refactor: relational identity provider table and projection (#11739)

backend/v3/storage/database/dialect/postgres/migration/005_identity_providers_table/up.sql

@@ -10,13 +10,11 @@ CREATE TABLE zitadel.identity_providers (
     , state zitadel.idp_state NOT NULL DEFAULT 'active'
     , name TEXT NOT NULL CHECK (name <> '')
     , type SMALLINT DEFAULT NULL
-    , auto_register BOOLEAN NOT NULL DEFAULT TRUE
     , allow_creation BOOLEAN NOT NULL DEFAULT TRUE
     , allow_auto_creation BOOLEAN NOT NULL DEFAULT TRUE
     , allow_auto_update BOOLEAN NOT NULL DEFAULT TRUE
     , allow_linking BOOLEAN NOT NULL DEFAULT TRUE
     , auto_linking_field SMALLINT DEFAULT NULL
-    , styling_type SMALLINT
     , payload JSONB
     
     , created_at TIMESTAMPTZ NOT NULL DEFAULT now()
@@ -25,8 +23,8 @@ CREATE TABLE zitadel.identity_providers (
     , PRIMARY KEY (instance_id, id)
     , CONSTRAINT identity_providers_id_unique UNIQUE NULLS NOT DISTINCT (instance_id, org_id, id)
     , CONSTRAINT identity_providers_name_unique UNIQUE NULLS NOT DISTINCT (instance_id, org_id, name)
-    , FOREIGN KEY (instance_id) REFERENCES zitadel.instances(id)
-    , FOREIGN KEY (instance_id, org_id) REFERENCES zitadel.organizations(instance_id, id)
+    , FOREIGN KEY (instance_id) REFERENCES zitadel.instances(id) ON DELETE CASCADE
+    , FOREIGN KEY (instance_id, org_id) REFERENCES zitadel.organizations(instance_id, id) ON DELETE CASCADE
 );
 
 -- CREATE INDEX idx_identity_providers_org_id ON identity_providers(instance_id, org_id) WHERE org_id IS NOT NULL;

backend/v3/storage/database/events_testing/id_provider_instance_test.go

@@ -145,7 +145,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		name := gofakeit.Name()
 
 		before := time.Now()
-		addOIDC, err := AdminClient.AddOIDCIDP(IAMCTX, defaultOIDCIDReq(name, true))
+		addOIDC, err := AdminClient.AddOIDCIDP(IAMCTX, defaultOIDCIDPReq(name, true))
 		after := time.Now()
 		require.NoError(t, err)
 
@@ -153,11 +153,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			idp, err := idpRepo.Get(IAMCTX, pool,
-				idpRepo.NameCondition(name),
-				instanceID,
-				nil,
-			)
+			idp, err := idpRepo.Get(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.NameCondition(database.TextOperationEqual, name))))
 			require.NoError(t, err)
 
 			// event iam.idp.config.added
@@ -166,12 +162,10 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 			assert.Equal(t, addOIDC.IdpId, idp.ID)
 			assert.Equal(t, domain.IDPStateActive, idp.State)
 			assert.Equal(t, name, idp.Name)
-			assert.Equal(t, true, idp.AutoRegister)
 			assert.Equal(t, true, idp.AllowCreation)
 			assert.Equal(t, false, idp.AllowAutoUpdate)
 			assert.Equal(t, true, idp.AllowLinking)
 			assert.Nil(t, idp.AutoLinkingField)
-			assert.Equal(t, int16(idp_grpc.IDPStylingType_STYLING_TYPE_GOOGLE), *idp.StylingType)
 			assert.WithinRange(t, idp.UpdatedAt, before, after)
 			assert.WithinRange(t, idp.CreatedAt, before, after)
 		}, retryDuration, tick)
@@ -180,7 +174,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 	t.Run("test instance idp update reduces", func(t *testing.T) {
 		name := gofakeit.Name()
 
-		addOIDC, err := AdminClient.AddOIDCIDP(IAMCTX, defaultOIDCIDReq(name, true))
+		addOIDC, err := AdminClient.AddOIDCIDP(IAMCTX, defaultOIDCIDPReq(name, true))
 		require.NoError(t, err)
 
 		name = "new_" + name
@@ -199,18 +193,12 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			idp, err := idpRepo.Get(IAMCTX, pool,
-				idpRepo.NameCondition(name),
-				instanceID,
-				nil,
-			)
+			idp, err := idpRepo.Get(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.NameCondition(database.TextOperationEqual, name))))
 			require.NoError(t, err)
 
 			// event iam.idp.config.changed
 			assert.Equal(t, addOIDC.IdpId, idp.ID)
 			assert.Equal(t, name, idp.Name)
-			assert.Equal(t, false, idp.AutoRegister)
-			assert.Equal(t, int16(idp_grpc.IDPStylingType_STYLING_TYPE_UNSPECIFIED), *idp.StylingType)
 			assert.WithinRange(t, idp.UpdatedAt, before, after)
 		}, retryDuration, tick)
 	})
@@ -218,7 +206,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 	t.Run("test instance idp deactivate reduces", func(t *testing.T) {
 		name := gofakeit.Name()
 
-		addOIDC, err := AdminClient.AddOIDCIDP(IAMCTX, defaultOIDCIDReq(name, true))
+		addOIDC, err := AdminClient.AddOIDCIDP(IAMCTX, defaultOIDCIDPReq(name, true))
 		require.NoError(t, err)
 
 		// deactivate idp
@@ -233,11 +221,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			idp, err := idpRepo.Get(IAMCTX, pool,
-				idpRepo.IDCondition(addOIDC.IdpId),
-				instanceID,
-				nil,
-			)
+			idp, err := idpRepo.Get(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addOIDC.IdpId))))
 			require.NoError(t, err)
 
 			// event iam.idp.config.deactivated
@@ -250,7 +234,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 	t.Run("test instance idp config reactivate reduces", func(t *testing.T) {
 		name := gofakeit.Name()
 
-		addOIDC, err := AdminClient.AddOIDCIDP(IAMCTX, defaultOIDCIDReq(name, true))
+		addOIDC, err := AdminClient.AddOIDCIDP(IAMCTX, defaultOIDCIDPReq(name, true))
 		require.NoError(t, err)
 
 		idpRepo := repository.IDProviderRepository()
@@ -263,11 +247,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		// wait for idp to be deactivated
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			idp, err := idpRepo.Get(IAMCTX, pool,
-				idpRepo.IDCondition(addOIDC.IdpId),
-				instanceID,
-				nil,
-			)
+			idp, err := idpRepo.Get(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addOIDC.IdpId))))
 			require.NoError(t, err)
 
 			assert.Equal(t, addOIDC.IdpId, idp.ID)
@@ -284,11 +264,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 
 		retryDuration, tick = integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			idp, err := idpRepo.Get(IAMCTX, pool,
-				idpRepo.IDCondition(addOIDC.IdpId),
-				instanceID,
-				nil,
-			)
+			idp, err := idpRepo.Get(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addOIDC.IdpId))))
 			require.NoError(t, err)
 
 			// event iam.idp.config.reactivated
@@ -302,10 +278,16 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		name := gofakeit.Name()
 
 		// add idp
-		addOIDC, err := AdminClient.AddOIDCIDP(IAMCTX, defaultOIDCIDReq(name, true))
+		addOIDC, err := AdminClient.AddOIDCIDP(IAMCTX, defaultOIDCIDPReq(name, true))
 		require.NoError(t, err)
 
 		idpRepo := repository.IDProviderRepository()
+		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
+		assert.EventuallyWithT(t, func(t *assert.CollectT) {
+			_, err := idpRepo.Get(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addOIDC.IdpId))))
+
+			require.NoError(t, err)
+		}, retryDuration, tick)
 
 		// remove idp
 		_, err = AdminClient.RemoveIDP(IAMCTX, &admin.RemoveIDPRequest{
@@ -313,13 +295,9 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		})
 		require.NoError(t, err)
 
-		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
+		retryDuration, tick = integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			_, err := idpRepo.Get(IAMCTX, pool,
-				idpRepo.IDCondition(addOIDC.IdpId),
-				instanceID,
-				nil,
-			)
+			_, err := idpRepo.Get(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addOIDC.IdpId))))
 
 			// event iam.idp.config.remove
 			require.ErrorIs(t, &database.NoRowFoundError{}, err)
@@ -330,18 +308,14 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		name := gofakeit.Name()
 
 		// add oidc
-		addOIDC, err := AdminClient.AddOIDCIDP(IAMCTX, defaultOIDCIDReq(name, false))
+		addOIDC, err := AdminClient.AddOIDCIDP(IAMCTX, defaultOIDCIDPReq(name, false))
 		require.NoError(t, err)
 
 		idpRepo := repository.IDProviderRepository()
 
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			oidc, err := idpRepo.GetOIDC(IAMCTX, pool,
-				idpRepo.IDCondition(addOIDC.IdpId),
-				instanceID,
-				nil,
-			)
+			oidc, err := idpRepo.GetOIDC(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addOIDC.IdpId))))
 			require.NoError(t, err)
 
 			// event org.idp.oidc.config.added
@@ -356,8 +330,6 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 			assert.Equal(t, "issuer", oidc.Issuer)
 			assert.Equal(t, "clientID", oidc.ClientID)
 			assert.Equal(t, []string{"scope"}, oidc.Scopes)
-			assert.Equal(t, int16(idp_grpc.IDPStylingType_STYLING_TYPE_GOOGLE), *oidc.StylingType)
-			assert.Equal(t, false, oidc.AutoRegister)
 			assert.Equal(t, domain.OIDCMappingField(idp.OIDCMappingField_OIDC_MAPPING_FIELD_EMAIL), oidc.IDPDisplayNameMapping)
 			assert.Equal(t, domain.OIDCMappingField(idp.OIDCMappingField_OIDC_MAPPING_FIELD_EMAIL), oidc.UserNameMapping)
 		}, retryDuration, tick)
@@ -367,16 +339,16 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		name := gofakeit.Name()
 
 		// add oidc
-		addOIDC, err := AdminClient.AddOIDCIDP(IAMCTX, defaultOIDCIDReq(name, true))
+		addOIDC, err := AdminClient.AddOIDCIDP(IAMCTX, defaultOIDCIDPReq(name, true))
 		require.NoError(t, err)
 
 		idpRepo := repository.IDProviderRepository()
 
-		// check original values for OCID
+		// ensure oidc is added before updating
 		var oidc *domain.IDPOIDC
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			oidc, err = idpRepo.GetOIDC(IAMCTX, pool, idpRepo.IDCondition(addOIDC.IdpId), instanceID, nil)
+			oidc, err = idpRepo.GetOIDC(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addOIDC.IdpId))))
 			require.NoError(t, err)
 			assert.Equal(t, addOIDC.IdpId, oidc.ID)
 		}, retryDuration, tick)
@@ -396,14 +368,9 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 
 		retryDuration, tick = integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			updateOIDC, err := idpRepo.GetOIDC(IAMCTX, pool,
-				idpRepo.IDCondition(addOIDC.IdpId),
-				instanceID,
-				nil,
-			)
+			updateOIDC, err := idpRepo.GetOIDC(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addOIDC.IdpId))))
 			require.NoError(t, err)
 
-			// event org.idp.oidc.config.changed
 			// idp
 			assert.Equal(t, instanceID, oidc.InstanceID)
 			assert.Nil(t, oidc.OrgID)
@@ -444,11 +411,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			jwt, err := idpRepo.GetJWT(IAMCTX, pool,
-				idpRepo.IDCondition(addJWT.IdpId),
-				instanceID,
-				nil,
-			)
+			jwt, err := idpRepo.GetJWT(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addJWT.IdpId))))
 			require.NoError(t, err)
 
 			// event iam.idp.jwt.config.added
@@ -458,7 +421,6 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 			assert.Equal(t, name, jwt.Name)
 			assert.Equal(t, addJWT.IdpId, jwt.ID)
 			assert.Equal(t, domain.IDPTypeJWT, domain.IDPType(*jwt.Type))
-			assert.Equal(t, int16(idp_grpc.IDPStylingType_STYLING_TYPE_GOOGLE), *jwt.StylingType)
 
 			// jwt
 			assert.Equal(t, "jwtEndpoint", jwt.JWTEndpoint)
@@ -498,11 +460,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			updateJWT, err := idpRepo.GetJWT(IAMCTX, pool,
-				idpRepo.IDCondition(addJWT.IdpId),
-				instanceID,
-				nil,
-			)
+			updateJWT, err := idpRepo.GetJWT(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addJWT.IdpId))))
 			require.NoError(t, err)
 
 			// event iam.idp.jwt.config.changed
@@ -551,7 +509,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		var oauth *domain.IDPOAuth
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			oauth, err = idpRepo.GetOAuth(IAMCTX, pool, idpRepo.IDCondition(addOAuth.Id), instanceID, nil)
+			oauth, err = idpRepo.GetOAuth(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addOAuth.Id))))
 			require.NoError(t, err)
 
 			// event instance.idp.oauth.added
@@ -610,7 +568,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		var oauth *domain.IDPOAuth
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			oauth, err = idpRepo.GetOAuth(IAMCTX, pool, idpRepo.IDCondition(addOAuth.Id), instanceID, nil)
+			oauth, err = idpRepo.GetOAuth(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addOAuth.Id))))
 			require.NoError(t, err)
 			assert.Equal(t, addOAuth.Id, oauth.ID)
 		}, retryDuration, tick)
@@ -641,11 +599,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 
 		retryDuration, tick = integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			updateOauth, err := idpRepo.GetOAuth(IAMCTX, pool,
-				idpRepo.IDCondition(addOAuth.Id),
-				instanceID,
-				nil,
-			)
+			updateOauth, err := idpRepo.GetOAuth(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addOAuth.Id))))
 			require.NoError(t, err)
 
 			// event instance.idp.oauth.changed
@@ -658,7 +612,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 			assert.Equal(t, true, updateOauth.AllowLinking)
 			assert.Equal(t, true, updateOauth.AllowCreation)
 			assert.Equal(t, true, updateOauth.AllowAutoUpdate)
-			assert.Equal(t, domain.IDPAutoLinkingFieldUserName, domain.IDPAutoLinkingField(*updateOauth.AutoLinkingField))
+			assert.Equal(t, domain.IDPAutoLinkingFieldUsername, domain.IDPAutoLinkingField(*updateOauth.AutoLinkingField))
 			assert.Equal(t, true, updateOauth.UsePKCE)
 			assert.WithinRange(t, updateOauth.UpdatedAt, before, after)
 
@@ -701,7 +655,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		// check values for oidc
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			oidc, err := idpRepo.GetOIDC(IAMCTX, pool, idpRepo.IDCondition(addOIDC.Id), instanceID, nil)
+			oidc, err := idpRepo.GetOIDC(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addOIDC.Id))))
 			require.NoError(t, err)
 
 			// event instance.idp.oidc added
@@ -729,7 +683,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		}, retryDuration, tick)
 	})
 
-	t.Run("test instanceidp oidc changed reduces", func(t *testing.T) {
+	t.Run("test instance idp oidc changed reduces", func(t *testing.T) {
 		name := gofakeit.Name()
 
 		addOIDC, err := AdminClient.AddGenericOIDCProvider(IAMCTX, &admin.AddGenericOIDCProviderRequest{
@@ -756,7 +710,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		var oidc *domain.IDPOIDC
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			oidc, err = idpRepo.GetOIDC(IAMCTX, pool, idpRepo.IDCondition(addOIDC.Id), instanceID, nil)
+			oidc, err = idpRepo.GetOIDC(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addOIDC.Id))))
 			require.NoError(t, err)
 		}, retryDuration, tick)
 
@@ -784,11 +738,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 
 		retryDuration, tick = integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			updateOIDC, err := idpRepo.GetOIDC(IAMCTX, pool,
-				idpRepo.IDCondition(addOIDC.Id),
-				instanceID,
-				nil,
-			)
+			updateOIDC, err := idpRepo.GetOIDC(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addOIDC.Id))))
 			require.NoError(t, err)
 
 			// event instance.idp.oidc.changed
@@ -801,7 +751,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 			assert.Equal(t, true, updateOIDC.AllowLinking)
 			assert.Equal(t, true, updateOIDC.AllowCreation)
 			assert.Equal(t, true, updateOIDC.AllowAutoUpdate)
-			assert.Equal(t, domain.IDPAutoLinkingFieldUserName, domain.IDPAutoLinkingField(*updateOIDC.AutoLinkingField))
+			assert.Equal(t, domain.IDPAutoLinkingFieldUsername, domain.IDPAutoLinkingField(*updateOIDC.AutoLinkingField))
 			assert.WithinRange(t, updateOIDC.UpdatedAt, before, after)
 
 			// oidc
@@ -841,7 +791,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		var oidc *domain.IDPOIDC
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			oidc, err = idpRepo.GetOIDC(IAMCTX, pool, idpRepo.IDCondition(addOIDC.Id), instanceID, nil)
+			oidc, err = idpRepo.GetOIDC(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addOIDC.Id))))
 			require.NoError(t, err)
 			assert.Equal(t, domain.IDPTypeOIDC, domain.IDPType(*oidc.Type))
 		}, retryDuration, tick)
@@ -876,7 +826,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 
 		retryDuration, tick = integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			azure, err := idpRepo.GetAzureAD(IAMCTX, pool, idpRepo.IDCondition(addOIDC.Id), instanceID, nil)
+			azure, err := idpRepo.GetAzureAD(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addOIDC.Id))))
 			require.NoError(t, err)
 
 			// event instance.idp.oidc.migrated.azure
@@ -890,7 +840,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 			assert.Equal(t, true, azure.AllowLinking)
 			assert.Equal(t, true, azure.AllowCreation)
 			assert.Equal(t, true, azure.AllowAutoUpdate)
-			assert.Equal(t, domain.IDPAutoLinkingFieldUserName, domain.IDPAutoLinkingField(*azure.AutoLinkingField))
+			assert.Equal(t, domain.IDPAutoLinkingFieldUsername, domain.IDPAutoLinkingField(*azure.AutoLinkingField))
 			assert.WithinRange(t, azure.UpdatedAt, before, after)
 
 			// oidc
@@ -929,7 +879,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		var oidc *domain.IDPOIDC
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			oidc, err = idpRepo.GetOIDC(IAMCTX, pool, idpRepo.IDCondition(addOIDC.Id), instanceID, nil)
+			oidc, err = idpRepo.GetOIDC(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addOIDC.Id))))
 			require.NoError(t, err)
 			assert.Equal(t, domain.IDPTypeOIDC, domain.IDPType(*oidc.Type))
 		}, retryDuration, tick)
@@ -958,7 +908,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 
 		retryDuration, tick = integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			google, err := idpRepo.GetGoogle(IAMCTX, pool, idpRepo.IDCondition(addOIDC.Id), instanceID, nil)
+			google, err := idpRepo.GetGoogle(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addOIDC.Id))))
 			require.NoError(t, err)
 
 			// event instance.idp.oidc.migrated.google
@@ -972,7 +922,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 			assert.Equal(t, true, google.AllowLinking)
 			assert.Equal(t, true, google.AllowCreation)
 			assert.Equal(t, true, google.AllowAutoUpdate)
-			assert.Equal(t, domain.IDPAutoLinkingFieldUserName, domain.IDPAutoLinkingField(*google.AutoLinkingField))
+			assert.Equal(t, domain.IDPAutoLinkingFieldUsername, domain.IDPAutoLinkingField(*google.AutoLinkingField))
 			assert.WithinRange(t, google.UpdatedAt, before, after)
 
 			// oidc
@@ -1009,7 +959,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		// check values for jwt
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			jwt, err := idpRepo.GetJWT(IAMCTX, pool, idpRepo.IDCondition(addJWT.Id), instanceID, nil)
+			jwt, err := idpRepo.GetJWT(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addJWT.Id))))
 			require.NoError(t, err)
 
 			// event instance.idp.jwt.added
@@ -1080,7 +1030,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		// check values for jwt
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			jwt, err := idpRepo.GetJWT(IAMCTX, pool, idpRepo.IDCondition(addJWT.Id), instanceID, nil)
+			jwt, err := idpRepo.GetJWT(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addJWT.Id))))
 			require.NoError(t, err)
 
 			// event instance.idp.jwt.added
@@ -1093,7 +1043,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 			assert.Equal(t, true, jwt.AllowLinking)
 			assert.Equal(t, true, jwt.AllowCreation)
 			assert.Equal(t, true, jwt.AllowAutoUpdate)
-			assert.Equal(t, domain.IDPAutoLinkingFieldUserName, domain.IDPAutoLinkingField(*jwt.AutoLinkingField))
+			assert.Equal(t, domain.IDPAutoLinkingFieldUsername, domain.IDPAutoLinkingField(*jwt.AutoLinkingField))
 			assert.WithinRange(t, jwt.UpdatedAt, before, after)
 
 			// jwt
@@ -1136,7 +1086,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		// check values for azure
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			azure, err := idpRepo.GetAzureAD(IAMCTX, pool, idpRepo.IDCondition(addAzure.Id), instanceID, nil)
+			azure, err := idpRepo.GetAzureAD(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addAzure.Id))))
 			require.NoError(t, err)
 
 			// event instance.idp.azure.added
@@ -1149,7 +1099,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 			assert.Equal(t, true, azure.AllowLinking)
 			assert.Equal(t, true, azure.AllowCreation)
 			assert.Equal(t, true, azure.AllowAutoUpdate)
-			assert.Equal(t, domain.IDPAutoLinkingFieldUserName, domain.IDPAutoLinkingField(*azure.AutoLinkingField))
+			assert.Equal(t, domain.IDPAutoLinkingFieldUsername, domain.IDPAutoLinkingField(*azure.AutoLinkingField))
 			assert.WithinRange(t, azure.UpdatedAt, before, after)
 
 			// azure
@@ -1191,7 +1141,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		var azure *domain.IDPAzureAD
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			azure, err = idpRepo.GetAzureAD(IAMCTX, pool, idpRepo.IDCondition(addAzure.Id), instanceID, nil)
+			azure, err = idpRepo.GetAzureAD(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addAzure.Id))))
 			require.NoError(t, err)
 			assert.Equal(t, addAzure.Id, azure.ID)
 		}, retryDuration, tick)
@@ -1225,7 +1175,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		// check values for azure
 		retryDuration, tick = integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			updateAzure, err := idpRepo.GetAzureAD(IAMCTX, pool, idpRepo.IDCondition(addAzure.Id), instanceID, nil)
+			updateAzure, err := idpRepo.GetAzureAD(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addAzure.Id))))
 			require.NoError(t, err)
 
 			// event instance.idp.azure.changed
@@ -1276,7 +1226,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		// check values for github
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			github, err := idpRepo.GetGithub(IAMCTX, pool, idpRepo.IDCondition(addGithub.Id), instanceID, nil)
+			github, err := idpRepo.GetGithub(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addGithub.Id))))
 			require.NoError(t, err)
 
 			// event instance.idp.github.added
@@ -1289,7 +1239,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 			assert.Equal(t, false, github.AllowLinking)
 			assert.Equal(t, false, github.AllowCreation)
 			assert.Equal(t, false, github.AllowAutoUpdate)
-			assert.Equal(t, domain.IDPAutoLinkingFieldUserName, domain.IDPAutoLinkingField(*github.AutoLinkingField))
+			assert.Equal(t, domain.IDPAutoLinkingFieldUsername, domain.IDPAutoLinkingField(*github.AutoLinkingField))
 			assert.WithinRange(t, github.UpdatedAt, before, after)
 
 			assert.Equal(t, "clientId", github.ClientID)
@@ -1322,7 +1272,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		var github *domain.IDPGithub
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			github, err = idpRepo.GetGithub(IAMCTX, pool, idpRepo.IDCondition(addGithub.Id), instanceID, nil)
+			github, err = idpRepo.GetGithub(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addGithub.Id))))
 			require.NoError(t, err)
 			assert.Equal(t, addGithub.Id, github.ID)
 		}, retryDuration, tick)
@@ -1350,7 +1300,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		// check values for azure
 		retryDuration, tick = integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			updateGithub, err := idpRepo.GetGithub(IAMCTX, pool, idpRepo.IDCondition(addGithub.Id), instanceID, nil)
+			updateGithub, err := idpRepo.GetGithub(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addGithub.Id))))
 			require.NoError(t, err)
 
 			// event instance.idp.github.changed
@@ -1363,7 +1313,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 			assert.Equal(t, true, updateGithub.AllowLinking)
 			assert.Equal(t, true, updateGithub.AllowCreation)
 			assert.Equal(t, true, updateGithub.AllowAutoUpdate)
-			assert.Equal(t, domain.IDPAutoLinkingFieldUserName, domain.IDPAutoLinkingField(*updateGithub.AutoLinkingField))
+			assert.Equal(t, domain.IDPAutoLinkingFieldUsername, domain.IDPAutoLinkingField(*updateGithub.AutoLinkingField))
 			assert.WithinRange(t, updateGithub.UpdatedAt, before, after)
 
 			// github
@@ -1402,7 +1352,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		// check values for github enterprise
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			githubEnterprise, err := idpRepo.GetGithubEnterprise(IAMCTX, pool, idpRepo.IDCondition(addGithubEnterprise.Id), instanceID, nil)
+			githubEnterprise, err := idpRepo.GetGithubEnterprise(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addGithubEnterprise.Id))))
 			require.NoError(t, err)
 
 			// event instance.idp.github_enterprise.added
@@ -1456,7 +1406,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		var githubEnterprise *domain.IDPGithubEnterprise
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			githubEnterprise, err = idpRepo.GetGithubEnterprise(IAMCTX, pool, idpRepo.IDCondition(addGithubEnterprise.Id), instanceID, nil)
+			githubEnterprise, err = idpRepo.GetGithubEnterprise(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addGithubEnterprise.Id))))
 			require.NoError(t, err)
 			assert.Equal(t, addGithubEnterprise.Id, githubEnterprise.ID)
 		}, retryDuration, tick)
@@ -1487,7 +1437,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		// check values for azure
 		retryDuration, tick = integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			updateGithubEnterprise, err := idpRepo.GetGithubEnterprise(IAMCTX, pool, idpRepo.IDCondition(addGithubEnterprise.Id), instanceID, nil)
+			updateGithubEnterprise, err := idpRepo.GetGithubEnterprise(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addGithubEnterprise.Id))))
 			require.NoError(t, err)
 
 			// event instance.idp.github_enterprise.changed
@@ -1539,7 +1489,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		// check values for gitlab
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			gitlab, err := idpRepo.GetGitlab(IAMCTX, pool, idpRepo.IDCondition(addGithub.Id), instanceID, nil)
+			gitlab, err := idpRepo.GetGitlab(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addGithub.Id))))
 			require.NoError(t, err)
 
 			// event instance.idp.gitlab.added
@@ -1587,7 +1537,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		var githlab *domain.IDPGitlab
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			githlab, err = idpRepo.GetGitlab(IAMCTX, pool, idpRepo.IDCondition(addGitlab.Id), instanceID, nil)
+			githlab, err = idpRepo.GetGitlab(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addGitlab.Id))))
 			require.NoError(t, err)
 			assert.Equal(t, addGitlab.Id, githlab.ID)
 		}, retryDuration, tick)
@@ -1615,7 +1565,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		// check values for gitlab
 		retryDuration, tick = integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			updateGitlab, err := idpRepo.GetGitlab(IAMCTX, pool, idpRepo.IDCondition(addGitlab.Id), instanceID, nil)
+			updateGitlab, err := idpRepo.GetGitlab(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addGitlab.Id))))
 			require.NoError(t, err)
 
 			// event instance.idp.gitlab.changed
@@ -1627,7 +1577,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 			assert.Equal(t, true, updateGitlab.AllowLinking)
 			assert.Equal(t, true, updateGitlab.AllowCreation)
 			assert.Equal(t, true, updateGitlab.AllowAutoUpdate)
-			assert.Equal(t, domain.IDPAutoLinkingFieldUserName, domain.IDPAutoLinkingField(*updateGitlab.AutoLinkingField))
+			assert.Equal(t, domain.IDPAutoLinkingFieldUsername, domain.IDPAutoLinkingField(*updateGitlab.AutoLinkingField))
 			assert.WithinRange(t, updateGitlab.UpdatedAt, before, after)
 
 			// gitlab
@@ -1665,7 +1615,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		// check values for gitlab self hosted
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			gitlabSelfHosted, err := idpRepo.GetGitlabSelfHosting(IAMCTX, pool, idpRepo.IDCondition(addGitlabSelfHosted.Id), instanceID, nil)
+			gitlabSelfHosted, err := idpRepo.GetGitlabSelfHosted(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addGitlabSelfHosted.Id))))
 			require.NoError(t, err)
 
 			// event instance.idp.gitlab_self_hosted.added
@@ -1712,10 +1662,10 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 
 		idpRepo := repository.IDProviderRepository()
 
-		var githlabSelfHosted *domain.IDPGitlabSelfHosting
+		var githlabSelfHosted *domain.IDPGitlabSelfHosted
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			githlabSelfHosted, err = idpRepo.GetGitlabSelfHosting(IAMCTX, pool, idpRepo.IDCondition(addGitlabSelfHosted.Id), instanceID, nil)
+			githlabSelfHosted, err = idpRepo.GetGitlabSelfHosted(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addGitlabSelfHosted.Id))))
 			require.NoError(t, err)
 			assert.Equal(t, addGitlabSelfHosted.Id, githlabSelfHosted.ID)
 		}, retryDuration, tick)
@@ -1744,7 +1694,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		// check values for gitlab self hosted
 		retryDuration, tick = integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			updateGitlabSelfHosted, err := idpRepo.GetGitlabSelfHosting(IAMCTX, pool, idpRepo.IDCondition(addGitlabSelfHosted.Id), instanceID, nil)
+			updateGitlabSelfHosted, err := idpRepo.GetGitlabSelfHosted(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addGitlabSelfHosted.Id))))
 			require.NoError(t, err)
 
 			// event instance.idp.gitlab_self_hosted.changed
@@ -1757,7 +1707,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 			assert.Equal(t, true, updateGitlabSelfHosted.AllowLinking)
 			assert.Equal(t, true, updateGitlabSelfHosted.AllowCreation)
 			assert.Equal(t, true, updateGitlabSelfHosted.AllowAutoUpdate)
-			assert.Equal(t, domain.IDPAutoLinkingFieldUserName, domain.IDPAutoLinkingField(*updateGitlabSelfHosted.AutoLinkingField))
+			assert.Equal(t, domain.IDPAutoLinkingFieldUsername, domain.IDPAutoLinkingField(*updateGitlabSelfHosted.AutoLinkingField))
 			assert.WithinRange(t, updateGitlabSelfHosted.UpdatedAt, before, after)
 
 			// gitlab self hosted
@@ -1794,7 +1744,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		// check values for google
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			google, err := idpRepo.GetGoogle(IAMCTX, pool, idpRepo.IDCondition(addGoogle.Id), instanceID, nil)
+			google, err := idpRepo.GetGoogle(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addGoogle.Id))))
 			require.NoError(t, err)
 
 			// event instance.idp.google.added
@@ -1842,7 +1792,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		var google *domain.IDPGoogle
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			google, err = idpRepo.GetGoogle(IAMCTX, pool, idpRepo.IDCondition(addGoogle.Id), instanceID, nil)
+			google, err = idpRepo.GetGoogle(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addGoogle.Id))))
 			require.NoError(t, err)
 			assert.Equal(t, addGoogle.Id, google.ID)
 		}, retryDuration, tick)
@@ -1870,7 +1820,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		// check values for google
 		retryDuration, tick = integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			updateGoogle, err := idpRepo.GetGoogle(IAMCTX, pool, idpRepo.IDCondition(addGoogle.Id), instanceID, nil)
+			updateGoogle, err := idpRepo.GetGoogle(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addGoogle.Id))))
 			require.NoError(t, err)
 
 			// event instance.idp.google.changed
@@ -1883,7 +1833,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 			assert.Equal(t, true, updateGoogle.AllowLinking)
 			assert.Equal(t, true, updateGoogle.AllowCreation)
 			assert.Equal(t, true, updateGoogle.AllowAutoUpdate)
-			assert.Equal(t, domain.IDPAutoLinkingFieldUserName, domain.IDPAutoLinkingField(*updateGoogle.AutoLinkingField))
+			assert.Equal(t, domain.IDPAutoLinkingFieldUsername, domain.IDPAutoLinkingField(*updateGoogle.AutoLinkingField))
 			assert.WithinRange(t, updateGoogle.UpdatedAt, before, after)
 
 			// google
@@ -1906,7 +1856,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			ldap, err := idpRepo.GetLDAP(IAMCTX, pool, idpRepo.IDCondition(addLdap.Id), instanceID, nil)
+			ldap, err := idpRepo.GetLDAP(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addLdap.Id))))
 			require.NoError(t, err)
 
 			// event instance.idp.ldap.v2.added
@@ -1961,7 +1911,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		var ldap *domain.IDPLDAP
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			ldap, err = idpRepo.GetLDAP(IAMCTX, pool, idpRepo.IDCondition(addLdap.Id), instanceID, nil)
+			ldap, err = idpRepo.GetLDAP(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addLdap.Id))))
 			require.NoError(t, err)
 			assert.Equal(t, addLdap.Id, ldap.ID)
 		}, retryDuration, tick)
@@ -2010,7 +1960,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		// check values for ldap
 		retryDuration, tick = integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			updateLdap, err := idpRepo.GetLDAP(IAMCTX, pool, idpRepo.IDCondition(addLdap.Id), instanceID, nil)
+			updateLdap, err := idpRepo.GetLDAP(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addLdap.Id))))
 			require.NoError(t, err)
 
 			// event instance.idp.ldap.v2.changed
@@ -2023,7 +1973,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 			assert.Equal(t, true, updateLdap.AllowLinking)
 			assert.Equal(t, true, updateLdap.AllowCreation)
 			assert.Equal(t, true, updateLdap.AllowAutoUpdate)
-			assert.Equal(t, domain.IDPAutoLinkingFieldUserName, domain.IDPAutoLinkingField(*updateLdap.AutoLinkingField))
+			assert.Equal(t, domain.IDPAutoLinkingFieldUsername, domain.IDPAutoLinkingField(*updateLdap.AutoLinkingField))
 			assert.WithinRange(t, updateLdap.UpdatedAt, before, after)
 
 			// ldap
@@ -2079,7 +2029,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			apple, err := idpRepo.GetApple(IAMCTX, pool, idpRepo.IDCondition(addApple.Id), instanceID, nil)
+			apple, err := idpRepo.GetApple(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addApple.Id))))
 			require.NoError(t, err)
 
 			// event instance.idp.apple.added
@@ -2131,7 +2081,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		var apple *domain.IDPApple
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			apple, err = idpRepo.GetApple(IAMCTX, pool, idpRepo.IDCondition(addApple.Id), instanceID, nil)
+			apple, err = idpRepo.GetApple(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addApple.Id))))
 			require.NoError(t, err)
 			assert.Equal(t, addApple.Id, apple.ID)
 		}, retryDuration, tick)
@@ -2161,7 +2111,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		// check values for apple
 		retryDuration, tick = integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			updateApple, err := idpRepo.GetApple(IAMCTX, pool, idpRepo.IDCondition(addApple.Id), instanceID, nil)
+			updateApple, err := idpRepo.GetApple(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addApple.Id))))
 			require.NoError(t, err)
 
 			// event nstance.idp.apple.changed
@@ -2174,7 +2124,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 			assert.Equal(t, true, updateApple.AllowLinking)
 			assert.Equal(t, true, updateApple.AllowCreation)
 			assert.Equal(t, true, updateApple.AllowAutoUpdate)
-			assert.Equal(t, domain.IDPAutoLinkingFieldUserName, domain.IDPAutoLinkingField(*updateApple.AutoLinkingField))
+			assert.Equal(t, domain.IDPAutoLinkingFieldUsername, domain.IDPAutoLinkingField(*updateApple.AutoLinkingField))
 			assert.WithinRange(t, updateApple.UpdatedAt, before, after)
 
 			// apple
@@ -2200,7 +2150,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			saml, err := idpRepo.GetSAML(IAMCTX, pool, idpRepo.IDCondition(addSAML.Id), instanceID, nil)
+			saml, err := idpRepo.GetSAML(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addSAML.Id))))
 			require.NoError(t, err)
 
 			// event instance.idp.saml.added
@@ -2243,7 +2193,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		var saml *domain.IDPSAML
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			saml, err = idpRepo.GetSAML(IAMCTX, pool, idpRepo.IDCondition(addSAML.Id), instanceID, nil)
+			saml, err = idpRepo.GetSAML(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addSAML.Id))))
 			require.NoError(t, err)
 			assert.Equal(t, addSAML.Id, saml.ID)
 		}, retryDuration, tick)
@@ -2278,7 +2228,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		// check values for apple
 		retryDuration, tick = integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			updateSAML, err := idpRepo.GetSAML(IAMCTX, pool, idpRepo.IDCondition(addSAML.Id), instanceID, nil)
+			updateSAML, err := idpRepo.GetSAML(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addSAML.Id))))
 			require.NoError(t, err)
 
 			// event instance.idp.saml.changed
@@ -2291,7 +2241,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 			assert.Equal(t, true, updateSAML.AllowLinking)
 			assert.Equal(t, true, updateSAML.AllowCreation)
 			assert.Equal(t, true, updateSAML.AllowAutoUpdate)
-			assert.Equal(t, domain.IDPAutoLinkingFieldUserName, domain.IDPAutoLinkingField(*updateSAML.AutoLinkingField))
+			assert.Equal(t, domain.IDPAutoLinkingFieldUsername, domain.IDPAutoLinkingField(*updateSAML.AutoLinkingField))
 			assert.WithinRange(t, updateSAML.UpdatedAt, before, after)
 
 			// saml
@@ -2312,7 +2262,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		name := gofakeit.Name()
 
 		// add idp
-		addOIDC, err := AdminClient.AddOIDCIDP(IAMCTX, defaultOIDCIDReq(name, true))
+		addOIDC, err := AdminClient.AddOIDCIDP(IAMCTX, defaultOIDCIDPReq(name, true))
 		require.NoError(t, err)
 
 		idpRepo := repository.IDProviderRepository()
@@ -2320,11 +2270,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		// check idp exists
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			_, err := idpRepo.Get(IAMCTX, pool,
-				idpRepo.IDCondition(addOIDC.IdpId),
-				instanceID,
-				nil,
-			)
+			_, err := idpRepo.Get(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addOIDC.IdpId))))
 			require.NoError(t, err)
 		}, retryDuration, tick)
 
@@ -2337,11 +2283,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		// check idp is removed
 		retryDuration, tick = integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			_, err := idpRepo.Get(IAMCTX, pool,
-				idpRepo.IDCondition(addOIDC.IdpId),
-				instanceID,
-				nil,
-			)
+			_, err := idpRepo.Get(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.IDCondition(addOIDC.IdpId))))
 			require.ErrorIs(t, &database.NoRowFoundError{}, err)
 		}, retryDuration, tick)
 	})
@@ -2369,7 +2311,7 @@ func defaultInstanceSAMLRequest(name string, federatedLogoutEnable *bool) *admin
 	}
 }
 
-func defaultOIDCIDReq(name string, autoRegister bool) *admin.AddOIDCIDPRequest {
+func defaultOIDCIDPReq(name string, autoRegister bool) *admin.AddOIDCIDPRequest {
 	return &admin.AddOIDCIDPRequest{
 		Name:               name,
 		StylingType:        idp_grpc.IDPStylingType_STYLING_TYPE_GOOGLE,

backend/v3/storage/database/events_testing/id_provider_org_test.go

@@ -25,7 +25,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 	instanceID := Instance.ID()
 	orgID := Instance.DefaultOrg.Id
 
-	t.Run("test instance idp add reduces", func(t *testing.T) {
+	t.Run("test org idp add reduces", func(t *testing.T) {
 		name := gofakeit.Name()
 
 		before := time.Now()
@@ -47,11 +47,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			idp, err := idpRepo.Get(IAMCTX, pool,
-				idpRepo.NameCondition(name),
-				instanceID,
-				&orgID,
-			)
+			idp, err := idpRepo.Get(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.NameCondition(database.TextOperationEqual, name))))
 			require.NoError(t, err)
 
 			// event org.idp.config.added
@@ -60,18 +56,16 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 			assert.Equal(t, addOIDC.IdpId, idp.ID)
 			assert.Equal(t, domain.IDPStateActive, idp.State)
 			assert.Equal(t, name, idp.Name)
-			assert.Equal(t, true, idp.AutoRegister)
 			assert.Equal(t, true, idp.AllowCreation)
 			assert.Equal(t, false, idp.AllowAutoUpdate)
 			assert.Equal(t, true, idp.AllowLinking)
 			assert.Nil(t, idp.AutoLinkingField)
-			assert.Equal(t, int16(idp_grpc.IDPStylingType_STYLING_TYPE_GOOGLE), *idp.StylingType)
 			assert.WithinRange(t, idp.UpdatedAt, before, after)
 			assert.WithinRange(t, idp.CreatedAt, before, after)
 		}, retryDuration, tick)
 	})
 
-	// t.Run("test instance idp update reduces", func(t *testing.T) {
+	// t.Run("test org idp update reduces", func(t *testing.T) {
 	// 	name := gofakeit.Name()
 
 	// 	addOIDC, err := MgmtClient.AddOrgOIDCIDP(IAMCTX, &management.AddOrgOIDCIDPRequest{
@@ -119,7 +113,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 	// 	}, retryDuration, tick)
 	// })
 
-	t.Run("test instance idp deactivate reduces", func(t *testing.T) {
+	t.Run("test org idp deactivate reduces", func(t *testing.T) {
 		name := gofakeit.Name()
 
 		addOIDC, err := MgmtClient.AddOrgOIDCIDP(IAMCTX, &management.AddOrgOIDCIDPRequest{
@@ -147,11 +141,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			idp, err := idpRepo.Get(IAMCTX, pool,
-				idpRepo.IDCondition(addOIDC.IdpId),
-				instanceID,
-				&orgID,
-			)
+			idp, err := idpRepo.Get(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addOIDC.IdpId))))
 			require.NoError(t, err)
 
 			// event org.idp.config.deactivated
@@ -161,7 +151,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		}, retryDuration, tick)
 	})
 
-	t.Run("test instance idp reactivate reduces", func(t *testing.T) {
+	t.Run("test org idp reactivate reduces", func(t *testing.T) {
 		name := gofakeit.Name()
 
 		addOIDC, err := MgmtClient.AddOrgOIDCIDP(IAMCTX, &management.AddOrgOIDCIDPRequest{
@@ -187,11 +177,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		// wait for idp to be deactivated
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			idp, err := idpRepo.Get(IAMCTX, pool,
-				idpRepo.IDCondition(addOIDC.IdpId),
-				instanceID,
-				&orgID,
-			)
+			idp, err := idpRepo.Get(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addOIDC.IdpId))))
 			require.NoError(t, err)
 
 			assert.Equal(t, addOIDC.IdpId, idp.ID)
@@ -208,11 +194,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 
 		retryDuration, tick = integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			idp, err := idpRepo.Get(IAMCTX, pool,
-				idpRepo.IDCondition(addOIDC.IdpId),
-				instanceID,
-				&orgID,
-			)
+			idp, err := idpRepo.Get(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addOIDC.IdpId))))
 			require.NoError(t, err)
 
 			// event org.idp.config.reactivated
@@ -222,7 +204,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		}, retryDuration, tick)
 	})
 
-	t.Run("test instance idp remove reduces", func(t *testing.T) {
+	t.Run("test org idp remove reduces", func(t *testing.T) {
 		name := gofakeit.Name()
 
 		// add idp
@@ -241,26 +223,31 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 
 		idpRepo := repository.IDProviderRepository()
 
+		// wait until idp is added
+		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
+		assert.EventuallyWithT(t, func(t *assert.CollectT) {
+			_, err := idpRepo.Get(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addOIDC.IdpId))))
+
+			// event org.idp.config.remove
+			require.NoError(t, err)
+		}, retryDuration, tick)
+
 		// remove idp
 		_, err = MgmtClient.RemoveOrgIDP(IAMCTX, &management.RemoveOrgIDPRequest{
 			IdpId: addOIDC.IdpId,
 		})
 		require.NoError(t, err)
 
-		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
+		retryDuration, tick = integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			_, err := idpRepo.Get(IAMCTX, pool,
-				idpRepo.IDCondition(addOIDC.IdpId),
-				instanceID,
-				&orgID,
-			)
+			_, err := idpRepo.Get(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addOIDC.IdpId))))
 
 			// event org.idp.config.remove
 			require.ErrorIs(t, &database.NoRowFoundError{}, err)
 		}, retryDuration, tick)
 	})
 
-	t.Run("test instance idp oidc added reduces", func(t *testing.T) {
+	t.Run("test org idp oidc added reduces", func(t *testing.T) {
 		name := gofakeit.Name()
 
 		// add oidc
@@ -281,11 +268,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			oidc, err := idpRepo.GetOIDC(IAMCTX, pool,
-				idpRepo.IDCondition(addOIDC.IdpId),
-				instanceID,
-				&orgID,
-			)
+			oidc, err := idpRepo.GetOIDC(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addOIDC.IdpId))))
 			require.NoError(t, err)
 
 			// event org.idp.oidc.config.added
@@ -300,14 +283,12 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 			assert.Equal(t, "issuer", oidc.Issuer)
 			assert.Equal(t, "clientID", oidc.ClientID)
 			assert.Equal(t, []string{"scope"}, oidc.Scopes)
-			assert.Equal(t, int16(idp_grpc.IDPStylingType_STYLING_TYPE_GOOGLE), *oidc.StylingType)
-			assert.Equal(t, false, oidc.AutoRegister)
 			assert.Equal(t, domain.OIDCMappingField(idp.OIDCMappingField_OIDC_MAPPING_FIELD_EMAIL), oidc.IDPDisplayNameMapping)
 			assert.Equal(t, domain.OIDCMappingField(idp.OIDCMappingField_OIDC_MAPPING_FIELD_EMAIL), oidc.UserNameMapping)
 		}, retryDuration, tick)
 	})
 
-	t.Run("test instance idp oidc changed reduces", func(t *testing.T) {
+	t.Run("test org idp oidc changed reduces", func(t *testing.T) {
 		name := gofakeit.Name()
 
 		// add oidc
@@ -330,7 +311,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		var oidc *domain.IDPOIDC
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			oidc, err = idpRepo.GetOIDC(IAMCTX, pool, idpRepo.IDCondition(addOIDC.IdpId), instanceID, &orgID)
+			oidc, err = idpRepo.GetOIDC(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addOIDC.IdpId))))
 			require.NoError(t, err)
 			assert.Equal(t, addOIDC.IdpId, oidc.ID)
 		}, retryDuration, tick)
@@ -350,11 +331,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 
 		retryDuration, tick = integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			updateOIDC, err := idpRepo.GetOIDC(IAMCTX, pool,
-				idpRepo.IDCondition(addOIDC.IdpId),
-				instanceID,
-				&orgID,
-			)
+			updateOIDC, err := idpRepo.GetOIDC(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addOIDC.IdpId))))
 			require.NoError(t, err)
 
 			// event org.idp.oidc.config.changed
@@ -379,7 +356,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		}, retryDuration, tick)
 	})
 
-	t.Run("test instance idp jwt added reduces", func(t *testing.T) {
+	t.Run("test org idp jwt added reduces", func(t *testing.T) {
 		name := gofakeit.Name()
 
 		// add jwt
@@ -398,11 +375,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			jwt, err := idpRepo.GetJWT(IAMCTX, pool,
-				idpRepo.IDCondition(addJWT.IdpId),
-				instanceID,
-				&orgID,
-			)
+			jwt, err := idpRepo.GetJWT(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addJWT.IdpId))))
 			require.NoError(t, err)
 
 			// event org.idp.jwt.config.added
@@ -412,7 +385,6 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 			assert.Equal(t, name, jwt.Name)
 			assert.Equal(t, addJWT.IdpId, jwt.ID)
 			assert.Equal(t, domain.IDPTypeJWT, domain.IDPType(*jwt.Type))
-			assert.Equal(t, int16(idp_grpc.IDPStylingType_STYLING_TYPE_GOOGLE), *jwt.StylingType)
 
 			// jwt
 			assert.Equal(t, "jwtEndpoint", jwt.JWTEndpoint)
@@ -422,7 +394,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		}, retryDuration, tick)
 	})
 
-	t.Run("test instance idp jwt changed reduces", func(t *testing.T) {
+	t.Run("test org idp jwt changed reduces", func(t *testing.T) {
 		name := gofakeit.Name()
 
 		// add jwt
@@ -452,11 +424,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			updateJWT, err := idpRepo.GetJWT(IAMCTX, pool,
-				idpRepo.IDCondition(addJWT.IdpId),
-				instanceID,
-				&orgID,
-			)
+			updateJWT, err := idpRepo.GetJWT(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addJWT.IdpId))))
 			require.NoError(t, err)
 
 			// event org.idp.jwt.config.changed
@@ -506,7 +474,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		var oauth *domain.IDPOAuth
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			oauth, err = idpRepo.GetOAuth(IAMCTX, pool, idpRepo.IDCondition(addOAuth.Id), instanceID, &orgID)
+			oauth, err = idpRepo.GetOAuth(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addOAuth.Id))))
 			require.NoError(t, err)
 
 			// event org.idp.oauth.added
@@ -519,7 +487,9 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 			assert.Equal(t, false, oauth.AllowLinking)
 			assert.Equal(t, false, oauth.AllowCreation)
 			assert.Equal(t, false, oauth.AllowAutoUpdate)
-			assert.Equal(t, domain.IDPAutoLinkingFieldEmail, domain.IDPAutoLinkingField(*oauth.AutoLinkingField))
+			if assert.NotNil(t, oauth.AutoLinkingField) {
+				assert.Equal(t, domain.IDPAutoLinkingFieldEmail, domain.IDPAutoLinkingField(*oauth.AutoLinkingField))
+			}
 			assert.WithinRange(t, oauth.CreatedAt, before, after)
 			assert.WithinRange(t, oauth.UpdatedAt, before, after)
 
@@ -565,7 +535,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		var oauth *domain.IDPOAuth
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			oauth, err = idpRepo.GetOAuth(IAMCTX, pool, idpRepo.IDCondition(addOAuth.Id), instanceID, &orgID)
+			oauth, err = idpRepo.GetOAuth(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addOAuth.Id))))
 			require.NoError(t, err)
 			assert.Equal(t, addOAuth.Id, oauth.ID)
 		}, retryDuration, tick)
@@ -596,11 +566,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 
 		retryDuration, tick = integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			updateOauth, err := idpRepo.GetOAuth(IAMCTX, pool,
-				idpRepo.IDCondition(addOAuth.Id),
-				instanceID,
-				&orgID,
-			)
+			updateOauth, err := idpRepo.GetOAuth(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addOAuth.Id))))
 			require.NoError(t, err)
 
 			// event org.idp.oauth.changed
@@ -613,7 +579,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 			assert.Equal(t, true, updateOauth.AllowLinking)
 			assert.Equal(t, true, updateOauth.AllowCreation)
 			assert.Equal(t, true, updateOauth.AllowAutoUpdate)
-			assert.Equal(t, domain.IDPAutoLinkingFieldUserName, domain.IDPAutoLinkingField(*updateOauth.AutoLinkingField))
+			assert.Equal(t, domain.IDPAutoLinkingFieldUsername, domain.IDPAutoLinkingField(*updateOauth.AutoLinkingField))
 			assert.Equal(t, true, updateOauth.UsePKCE)
 			assert.WithinRange(t, updateOauth.UpdatedAt, before, after)
 
@@ -656,7 +622,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		// check values for oidc
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			oidc, err := idpRepo.GetOIDC(IAMCTX, pool, idpRepo.IDCondition(addOIDC.Id), instanceID, &orgID)
+			oidc, err := idpRepo.GetOIDC(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addOIDC.Id))))
 			require.NoError(t, err)
 
 			// event org.idp.oidc added
@@ -711,7 +677,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		var oidc *domain.IDPOIDC
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			oidc, err = idpRepo.GetOIDC(IAMCTX, pool, idpRepo.IDCondition(addOIDC.Id), instanceID, &orgID)
+			oidc, err = idpRepo.GetOIDC(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addOIDC.Id))))
 			require.NoError(t, err)
 		}, retryDuration, tick)
 
@@ -739,11 +705,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 
 		retryDuration, tick = integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			updateOIDC, err := idpRepo.GetOIDC(IAMCTX, pool,
-				idpRepo.IDCondition(addOIDC.Id),
-				instanceID,
-				&orgID,
-			)
+			updateOIDC, err := idpRepo.GetOIDC(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addOIDC.Id))))
 			require.NoError(t, err)
 
 			// event org.idp.oidc.changed
@@ -756,7 +718,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 			assert.Equal(t, true, updateOIDC.AllowLinking)
 			assert.Equal(t, true, updateOIDC.AllowCreation)
 			assert.Equal(t, true, updateOIDC.AllowAutoUpdate)
-			assert.Equal(t, domain.IDPAutoLinkingFieldUserName, domain.IDPAutoLinkingField(*updateOIDC.AutoLinkingField))
+			assert.Equal(t, domain.IDPAutoLinkingFieldUsername, domain.IDPAutoLinkingField(*updateOIDC.AutoLinkingField))
 			assert.WithinRange(t, updateOIDC.UpdatedAt, before, after)
 
 			// oidc
@@ -795,7 +757,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		var oidc *domain.IDPOIDC
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			oidc, err = idpRepo.GetOIDC(IAMCTX, pool, idpRepo.IDCondition(addOIDC.Id), instanceID, &orgID)
+			oidc, err = idpRepo.GetOIDC(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addOIDC.Id))))
 			require.NoError(t, err)
 			assert.Equal(t, domain.IDPTypeOIDC, domain.IDPType(*oidc.Type))
 		}, retryDuration, tick)
@@ -830,7 +792,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 
 		retryDuration, tick = integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			azure, err := idpRepo.GetAzureAD(IAMCTX, pool, idpRepo.IDCondition(addOIDC.Id), instanceID, &orgID)
+			azure, err := idpRepo.GetAzureAD(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addOIDC.Id))))
 			require.NoError(t, err)
 
 			// event org.idp.oidc.migrated.azure
@@ -844,7 +806,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 			assert.Equal(t, true, azure.AllowLinking)
 			assert.Equal(t, true, azure.AllowCreation)
 			assert.Equal(t, true, azure.AllowAutoUpdate)
-			assert.Equal(t, domain.IDPAutoLinkingFieldUserName, domain.IDPAutoLinkingField(*azure.AutoLinkingField))
+			assert.Equal(t, domain.IDPAutoLinkingFieldUsername, domain.IDPAutoLinkingField(*azure.AutoLinkingField))
 			assert.WithinRange(t, azure.UpdatedAt, before, after)
 
 			// oidc
@@ -883,7 +845,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		var oidc *domain.IDPOIDC
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			oidc, err = idpRepo.GetOIDC(IAMCTX, pool, idpRepo.IDCondition(addOIDC.Id), instanceID, &orgID)
+			oidc, err = idpRepo.GetOIDC(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addOIDC.Id))))
 			require.NoError(t, err)
 			assert.Equal(t, domain.IDPTypeOIDC, domain.IDPType(*oidc.Type))
 		}, retryDuration, tick)
@@ -912,7 +874,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 
 		retryDuration, tick = integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			google, err := idpRepo.GetGoogle(IAMCTX, pool, idpRepo.IDCondition(addOIDC.Id), instanceID, &orgID)
+			google, err := idpRepo.GetGoogle(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addOIDC.Id))))
 			require.NoError(t, err)
 
 			// event org.idp.oidc.migrated.google
@@ -926,7 +888,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 			assert.Equal(t, true, google.AllowLinking)
 			assert.Equal(t, true, google.AllowCreation)
 			assert.Equal(t, true, google.AllowAutoUpdate)
-			assert.Equal(t, domain.IDPAutoLinkingFieldUserName, domain.IDPAutoLinkingField(*google.AutoLinkingField))
+			assert.Equal(t, domain.IDPAutoLinkingFieldUsername, domain.IDPAutoLinkingField(*google.AutoLinkingField))
 			assert.WithinRange(t, google.UpdatedAt, before, after)
 
 			// oidc
@@ -963,7 +925,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		// check values for jwt
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			jwt, err := idpRepo.GetJWT(IAMCTX, pool, idpRepo.IDCondition(addJWT.Id), instanceID, &orgID)
+			jwt, err := idpRepo.GetJWT(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addJWT.Id))))
 			require.NoError(t, err)
 
 			// event org.idp.jwt.added
@@ -1034,7 +996,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		// check values for jwt
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			updateJwt, err := idpRepo.GetJWT(IAMCTX, pool, idpRepo.IDCondition(addJWT.Id), instanceID, &orgID)
+			updateJwt, err := idpRepo.GetJWT(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addJWT.Id))))
 			require.NoError(t, err)
 
 			// event org.idp.jwt.added
@@ -1047,7 +1009,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 			assert.Equal(t, true, updateJwt.AllowLinking)
 			assert.Equal(t, true, updateJwt.AllowCreation)
 			assert.Equal(t, true, updateJwt.AllowAutoUpdate)
-			assert.Equal(t, domain.IDPAutoLinkingFieldUserName, domain.IDPAutoLinkingField(*updateJwt.AutoLinkingField))
+			assert.Equal(t, domain.IDPAutoLinkingFieldUsername, domain.IDPAutoLinkingField(*updateJwt.AutoLinkingField))
 			assert.WithinRange(t, updateJwt.UpdatedAt, before, after)
 
 			// jwt
@@ -1090,7 +1052,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		// check values for azure
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			azure, err := idpRepo.GetAzureAD(IAMCTX, pool, idpRepo.IDCondition(addAzure.Id), instanceID, &orgID)
+			azure, err := idpRepo.GetAzureAD(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addAzure.Id))))
 			require.NoError(t, err)
 
 			// event org.idp.azure.added
@@ -1103,7 +1065,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 			assert.Equal(t, true, azure.AllowLinking)
 			assert.Equal(t, true, azure.AllowCreation)
 			assert.Equal(t, true, azure.AllowAutoUpdate)
-			assert.Equal(t, domain.IDPAutoLinkingFieldUserName, domain.IDPAutoLinkingField(*azure.AutoLinkingField))
+			assert.Equal(t, domain.IDPAutoLinkingFieldUsername, domain.IDPAutoLinkingField(*azure.AutoLinkingField))
 			assert.WithinRange(t, azure.UpdatedAt, before, after)
 
 			// azure
@@ -1145,7 +1107,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		var azure *domain.IDPAzureAD
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			azure, err = idpRepo.GetAzureAD(IAMCTX, pool, idpRepo.IDCondition(addAzure.Id), instanceID, &orgID)
+			azure, err = idpRepo.GetAzureAD(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addAzure.Id))))
 			require.NoError(t, err)
 			assert.Equal(t, addAzure.Id, azure.ID)
 		}, retryDuration, tick)
@@ -1179,7 +1141,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		// check values for azure
 		retryDuration, tick = integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			updateAzure, err := idpRepo.GetAzureAD(IAMCTX, pool, idpRepo.IDCondition(addAzure.Id), instanceID, &orgID)
+			updateAzure, err := idpRepo.GetAzureAD(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addAzure.Id))))
 			require.NoError(t, err)
 
 			// event org.idp.azure.changed
@@ -1230,7 +1192,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		// check values for github
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			github, err := idpRepo.GetGithub(IAMCTX, pool, idpRepo.IDCondition(addGithub.Id), instanceID, &orgID)
+			github, err := idpRepo.GetGithub(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addGithub.Id))))
 			require.NoError(t, err)
 
 			// event org.idp.github.added
@@ -1243,7 +1205,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 			assert.Equal(t, false, github.AllowLinking)
 			assert.Equal(t, false, github.AllowCreation)
 			assert.Equal(t, false, github.AllowAutoUpdate)
-			assert.Equal(t, domain.IDPAutoLinkingFieldUserName, domain.IDPAutoLinkingField(*github.AutoLinkingField))
+			assert.Equal(t, domain.IDPAutoLinkingFieldUsername, domain.IDPAutoLinkingField(*github.AutoLinkingField))
 			assert.WithinRange(t, github.UpdatedAt, before, after)
 
 			assert.Equal(t, "clientId", github.ClientID)
@@ -1276,7 +1238,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		var github *domain.IDPGithub
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			github, err = idpRepo.GetGithub(IAMCTX, pool, idpRepo.IDCondition(addGithub.Id), instanceID, &orgID)
+			github, err = idpRepo.GetGithub(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addGithub.Id))))
 			require.NoError(t, err)
 			assert.Equal(t, addGithub.Id, github.ID)
 		}, retryDuration, tick)
@@ -1304,7 +1266,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		// check values for azure
 		retryDuration, tick = integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			updateGithub, err := idpRepo.GetGithub(IAMCTX, pool, idpRepo.IDCondition(addGithub.Id), instanceID, &orgID)
+			updateGithub, err := idpRepo.GetGithub(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addGithub.Id))))
 			require.NoError(t, err)
 
 			// event org.idp.github.changed
@@ -1317,7 +1279,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 			assert.Equal(t, true, updateGithub.AllowLinking)
 			assert.Equal(t, true, updateGithub.AllowCreation)
 			assert.Equal(t, true, updateGithub.AllowAutoUpdate)
-			assert.Equal(t, domain.IDPAutoLinkingFieldUserName, domain.IDPAutoLinkingField(*updateGithub.AutoLinkingField))
+			assert.Equal(t, domain.IDPAutoLinkingFieldUsername, domain.IDPAutoLinkingField(*updateGithub.AutoLinkingField))
 			assert.WithinRange(t, updateGithub.UpdatedAt, before, after)
 
 			// github
@@ -1356,7 +1318,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		// check values for github enterprise
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			githubEnterprise, err := idpRepo.GetGithubEnterprise(IAMCTX, pool, idpRepo.IDCondition(addGithubEnterprise.Id), instanceID, &orgID)
+			githubEnterprise, err := idpRepo.GetGithubEnterprise(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addGithubEnterprise.Id))))
 			require.NoError(t, err)
 
 			// event org.idp.github_enterprise.added
@@ -1410,7 +1372,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		var githubEnterprise *domain.IDPGithubEnterprise
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			githubEnterprise, err = idpRepo.GetGithubEnterprise(IAMCTX, pool, idpRepo.IDCondition(addGithubEnterprise.Id), instanceID, &orgID)
+			githubEnterprise, err = idpRepo.GetGithubEnterprise(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addGithubEnterprise.Id))))
 			require.NoError(t, err)
 			assert.Equal(t, addGithubEnterprise.Id, githubEnterprise.ID)
 		}, retryDuration, tick)
@@ -1441,7 +1403,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		// check values for azure
 		retryDuration, tick = integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			updateGithubEnterprise, err := idpRepo.GetGithubEnterprise(IAMCTX, pool, idpRepo.IDCondition(addGithubEnterprise.Id), instanceID, &orgID)
+			updateGithubEnterprise, err := idpRepo.GetGithubEnterprise(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addGithubEnterprise.Id))))
 			require.NoError(t, err)
 
 			// event org.idp.github_enterprise.changed
@@ -1493,7 +1455,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		// check values for gitlab
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			gitlab, err := idpRepo.GetGitlab(IAMCTX, pool, idpRepo.IDCondition(addGithub.Id), instanceID, &orgID)
+			gitlab, err := idpRepo.GetGitlab(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addGithub.Id))))
 			require.NoError(t, err)
 
 			// event org.idp.gitlab.added
@@ -1541,7 +1503,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		var gitlab *domain.IDPGitlab
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			gitlab, err = idpRepo.GetGitlab(IAMCTX, pool, idpRepo.IDCondition(addGitlab.Id), instanceID, &orgID)
+			gitlab, err = idpRepo.GetGitlab(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addGitlab.Id))))
 			require.NoError(t, err)
 			assert.Equal(t, addGitlab.Id, gitlab.ID)
 		}, retryDuration, tick)
@@ -1569,7 +1531,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		// check values for gitlab
 		retryDuration, tick = integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			updateGitlab, err := idpRepo.GetGitlab(IAMCTX, pool, idpRepo.IDCondition(addGitlab.Id), instanceID, &orgID)
+			updateGitlab, err := idpRepo.GetGitlab(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addGitlab.Id))))
 			require.NoError(t, err)
 
 			// event org.idp.gitlab.changed
@@ -1581,7 +1543,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 			assert.Equal(t, true, updateGitlab.AllowLinking)
 			assert.Equal(t, true, updateGitlab.AllowCreation)
 			assert.Equal(t, true, updateGitlab.AllowAutoUpdate)
-			assert.Equal(t, domain.IDPAutoLinkingFieldUserName, domain.IDPAutoLinkingField(*updateGitlab.AutoLinkingField))
+			assert.Equal(t, domain.IDPAutoLinkingFieldUsername, domain.IDPAutoLinkingField(*updateGitlab.AutoLinkingField))
 			assert.WithinRange(t, updateGitlab.UpdatedAt, before, after)
 
 			// gitlab
@@ -1619,7 +1581,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		// check values for gitlab self hosted
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			gitlabSelfHosted, err := idpRepo.GetGitlabSelfHosting(IAMCTX, pool, idpRepo.IDCondition(addGitlabSelfHosted.Id), instanceID, &orgID)
+			gitlabSelfHosted, err := idpRepo.GetGitlabSelfHosted(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addGitlabSelfHosted.Id))))
 			require.NoError(t, err)
 
 			// event org.idp.gitlab_self_hosted.added
@@ -1666,10 +1628,10 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 
 		idpRepo := repository.IDProviderRepository()
 
-		var githlabSelfHosted *domain.IDPGitlabSelfHosting
+		var githlabSelfHosted *domain.IDPGitlabSelfHosted
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			githlabSelfHosted, err = idpRepo.GetGitlabSelfHosting(IAMCTX, pool, idpRepo.IDCondition(addGitlabSelfHosted.Id), instanceID, &orgID)
+			githlabSelfHosted, err = idpRepo.GetGitlabSelfHosted(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addGitlabSelfHosted.Id))))
 			require.NoError(t, err)
 			assert.Equal(t, addGitlabSelfHosted.Id, githlabSelfHosted.ID)
 		}, retryDuration, tick)
@@ -1698,7 +1660,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		// check values for gitlab self hosted
 		retryDuration, tick = integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			updateGitlabSelfHosted, err := idpRepo.GetGitlabSelfHosting(IAMCTX, pool, idpRepo.IDCondition(addGitlabSelfHosted.Id), instanceID, &orgID)
+			updateGitlabSelfHosted, err := idpRepo.GetGitlabSelfHosted(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addGitlabSelfHosted.Id))))
 			require.NoError(t, err)
 
 			// event org.idp.gitlab_self_hosted.changed
@@ -1711,7 +1673,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 			assert.Equal(t, true, updateGitlabSelfHosted.AllowLinking)
 			assert.Equal(t, true, updateGitlabSelfHosted.AllowCreation)
 			assert.Equal(t, true, updateGitlabSelfHosted.AllowAutoUpdate)
-			assert.Equal(t, domain.IDPAutoLinkingFieldUserName, domain.IDPAutoLinkingField(*updateGitlabSelfHosted.AutoLinkingField))
+			assert.Equal(t, domain.IDPAutoLinkingFieldUsername, domain.IDPAutoLinkingField(*updateGitlabSelfHosted.AutoLinkingField))
 			assert.WithinRange(t, updateGitlabSelfHosted.UpdatedAt, before, after)
 
 			// gitlab self hosted
@@ -1748,7 +1710,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		// check values for google
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			google, err := idpRepo.GetGoogle(IAMCTX, pool, idpRepo.IDCondition(addGoogle.Id), instanceID, &orgID)
+			google, err := idpRepo.GetGoogle(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addGoogle.Id))))
 			require.NoError(t, err)
 
 			// event org.idp.google.added
@@ -1796,7 +1758,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		var google *domain.IDPGoogle
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			google, err = idpRepo.GetGoogle(IAMCTX, pool, idpRepo.IDCondition(addGoogle.Id), instanceID, &orgID)
+			google, err = idpRepo.GetGoogle(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addGoogle.Id))))
 			require.NoError(t, err)
 			assert.Equal(t, addGoogle.Id, google.ID)
 		}, retryDuration, tick)
@@ -1824,7 +1786,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		// check values for google
 		retryDuration, tick = integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			updateGoogle, err := idpRepo.GetGoogle(IAMCTX, pool, idpRepo.IDCondition(addGoogle.Id), instanceID, &orgID)
+			updateGoogle, err := idpRepo.GetGoogle(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addGoogle.Id))))
 			require.NoError(t, err)
 
 			// event org.idp.google.changed
@@ -1837,7 +1799,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 			assert.Equal(t, true, updateGoogle.AllowLinking)
 			assert.Equal(t, true, updateGoogle.AllowCreation)
 			assert.Equal(t, true, updateGoogle.AllowAutoUpdate)
-			assert.Equal(t, domain.IDPAutoLinkingFieldUserName, domain.IDPAutoLinkingField(*updateGoogle.AutoLinkingField))
+			assert.Equal(t, domain.IDPAutoLinkingFieldUsername, domain.IDPAutoLinkingField(*updateGoogle.AutoLinkingField))
 			assert.WithinRange(t, updateGoogle.UpdatedAt, before, after)
 
 			// google
@@ -1860,7 +1822,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			ldap, err := idpRepo.GetLDAP(IAMCTX, pool, idpRepo.IDCondition(addLdap.Id), instanceID, &orgID)
+			ldap, err := idpRepo.GetLDAP(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addLdap.Id))))
 			require.NoError(t, err)
 
 			// event org.idp.ldap.v2.added
@@ -1915,7 +1877,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		var ldap *domain.IDPLDAP
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			ldap, err = idpRepo.GetLDAP(IAMCTX, pool, idpRepo.IDCondition(addLdap.Id), instanceID, &orgID)
+			ldap, err = idpRepo.GetLDAP(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addLdap.Id))))
 			require.NoError(t, err)
 			assert.Equal(t, addLdap.Id, ldap.ID)
 		}, retryDuration, tick)
@@ -1964,7 +1926,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		// check values for ldap
 		retryDuration, tick = integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			updateLdap, err := idpRepo.GetLDAP(IAMCTX, pool, idpRepo.IDCondition(addLdap.Id), instanceID, &orgID)
+			updateLdap, err := idpRepo.GetLDAP(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addLdap.Id))))
 			require.NoError(t, err)
 
 			// event org.idp.ldap.v2.changed
@@ -1977,7 +1939,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 			assert.Equal(t, true, updateLdap.AllowLinking)
 			assert.Equal(t, true, updateLdap.AllowCreation)
 			assert.Equal(t, true, updateLdap.AllowAutoUpdate)
-			assert.Equal(t, domain.IDPAutoLinkingFieldUserName, domain.IDPAutoLinkingField(*updateLdap.AutoLinkingField))
+			assert.Equal(t, domain.IDPAutoLinkingFieldUsername, domain.IDPAutoLinkingField(*updateLdap.AutoLinkingField))
 			assert.WithinRange(t, updateLdap.UpdatedAt, before, after)
 
 			// ldap
@@ -2033,7 +1995,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			apple, err := idpRepo.GetApple(IAMCTX, pool, idpRepo.IDCondition(addApple.Id), instanceID, &orgID)
+			apple, err := idpRepo.GetApple(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addApple.Id))))
 			require.NoError(t, err)
 
 			// event org.idp.apple.added
@@ -2085,7 +2047,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		var apple *domain.IDPApple
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			apple, err = idpRepo.GetApple(IAMCTX, pool, idpRepo.IDCondition(addApple.Id), instanceID, &orgID)
+			apple, err = idpRepo.GetApple(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addApple.Id))))
 			require.NoError(t, err)
 			assert.Equal(t, addApple.Id, apple.ID)
 		}, retryDuration, tick)
@@ -2115,7 +2077,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		// check values for apple
 		retryDuration, tick = integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			updateApple, err := idpRepo.GetApple(IAMCTX, pool, idpRepo.IDCondition(addApple.Id), instanceID, &orgID)
+			updateApple, err := idpRepo.GetApple(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addApple.Id))))
 			require.NoError(t, err)
 
 			// event nstance.idp.apple.changed
@@ -2128,7 +2090,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 			assert.Equal(t, true, updateApple.AllowLinking)
 			assert.Equal(t, true, updateApple.AllowCreation)
 			assert.Equal(t, true, updateApple.AllowAutoUpdate)
-			assert.Equal(t, domain.IDPAutoLinkingFieldUserName, domain.IDPAutoLinkingField(*updateApple.AutoLinkingField))
+			assert.Equal(t, domain.IDPAutoLinkingFieldUsername, domain.IDPAutoLinkingField(*updateApple.AutoLinkingField))
 			assert.WithinRange(t, updateApple.UpdatedAt, before, after)
 
 			// apple
@@ -2172,7 +2134,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			saml, err := idpRepo.GetSAML(IAMCTX, pool, idpRepo.IDCondition(addSAML.Id), instanceID, &orgID)
+			saml, err := idpRepo.GetSAML(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addSAML.Id))))
 			require.NoError(t, err)
 
 			// event org.idp.saml.added
@@ -2233,7 +2195,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		var saml *domain.IDPSAML
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			saml, err = idpRepo.GetSAML(IAMCTX, pool, idpRepo.IDCondition(addSAML.Id), instanceID, &orgID)
+			saml, err = idpRepo.GetSAML(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addSAML.Id))))
 			require.NoError(t, err)
 			assert.Equal(t, addSAML.Id, saml.ID)
 		}, retryDuration, tick)
@@ -2268,7 +2230,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		// check values for apple
 		retryDuration, tick = integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			updateSAML, err := idpRepo.GetSAML(IAMCTX, pool, idpRepo.IDCondition(addSAML.Id), instanceID, &orgID)
+			updateSAML, err := idpRepo.GetSAML(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addSAML.Id))))
 			require.NoError(t, err)
 
 			// event org.idp.saml.changed
@@ -2281,7 +2243,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 			assert.Equal(t, true, updateSAML.AllowLinking)
 			assert.Equal(t, true, updateSAML.AllowCreation)
 			assert.Equal(t, true, updateSAML.AllowAutoUpdate)
-			assert.Equal(t, domain.IDPAutoLinkingFieldUserName, domain.IDPAutoLinkingField(*updateSAML.AutoLinkingField))
+			assert.Equal(t, domain.IDPAutoLinkingFieldUsername, domain.IDPAutoLinkingField(*updateSAML.AutoLinkingField))
 			assert.WithinRange(t, updateSAML.UpdatedAt, before, after)
 
 			// saml
@@ -2320,11 +2282,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		// check idp exists
 		retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			_, err := idpRepo.Get(IAMCTX, pool,
-				idpRepo.IDCondition(addOIDC.IdpId),
-				instanceID,
-				&orgID,
-			)
+			_, err := idpRepo.Get(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addOIDC.IdpId))))
 			require.NoError(t, err)
 		}, retryDuration, tick)
 
@@ -2337,11 +2295,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		// check idp is removed
 		retryDuration, tick = integration.WaitForAndTickWithMaxDuration(IAMCTX, time.Minute)
 		assert.EventuallyWithT(t, func(t *assert.CollectT) {
-			_, err := idpRepo.Get(IAMCTX, pool,
-				idpRepo.IDCondition(addOIDC.IdpId),
-				instanceID,
-				&orgID,
-			)
+			_, err := idpRepo.Get(IAMCTX, pool, database.WithCondition(database.And(idpRepo.InstanceIDCondition(instanceID), idpRepo.OrgIDCondition(&orgID), idpRepo.IDCondition(addOIDC.IdpId))))
 			require.ErrorIs(t, &database.NoRowFoundError{}, err)
 		}, retryDuration, tick)
 	})

backend/v3/storage/database/repository/id_provider.go

@@ -17,49 +17,54 @@ func IDProviderRepository() domain.IDProviderRepository {
 	return new(idProvider)
 }
 
-const queryIDProviderStmt = `SELECT instance_id, org_id, id, state, name, type, auto_register, allow_creation, allow_auto_creation,` +
-	` allow_auto_update, allow_linking, auto_linking_field, styling_type, payload, created_at, updated_at` +
+func (idProvider) qualifiedTableName() string {
+	return "zitadel.identity_providers"
+}
+
+const queryIDProviderStmt = `SELECT instance_id, org_id, id, state, name, type, allow_creation, allow_auto_creation,` +
+	` allow_auto_update, allow_linking, auto_linking_field, payload, created_at, updated_at` +
 	` FROM zitadel.identity_providers`
 
-func (i *idProvider) Get(ctx context.Context, client database.QueryExecutor, id domain.IDPIdentifierCondition, instanceID string, orgID *string) (*domain.IdentityProvider, error) {
-	builder := database.StatementBuilder{}
-
-	builder.WriteString(queryIDProviderStmt)
-
-	conditions := []database.Condition{id, i.InstanceIDCondition(instanceID), i.OrgIDCondition(orgID)}
-
-	writeCondition(&builder, database.And(conditions...))
-
-	return scanIDProvider(ctx, client, &builder)
-}
-
-func (i *idProvider) List(ctx context.Context, client database.QueryExecutor, conditions ...database.Condition) ([]*domain.IdentityProvider, error) {
-	builder := database.StatementBuilder{}
-
-	builder.WriteString(queryIDProviderStmt)
-
-	if conditions != nil {
-		writeCondition(&builder, database.And(conditions...))
+func (i *idProvider) Get(ctx context.Context, client database.QueryExecutor, opts ...database.QueryOption) (*domain.IdentityProvider, error) {
+	options := new(database.QueryOpts)
+	for _, opt := range opts {
+		opt(options)
+	}
+	if err := checkRestrictingColumns(options.Condition, i.InstanceIDColumn()); err != nil {
+		return nil, err
 	}
 
-	orderBy := database.OrderBy(i.CreatedAtColumn())
-	orderBy.Write(&builder)
+	builder := database.NewStatementBuilder(queryIDProviderStmt)
+	options.Write(builder)
 
-	return scanIDProviders(ctx, client, &builder)
+	return scanIDProvider(ctx, client, builder)
 }
 
-const createIDProviderStmtStart = `INSERT INTO zitadel.identity_providers` +
-	` (instance_id, org_id, id, state, name, type, allow_creation, allow_auto_creation,` +
-	` allow_auto_update, allow_linking, styling_type, payload) VALUES (`
+func (i *idProvider) List(ctx context.Context, client database.QueryExecutor, opts ...database.QueryOption) ([]*domain.IdentityProvider, error) {
+	options := new(database.QueryOpts)
+	for _, opt := range opts {
+		opt(options)
+	}
 
-const createIDProviderStmtEnd = `) RETURNING created_at, updated_at`
+	if err := checkRestrictingColumns(options.Condition, i.InstanceIDColumn()); err != nil {
+		return nil, err
+	}
+
+	builder := database.NewStatementBuilder(queryIDProviderStmt)
+	options.Write(builder)
+
+	return scanIDProviders(ctx, client, builder)
+}
+
+const (
+	createIDProviderStmtStart = `INSERT INTO zitadel.identity_providers` +
+		` (instance_id, org_id, id, state, name, type, allow_creation, allow_auto_creation,` +
+		` allow_auto_update, allow_linking, auto_linking_field, payload, created_at, updated_at) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, `
+	createIDProviderStmtEnd = `) RETURNING created_at, updated_at`
+)
 
 func (i *idProvider) Create(ctx context.Context, client database.QueryExecutor, idp *domain.IdentityProvider) error {
-	builder := database.StatementBuilder{}
-
-	builder.WriteString(createIDProviderStmtStart)
-
-	builder.WriteArgs(
+	builder := database.NewStatementBuilder(createIDProviderStmtStart,
 		idp.InstanceID,
 		idp.OrgID,
 		idp.ID,
@@ -70,364 +75,227 @@ func (i *idProvider) Create(ctx context.Context, client database.QueryExecutor,
 		idp.AllowAutoCreation,
 		idp.AllowAutoUpdate,
 		idp.AllowLinking,
-		idp.StylingType,
-		string(idp.Payload))
-
+		idp.AutoLinkingField,
+		idp.Payload,
+	)
+	var createdAt any = database.NowInstruction
+	if !idp.CreatedAt.IsZero() {
+		createdAt = idp.CreatedAt
+	}
+	builder.WriteArgs(createdAt, createdAt)
 	builder.WriteString(createIDProviderStmtEnd)
 
-	err := client.QueryRow(ctx, builder.String(), builder.Args()...).Scan(&idp.CreatedAt, &idp.UpdatedAt)
-	return err
+	return client.QueryRow(ctx, builder.String(), builder.Args()...).Scan(&idp.CreatedAt, &idp.UpdatedAt)
 }
 
-func (i *idProvider) Update(ctx context.Context, client database.QueryExecutor, id domain.IDPIdentifierCondition, instanceID string, orgID *string, changes ...database.Change) (int64, error) {
+func (i *idProvider) Update(ctx context.Context, client database.QueryExecutor, condition database.Condition, changes ...database.Change) (int64, error) {
 	if changes == nil {
 		return 0, database.ErrNoChanges
 	}
-	changes = append(changes, i.SetUpdatedAt(nil))
-	builder := database.StatementBuilder{}
-	builder.WriteString(`UPDATE zitadel.identity_providers SET `)
-
-	conditions := []database.Condition{
-		id,
-		i.InstanceIDCondition(instanceID),
-		i.OrgIDCondition(orgID),
+	if err := checkRestrictingColumns(condition, i.InstanceIDColumn(), i.IDColumn()); err != nil {
+		return 0, err
 	}
-	err := database.Changes(changes).Write(&builder)
+	dbChanges := database.Changes(changes)
+	if !dbChanges.IsOnColumn(i.UpdatedAtColumn()) {
+		dbChanges = append(dbChanges, i.SetUpdatedAt(nil))
+	}
+
+	builder := database.NewStatementBuilder(`UPDATE zitadel.identity_providers SET `)
+	err := dbChanges.Write(builder)
 	if err != nil {
 		return 0, err
 	}
-	writeCondition(&builder, database.And(conditions...))
-
-	stmt := builder.String()
-
-	return client.Exec(ctx, stmt, builder.Args()...)
-}
-
-func (i *idProvider) Delete(ctx context.Context, client database.QueryExecutor, id domain.IDPIdentifierCondition, instanceID string, orgID *string) (int64, error) {
-	builder := database.StatementBuilder{}
-
-	builder.WriteString(`DELETE FROM zitadel.identity_providers`)
-
-	conditions := []database.Condition{
-		id,
-		i.InstanceIDCondition(instanceID),
-		i.OrgIDCondition(orgID),
-	}
-	writeCondition(&builder, database.And(conditions...))
+	writeCondition(builder, condition)
 
 	return client.Exec(ctx, builder.String(), builder.Args()...)
 }
 
-func (i *idProvider) GetOIDC(ctx context.Context, client database.QueryExecutor, id domain.IDPIdentifierCondition, instanceID string, orgID *string) (*domain.IDPOIDC, error) {
-	idpOIDC := &domain.IDPOIDC{}
-	var err error
-
-	idpOIDC.IdentityProvider, err = i.Get(ctx, client, id, instanceID, orgID)
-	if err != nil {
-		return nil, err
+func (i *idProvider) Delete(ctx context.Context, client database.QueryExecutor, condition database.Condition) (int64, error) {
+	if err := checkRestrictingColumns(condition, i.InstanceIDColumn(), i.IDColumn()); err != nil {
+		return 0, err
 	}
 
-	var idpType domain.IDPType
-	if idpOIDC.Type != nil {
-		idpType = *idpOIDC.Type
-	}
+	builder := database.NewStatementBuilder(`DELETE FROM `)
+	builder.WriteString(i.qualifiedTableName())
+	writeCondition(builder, condition)
 
-	if idpType != domain.IDPTypeOIDC {
-		return nil, domain.NewIDPWrongTypeError(domain.IDPTypeOIDC, idpType)
-	}
-
-	err = json.Unmarshal(idpOIDC.Payload, idpOIDC)
-	if err != nil {
-		return nil, err
-	}
-
-	return idpOIDC, nil
+	return client.Exec(ctx, builder.String(), builder.Args()...)
 }
 
-func (i *idProvider) GetJWT(ctx context.Context, client database.QueryExecutor, id domain.IDPIdentifierCondition, instanceID string, orgID *string) (*domain.IDPJWT, error) {
-	idpJWT := &domain.IDPJWT{}
-	var err error
-
-	idpJWT.IdentityProvider, err = i.Get(ctx, client, id, instanceID, orgID)
+func (i *idProvider) GetOIDC(ctx context.Context, client database.QueryExecutor, opts ...database.QueryOption) (*domain.IDPOIDC, error) {
+	idp, typ, err := getIDP[domain.OIDC](ctx, client, i, domain.IDPTypeOIDC, opts...)
 	if err != nil {
 		return nil, err
 	}
 
-	var idpType domain.IDPType
-	if idpJWT.Type != nil {
-		idpType = *idpJWT.Type
-	}
-
-	if idpType != domain.IDPTypeJWT {
-		return nil, domain.NewIDPWrongTypeError(domain.IDPTypeJWT, idpType)
-	}
-
-	err = json.Unmarshal(idpJWT.Payload, idpJWT)
-	if err != nil {
-		return nil, err
-	}
-
-	return idpJWT, nil
+	return &domain.IDPOIDC{
+		IdentityProvider: idp,
+		OIDC:             typ,
+	}, nil
 }
 
-func (i *idProvider) GetOAuth(ctx context.Context, client database.QueryExecutor, id domain.IDPIdentifierCondition, instanceID string, orgID *string) (*domain.IDPOAuth, error) {
-	idpOAuth := &domain.IDPOAuth{}
-	var err error
-
-	idpOAuth.IdentityProvider, err = i.Get(ctx, client, id, instanceID, orgID)
+func (i *idProvider) GetJWT(ctx context.Context, client database.QueryExecutor, opts ...database.QueryOption) (*domain.IDPJWT, error) {
+	idp, typ, err := getIDP[domain.JWT](ctx, client, i, domain.IDPTypeJWT, opts...)
 	if err != nil {
 		return nil, err
 	}
 
-	var idpType domain.IDPType
-	if idpOAuth.Type != nil {
-		idpType = *idpOAuth.Type
-	}
-
-	if idpType != domain.IDPTypeOAuth {
-		return nil, domain.NewIDPWrongTypeError(domain.IDPTypeOAuth, idpType)
-	}
-
-	err = json.Unmarshal(idpOAuth.Payload, idpOAuth)
-	if err != nil {
-		return nil, err
-	}
-
-	return idpOAuth, nil
+	return &domain.IDPJWT{
+		IdentityProvider: idp,
+		JWT:              typ,
+	}, nil
 }
 
-func (i *idProvider) GetAzureAD(ctx context.Context, client database.QueryExecutor, id domain.IDPIdentifierCondition, instanceID string, orgID *string) (*domain.IDPAzureAD, error) {
-	idpAzure := &domain.IDPAzureAD{}
-	var err error
-
-	idpAzure.IdentityProvider, err = i.Get(ctx, client, id, instanceID, orgID)
+func (i *idProvider) GetOAuth(ctx context.Context, client database.QueryExecutor, opts ...database.QueryOption) (*domain.IDPOAuth, error) {
+	idp, typ, err := getIDP[domain.OAuth](ctx, client, i, domain.IDPTypeOAuth, opts...)
 	if err != nil {
 		return nil, err
 	}
 
-	var idpType domain.IDPType
-	if idpAzure.Type != nil {
-		idpType = *idpAzure.Type
-	}
-
-	if idpType != domain.IDPTypeAzure {
-		return nil, domain.NewIDPWrongTypeError(domain.IDPTypeAzure, idpType)
-	}
-
-	err = json.Unmarshal(idpAzure.Payload, idpAzure)
-	if err != nil {
-		return nil, err
-	}
-
-	return idpAzure, nil
+	return &domain.IDPOAuth{
+		IdentityProvider: idp,
+		OAuth:            typ,
+	}, nil
 }
 
-func (i *idProvider) GetGoogle(ctx context.Context, client database.QueryExecutor, id domain.IDPIdentifierCondition, instanceID string, orgID *string) (*domain.IDPGoogle, error) {
-	idpGoogle := &domain.IDPGoogle{}
-	var err error
-
-	idpGoogle.IdentityProvider, err = i.Get(ctx, client, id, instanceID, orgID)
+func (i *idProvider) GetAzureAD(ctx context.Context, client database.QueryExecutor, opts ...database.QueryOption) (*domain.IDPAzureAD, error) {
+	idp, typ, err := getIDP[domain.Azure](ctx, client, i, domain.IDPTypeAzure, opts...)
 	if err != nil {
 		return nil, err
 	}
 
-	var idpType domain.IDPType
-	if idpGoogle.Type != nil {
-		idpType = *idpGoogle.Type
-	}
-
-	if idpType != domain.IDPTypeGoogle {
-		return nil, domain.NewIDPWrongTypeError(domain.IDPTypeGoogle, idpType)
-	}
-
-	err = json.Unmarshal(idpGoogle.Payload, idpGoogle)
-	if err != nil {
-		return nil, err
-	}
-
-	return idpGoogle, nil
+	return &domain.IDPAzureAD{
+		IdentityProvider: idp,
+		Azure:            typ,
+	}, nil
 }
 
-func (i *idProvider) GetGithub(ctx context.Context, client database.QueryExecutor, id domain.IDPIdentifierCondition, instanceID string, orgID *string) (*domain.IDPGithub, error) {
-	idpGithub := &domain.IDPGithub{}
-	var err error
-
-	idpGithub.IdentityProvider, err = i.Get(ctx, client, id, instanceID, orgID)
+func (i *idProvider) GetGoogle(ctx context.Context, client database.QueryExecutor, opts ...database.QueryOption) (*domain.IDPGoogle, error) {
+	idp, typ, err := getIDP[domain.Google](ctx, client, i, domain.IDPTypeGoogle, opts...)
 	if err != nil {
 		return nil, err
 	}
 
-	var idpType domain.IDPType
-	if idpGithub.Type != nil {
-		idpType = *idpGithub.Type
-	}
-
-	if idpType != domain.IDPTypeGitHub {
-		return nil, domain.NewIDPWrongTypeError(domain.IDPTypeGitHub, idpType)
-	}
-
-	err = json.Unmarshal(idpGithub.Payload, idpGithub)
-	if err != nil {
-		return nil, err
-	}
-
-	return idpGithub, nil
+	return &domain.IDPGoogle{
+		IdentityProvider: idp,
+		Google:           typ,
+	}, nil
 }
 
-func (i *idProvider) GetGithubEnterprise(ctx context.Context, client database.QueryExecutor, id domain.IDPIdentifierCondition, instanceID string, orgID *string) (*domain.IDPGithubEnterprise, error) {
-	idpGithubEnterprise := &domain.IDPGithubEnterprise{}
-	var err error
-
-	idpGithubEnterprise.IdentityProvider, err = i.Get(ctx, client, id, instanceID, orgID)
+func (i *idProvider) GetGithub(ctx context.Context, client database.QueryExecutor, opts ...database.QueryOption) (*domain.IDPGithub, error) {
+	idp, typ, err := getIDP[domain.Github](ctx, client, i, domain.IDPTypeGitHub, opts...)
 	if err != nil {
 		return nil, err
 	}
 
-	var idpType domain.IDPType
-	if idpGithubEnterprise.Type != nil {
-		idpType = *idpGithubEnterprise.Type
-	}
-
-	if idpType != domain.IDPTypeGitHubEnterprise {
-		return nil, domain.NewIDPWrongTypeError(domain.IDPTypeGitHubEnterprise, idpType)
-	}
-
-	err = json.Unmarshal(idpGithubEnterprise.Payload, idpGithubEnterprise)
-	if err != nil {
-		return nil, err
-	}
-
-	return idpGithubEnterprise, nil
+	return &domain.IDPGithub{
+		IdentityProvider: idp,
+		Github:           typ,
+	}, nil
 }
 
-func (i *idProvider) GetGitlab(ctx context.Context, client database.QueryExecutor, id domain.IDPIdentifierCondition, instanceID string, orgID *string) (*domain.IDPGitlab, error) {
-	idpGitlab := &domain.IDPGitlab{}
-	var err error
-
-	idpGitlab.IdentityProvider, err = i.Get(ctx, client, id, instanceID, orgID)
+func (i *idProvider) GetGithubEnterprise(ctx context.Context, client database.QueryExecutor, opts ...database.QueryOption) (*domain.IDPGithubEnterprise, error) {
+	idp, typ, err := getIDP[domain.GithubEnterprise](ctx, client, i, domain.IDPTypeGitHubEnterprise, opts...)
 	if err != nil {
 		return nil, err
 	}
 
-	var idpType domain.IDPType
-	if idpGitlab.Type != nil {
-		idpType = *idpGitlab.Type
-	}
-
-	if idpType != domain.IDPTypeGitLab {
-		return nil, domain.NewIDPWrongTypeError(domain.IDPTypeGitLab, idpType)
-	}
-
-	err = json.Unmarshal(idpGitlab.Payload, idpGitlab)
-	if err != nil {
-		return nil, err
-	}
-
-	return idpGitlab, nil
+	return &domain.IDPGithubEnterprise{
+		IdentityProvider: idp,
+		GithubEnterprise: typ,
+	}, nil
 }
 
-func (i *idProvider) GetGitlabSelfHosting(ctx context.Context, client database.QueryExecutor, id domain.IDPIdentifierCondition, instanceID string, orgID *string) (*domain.IDPGitlabSelfHosting, error) {
-	idpGitlabSelfHosting := &domain.IDPGitlabSelfHosting{}
-	var err error
-
-	idpGitlabSelfHosting.IdentityProvider, err = i.Get(ctx, client, id, instanceID, orgID)
+func (i *idProvider) GetGitlab(ctx context.Context, client database.QueryExecutor, opts ...database.QueryOption) (*domain.IDPGitlab, error) {
+	idp, typ, err := getIDP[domain.Gitlab](ctx, client, i, domain.IDPTypeGitLab, opts...)
 	if err != nil {
 		return nil, err
 	}
 
-	var idpType domain.IDPType
-	if idpGitlabSelfHosting.Type != nil {
-		idpType = *idpGitlabSelfHosting.Type
-	}
-
-	if idpType != domain.IDPTypeGitLabSelfHosted {
-		return nil, domain.NewIDPWrongTypeError(domain.IDPTypeGitLabSelfHosted, idpType)
-	}
-
-	err = json.Unmarshal(idpGitlabSelfHosting.Payload, idpGitlabSelfHosting)
-	if err != nil {
-		return nil, err
-	}
-
-	return idpGitlabSelfHosting, nil
+	return &domain.IDPGitlab{
+		IdentityProvider: idp,
+		Gitlab:           typ,
+	}, nil
 }
 
-func (i *idProvider) GetLDAP(ctx context.Context, client database.QueryExecutor, id domain.IDPIdentifierCondition, instanceID string, orgID *string) (*domain.IDPLDAP, error) {
-	ldap := &domain.IDPLDAP{}
-	var err error
-
-	ldap.IdentityProvider, err = i.Get(ctx, client, id, instanceID, orgID)
+func (i *idProvider) GetGitlabSelfHosted(ctx context.Context, client database.QueryExecutor, opts ...database.QueryOption) (*domain.IDPGitlabSelfHosted, error) {
+	idp, typ, err := getIDP[domain.GitlabSelfHosted](ctx, client, i, domain.IDPTypeGitLabSelfHosted, opts...)
 	if err != nil {
 		return nil, err
 	}
 
-	var idpType domain.IDPType
-	if ldap.Type != nil {
-		idpType = *ldap.Type
-	}
-
-	if idpType != domain.IDPTypeLDAP {
-		return nil, domain.NewIDPWrongTypeError(domain.IDPTypeLDAP, idpType)
-	}
-
-	err = json.Unmarshal(ldap.Payload, ldap)
-	if err != nil {
-		return nil, err
-	}
-
-	return ldap, nil
+	return &domain.IDPGitlabSelfHosted{
+		IdentityProvider: idp,
+		GitlabSelfHosted: typ,
+	}, nil
 }
 
-func (i *idProvider) GetApple(ctx context.Context, client database.QueryExecutor, id domain.IDPIdentifierCondition, instanceID string, orgID *string) (*domain.IDPApple, error) {
-	apple := &domain.IDPApple{}
-	var err error
-
-	apple.IdentityProvider, err = i.Get(ctx, client, id, instanceID, orgID)
+func (i *idProvider) GetLDAP(ctx context.Context, client database.QueryExecutor, opts ...database.QueryOption) (*domain.IDPLDAP, error) {
+	idp, typ, err := getIDP[domain.LDAP](ctx, client, i, domain.IDPTypeLDAP, opts...)
 	if err != nil {
 		return nil, err
 	}
 
-	var idpType domain.IDPType
-	if apple.Type != nil {
-		idpType = *apple.Type
-	}
-
-	if idpType != domain.IDPTypeApple {
-		return nil, domain.NewIDPWrongTypeError(domain.IDPTypeApple, idpType)
-	}
-
-	err = json.Unmarshal(apple.Payload, apple)
-	if err != nil {
-		return nil, err
-	}
-
-	return apple, nil
+	return &domain.IDPLDAP{
+		IdentityProvider: idp,
+		LDAP:             typ,
+	}, nil
 }
 
-func (i *idProvider) GetSAML(ctx context.Context, client database.QueryExecutor, id domain.IDPIdentifierCondition, instanceID string, orgID *string) (*domain.IDPSAML, error) {
-	saml := &domain.IDPSAML{}
-	var err error
-
-	saml.IdentityProvider, err = i.Get(ctx, client, id, instanceID, orgID)
+func (i *idProvider) GetApple(ctx context.Context, client database.QueryExecutor, opts ...database.QueryOption) (*domain.IDPApple, error) {
+	idp, typ, err := getIDP[domain.Apple](ctx, client, i, domain.IDPTypeApple, opts...)
 	if err != nil {
 		return nil, err
 	}
 
+	return &domain.IDPApple{
+		IdentityProvider: idp,
+		Apple:            typ,
+	}, nil
+}
+
+func (i *idProvider) GetSAML(ctx context.Context, client database.QueryExecutor, opts ...database.QueryOption) (*domain.IDPSAML, error) {
+	idp, typ, err := getIDP[domain.SAML](ctx, client, i, domain.IDPTypeSAML, opts...)
+	if err != nil {
+		return nil, err
+	}
+
+	return &domain.IDPSAML{
+		IdentityProvider: idp,
+		SAML:             typ,
+	}, nil
+}
+
+type idpType interface {
+	domain.OIDC | domain.JWT | domain.OAuth | domain.Azure | domain.Google |
+		domain.Github | domain.GithubEnterprise | domain.Gitlab | domain.GitlabSelfHosted |
+		domain.LDAP | domain.Apple | domain.SAML
+}
+
+func getIDP[T idpType](ctx context.Context, client database.QueryExecutor, repo *idProvider, expectedType domain.IDPType, opts ...database.QueryOption) (*domain.IdentityProvider, T, error) {
+	var zero T
+	idp, err := repo.Get(ctx, client, opts...)
+	if err != nil {
+
+		return nil, zero, err
+	}
+
 	var idpType domain.IDPType
-	if saml.Type != nil {
-		idpType = *saml.Type
+	if idp.Type != nil {
+		idpType = *idp.Type
 	}
 
-	if idpType != domain.IDPTypeSAML {
-		return nil, domain.NewIDPWrongTypeError(domain.IDPTypeSAML, idpType)
+	if idpType != expectedType {
+		return nil, zero, domain.NewIDPWrongTypeError(expectedType, idpType)
 	}
 
-	err = json.Unmarshal(saml.Payload, saml)
+	var specificIDP T
+	err = json.Unmarshal(idp.Payload, &specificIDP)
 	if err != nil {
-		return nil, err
+		return nil, zero, err
 	}
 
-	return saml, nil
+	return idp, specificIDP, nil
 }
 
 // -------------------------------------------------------------
@@ -466,10 +334,6 @@ func (idProvider) TypeColumn() database.Column {
 	return database.NewColumn("identity_providers", "type")
 }
 
-func (idProvider) AutoRegisterColumn() database.Column {
-	return database.NewColumn("identity_providers", "auto_register")
-}
-
 func (idProvider) AllowCreationColumn() database.Column {
 	return database.NewColumn("identity_providers", "allow_creation")
 }
@@ -486,14 +350,10 @@ func (idProvider) AllowLinkingColumn() database.Column {
 	return database.NewColumn("identity_providers", "allow_linking")
 }
 
-func (idProvider) AllowAutoLinkingColumn() database.Column {
+func (idProvider) AutoLinkingFieldColumn() database.Column {
 	return database.NewColumn("identity_providers", "auto_linking_field")
 }
 
-func (idProvider) StylingTypeColumn() database.Column {
-	return database.NewColumn("identity_providers", "styling_type")
-}
-
 func (idProvider) PayloadColumn() database.Column {
 	return database.NewColumn("identity_providers", "payload")
 }
@@ -528,7 +388,7 @@ func (i idProvider) OrgIDCondition(id *string) database.Condition {
 	return database.NewTextCondition(i.OrgIDColumn(), database.TextOperationEqual, *id)
 }
 
-func (i idProvider) IDCondition(id string) domain.IDPIdentifierCondition {
+func (i idProvider) IDCondition(id string) database.Condition {
 	return database.NewTextCondition(i.IDColumn(), database.TextOperationEqual, id)
 }
 
@@ -536,46 +396,14 @@ func (i idProvider) StateCondition(state domain.IDPState) database.Condition {
 	return database.NewTextCondition(i.StateColumn(), database.TextOperationEqual, state.String())
 }
 
-func (i idProvider) NameCondition(name string) domain.IDPIdentifierCondition {
-	return database.NewTextCondition(i.NameColumn(), database.TextOperationEqual, name)
+func (i idProvider) NameCondition(op database.TextOperation, name string) database.Condition {
+	return database.NewTextCondition(i.NameColumn(), op, name)
 }
 
 func (i idProvider) TypeCondition(typ domain.IDPType) database.Condition {
 	return database.NewNumberCondition(i.TypeColumn(), database.NumberOperationEqual, typ)
 }
 
-func (i idProvider) AutoRegisterCondition(allow bool) database.Condition {
-	return database.NewBooleanCondition(i.AutoRegisterColumn(), allow)
-}
-
-func (i idProvider) AllowCreationCondition(allow bool) database.Condition {
-	return database.NewBooleanCondition(i.AllowCreationColumn(), allow)
-}
-
-func (i idProvider) AllowAutoCreationCondition(allow bool) database.Condition {
-	return database.NewBooleanCondition(i.AllowAutoCreationColumn(), allow)
-}
-
-func (i idProvider) AllowAutoUpdateCondition(allow bool) database.Condition {
-	return database.NewBooleanCondition(i.AllowAutoUpdateColumn(), allow)
-}
-
-func (i idProvider) AllowLinkingCondition(allow bool) database.Condition {
-	return database.NewBooleanCondition(i.AllowLinkingColumn(), allow)
-}
-
-func (i idProvider) AllowAutoLinkingCondition(linkingType domain.IDPAutoLinkingField) database.Condition {
-	return database.NewTextCondition(i.AllowAutoLinkingColumn(), database.TextOperationEqual, linkingType.String())
-}
-
-func (i idProvider) StylingTypeCondition(style int16) database.Condition {
-	return database.NewNumberCondition(i.StylingTypeColumn(), database.NumberOperationEqual, style)
-}
-
-func (i idProvider) PayloadCondition(payload string) database.Condition {
-	return database.NewTextCondition(i.PayloadColumn(), database.TextOperationEqual, payload)
-}
-
 // -------------------------------------------------------------
 // changes
 // -------------------------------------------------------------
@@ -592,10 +420,6 @@ func (i idProvider) SetAllowCreation(allow bool) database.Change {
 	return database.NewChange(i.AllowCreationColumn(), allow)
 }
 
-func (i idProvider) SetAutoRegister(allow bool) database.Change {
-	return database.NewChange(i.AutoRegisterColumn(), allow)
-}
-
 func (i idProvider) SetAllowAutoCreation(allow bool) database.Change {
 	return database.NewChange(i.AllowAutoCreationColumn(), allow)
 }
@@ -608,12 +432,8 @@ func (i idProvider) SetAllowLinking(allow bool) database.Change {
 	return database.NewChange(i.AllowLinkingColumn(), allow)
 }
 
-func (i idProvider) SetAutoAllowLinking(allow bool) database.Change {
-	return database.NewChange(i.AllowAutoLinkingColumn(), allow)
-}
-
-func (i idProvider) SetStylingType(stylingType int16) database.Change {
-	return database.NewChange(i.StylingTypeColumn(), stylingType)
+func (i idProvider) SetAutoLinkingField(field *domain.IDPAutoLinkingField) database.Change {
+	return database.NewChangePtr(i.AutoLinkingFieldColumn(), field)
 }
 
 func (i idProvider) SetPayload(payload string) database.Change {
@@ -624,6 +444,10 @@ func (i idProvider) SetUpdatedAt(updatedAt *time.Time) database.Change {
 	return database.NewChangePtr(i.UpdatedAtColumn(), updatedAt)
 }
 
+func (i idProvider) SetType(typee domain.IDPType) database.Change {
+	return database.NewChange(i.TypeColumn(), typee)
+}
+
 func scanIDProvider(ctx context.Context, querier database.Querier, builder *database.StatementBuilder) (*domain.IdentityProvider, error) {
 	idp := &domain.IdentityProvider{}
 	rows, err := querier.Query(ctx, builder.String(), builder.Args()...)

backend/v3/storage/database/repository/repository_test.go

@@ -199,7 +199,7 @@ func createIdentityProvider(t *testing.T, tx database.QueryExecutor, instanceID,
 		AllowAutoCreation: true,
 		AllowAutoUpdate:   true,
 		AllowLinking:      true,
-		StylingType:       &stylingType,
+		AutoLinkingField:  gu.Ptr(domain.IDPAutoLinkingFieldEmail),
 		Payload:           []byte("{}"),
 	}
 	idpRepo := repository.IDProviderRepository()