTemplate(t *testing.T) {
 
 	type fields struct {
 		newCode     encrypedCodeFunc
-		eventstore  *eventstore.Eventstore
+		eventstore  func(t *testing.T) *eventstore.Eventstore
 		idGenerator id.Generator
 	}
 	type args struct {
@@ -569,7 +615,7 @@ func TestCommands_AddUserPasskeyCodeURLTemplate(t *testing.T) {
 			name: "template error",
 			fields: fields{
 				newCode:    newEncryptedCode,
-				eventstore: eventstoreExpect(t),
+				eventstore: expectEventstore(),
 			},
 			args: args{
 				userID:        "user1",
@@ -582,7 +628,7 @@ func TestCommands_AddUserPasskeyCodeURLTemplate(t *testing.T) {
 			name: "id generator error",
 			fields: fields{
 				newCode:     newEncryptedCode,
-				eventstore:  eventstoreExpect(t),
+				eventstore:  expectEventstore(),
 				idGenerator: id_mock.NewIDGeneratorExpectError(t, io.ErrClosedPipe),
 			},
 			args: args{
@@ -596,7 +642,7 @@ func TestCommands_AddUserPasskeyCodeURLTemplate(t *testing.T) {
 			name: "success",
 			fields: fields{
 				newCode: mockEncryptedCode("passkey1", time.Minute),
-				eventstore: eventstoreExpect(t,
+				eventstore: expectEventstore(
 					expectFilter(eventFromEventPusher(
 						user.NewHumanAddedEvent(context.Background(),
 							userAgg,
@@ -642,7 +688,7 @@ func TestCommands_AddUserPasskeyCodeURLTemplate(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			c := &Commands{
 				newEncryptedCode: tt.fields.newCode,
-				eventstore:       tt.fields.eventstore,
+				eventstore:       tt.fields.eventstore(t),
 				idGenerator:      tt.fields.idGenerator,
 			}
 			got, err := c.AddUserPasskeyCodeURLTemplate(context.Background(), tt.args.userID, tt.args.resourceOwner, alg, tt.args.urlTmpl)
@@ -657,8 +703,9 @@ func TestCommands_AddUserPasskeyCodeReturn(t *testing.T) {
 	userAgg := &user.NewAggregate("user1", "org1").Aggregate
 	type fields struct {
 		newCode     encrypedCodeFunc
-		eventstore  *eventstore.Eventstore
+		eventstore  func(t *testing.T) *eventstore.Eventstore
 		idGenerator id.Generator
+		loginPaths  func(*testing.T) LoginPaths
 	}
 	type args struct {
 		userID        string
@@ -675,8 +722,9 @@ func TestCommands_AddUserPasskeyCodeReturn(t *testing.T) {
 			name: "id generator error",
 			fields: fields{
 				newCode:     newEncryptedCode,
-				eventstore:  eventstoreExpect(t),
+				eventstore:  expectEventstore(),
 				idGenerator: id_mock.NewIDGeneratorExpectError(t, io.ErrClosedPipe),
+				loginPaths:  expectLoginPathsNoCall,
 			},
 			args: args{
 				userID:        "user1",
@@ -688,7 +736,7 @@ func TestCommands_AddUserPasskeyCodeReturn(t *testing.T) {
 			name: "success",
 			fields: fields{
 				newCode: mockEncryptedCode("passkey1", time.Minute),
-				eventstore: eventstoreExpect(t,
+				eventstore: expectEventstore(
 					expectFilter(eventFromEventPusher(
 						user.NewHumanAddedEvent(context.Background(),
 							userAgg,
@@ -716,6 +764,53 @@ func TestCommands_AddUserPasskeyCodeReturn(t *testing.T) {
 					),
 				),
 				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "123"),
+				loginPaths:  expectLoginPathsDefaultPasskeySetURLTemplate(""),
+			},
+			args: args{
+				userID:        "user1",
+				resourceOwner: "org1",
+			},
+			want: &domain.PasskeyCodeDetails{
+				ObjectDetails: &domain.ObjectDetails{
+					ResourceOwner: "org1",
+				},
+				CodeID: "123",
+				Code:   "passkey1",
+			},
+		},
+		{
+			name: "success, url template",
+			fields: fields{
+				newCode: mockEncryptedCode("passkey1", time.Minute),
+				eventstore: expectEventstore(
+					expectFilter(eventFromEventPusher(
+						user.NewHumanAddedEvent(context.Background(),
+							userAgg,
+							"username",
+							"firstname",
+							"lastname",
+							"nickname",
+							"displayname",
+							language.German,
+							domain.GenderUnspecified,
+							"[email protected]",
+							true,
+						),
+					)),
+					expectPush(
+						user.NewHumanPasswordlessInitCodeRequestedEvent(context.Background(),
+							userAgg,
+							"123", &crypto.CryptoValue{
+								CryptoType: crypto.TypeEncryption,
+								Algorithm:  "enc",
+								KeyID:      "id",
+								Crypted:    []byte("passkey1"),
+							}, time.Minute, "http://example.com/{{.user}}/email/{{.code}}", true,
+						),
+					),
+				),
+				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "123"),
+				loginPaths:  expectLoginPathsDefaultPasskeySetURLTemplate("http://example.com/{{.user}}/email/{{.code}}"),
 			},
 			args: args{
 				userID:        "user1",
@@ -734,8 +829,9 @@ func TestCommands_AddUserPasskeyCodeReturn(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			c := &Commands{
 				newEncryptedCode: tt.fields.newCode,
-				eventstore:       tt.fields.eventstore,
+				eventstore:       tt.fields.eventstore(t),
 				idGenerator:      tt.fields.idGenerator,
+				loginPaths:       tt.fields.loginPaths(t),
 			}
 			got, err := c.AddUserPasskeyCodeReturn(context.Background(), tt.args.userID, tt.args.resourceOwner, alg)
 			if tt.wantErr != nil {
@@ -754,8 +850,9 @@ func TestCommands_addUserPasskeyCode(t *testing.T) {
 	userAgg := &user.NewAggregate("user1", "org1").Aggregate
 	type fields struct {
 		newCode     encrypedCodeFunc
-		eventstore  *eventstore.Eventstore
+		eventstore  func(t *testing.T) *eventstore.Eventstore
 		idGenerator id.Generator
+		loginPaths  func(*testing.T) LoginPaths
 	}
 	type args struct {
 		userID        string
@@ -772,8 +869,9 @@ func TestCommands_addUserPasskeyCode(t *testing.T) {
 			name: "id generator error",
 			fields: fields{
 				newCode:     newEncryptedCode,
-				eventstore:  eventstoreExpect(t),
+				eventstore:  expectEventstore(),
 				idGenerator: id_mock.NewIDGeneratorExpectError(t, io.ErrClosedPipe),
+				loginPaths:  expectLoginPathsNoCall,
 			},
 			args: args{
 				userID:        "user1",
@@ -785,8 +883,9 @@ func TestCommands_addUserPasskeyCode(t *testing.T) {
 			name: "crypto error",
 			fields: fields{
 				newCode:     newEncryptedCode,
-				eventstore:  eventstoreExpect(t, expectFilterError(io.ErrClosedPipe)),
+				eventstore:  expectEventstore(expectFilterError(io.ErrClosedPipe)),
 				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "123"),
+				loginPaths:  expectLoginPathsNoCall,
 			},
 			args: args{
 				userID:        "user1",
@@ -798,11 +897,12 @@ func TestCommands_addUserPasskeyCode(t *testing.T) {
 			name: "filter query error",
 			fields: fields{
 				newCode: newEncryptedCode,
-				eventstore: eventstoreExpect(t,
+				eventstore: expectEventstore(
 					expectFilter(eventFromEventPusher(testSecretGeneratorAddedEvent(domain.SecretGeneratorTypePasswordlessInitCode))),
 					expectFilterError(io.ErrClosedPipe),
 				),
 				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "123"),
+				loginPaths:  expectLoginPathsNoCall,
 			},
 			args: args{
 				userID:        "user1",
@@ -814,7 +914,7 @@ func TestCommands_addUserPasskeyCode(t *testing.T) {
 			name: "push error",
 			fields: fields{
 				newCode: mockEncryptedCode("passkey1", time.Minute),
-				eventstore: eventstoreExpect(t,
+				eventstore: expectEventstore(
 					expectFilter(eventFromEventPusher(
 						user.NewHumanAddedEvent(context.Background(),
 							userAgg,
@@ -842,6 +942,7 @@ func TestCommands_addUserPasskeyCode(t *testing.T) {
 					),
 				),
 				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "123"),
+				loginPaths:  expectLoginPathsDefaultPasskeySetURLTemplate(""),
 			},
 			args: args{
 				userID:        "user1",
@@ -853,7 +954,7 @@ func TestCommands_addUserPasskeyCode(t *testing.T) {
 			name: "success",
 			fields: fields{
 				newCode: mockEncryptedCode("passkey1", time.Minute),
-				eventstore: eventstoreExpect(t,
+				eventstore: expectEventstore(
 					expectFilter(eventFromEventPusher(
 						user.NewHumanAddedEvent(context.Background(),
 							userAgg,
@@ -881,6 +982,52 @@ func TestCommands_addUserPasskeyCode(t *testing.T) {
 					),
 				),
 				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "123"),
+				loginPaths:  expectLoginPathsDefaultPasskeySetURLTemplate(""),
+			},
+			args: args{
+				userID:        "user1",
+				resourceOwner: "org1",
+			},
+			want: &domain.PasskeyCodeDetails{
+				ObjectDetails: &domain.ObjectDetails{
+					ResourceOwner: "org1",
+				},
+				CodeID: "123",
+				Code:   "passkey1",
+			},
+		}, {
+			name: "success, url template",
+			fields: fields{
+				newCode: mockEncryptedCode("passkey1", time.Minute),
+				eventstore: expectEventstore(
+					expectFilter(eventFromEventPusher(
+						user.NewHumanAddedEvent(context.Background(),
+							userAgg,
+							"username",
+							"firstname",
+							"lastname",
+							"nickname",
+							"displayname",
+							language.German,
+							domain.GenderUnspecified,
+							"[email protected]",
+							true,
+						),
+					)),
+					expectPush(
+						user.NewHumanPasswordlessInitCodeRequestedEvent(context.Background(),
+							userAgg,
+							"123", &crypto.CryptoValue{
+								CryptoType: crypto.TypeEncryption,
+								Algorithm:  "enc",
+								KeyID:      "id",
+								Crypted:    []byte("passkey1"),
+							}, time.Minute, "http://example.com/{{.user}}/email/{{.code}}", false,
+						),
+					),
+				),
+				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "123"),
+				loginPaths:  expectLoginPathsDefaultPasskeySetURLTemplate("http://example.com/{{.user}}/email/{{.code}}"),
 			},
 			args: args{
 				userID:        "user1",
@@ -899,8 +1046,9 @@ func TestCommands_addUserPasskeyCode(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			c := &Commands{
 				newEncryptedCode: tt.fields.newCode,
-				eventstore:       tt.fields.eventstore,
+				eventstore:       tt.fields.eventstore(t),
 				idGenerator:      tt.fields.idGenerator,
+				loginPaths:       tt.fields.loginPaths(t),
 			}
 			got, err := c.addUserPasskeyCode(context.Background(), tt.args.userID, tt.args.resourceOwner, alg, "", false)
 			if tt.wantErr != nil {

internal/command/user_v2_password.go

@@ -63,7 +63,7 @@ func (c *Commands) requestPasswordReset(ctx context.Context, userID string, retu
 		return nil, nil, err
 	}
 	if urlTmpl == "" {
-		urlTmpl = c.defaultPasswordSetURLTemplate(ctx)
+		urlTmpl = c.loginPaths.DefaultPasswordSetURLTemplate(ctx)
 	}
 	cmd := user.NewHumanPasswordCodeAddedEventV2(ctx, UserAggregateFromWriteModelCtx(ctx, &model.WriteModel), passwordCode.CryptedCode(), passwordCode.CodeExpiry(), notificationType, urlTmpl, returnCode, generatorID)
 

internal/command/user_v2_password_test.go

@@ -338,13 +338,13 @@ func TestCommands_requestPasswordReset(t *testing.T) {
 		},
 	}
 	type fields struct {
-		checkPermission               domain.PermissionCheck
-		eventstore                    func(t *testing.T) *eventstore.Eventstore
-		userEncryption                crypto.EncryptionAlgorithm
-		newCode                       encrypedCodeFunc
-		newEncryptedCodeWithDefault   encryptedCodeWithDefaultFunc
-		defaultSecretGenerators       *SecretGenerators
-		defaultPasswordSetURLTemplate func(ctx context.Context) string
+		checkPermission             domain.PermissionCheck
+		eventstore                  func(t *testing.T) *eventstore.Eventstore
+		userEncryption              crypto.EncryptionAlgorithm
+		newCode                     encrypedCodeFunc
+		newEncryptedCodeWithDefault encryptedCodeWithDefaultFunc
+		defaultSecretGenerators     *SecretGenerators
+		loginPaths                  func(*testing.T) LoginPaths
 	}
 	type args struct {
 		ctx              context.Context
@@ -368,6 +368,7 @@ func TestCommands_requestPasswordReset(t *testing.T) {
 			name: "missing userID",
 			fields: fields{
 				eventstore: expectEventstore(),
+				loginPaths: expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:    context.Background(),
@@ -383,6 +384,7 @@ func TestCommands_requestPasswordReset(t *testing.T) {
 				eventstore: expectEventstore(
 					expectFilter(),
 				),
+				loginPaths: expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:    context.Background(),
@@ -408,6 +410,7 @@ func TestCommands_requestPasswordReset(t *testing.T) {
 						),
 					),
 				),
+				loginPaths: expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:    context.Background(),
@@ -430,6 +433,7 @@ func TestCommands_requestPasswordReset(t *testing.T) {
 					),
 				),
 				checkPermission: newMockPermissionCheckNotAllowed(),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:    context.Background(),
@@ -466,9 +470,9 @@ func TestCommands_requestPasswordReset(t *testing.T) {
 						),
 					),
 				),
-				checkPermission:               newMockPermissionCheckAllowed(),
-				newCode:                       mockEncryptedCode("code", 10*time.Minute),
-				defaultPasswordSetURLTemplate: func(ctx context.Context) string { return "http://example.com/{{.user}}/password/{{.code}}" },
+				checkPermission: newMockPermissionCheckAllowed(),
+				newCode:         mockEncryptedCode("code", 10*time.Minute),
+				loginPaths:      expectLoginPathsDefaultPasswordSetURLTemplate("http://example.com/{{.user}}/password/{{.code}}"),
 			},
 			args: args{
 				ctx:    context.Background(),
@@ -510,6 +514,7 @@ func TestCommands_requestPasswordReset(t *testing.T) {
 				),
 				checkPermission: newMockPermissionCheckAllowed(),
 				newCode:         mockEncryptedCode("code", 10*time.Minute),
+				loginPaths:      expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:     context.Background(),
@@ -583,6 +588,7 @@ func TestCommands_requestPasswordReset(t *testing.T) {
 				defaultSecretGenerators:     defaultGenerators,
 				checkPermission:             newMockPermissionCheckAllowed(),
 				newEncryptedCodeWithDefault: mockEncryptedCodeWithDefault("code", 10*time.Minute),
+				loginPaths:                  expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:              context.Background(),
@@ -652,6 +658,7 @@ func TestCommands_requestPasswordReset(t *testing.T) {
 				checkPermission:         newMockPermissionCheckAllowed(),
 				newCode:                 mockEncryptedCode("code", 10*time.Minute),
 				defaultSecretGenerators: defaultGenerators,
+				loginPaths:              expectLoginPathsNoCall,
 			},
 			args: args{
 				ctx:              context.Background(),
@@ -693,9 +700,9 @@ func TestCommands_requestPasswordReset(t *testing.T) {
 						),
 					),
 				),
-				checkPermission:               newMockPermissionCheckAllowed(),
-				newCode:                       mockEncryptedCode("code", 10*time.Minute),
-				defaultPasswordSetURLTemplate: func(ctx context.Context) string { return "http://example.com/{{.user}}/password/{{.code}}" },
+				checkPermission: newMockPermissionCheckAllowed(),
+				newCode:         mockEncryptedCode("code", 10*time.Minute),
+				loginPaths:      expectLoginPathsDefaultPasswordSetURLTemplate("http://example.com/{{.user}}/password/{{.code}}"),
 			},
 			args: args{
 				ctx:        context.Background(),
@@ -713,13 +720,13 @@ func TestCommands_requestPasswordReset(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			c := &Commands{
-				checkPermission:               tt.fields.checkPermission,
-				eventstore:                    tt.fields.eventstore(t),
-				userEncryption:                tt.fields.userEncryption,
-				newEncryptedCode:              tt.fields.newCode,
-				newEncryptedCodeWithDefault:   tt.fields.newEncryptedCodeWithDefault,
-				defaultSecretGenerators:       tt.fields.defaultSecretGenerators,
-				defaultPasswordSetURLTemplate: tt.fields.defaultPasswordSetURLTemplate,
+				checkPermission:             tt.fields.checkPermission,
+				eventstore:                  tt.fields.eventstore(t),
+				userEncryption:              tt.fields.userEncryption,
+				newEncryptedCode:            tt.fields.newCode,
+				newEncryptedCodeWithDefault: tt.fields.newEncryptedCodeWithDefault,
+				defaultSecretGenerators:     tt.fields.defaultSecretGenerators,
+				loginPaths:                  tt.fields.loginPaths(t),
 			}
 
 			got, gotPlainCode, err := c.requestPasswordReset(tt.args.ctx, tt.args.userID, tt.args.returnCode, tt.args.urlTmpl, tt.args.notificationType)