fix: remove legacy events (#10464)

# Which Problems Are Solved

Some events that are now unused are clogging the event queue from time
to time.

# How the Problems Are Solved

Remove the events described in #10458

# Additional Changes

- Updated `stringer` and `enumer` in Makefile target `core_generate_all`
to resolve generated files compilation issues

# Notes
It looks like there are a lot of changes, but most of it is fixing
translation files. I suggest doing a review per-commit

# Additional Context

- Closes #10458
- Depends on https://github.com/zitadel/zitadel/pull/10513

internal/command/command_test.go

@@ -33,7 +33,7 @@ func TestCommands_asyncPush(t *testing.T) {
 	// make sure the test terminates on deadlock
 	background := context.Background()
 	agg := user.NewAggregate("userID", "orgID")
-	cmd := user.NewMachineSecretCheckFailedEvent(background, &agg.Aggregate)
+	cmd := user.NewMachineSecretHashUpdatedEvent(background, &agg.Aggregate, "updatedSecret")
 
 	tests := []struct {
 		name         string

internal/command/device_auth_test.go

@@ -1051,7 +1051,6 @@ func TestCommands_CreateOIDCSessionFromDeviceAuth(t *testing.T) {
 							&oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate,
 							"at_accessTokenID", []string{"openid", "offline_access"}, time.Hour, domain.TokenReasonAuthRequest, nil,
 						),
-						user.NewUserTokenV2AddedEvent(context.Background(), &user.NewAggregate("userID", "org1").Aggregate, "at_accessTokenID"),
 						deviceauth.NewDoneEvent(ctx,
 							deviceauth.NewAggregate("123", "instance1"),
 						),
@@ -1156,7 +1155,6 @@ func TestCommands_CreateOIDCSessionFromDeviceAuth(t *testing.T) {
 							&oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate,
 							"at_accessTokenID", []string{"openid", "offline_access"}, time.Hour, domain.TokenReasonAuthRequest, nil,
 						),
-						user.NewUserTokenV2AddedEvent(context.Background(), &user.NewAggregate("userID", "org1").Aggregate, "at_accessTokenID"),
 						deviceauth.NewDoneEvent(ctx,
 							deviceauth.NewAggregate("123", "instance1"),
 						),
@@ -1256,7 +1254,6 @@ func TestCommands_CreateOIDCSessionFromDeviceAuth(t *testing.T) {
 							&oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate,
 							"at_accessTokenID", []string{"openid", "offline_access"}, time.Hour, domain.TokenReasonAuthRequest, nil,
 						),
-						user.NewUserTokenV2AddedEvent(context.Background(), &user.NewAggregate("userID", "org1").Aggregate, "at_accessTokenID"),
 						oidcsession.NewRefreshTokenAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate,
 							"rt_refreshTokenID", 7*24*time.Hour, 24*time.Hour,
 						),

internal/command/instance_features.go

@@ -19,7 +19,6 @@ type InstanceFeatures struct {
 	ImprovedPerformance            []feature.ImprovedPerformanceType
 	DebugOIDCParentError           *bool
 	OIDCSingleV1SessionTermination *bool
-	DisableUserTokenEvent          *bool
 	EnableBackChannelLogout        *bool
 	LoginV2                        *feature.LoginV2
 	PermissionCheckV2              *bool
@@ -34,7 +33,6 @@ func (m *InstanceFeatures) isEmpty() bool {
 		m.ImprovedPerformance == nil &&
 		m.DebugOIDCParentError == nil &&
 		m.OIDCSingleV1SessionTermination == nil &&
-		m.DisableUserTokenEvent == nil &&
 		m.EnableBackChannelLogout == nil &&
 		m.LoginV2 == nil &&
 		m.PermissionCheckV2 == nil && m.ConsoleUseV2UserApi == nil

internal/command/instance_features_model.go

@@ -72,7 +72,6 @@ func (m *InstanceFeaturesWriteModel) Query() *eventstore.SearchQueryBuilder {
 			feature_v2.InstanceImprovedPerformanceEventType,
 			feature_v2.InstanceDebugOIDCParentErrorEventType,
 			feature_v2.InstanceOIDCSingleV1SessionTerminationEventType,
-			feature_v2.InstanceDisableUserTokenEvent,
 			feature_v2.InstanceEnableBackChannelLogout,
 			feature_v2.InstanceLoginVersion,
 			feature_v2.InstancePermissionCheckV2,
@@ -107,9 +106,6 @@ func reduceInstanceFeature(features *InstanceFeatures, key feature.Key, value an
 	case feature.KeyOIDCSingleV1SessionTermination:
 		v := value.(bool)
 		features.OIDCSingleV1SessionTermination = &v
-	case feature.KeyDisableUserTokenEvent:
-		v := value.(bool)
-		features.DisableUserTokenEvent = &v
 	case feature.KeyEnableBackChannelLogout:
 		v := value.(bool)
 		features.EnableBackChannelLogout = &v
@@ -133,7 +129,6 @@ func (wm *InstanceFeaturesWriteModel) setCommands(ctx context.Context, f *Instan
 	cmds = appendFeatureSliceUpdate(ctx, cmds, aggregate, wm.ImprovedPerformance, f.ImprovedPerformance, feature_v2.InstanceImprovedPerformanceEventType)
 	cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.DebugOIDCParentError, f.DebugOIDCParentError, feature_v2.InstanceDebugOIDCParentErrorEventType)
 	cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.OIDCSingleV1SessionTermination, f.OIDCSingleV1SessionTermination, feature_v2.InstanceOIDCSingleV1SessionTerminationEventType)
-	cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.DisableUserTokenEvent, f.DisableUserTokenEvent, feature_v2.InstanceDisableUserTokenEvent)
 	cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.EnableBackChannelLogout, f.EnableBackChannelLogout, feature_v2.InstanceEnableBackChannelLogout)
 	cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.LoginV2, f.LoginV2, feature_v2.InstanceLoginVersion)
 	cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.PermissionCheckV2, f.PermissionCheckV2, feature_v2.InstancePermissionCheckV2)

internal/command/oidc_session.go

@@ -473,9 +473,6 @@ func (c *OIDCSessionEvents) AddAccessToken(ctx context.Context, scope []string,
 	}
 	c.accessTokenID = AccessTokenPrefix + accessTokenID
 	c.events = append(c.events, oidcsession.NewAccessTokenAddedEvent(ctx, c.oidcSessionWriteModel.aggregate, c.accessTokenID, scope, c.accessTokenLifetime, reason, actor))
-	if !authz.GetFeatures(ctx).DisableUserTokenEvent {
-		c.events = append(c.events, user.NewUserTokenV2AddedEvent(ctx, &user.NewAggregate(userID, resourceOwner).Aggregate, c.accessTokenID))
-	}
 	return nil
 }
 

internal/command/oidc_session_test.go

@@ -400,7 +400,6 @@ func TestCommands_CreateOIDCSessionFromAuthRequest(t *testing.T) {
 						),
 						oidcsession.NewAccessTokenAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate,
 							"at_accessTokenID", []string{"openid", "offline_access"}, time.Hour, domain.TokenReasonAuthRequest, nil),
-						user.NewUserTokenV2AddedEvent(context.Background(), &user.NewAggregate("userID", "org1").Aggregate, "at_accessTokenID"),
 						oidcsession.NewRefreshTokenAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate,
 							"rt_refreshTokenID", 7*24*time.Hour, 24*time.Hour),
 						authrequest.NewSucceededEvent(context.Background(), &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate),
@@ -542,7 +541,6 @@ func TestCommands_CreateOIDCSessionFromAuthRequest(t *testing.T) {
 						),
 						oidcsession.NewAccessTokenAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate,
 							"at_accessTokenID", []string{"openid", "offline_access"}, time.Hour, domain.TokenReasonAuthRequest, nil),
-						user.NewUserTokenV2AddedEvent(context.Background(), &user.NewAggregate("userID", "org1").Aggregate, "at_accessTokenID"),
 						oidcsession.NewRefreshTokenAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate,
 							"rt_refreshTokenID", 7*24*time.Hour, 24*time.Hour),
 						authrequest.NewSucceededEvent(context.Background(), &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate),
@@ -589,145 +587,6 @@ func TestCommands_CreateOIDCSessionFromAuthRequest(t *testing.T) {
 				state: "state",
 			},
 		},
-		{
-			"disable user token event",
-			fields{
-				eventstore: expectEventstore(
-					expectFilter(
-						eventFromEventPusher(
-							authrequest.NewAddedEvent(context.Background(), &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate,
-								"loginClient",
-								"clientID",
-								"redirectURI",
-								"state",
-								"nonce",
-								[]string{"openid", "offline_access"},
-								[]string{"audience"},
-								domain.OIDCResponseTypeCode,
-								domain.OIDCResponseModeQuery,
-								&domain.OIDCCodeChallenge{
-									Challenge: "challenge",
-									Method:    domain.CodeChallengeMethodS256,
-								},
-								[]domain.Prompt{domain.PromptNone},
-								[]string{"en", "de"},
-								gu.Ptr(time.Duration(0)),
-								gu.Ptr("loginHint"),
-								gu.Ptr("hintUserID"),
-								true,
-								"issuer",
-							),
-						),
-						eventFromEventPusher(
-							authrequest.NewCodeAddedEvent(context.Background(), &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate),
-						),
-						eventFromEventPusher(
-							authrequest.NewSessionLinkedEvent(context.Background(), &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate,
-								"sessionID",
-								"userID",
-								testNow,
-								[]domain.UserAuthMethodType{domain.UserAuthMethodTypePassword},
-							),
-						),
-					),
-					expectFilter(
-						eventFromEventPusher(
-							session.NewAddedEvent(context.Background(),
-								&session.NewAggregate("sessionID", "instance1").Aggregate,
-								&domain.UserAgent{
-									FingerprintID: gu.Ptr("fp1"),
-									IP:            net.ParseIP("1.2.3.4"),
-									Description:   gu.Ptr("firefox"),
-									Header:        http.Header{"foo": []string{"bar"}},
-								},
-							),
-						),
-						eventFromEventPusher(
-							session.NewUserCheckedEvent(context.Background(), &session.NewAggregate("sessionID", "instanceID").Aggregate,
-								"userID", "org1", testNow, &language.Afrikaans),
-						),
-						eventFromEventPusher(
-							session.NewPasswordCheckedEvent(context.Background(), &session.NewAggregate("sessionID", "instanceID").Aggregate,
-								testNow),
-						),
-					),
-					expectFilter(
-						user.NewHumanAddedEvent(
-							context.Background(),
-							&user.NewAggregate("userID", "org1").Aggregate,
-							"username",
-							"firstname",
-							"lastname",
-							"nickname",
-							"displayname",
-							language.Afrikaans,
-							domain.GenderUnspecified,
-							"email",
-							false,
-						),
-					),
-					expectFilter(), // token lifetime
-					expectPush(
-						authrequest.NewCodeExchangedEvent(context.Background(), &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate),
-						oidcsession.NewAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate,
-							"userID", "org1", "sessionID", "clientID", []string{"audience"}, []string{"openid", "offline_access"},
-							[]domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow, "nonce", &language.Afrikaans,
-							&domain.UserAgent{
-								FingerprintID: gu.Ptr("fp1"),
-								IP:            net.ParseIP("1.2.3.4"),
-								Description:   gu.Ptr("firefox"),
-								Header:        http.Header{"foo": []string{"bar"}},
-							},
-						),
-						oidcsession.NewAccessTokenAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate,
-							"at_accessTokenID", []string{"openid", "offline_access"}, time.Hour, domain.TokenReasonAuthRequest, nil),
-						oidcsession.NewRefreshTokenAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate,
-							"rt_refreshTokenID", 7*24*time.Hour, 24*time.Hour),
-						authrequest.NewSucceededEvent(context.Background(), &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate),
-					),
-				),
-				idGenerator:                     mock.NewIDGeneratorExpectIDs(t, "oidcSessionID", "accessTokenID", "refreshTokenID"),
-				defaultAccessTokenLifetime:      time.Hour,
-				defaultRefreshTokenLifetime:     7 * 24 * time.Hour,
-				defaultRefreshTokenIdleLifetime: 24 * time.Hour,
-				keyAlgorithm:                    crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
-			},
-			args{
-				ctx: authz.WithFeatures(
-					authz.WithInstanceID(context.Background(), "instanceID"),
-					feature.Features{
-						DisableUserTokenEvent: true,
-					},
-				),
-				authRequestID:    "V2_authRequestID",
-				complianceCheck:  mockAuthRequestComplianceChecker(nil),
-				needRefreshToken: true,
-			},
-			res{
-				session: &OIDCSession{
-					SessionID:         "sessionID",
-					TokenID:           "V2_oidcSessionID-at_accessTokenID",
-					ClientID:          "clientID",
-					UserID:            "userID",
-					Audience:          []string{"audience"},
-					Expiration:        time.Time{}.Add(time.Hour),
-					Scope:             []string{"openid", "offline_access"},
-					AuthMethods:       []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword},
-					AuthTime:          testNow,
-					Nonce:             "nonce",
-					PreferredLanguage: &language.Afrikaans,
-					UserAgent: &domain.UserAgent{
-						FingerprintID: gu.Ptr("fp1"),
-						IP:            net.ParseIP("1.2.3.4"),
-						Description:   gu.Ptr("firefox"),
-						Header:        http.Header{"foo": []string{"bar"}},
-					},
-					Reason:       domain.TokenReasonAuthRequest,
-					RefreshToken: "VjJfb2lkY1Nlc3Npb25JRC1ydF9yZWZyZXNoVG9rZW5JRDp1c2VySUQ", //V2_oidcSessionID-rt_refreshTokenID:userID
-				},
-				state: "state",
-			},
-		},
 		{
 			"without ID token only (implicit)",
 			fields{
@@ -1042,7 +901,6 @@ func TestCommands_CreateOIDCSession(t *testing.T) {
 								Issuer: "foo.com",
 							},
 						),
-						user.NewUserTokenV2AddedEvent(context.Background(), &user.NewAggregate("userID", "org1").Aggregate, "at_accessTokenID"),
 					),
 				),
 				idGenerator:                     mock.NewIDGeneratorExpectIDs(t, "oidcSessionID", "accessTokenID"),
@@ -1181,107 +1039,6 @@ func TestCommands_CreateOIDCSession(t *testing.T) {
 				},
 			},
 		},
-		{
-			name: "disable user token event",
-			fields: fields{
-				eventstore: expectEventstore(
-					expectFilter(
-						user.NewHumanAddedEvent(
-							context.Background(),
-							&user.NewAggregate("userID", "org1").Aggregate,
-							"username",
-							"firstname",
-							"lastname",
-							"nickname",
-							"displayname",
-							language.Afrikaans,
-							domain.GenderUnspecified,
-							"email",
-							false,
-						),
-					),
-					expectFilter(), // token lifetime
-					expectPush(
-						oidcsession.NewAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate,
-							"userID", "org1", "", "clientID", []string{"audience"}, []string{"openid", "offline_access"},
-							[]domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow, "nonce", &language.Afrikaans,
-							&domain.UserAgent{
-								FingerprintID: gu.Ptr("fp1"),
-								IP:            net.ParseIP("1.2.3.4"),
-								Description:   gu.Ptr("firefox"),
-								Header:        http.Header{"foo": []string{"bar"}},
-							},
-						),
-						oidcsession.NewAccessTokenAddedEvent(context.Background(),
-							&oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate,
-							"at_accessTokenID", []string{"openid", "offline_access"}, time.Hour, domain.TokenReasonAuthRequest,
-							&domain.TokenActor{
-								UserID: "user2",
-								Issuer: "foo.com",
-							},
-						),
-					),
-				),
-				idGenerator:                     mock.NewIDGeneratorExpectIDs(t, "oidcSessionID", "accessTokenID"),
-				defaultAccessTokenLifetime:      time.Hour,
-				defaultRefreshTokenLifetime:     7 * 24 * time.Hour,
-				defaultRefreshTokenIdleLifetime: 24 * time.Hour,
-				keyAlgorithm:                    crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
-			},
-			args: args{
-				ctx: authz.WithFeatures(
-					authz.WithInstanceID(context.Background(), "instanceID"),
-					feature.Features{
-						DisableUserTokenEvent: true,
-					},
-				),
-				userID:            "userID",
-				resourceOwner:     "org1",
-				clientID:          "clientID",
-				audience:          []string{"audience"},
-				scope:             []string{"openid", "offline_access"},
-				authMethods:       []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword},
-				authTime:          testNow,
-				nonce:             "nonce",
-				preferredLanguage: &language.Afrikaans,
-				userAgent: &domain.UserAgent{
-					FingerprintID: gu.Ptr("fp1"),
-					IP:            net.ParseIP("1.2.3.4"),
-					Description:   gu.Ptr("firefox"),
-					Header:        http.Header{"foo": []string{"bar"}},
-				},
-				reason: domain.TokenReasonAuthRequest,
-				actor: &domain.TokenActor{
-					UserID: "user2",
-					Issuer: "foo.com",
-				},
-				needRefreshToken: false,
-				responseType:     domain.OIDCResponseTypeUnspecified,
-			},
-			want: &OIDCSession{
-				TokenID:           "V2_oidcSessionID-at_accessTokenID",
-				ClientID:          "clientID",
-				UserID:            "userID",
-				Audience:          []string{"audience"},
-				Expiration:        time.Time{}.Add(time.Hour),
-				Scope:             []string{"openid", "offline_access"},
-				AuthMethods:       []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword},
-				AuthTime:          testNow,
-				Nonce:             "nonce",
-				PreferredLanguage: &language.Afrikaans,
-				UserAgent: &domain.UserAgent{
-					FingerprintID: gu.Ptr("fp1"),
-					IP:            net.ParseIP("1.2.3.4"),
-					Description:   gu.Ptr("firefox"),
-					Header:        http.Header{"foo": []string{"bar"}},
-				},
-				Reason: domain.TokenReasonAuthRequest,
-				Actor: &domain.TokenActor{
-					UserID: "user2",
-					Issuer: "foo.com",
-				},
-			},
-		},
 		{
 			name: "with refresh token",
 			fields: fields{
@@ -1320,7 +1077,6 @@ func TestCommands_CreateOIDCSession(t *testing.T) {
 								UserID: "user2",
 								Issuer: "foo.com",
 							}),
-						user.NewUserTokenV2AddedEvent(context.Background(), &user.NewAggregate("userID", "org1").Aggregate, "at_accessTokenID"),
 						oidcsession.NewRefreshTokenAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate,
 							"rt_refreshTokenID", 7*24*time.Hour, 24*time.Hour),
 					),
@@ -1420,7 +1176,6 @@ func TestCommands_CreateOIDCSession(t *testing.T) {
 								Issuer: "foo.com",
 							},
 						),
-						user.NewUserTokenV2AddedEvent(context.Background(), &user.NewAggregate("userID", "org1").Aggregate, "at_accessTokenID"),
 					),
 				),
 				idGenerator:                     mock.NewIDGeneratorExpectIDs(t, "oidcSessionID", "accessTokenID"),
@@ -1519,7 +1274,6 @@ func TestCommands_CreateOIDCSession(t *testing.T) {
 								Issuer: "foo.com",
 							},
 						),
-						user.NewUserTokenV2AddedEvent(context.Background(), &user.NewAggregate("userID", "org1").Aggregate, "at_accessTokenID"),
 					),
 				),
 				idGenerator:                     mock.NewIDGeneratorExpectIDs(t, "oidcSessionID", "accessTokenID"),
@@ -1616,7 +1370,6 @@ func TestCommands_CreateOIDCSession(t *testing.T) {
 								Issuer: "foo.com",
 							},
 						),
-						user.NewUserTokenV2AddedEvent(context.Background(), &user.NewAggregate("userID", "org1").Aggregate, "at_accessTokenID"),
 					),
 				),
 				idGenerator:                     mock.NewIDGeneratorExpectIDs(t, "oidcSessionID", "accessTokenID"),
@@ -1722,7 +1475,6 @@ func TestCommands_CreateOIDCSession(t *testing.T) {
 								Issuer: "foo.com",
 							},
 						),
-						user.NewUserTokenV2AddedEvent(context.Background(), &user.NewAggregate("userID", "org1").Aggregate, "at_accessTokenID"),
 					),
 				),
 				idGenerator:                     mock.NewIDGeneratorExpectIDs(t, "oidcSessionID", "accessTokenID"),
@@ -1882,7 +1634,6 @@ func TestCommands_CreateOIDCSession(t *testing.T) {
 								Issuer: "foo.com",
 							},
 						),
-						user.NewUserTokenV2AddedEvent(context.Background(), &user.NewAggregate("userID", "org1").Aggregate, "at_accessTokenID"),
 					),
 				),
 				idGenerator:                     mock.NewIDGeneratorExpectIDs(t, "oidcSessionID", "accessTokenID"),
@@ -2213,7 +1964,6 @@ func TestCommands_ExchangeOIDCSessionRefreshAndAccessToken(t *testing.T) {
 					expectPush(
 						oidcsession.NewAccessTokenAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate,
 							"at_accessTokenID", []string{"openid", "offline_access"}, time.Hour, domain.TokenReasonRefresh, nil),
-						user.NewUserTokenV2AddedEvent(context.Background(), &user.NewAggregate("userID", "org1").Aggregate, "at_accessTokenID"),
 						oidcsession.NewRefreshTokenRenewedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate,
 							"rt_refreshTokenID2", 24*time.Hour),
 					),

internal/command/system_features.go

@@ -15,7 +15,6 @@ type SystemFeatures struct {
 	UserSchema                     *bool
 	ImprovedPerformance            []feature.ImprovedPerformanceType
 	OIDCSingleV1SessionTermination *bool
-	DisableUserTokenEvent          *bool
 	EnableBackChannelLogout        *bool
 	LoginV2                        *feature.LoginV2
 	PermissionCheckV2              *bool
@@ -28,7 +27,6 @@ func (m *SystemFeatures) isEmpty() bool {
 		// nil check to allow unset improvements
 		m.ImprovedPerformance == nil &&
 		m.OIDCSingleV1SessionTermination == nil &&
-		m.DisableUserTokenEvent == nil &&
 		m.EnableBackChannelLogout == nil &&
 		m.LoginV2 == nil &&
 		m.PermissionCheckV2 == nil

internal/command/system_features_model.go

@@ -64,7 +64,6 @@ func (m *SystemFeaturesWriteModel) Query() *eventstore.SearchQueryBuilder {
 			feature_v2.SystemTokenExchangeEventType,
 			feature_v2.SystemImprovedPerformanceEventType,
 			feature_v2.SystemOIDCSingleV1SessionTerminationEventType,
-			feature_v2.SystemDisableUserTokenEvent,
 			feature_v2.SystemEnableBackChannelLogout,
 			feature_v2.SystemLoginVersion,
 			feature_v2.SystemPermissionCheckV2,
@@ -94,9 +93,6 @@ func reduceSystemFeature(features *SystemFeatures, key feature.Key, value any) {
 	case feature.KeyOIDCSingleV1SessionTermination:
 		v := value.(bool)
 		features.OIDCSingleV1SessionTermination = &v
-	case feature.KeyDisableUserTokenEvent:
-		v := value.(bool)
-		features.DisableUserTokenEvent = &v
 	case feature.KeyEnableBackChannelLogout:
 		v := value.(bool)
 		features.EnableBackChannelLogout = &v
@@ -116,7 +112,6 @@ func (wm *SystemFeaturesWriteModel) setCommands(ctx context.Context, f *SystemFe
 	cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.TokenExchange, f.TokenExchange, feature_v2.SystemTokenExchangeEventType)
 	cmds = appendFeatureSliceUpdate(ctx, cmds, aggregate, wm.ImprovedPerformance, f.ImprovedPerformance, feature_v2.SystemImprovedPerformanceEventType)
 	cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.OIDCSingleV1SessionTermination, f.OIDCSingleV1SessionTermination, feature_v2.SystemOIDCSingleV1SessionTerminationEventType)
-	cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.DisableUserTokenEvent, f.DisableUserTokenEvent, feature_v2.SystemDisableUserTokenEvent)
 	cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.EnableBackChannelLogout, f.EnableBackChannelLogout, feature_v2.SystemEnableBackChannelLogout)
 	cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.LoginV2, f.LoginV2, feature_v2.SystemLoginVersion)
 	cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.PermissionCheckV2, f.PermissionCheckV2, feature_v2.SystemPermissionCheckV2)

internal/command/user_machine_secret.go

@@ -111,17 +111,8 @@ func prepareRemoveMachineSecret(a *user.Aggregate, check PermissionCheck) prepar
 
 func (c *Commands) MachineSecretCheckSucceeded(ctx context.Context, userID, resourceOwner, updated string) {
 	agg := user.NewAggregate(userID, resourceOwner)
-	cmds := append(
-		make([]eventstore.Command, 0, 2),
-		user.NewMachineSecretCheckSucceededEvent(ctx, &agg.Aggregate),
-	)
 	if updated != "" {
-		cmds = append(cmds, user.NewMachineSecretHashUpdatedEvent(ctx, &agg.Aggregate, updated))
+		cmds := []eventstore.Command{user.NewMachineSecretHashUpdatedEvent(ctx, &agg.Aggregate, updated)}
+		c.asyncPush(ctx, cmds...)
 	}
-	c.asyncPush(ctx, cmds...)
-}
-
-func (c *Commands) MachineSecretCheckFailed(ctx context.Context, userID, resourceOwner string) {
-	agg := user.NewAggregate(userID, resourceOwner)
-	c.asyncPush(ctx, user.NewMachineSecretCheckFailedEvent(ctx, &agg.Aggregate))
 }

internal/command/user_machine_secret_test.go

@@ -304,33 +304,45 @@ func TestCommandSide_RemoveMachineSecret(t *testing.T) {
 }
 
 func TestCommands_MachineSecretCheckSucceeded(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
-	defer cancel()
 
-	agg := user.NewAggregate("userID", "orgID")
-	cmd := user.NewMachineSecretCheckSucceededEvent(ctx, &agg.Aggregate)
+	tt := []struct {
+		testName               string
+		eventStoreExpectations func(ctx context.Context, updatedSecret string) []expect
 
-	c := &Commands{
-		eventstore: eventstoreExpect(t,
-			expectPushSlow(time.Second/100, cmd),
-		),
+		inputUpdatedMachineSecret string
+	}{
+		{
+			testName:                  "when machine secret is updated should meet expectations and return no error",
+			inputUpdatedMachineSecret: "upd4t3dS3cr3t",
+			eventStoreExpectations: func(ctx context.Context, updatedSecret string) []expect {
+				return []expect{expectPushSlow(time.Second/100, user.NewMachineSecretHashUpdatedEvent(
+					ctx,
+					&user.NewAggregate("userID", "orgID").Aggregate,
+					updatedSecret,
+				))}
+			},
+		},
+		{
+			testName: "when machine secret is not update should have no expectations and return no error",
+			eventStoreExpectations: func(_ context.Context, _ string) []expect {
+				return []expect{}
+			},
+		},
 	}
-	c.MachineSecretCheckSucceeded(ctx, "userID", "orgID", "")
-	require.NoError(t, c.Close(ctx))
-}
 
-func TestCommands_MachineSecretCheckFailed(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
-	defer cancel()
+	for _, tc := range tt {
+		t.Run(tc.testName, func(t *testing.T) {
+			// Given
+			ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+			defer cancel()
 
-	agg := user.NewAggregate("userID", "orgID")
-	cmd := user.NewMachineSecretCheckFailedEvent(ctx, &agg.Aggregate)
+			c := &Commands{eventstore: expectEventstore(tc.eventStoreExpectations(ctx, tc.inputUpdatedMachineSecret)...)(t)}
 
-	c := &Commands{
-		eventstore: eventstoreExpect(t,
-			expectPushSlow(time.Second/100, cmd),
-		),
+			// Test
+			c.MachineSecretCheckSucceeded(ctx, "userID", "orgID", tc.inputUpdatedMachineSecret)
+
+			// Verify
+			require.NoError(t, c.Close(ctx))
+		})
 	}
-	c.MachineSecretCheckFailed(ctx, "userID", "orgID")
-	require.NoError(t, c.Close(ctx))
 }