feat(action v2): add JWT and JWE payload type options (#11196)

# Which Problems Are Solved

The payload in actions V2 is currently sent as JSON to the target
endpoint. It might get exposed to intermediary infrastructure or logging
systems.
For these scenarios there needs to be an application-layer encryption,
where the provider of the endpoint can define an key to be used for the
encryption.

# How the Problems Are Solved

- Added an additional option to the target to specify the payload type:
`JSON` (current and default), `JWT`, `JWE` (api and console)
- added endpoints to upload and manage public keys (to be used for
encryption) for a target
- updated all action v2 executions (interceptors, oidc, saml, ...) to
provide the `GetActiveSigningWebKey` from queries
- implemented jwt and jwe in the exections incl. refactoring of code and
tests
- changes to the authn_keys table:
  - added a `fingerprint` column
  - dropped not null constraint on expiration
- moved the `GetSignerOnce` into its own package to prevent circular
dependencies

# Additional Changes

None

# Additional Context

closes #11061

---------

Co-authored-by: Marco A. <[email protected]>
Co-authored-by: conblem <[email protected]>
Co-authored-by: Silvan <[email protected]>

internal/command/action_v2_execution_test.go

@@ -181,6 +181,7 @@ func TestCommands_SetExecutionRequest(t *testing.T) {
 									KeyID:      "id",
 									Crypted:    []byte("12345678"),
 								},
+								target_domain.PayloadTypeJSON,
 							),
 						),
 					),
@@ -236,6 +237,7 @@ func TestCommands_SetExecutionRequest(t *testing.T) {
 									KeyID:      "id",
 									Crypted:    []byte("12345678"),
 								},
+								target_domain.PayloadTypeJSON,
 							),
 						),
 					),
@@ -291,6 +293,7 @@ func TestCommands_SetExecutionRequest(t *testing.T) {
 									KeyID:      "id",
 									Crypted:    []byte("12345678"),
 								},
+								target_domain.PayloadTypeJSON,
 							),
 						),
 					),
@@ -863,6 +866,7 @@ func TestCommands_SetExecutionResponse(t *testing.T) {
 								KeyID:      "id",
 								Crypted:    []byte("12345678"),
 							},
+							target_domain.PayloadTypeJSON,
 						),
 					),
 					expectPushFailed(
@@ -963,6 +967,7 @@ func TestCommands_SetExecutionResponse(t *testing.T) {
 									KeyID:      "id",
 									Crypted:    []byte("12345678"),
 								},
+								target_domain.PayloadTypeJSON,
 							),
 						),
 					),

internal/command/action_v2_target.go

@@ -22,6 +22,7 @@ type AddTarget struct {
 	Endpoint         string
 	Timeout          time.Duration
 	InterruptOnError bool
+	PayloadType      target_domain.PayloadType
 
 	SigningKey string
 }
@@ -77,6 +78,7 @@ func (c *Commands) AddTarget(ctx context.Context, add *AddTarget, resourceOwner
 		add.Timeout,
 		add.InterruptOnError,
 		code.Crypted,
+		add.PayloadType,
 	))
 	if err != nil {
 		return time.Time{}, err
@@ -95,6 +97,7 @@ type ChangeTarget struct {
 	Endpoint         *string
 	Timeout          *time.Duration
 	InterruptOnError *bool
+	PayloadType      target_domain.PayloadType
 
 	ExpirationSigningKey bool
 	SigningKey           *string
@@ -153,6 +156,7 @@ func (c *Commands) ChangeTarget(ctx context.Context, change *ChangeTarget, resou
 		change.Timeout,
 		change.InterruptOnError,
 		changedSigningKey,
+		change.PayloadType,
 	)
 	if changedEvent == nil {
 		return existing.WriteModel.ChangeDate, nil

internal/command/action_v2_target_key.go

@@ -0,0 +1,190 @@
+package command
+
+import (
+	"context"
+	"crypto/ecdsa"
+	"crypto/rsa"
+	"crypto/sha256"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/pem"
+	"fmt"
+	"time"
+
+	"github.com/zitadel/zitadel/internal/repository/target"
+	"github.com/zitadel/zitadel/internal/telemetry/tracing"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	ErrTargetIDMissing          = "ErrTargetIDMissing"
+	ErrPublicKeyFormat          = "ErrPublicKeyFormat"
+	ErrExpirationDateBeforeNow  = "ErrExpirationDateBeforeNow"
+	ErrPublicKeyDeleteActiveKey = "ErrPublicKeyDeleteActiveKey"
+	ErrTargetNotFound           = "ErrTargetNotFound"
+	ErrKeyNotFound              = "ErrKeyNotFound"
+	ErrPublicKeyExpired         = "ErrPublicKeyExpired"
+)
+
+type TargetPublicKey struct {
+	TargetID   string
+	PublicKey  []byte
+	Expiration time.Time
+
+	// KeyID is generated and returned after adding the public key
+	KeyID string
+}
+
+func (c *Commands) AddTargetPublicKey(ctx context.Context, key *TargetPublicKey, resourceOwner string) (_ time.Time, err error) {
+	ctx, span := tracing.NewSpan(ctx)
+	defer func() { span.EndWithError(err) }()
+
+	if key.TargetID == "" {
+		return time.Time{}, zerrors.ThrowInvalidArgument(nil, ErrTargetIDMissing, "Errors.IDMissing")
+	}
+	if !key.Expiration.IsZero() && key.Expiration.Before(time.Now()) {
+		return time.Time{}, zerrors.ThrowInvalidArgument(nil, ErrExpirationDateBeforeNow, "Errors.Target.InvalidExpirationDate")
+	}
+	fingerprint, err := checkPublicKeyAndComputeFingerprint(key.PublicKey)
+	if err != nil {
+		return time.Time{}, err
+	}
+	key.KeyID, err = c.idGenerator.Next()
+	if err != nil {
+		return time.Time{}, err
+	}
+	writeModel, err := c.getTargetKeyWriteModelByID(ctx, key.TargetID, key.KeyID, resourceOwner)
+	if err != nil {
+		return time.Time{}, err
+	}
+	if !writeModel.TargetExists {
+		return time.Time{}, zerrors.ThrowPreconditionFailed(nil, ErrTargetNotFound, "Errors.Target.NotFound")
+	}
+	err = c.pushAppendAndReduce(ctx, writeModel, target.NewKeyAddedEvent(
+		ctx,
+		TargetAggregateFromWriteModel(&writeModel.WriteModel),
+		key.KeyID,
+		key.PublicKey,
+		fingerprint,
+		key.Expiration,
+	))
+	if err != nil {
+		return time.Time{}, err
+	}
+	return writeModel.ChangeDate, nil
+}
+
+func (c *Commands) ActivateTargetPublicKey(ctx context.Context, targetID, keyID, resourceOwner string) (_ time.Time, err error) {
+	ctx, span := tracing.NewSpan(ctx)
+	defer func() { span.EndWithError(err) }()
+
+	if targetID == "" || keyID == "" {
+		return time.Time{}, zerrors.ThrowInvalidArgument(nil, ErrTargetIDMissing, "Errors.IDMissing")
+	}
+	writeModel, err := c.getTargetKeyWriteModelByID(ctx, targetID, keyID, resourceOwner)
+	if err != nil {
+		return time.Time{}, err
+	}
+	if !writeModel.TargetExists || !writeModel.KeyExists {
+		return time.Time{}, zerrors.ThrowPreconditionFailed(nil, ErrKeyNotFound, "Errors.Target.NotFound")
+	}
+	if !writeModel.ExpirationDate.IsZero() && writeModel.ExpirationDate.Before(time.Now()) {
+		return time.Time{}, zerrors.ThrowPreconditionFailed(nil, ErrPublicKeyExpired, "Errors.Target.PublicKeyExpired")
+	}
+	if writeModel.Active {
+		return writeModel.ChangeDate, nil
+	}
+	err = c.pushAppendAndReduce(ctx, writeModel, target.NewKeyActivatedEvent(
+		ctx,
+		TargetAggregateFromWriteModel(&writeModel.WriteModel),
+		keyID,
+	))
+	if err != nil {
+		return time.Time{}, err
+	}
+	return writeModel.ChangeDate, nil
+}
+
+func (c *Commands) DeactivateTargetPublicKey(ctx context.Context, targetID, keyID, resourceOwner string) (_ time.Time, err error) {
+	ctx, span := tracing.NewSpan(ctx)
+	defer func() { span.EndWithError(err) }()
+
+	if targetID == "" || keyID == "" {
+		return time.Time{}, zerrors.ThrowInvalidArgument(nil, ErrTargetIDMissing, "Errors.IDMissing")
+	}
+	writeModel, err := c.getTargetKeyWriteModelByID(ctx, targetID, keyID, resourceOwner)
+	if err != nil {
+		return time.Time{}, err
+	}
+	if !writeModel.TargetExists || !writeModel.KeyExists {
+		return time.Time{}, zerrors.ThrowPreconditionFailed(nil, ErrKeyNotFound, "Errors.Target.NotFound")
+	}
+	if !writeModel.Active {
+		return writeModel.ChangeDate, nil
+	}
+	err = c.pushAppendAndReduce(ctx, writeModel, target.NewKeyDeactivatedEvent(
+		ctx,
+		TargetAggregateFromWriteModel(&writeModel.WriteModel),
+		keyID,
+	))
+	if err != nil {
+		return time.Time{}, err
+	}
+	return writeModel.ChangeDate, nil
+}
+
+func (c *Commands) RemoveTargetPublicKey(ctx context.Context, targetID, keyID, resourceOwner string) (_ time.Time, err error) {
+	ctx, span := tracing.NewSpan(ctx)
+	defer func() { span.EndWithError(err) }()
+
+	if targetID == "" || keyID == "" {
+		return time.Time{}, zerrors.ThrowInvalidArgument(nil, ErrTargetIDMissing, "Errors.IDMissing")
+	}
+	writeModel, err := c.getTargetKeyWriteModelByID(ctx, targetID, keyID, resourceOwner)
+	if err != nil {
+		return time.Time{}, err
+	}
+	if !writeModel.TargetExists || !writeModel.KeyExists {
+		return writeModel.ChangeDate, nil
+	}
+	if writeModel.Active {
+		return time.Time{}, zerrors.ThrowPreconditionFailed(nil, ErrPublicKeyDeleteActiveKey, "Errors.Target.PublicKeyActive")
+	}
+	err = c.pushAppendAndReduce(ctx, writeModel, target.NewKeyRemovedEvent(
+		ctx,
+		TargetAggregateFromWriteModel(&writeModel.WriteModel),
+		keyID,
+	))
+	if err != nil {
+		return time.Time{}, err
+	}
+	return writeModel.ChangeDate, nil
+}
+
+func checkPublicKeyAndComputeFingerprint(key []byte) (string, error) {
+	block, _ := pem.Decode(key)
+	if block == nil {
+		return "", zerrors.ThrowInvalidArgument(nil, ErrPublicKeyFormat, "Errors.Target.InvalidPublicKey")
+	}
+	pub, err := x509.ParsePKIXPublicKey(block.Bytes)
+	if err != nil {
+		return "", zerrors.ThrowInvalidArgument(err, ErrPublicKeyFormat, "Errors.Target.InvalidPublicKey")
+	}
+	switch pub.(type) {
+	case *rsa.PublicKey,
+		*ecdsa.PublicKey:
+		fingerprint := sha256.Sum256(block.Bytes)
+		return fmt.Sprintf("SHA256:%s", base64.RawStdEncoding.EncodeToString(fingerprint[:])), nil
+	default:
+		return "", zerrors.ThrowInvalidArgument(nil, ErrPublicKeyFormat, "Errors.Target.InvalidPublicKey")
+	}
+}
+
+func (c *Commands) getTargetKeyWriteModelByID(ctx context.Context, targetID, keyID string, resourceOwner string) (*TargetKeyWriteModel, error) {
+	wm := NewTargetKeyWriteModel(targetID, keyID, resourceOwner)
+	err := c.eventstore.FilterToQueryReducer(ctx, wm)
+	if err != nil {
+		return nil, err
+	}
+	return wm, nil
+}

internal/command/action_v2_target_key_model.go

@@ -0,0 +1,94 @@
+package command
+
+import (
+	"time"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/target"
+)
+
+type TargetKeyWriteModel struct {
+	eventstore.WriteModel
+	KeyID string
+
+	KeyExists      bool
+	TargetExists   bool
+	Active         bool
+	ExpirationDate time.Time
+}
+
+func NewTargetKeyWriteModel(targetID, keyID string, resourceOwner string) *TargetKeyWriteModel {
+	return &TargetKeyWriteModel{
+		WriteModel: eventstore.WriteModel{
+			AggregateID:   targetID,
+			ResourceOwner: resourceOwner,
+		},
+		KeyID: keyID,
+	}
+}
+
+func (wm *TargetKeyWriteModel) AppendEvents(events ...eventstore.Event) {
+	for _, event := range events {
+		switch e := event.(type) {
+		case *target.KeyAddedEvent:
+			if wm.KeyID != e.KeyID {
+				continue
+			}
+			wm.WriteModel.AppendEvents(e)
+		case *target.KeyActivatedEvent:
+			// don't check for KeyID, as only one key can be active at a time any activation event affects all keys
+			wm.WriteModel.AppendEvents(e)
+		case *target.KeyDeactivatedEvent:
+			if wm.KeyID != e.KeyID {
+				continue
+			}
+			wm.WriteModel.AppendEvents(e)
+		case *target.KeyRemovedEvent:
+			if wm.KeyID != e.KeyID {
+				continue
+			}
+			wm.WriteModel.AppendEvents(e)
+		case *target.AddedEvent:
+			wm.WriteModel.AppendEvents(e)
+		case *target.RemovedEvent:
+			wm.WriteModel.AppendEvents(e)
+		}
+	}
+}
+
+func (wm *TargetKeyWriteModel) Reduce() error {
+	for _, event := range wm.Events {
+		switch e := event.(type) {
+		case *target.KeyAddedEvent:
+			wm.KeyID = e.KeyID
+			wm.KeyExists = true
+			wm.ExpirationDate = e.ExpirationDate
+		case *target.KeyActivatedEvent:
+			wm.Active = wm.KeyID == e.KeyID
+		case *target.KeyDeactivatedEvent:
+			wm.Active = false
+		case *target.KeyRemovedEvent:
+			wm.KeyExists = false
+		case *target.AddedEvent:
+			wm.TargetExists = true
+		case *target.RemovedEvent:
+			wm.TargetExists = false
+		}
+	}
+	return wm.WriteModel.Reduce()
+}
+
+func (wm *TargetKeyWriteModel) Query() *eventstore.SearchQueryBuilder {
+	return eventstore.NewSearchQueryBuilder(eventstore.ColumnsEvent).
+		ResourceOwner(wm.ResourceOwner).
+		AddQuery().
+		AggregateTypes(target.AggregateType).
+		AggregateIDs(wm.AggregateID).
+		EventTypes(target.KeyAddedEventType,
+			target.KeyActivatedEventType,
+			target.KeyDeactivatedEventType,
+			target.KeyRemovedEventType,
+			target.AddedEventType,
+			target.RemovedEventType).
+		Builder()
+}

internal/command/action_v2_target_key_test.go

@@ -0,0 +1,655 @@
+package command
+
+import (
+	"context"
+	"crypto/ed25519"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha256"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/pem"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/id"
+	"github.com/zitadel/zitadel/internal/id/mock"
+	"github.com/zitadel/zitadel/internal/repository/target"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+var (
+	rsaPublicKey = func() *rsa.PublicKey {
+		privateKey, _ := rsa.GenerateKey(rand.Reader, 2048)
+		return &privateKey.PublicKey
+	}()
+	rsaPublicKeyBytes = func() []byte {
+		data, _ := crypto.PublicKeyToBytes(rsaPublicKey)
+		return data
+	}()
+	rsaFingerprint = func() string {
+		block, _ := x509.MarshalPKIXPublicKey(rsaPublicKey)
+		hash := sha256.Sum256(block)
+		return fmt.Sprintf("SHA256:%s", base64.RawStdEncoding.EncodeToString(hash[:]))
+	}()
+)
+
+func TestCommands_AddTargetPublicKey(t *testing.T) {
+	type fields struct {
+		eventstore  func(t *testing.T) *eventstore.Eventstore
+		idGenerator id.Generator
+	}
+	type args struct {
+		ctx           context.Context
+		key           *TargetPublicKey
+		resourceOwner string
+	}
+	type res struct {
+		err error
+	}
+	tests := []struct {
+		name   string
+		fields fields
+		args   args
+		res    res
+	}{
+		{
+			name: "missing target id",
+			fields: fields{
+				eventstore: expectEventstore(),
+			},
+			args: args{
+				ctx: context.Background(),
+				key: &TargetPublicKey{},
+			},
+			res: res{
+				err: zerrors.ThrowInvalidArgument(nil, ErrTargetIDMissing, "Errors.IDMissing"),
+			},
+		},
+		{
+			name: "expiration date before now",
+			fields: fields{
+				eventstore: expectEventstore(),
+			},
+			args: args{
+				ctx: context.Background(),
+				key: &TargetPublicKey{
+					TargetID:   "target-1",
+					Expiration: testNow.Add(-time.Hour),
+				},
+			},
+			res: res{
+				err: zerrors.ThrowInvalidArgument(nil, ErrExpirationDateBeforeNow, "Errors.Target.InvalidExpirationDate"),
+			},
+		},
+		{
+			name: "invalid public key",
+			fields: fields{
+				eventstore: expectEventstore(),
+			},
+			args: args{
+				ctx: context.Background(),
+				key: &TargetPublicKey{
+					TargetID:  "target-1",
+					PublicKey: []byte("invalid-key"),
+				},
+			},
+			res: res{
+				err: zerrors.ThrowInvalidArgument(nil, ErrPublicKeyFormat, "Errors.Target.InvalidPublicKey"),
+			},
+		},
+		{
+			name: "invalid public key format (PKCS1)",
+			fields: fields{
+				eventstore: expectEventstore(),
+			},
+			args: args{
+				ctx: context.Background(),
+				key: &TargetPublicKey{
+					TargetID:  "target-1",
+					PublicKey: pem.EncodeToMemory(&pem.Block{Type: "RSA PUBLIC KEY", Bytes: x509.MarshalPKCS1PublicKey(rsaPublicKey)}),
+				},
+			},
+			res: res{
+				err: zerrors.ThrowInvalidArgument(nil, ErrPublicKeyFormat, "Errors.Target.InvalidPublicKey"),
+			},
+		},
+		{
+			name: "invalid public key type (ed25519)",
+			fields: fields{
+				eventstore: expectEventstore(),
+			},
+			args: args{
+				ctx: context.Background(),
+				key: &TargetPublicKey{
+					TargetID: "target-1",
+					PublicKey: func() []byte {
+						publicKey, _, _ := ed25519.GenerateKey(rand.Reader)
+						ed25519PublicKeyBytes, _ := x509.MarshalPKIXPublicKey(publicKey)
+						return pem.EncodeToMemory(&pem.Block{Type: "PUBLIC KEY", Bytes: ed25519PublicKeyBytes})
+					}(),
+				},
+			},
+			res: res{
+				err: zerrors.ThrowInvalidArgument(nil, ErrPublicKeyFormat, "Errors.Target.InvalidPublicKey"),
+			},
+		},
+		{
+			name: "target not found",
+			fields: fields{
+				eventstore: expectEventstore(
+					expectFilter(),
+				),
+				idGenerator: mock.ExpectID(t, "key-1"),
+			},
+			args: args{
+				ctx: context.Background(),
+				key: &TargetPublicKey{
+					TargetID:  "target-1",
+					PublicKey: rsaPublicKeyBytes,
+				},
+			},
+			res: res{
+				err: zerrors.ThrowPreconditionFailed(nil, ErrTargetNotFound, "Errors.Target.NotFound"),
+			},
+		},
+		{
+			name: "success",
+			fields: fields{
+				eventstore: expectEventstore(
+					expectFilter(
+						eventFromEventPusher(
+							targetAddEvent("target-1", "instance1"),
+						),
+					),
+					expectPush(
+						eventFromEventPusher(
+							target.NewKeyAddedEvent(context.Background(),
+								target.NewAggregate("target-1", "instance1"),
+								"key-1",
+								rsaPublicKeyBytes,
+								rsaFingerprint,
+								time.Time{},
+							),
+						),
+					),
+				),
+				idGenerator: mock.ExpectID(t, "key-1"),
+			},
+			args: args{
+				ctx: context.Background(),
+				key: &TargetPublicKey{
+					TargetID:  "target-1",
+					PublicKey: rsaPublicKeyBytes,
+				},
+			},
+			res: res{},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			c := &Commands{
+				eventstore:  tt.fields.eventstore(t),
+				idGenerator: tt.fields.idGenerator,
+			}
+			_, err := c.AddTargetPublicKey(tt.args.ctx, tt.args.key, tt.args.resourceOwner)
+			assert.ErrorIs(t, err, tt.res.err)
+		})
+	}
+}
+
+func TestCommands_ActivateTargetPublicKey(t *testing.T) {
+	type fields struct {
+		eventstore func(t *testing.T) *eventstore.Eventstore
+	}
+	type args struct {
+		ctx           context.Context
+		targetID      string
+		keyID         string
+		resourceOwner string
+	}
+	type res struct {
+		err error
+	}
+	tests := []struct {
+		name   string
+		fields fields
+		args   args
+		res    res
+	}{
+		{
+			name: "missing target id",
+			fields: fields{
+				eventstore: expectEventstore(),
+			},
+			args: args{
+				ctx: context.Background(),
+			},
+			res: res{
+				err: zerrors.ThrowInvalidArgument(nil, ErrTargetIDMissing, "Errors.IDMissing"),
+			},
+		},
+		{
+			name: "missing key id",
+			fields: fields{
+				eventstore: expectEventstore(),
+			},
+			args: args{
+				ctx:      context.Background(),
+				targetID: "target-1",
+			},
+			res: res{
+				err: zerrors.ThrowInvalidArgument(nil, ErrTargetIDMissing, "Errors.IDMissing"),
+			},
+		},
+		{
+			name: "target not found",
+			fields: fields{
+				eventstore: expectEventstore(
+					expectFilter(),
+				),
+			},
+			args: args{
+				ctx:      context.Background(),
+				targetID: "target-1",
+				keyID:    "key-1",
+			},
+			res: res{
+				err: zerrors.ThrowPreconditionFailed(nil, ErrKeyNotFound, "Errors.Target.NotFound"),
+			},
+		},
+		{
+			name: "already expired",
+			fields: fields{
+				eventstore: expectEventstore(
+					expectFilter(
+						eventFromEventPusher(
+							targetAddEvent("target-1", "instance1"),
+						),
+						eventFromEventPusher(
+							target.NewKeyAddedEvent(context.Background(),
+								target.NewAggregate("target-1", "instance1"),
+								"key-1",
+								rsaPublicKeyBytes,
+								rsaFingerprint,
+								time.Now().Add(-time.Hour),
+							),
+						),
+					),
+				),
+			},
+			args: args{
+				ctx:      context.Background(),
+				targetID: "target-1",
+				keyID:    "key-1",
+			},
+			res: res{
+				err: zerrors.ThrowPreconditionFailed(nil, ErrPublicKeyExpired, "Errors.Target.PublicKeyExpired"),
+			},
+		},
+		{
+			name: "already active",
+			fields: fields{
+				eventstore: expectEventstore(
+					expectFilter(
+						eventFromEventPusher(
+							targetAddEvent("target-1", "instance1"),
+						),
+						eventFromEventPusher(
+							target.NewKeyAddedEvent(context.Background(),
+								target.NewAggregate("target-1", "instance1"),
+								"key-1",
+								rsaPublicKeyBytes,
+								rsaFingerprint,
+								time.Time{},
+							),
+						),
+						eventFromEventPusher(
+							target.NewKeyActivatedEvent(context.Background(),
+								target.NewAggregate("target-1", "instance1"),
+								"key-1",
+							),
+						),
+					),
+				),
+			},
+			args: args{
+				ctx:      context.Background(),
+				targetID: "target-1",
+				keyID:    "key-1",
+			},
+			res: res{},
+		},
+		{
+			name: "success",
+			fields: fields{
+				eventstore: expectEventstore(
+					expectFilter(
+						eventFromEventPusher(
+							targetAddEvent("target-1", "instance1"),
+						),
+						eventFromEventPusher(
+							target.NewKeyAddedEvent(context.Background(),
+								target.NewAggregate("target-1", "instance1"),
+								"key-1",
+								rsaPublicKeyBytes,
+								rsaFingerprint,
+								time.Time{},
+							),
+						),
+					),
+					expectPush(
+						eventFromEventPusher(
+							target.NewKeyActivatedEvent(context.Background(),
+								target.NewAggregate("target-1", "instance1"),
+								"key-1",
+							),
+						),
+					),
+				),
+			},
+			args: args{
+				ctx:      context.Background(),
+				targetID: "target-1",
+				keyID:    "key-1",
+			},
+			res: res{},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			c := &Commands{
+				eventstore: tt.fields.eventstore(t),
+			}
+			_, err := c.ActivateTargetPublicKey(tt.args.ctx, tt.args.targetID, tt.args.keyID, tt.args.resourceOwner)
+			assert.ErrorIs(t, err, tt.res.err)
+		})
+	}
+}
+
+func TestCommands_DeactivateTargetPublicKey(t *testing.T) {
+	type fields struct {
+		eventstore func(t *testing.T) *eventstore.Eventstore
+	}
+	type args struct {
+		ctx           context.Context
+		targetID      string
+		keyID         string
+		resourceOwner string
+	}
+	type res struct {
+		err error
+	}
+	tests := []struct {
+		name   string
+		fields fields
+		args   args
+		res    res
+	}{
+		{
+			name: "missing target id",
+			fields: fields{
+				eventstore: expectEventstore(),
+			},
+			args: args{
+				ctx: context.Background(),
+			},
+			res: res{
+				err: zerrors.ThrowInvalidArgument(nil, ErrTargetIDMissing, "Errors.IDMissing"),
+			},
+		},
+		{
+			name: "missing key id",
+			fields: fields{
+				eventstore: expectEventstore(),
+			},
+			args: args{
+				ctx:      context.Background(),
+				targetID: "target-1",
+			},
+			res: res{
+				err: zerrors.ThrowInvalidArgument(nil, ErrTargetIDMissing, "Errors.IDMissing"),
+			},
+		},
+		{
+			name: "target not found",
+			fields: fields{
+				eventstore: expectEventstore(
+					expectFilter(),
+				),
+			},
+			args: args{
+				ctx:      context.Background(),
+				targetID: "target-1",
+				keyID:    "key-1",
+			},
+			res: res{
+				err: zerrors.ThrowPreconditionFailed(nil, ErrKeyNotFound, "Errors.Target.NotFound"),
+			},
+		},
+		{
+			name: "already inactive",
+			fields: fields{
+				eventstore: expectEventstore(
+					expectFilter(
+						eventFromEventPusher(
+							targetAddEvent("target-1", "instance1"),
+						),
+						eventFromEventPusher(
+							target.NewKeyAddedEvent(context.Background(),
+								target.NewAggregate("target-1", "instance1"),
+								"key-1",
+								rsaPublicKeyBytes,
+								rsaFingerprint,
+								time.Time{},
+							),
+						),
+					),
+				),
+			},
+			args: args{
+				ctx:      context.Background(),
+				targetID: "target-1",
+				keyID:    "key-1",
+			},
+			res: res{},
+		},
+		{
+			name: "success",
+			fields: fields{
+				eventstore: expectEventstore(
+					expectFilter(
+						eventFromEventPusher(
+							targetAddEvent("target-1", "instance1"),
+						),
+						eventFromEventPusher(
+							target.NewKeyAddedEvent(context.Background(),
+								target.NewAggregate("target-1", "instance1"),
+								"key-1",
+								rsaPublicKeyBytes,
+								rsaFingerprint,
+								time.Time{},
+							),
+						),
+						eventFromEventPusher(
+							target.NewKeyActivatedEvent(context.Background(),
+								target.NewAggregate("target-1", "instance1"),
+								"key-1",
+							),
+						),
+					),
+					expectPush(
+						eventFromEventPusher(
+							target.NewKeyDeactivatedEvent(context.Background(),
+								target.NewAggregate("target-1", "instance1"),
+								"key-1",
+							),
+						),
+					),
+				),
+			},
+			args: args{
+				ctx:      context.Background(),
+				targetID: "target-1",
+				keyID:    "key-1",
+			},
+			res: res{},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			c := &Commands{
+				eventstore: tt.fields.eventstore(t),
+			}
+			_, err := c.DeactivateTargetPublicKey(tt.args.ctx, tt.args.targetID, tt.args.keyID, tt.args.resourceOwner)
+			assert.ErrorIs(t, err, tt.res.err)
+		})
+	}
+}
+
+func TestCommands_RemoveTargetPublicKey(t *testing.T) {
+	type fields struct {
+		eventstore func(t *testing.T) *eventstore.Eventstore
+	}
+	type args struct {
+		ctx           context.Context
+		targetID      string
+		keyID         string
+		resourceOwner string
+	}
+	type res struct {
+		err error
+	}
+	tests := []struct {
+		name   string
+		fields fields
+		args   args
+		res    res
+	}{
+		{
+			name: "missing target id",
+			fields: fields{
+				eventstore: expectEventstore(),
+			},
+			args: args{
+				ctx: context.Background(),
+			},
+			res: res{
+				err: zerrors.ThrowInvalidArgument(nil, ErrTargetIDMissing, "Errors.IDMissing"),
+			},
+		},
+		{
+			name: "missing key id",
+			fields: fields{
+				eventstore: expectEventstore(),
+			},
+			args: args{
+				ctx:      context.Background(),
+				targetID: "target-1",
+			},
+			res: res{
+				err: zerrors.ThrowInvalidArgument(nil, ErrTargetIDMissing, "Errors.IDMissing"),
+			},
+		},
+		{
+			name: "target not found",
+			fields: fields{
+				eventstore: expectEventstore(
+					expectFilter(),
+				),
+			},
+			args: args{
+				ctx:      context.Background(),
+				targetID: "target-1",
+				keyID:    "key-1",
+			},
+			res: res{
+				err: nil,
+			},
+		},
+		{
+			name: "key active",
+			fields: fields{
+				eventstore: expectEventstore(
+					expectFilter(
+						eventFromEventPusher(
+							targetAddEvent("target-1", "instance1"),
+						),
+						eventFromEventPusher(
+							target.NewKeyAddedEvent(context.Background(),
+								target.NewAggregate("target-1", "instance1"),
+								"key-1",
+								rsaPublicKeyBytes,
+								rsaFingerprint,
+								time.Time{},
+							),
+						),
+						eventFromEventPusher(
+							target.NewKeyActivatedEvent(context.Background(),
+								target.NewAggregate("target-1", "instance1"),
+								"key-1",
+							),
+						),
+					),
+				),
+			},
+			args: args{
+				ctx:      context.Background(),
+				targetID: "target-1",
+				keyID:    "key-1",
+			},
+			res: res{
+				err: zerrors.ThrowPreconditionFailed(nil, ErrPublicKeyDeleteActiveKey, "Errors.Target.PublicKeyActive"),
+			},
+		},
+		{
+			name: "success",
+			fields: fields{
+				eventstore: expectEventstore(
+					expectFilter(
+						eventFromEventPusher(
+							targetAddEvent("target-1", "instance1"),
+						),
+						eventFromEventPusher(
+							target.NewKeyAddedEvent(context.Background(),
+								target.NewAggregate("target-1", "instance1"),
+								"key-1",
+								rsaPublicKeyBytes,
+								rsaFingerprint,
+								time.Time{},
+							),
+						),
+					),
+					expectPush(
+						eventFromEventPusher(
+							target.NewKeyRemovedEvent(context.Background(),
+								target.NewAggregate("target-1", "instance1"),
+								"key-1",
+							),
+						),
+					),
+				),
+			},
+			args: args{
+				ctx:      context.Background(),
+				targetID: "target-1",
+				keyID:    "key-1",
+			},
+			res: res{},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			c := &Commands{
+				eventstore: tt.fields.eventstore(t),
+			}
+			_, err := c.RemoveTargetPublicKey(tt.args.ctx, tt.args.targetID, tt.args.keyID, tt.args.resourceOwner)
+			assert.ErrorIs(t, err, tt.res.err)
+		})
+	}
+}

internal/command/action_v2_target_model.go

@@ -21,6 +21,7 @@ type TargetWriteModel struct {
 	Timeout          time.Duration
 	InterruptOnError bool
 	SigningKey       *crypto.CryptoValue
+	PayloadType      target_domain.PayloadType
 
 	State domain.TargetState
 }
@@ -45,6 +46,7 @@ func (wm *TargetWriteModel) Reduce() error {
 			wm.Timeout = e.Timeout
 			wm.State = domain.TargetActive
 			wm.SigningKey = e.SigningKey
+			wm.PayloadType = e.PayloadType
 		case *target.ChangedEvent:
 			if e.Name != nil {
 				wm.Name = *e.Name
@@ -64,6 +66,9 @@ func (wm *TargetWriteModel) Reduce() error {
 			if e.SigningKey != nil {
 				wm.SigningKey = e.SigningKey
 			}
+			if e.PayloadType != target_domain.PayloadTypeUnspecified {
+				wm.PayloadType = e.PayloadType
+			}
 		case *target.RemovedEvent:
 			wm.State = domain.TargetRemoved
 		}
@@ -92,6 +97,7 @@ func (wm *TargetWriteModel) NewChangedEvent(
 	timeout *time.Duration,
 	interruptOnError *bool,
 	signingKey *crypto.CryptoValue,
+	payloadType target_domain.PayloadType,
 ) *target.ChangedEvent {
 	changes := make([]target.Changes, 0)
 	if name != nil && wm.Name != *name {
@@ -113,6 +119,9 @@ func (wm *TargetWriteModel) NewChangedEvent(
 	if signingKey != nil {
 		changes = append(changes, target.ChangeSigningKey(signingKey))
 	}
+	if payloadType != target_domain.PayloadTypeUnspecified && wm.PayloadType != payloadType {
+		changes = append(changes, target.ChangePayloadType(payloadType))
+	}
 	if len(changes) == 0 {
 		return nil
 	}

internal/command/action_v2_target_model_test.go

@@ -27,6 +27,7 @@ func targetAddEvent(aggID, resourceOwner string) *target.AddedEvent {
 			KeyID:      "id",
 			Crypted:    []byte("12345678"),
 		},
+		target_domain.PayloadTypeJSON,
 	)
 }
 

internal/command/action_v2_target_test.go

@@ -140,6 +140,7 @@ func TestCommands_AddTarget(t *testing.T) {
 								KeyID:      "id",
 								Crypted:    []byte("12345678"),
 							},
+							target_domain.PayloadTypeJSON,
 						),
 					),
 				),
@@ -150,10 +151,11 @@ func TestCommands_AddTarget(t *testing.T) {
 			args{
 				ctx: context.Background(),
 				add: &AddTarget{
-					Name:       "name",
-					Endpoint:   "https://example.com",
-					Timeout:    time.Second,
-					TargetType: target_domain.TargetTypeWebhook,
+					Name:        "name",
+					Endpoint:    "https://example.com",
+					Timeout:     time.Second,
+					TargetType:  target_domain.TargetTypeWebhook,
+					PayloadType: target_domain.PayloadTypeJSON,
 				},
 				resourceOwner: "instance",
 			},
@@ -203,10 +205,11 @@ func TestCommands_AddTarget(t *testing.T) {
 			args{
 				ctx: context.Background(),
 				add: &AddTarget{
-					Name:       "name",
-					TargetType: target_domain.TargetTypeWebhook,
-					Timeout:    time.Second,
-					Endpoint:   "https://example.com",
+					Name:        "name",
+					TargetType:  target_domain.TargetTypeWebhook,
+					Timeout:     time.Second,
+					Endpoint:    "https://example.com",
+					PayloadType: target_domain.PayloadTypeJSON,
 				},
 				resourceOwner: "instance",
 			},
@@ -239,6 +242,7 @@ func TestCommands_AddTarget(t *testing.T) {
 					Endpoint:         "https://example.com",
 					Timeout:          time.Second,
 					InterruptOnError: true,
+					PayloadType:      target_domain.PayloadTypeJSON,
 				},
 				resourceOwner: "instance",
 			},
@@ -514,6 +518,7 @@ func TestCommands_ChangeTarget(t *testing.T) {
 									KeyID:      "id",
 									Crypted:    []byte("12345678"),
 								}),
+								target.ChangePayloadType(target_domain.PayloadTypeJWE),
 							},
 						),
 					),
@@ -533,6 +538,7 @@ func TestCommands_ChangeTarget(t *testing.T) {
 					Timeout:              gu.Ptr(10 * time.Second),
 					InterruptOnError:     gu.Ptr(true),
 					ExpirationSigningKey: true,
+					PayloadType:          target_domain.PayloadTypeJWE,
 				},
 				resourceOwner: "instance",
 			},