feat: migrate unique constraints v1 to v2 (#1274)

* fix: unique migration

* fix: unique migration

* fix: remove migrations

* fix: member events

internal/v2/command/iam_idp_config.go

@@ -66,7 +66,7 @@ func (r *CommandSide) ChangeDefaultIDPConfig(ctx context.Context, config *domain
 		return nil, caos_errs.ThrowNotFound(nil, "IAM-4M9so", "Errors.IAM.IDPConfig.NotExisting")
 	}
 
-	changedEvent, hasChanged := existingIDP.NewChangedEvent(ctx, config.IDPConfigID, config.Name, config.StylingType)
+	changedEvent, hasChanged := existingIDP.NewChangedEvent(ctx, existingIDP.ResourceOwner, config.IDPConfigID, config.Name, config.StylingType)
 	if !hasChanged {
 		return nil, caos_errs.ThrowPreconditionFailed(nil, "IAM-4M9vs", "Errors.IAM.LabelPolicy.NotChanged")
 	}

internal/v2/command/iam_idp_config_model.go

@@ -84,13 +84,16 @@ func (wm *IAMIDPConfigWriteModel) AppendAndReduce(events ...eventstore.EventRead
 
 func (wm *IAMIDPConfigWriteModel) NewChangedEvent(
 	ctx context.Context,
+	resourceOwner,
 	configID,
 	name string,
 	stylingType domain.IDPConfigStylingType,
 ) (*iam.IDPConfigChangedEvent, bool) {
 
 	changes := make([]idpconfig.IDPConfigChanges, 0)
+	oldName := ""
 	if wm.Name != name {
+		oldName = wm.Name
 		changes = append(changes, idpconfig.ChangeName(name))
 	}
 	if stylingType.Valid() && wm.StylingType != stylingType {
@@ -99,7 +102,7 @@ func (wm *IAMIDPConfigWriteModel) NewChangedEvent(
 	if len(changes) == 0 {
 		return nil, false
 	}
-	changeEvent, err := iam.NewIDPConfigChangedEvent(ctx, configID, changes)
+	changeEvent, err := iam.NewIDPConfigChangedEvent(ctx, resourceOwner, configID, oldName, changes)
 	if err != nil {
 		return nil, false
 	}

internal/v2/command/iam_member.go

@@ -42,7 +42,7 @@ func (r *CommandSide) addIAMMember(ctx context.Context, iamAgg *iam_repo.Aggrega
 		return errors.ThrowAlreadyExists(nil, "IAM-sdgQ4", "Errors.IAM.Member.AlreadyExists")
 	}
 
-	iamAgg.PushEvents(iam_repo.NewMemberAddedEvent(ctx, member.UserID, member.Roles...))
+	iamAgg.PushEvents(iam_repo.NewMemberAddedEvent(ctx, iamAgg.ID(), member.UserID, member.Roles...))
 
 	return nil
 }
@@ -89,7 +89,7 @@ func (r *CommandSide) RemoveIAMMember(ctx context.Context, userID string) error
 	}
 
 	iamAgg := IAMAggregateFromWriteModel(&m.MemberWriteModel.WriteModel)
-	iamAgg.PushEvents(iam_repo.NewMemberRemovedEvent(ctx, userID))
+	iamAgg.PushEvents(iam_repo.NewMemberRemovedEvent(ctx, iamAgg.ID(), userID))
 
 	return r.eventstore.PushAggregate(ctx, m, iamAgg)
 }

internal/v2/command/iam_model.go

@@ -27,14 +27,6 @@ func NewIAMWriteModel() *IAMWriteModel {
 
 func (wm *IAMWriteModel) AppendEvents(events ...eventstore.EventReader) {
 	wm.WriteModel.AppendEvents(events...)
-	//for _, event := range events {
-	//	switch e := event.(type) {
-	//	case *iam.LabelPolicyAddedEvent:
-	//		wm.LabelPolicyWriteModel.AppendEvents(&e.LabelPolicyAddedEvent)
-	//	case *iam.LabelPolicyChangedEvent:
-	//		wm.LabelPolicyWriteModel.AppendEvents(&e.LabelPolicyChangedEvent)
-	//	}
-	//}
 }
 
 func (wm *IAMWriteModel) Reduce() error {
@@ -61,17 +53,6 @@ func (wm *IAMWriteModel) Query() *eventstore.SearchQueryBuilder {
 		ResourceOwner(wm.ResourceOwner)
 }
 
-//
-//func (wm *IAMLabelPolicyWriteModel) HasChanged(primaryColor, secondaryColor string) bool {
-//	if primaryColor != "" && wm.PrimaryColor != primaryColor {
-//		return true
-//	}
-//	if secondaryColor != "" && wm.SecondaryColor != secondaryColor {
-//		return true
-//	}
-//	return false
-//}
-
 func IAMAggregateFromWriteModel(wm *eventstore.WriteModel) *iam.Aggregate {
 	return &iam.Aggregate{
 		Aggregate: *eventstore.AggregateFromWriteModel(wm, iam.AggregateType, iam.AggregateVersion),

internal/v2/command/org_idp_config.go

@@ -67,7 +67,13 @@ func (r *CommandSide) ChangeIDPConfig(ctx context.Context, config *domain.IDPCon
 		return nil, caos_errs.ThrowNotFound(nil, "Org-4M9so", "Errors.Org.IDPConfig.NotExisting")
 	}
 
-	changedEvent, hasChanged := existingIDP.NewChangedEvent(ctx, config.IDPConfigID, config.Name, config.StylingType)
+	changedEvent, hasChanged := existingIDP.NewChangedEvent(
+		ctx,
+		existingIDP.ResourceOwner,
+		config.IDPConfigID,
+		config.Name,
+		config.StylingType)
+
 	if !hasChanged {
 		return nil, caos_errs.ThrowPreconditionFailed(nil, "Org-4M9vs", "Errors.Org.LabelPolicy.NotChanged")
 	}

internal/v2/command/org_idp_config_model.go

@@ -84,13 +84,16 @@ func (wm *OrgIDPConfigWriteModel) AppendAndReduce(events ...eventstore.EventRead
 
 func (wm *OrgIDPConfigWriteModel) NewChangedEvent(
 	ctx context.Context,
+	resourceOwner,
 	configID,
 	name string,
 	stylingType domain.IDPConfigStylingType,
 ) (*org.IDPConfigChangedEvent, bool) {
 
 	changes := make([]idpconfig.IDPConfigChanges, 0)
+	oldName := ""
 	if wm.Name != name {
+		oldName = wm.Name
 		changes = append(changes, idpconfig.ChangeName(name))
 	}
 	if stylingType.Valid() && wm.StylingType != stylingType {
@@ -99,7 +102,7 @@ func (wm *OrgIDPConfigWriteModel) NewChangedEvent(
 	if len(changes) == 0 {
 		return nil, false
 	}
-	changeEvent, err := org.NewIDPConfigChangedEvent(ctx, configID, changes)
+	changeEvent, err := org.NewIDPConfigChangedEvent(ctx, resourceOwner, configID, oldName, changes)
 	if err != nil {
 		return nil, false
 	}

internal/v2/command/org_member.go

@@ -42,7 +42,7 @@ func (r *CommandSide) addOrgMember(ctx context.Context, orgAgg *org.Aggregate, a
 		return errors.ThrowAlreadyExists(nil, "Org-PtXi1", "Errors.Org.Member.AlreadyExists")
 	}
 
-	orgAgg.PushEvents(org.NewMemberAddedEvent(ctx, member.UserID, member.Roles...))
+	orgAgg.PushEvents(org.NewMemberAddedEvent(ctx, orgAgg.ID(), member.UserID, member.Roles...))
 
 	return nil
 }
@@ -89,7 +89,7 @@ func (r *CommandSide) RemoveOrgMember(ctx context.Context, orgID, userID string)
 	}
 
 	orgAgg := OrgAggregateFromWriteModel(&m.MemberWriteModel.WriteModel)
-	orgAgg.PushEvents(org.NewMemberRemovedEvent(ctx, userID))
+	orgAgg.PushEvents(org.NewMemberRemovedEvent(ctx, orgAgg.ID(), userID))
 
 	return r.eventstore.PushAggregate(ctx, m, orgAgg)
 }

internal/v2/command/project.go

@@ -84,7 +84,7 @@ func (r *CommandSide) ChangeProject(ctx context.Context, projectChange *domain.P
 		return nil, caos_errs.ThrowNotFound(nil, "COMMAND-3M9sd", "Errors.Project.NotFound")
 	}
 
-	changedEvent, hasChanged, err := existingProject.NewChangedEvent(ctx, projectChange.Name, projectChange.ProjectRoleAssertion, projectChange.ProjectRoleCheck)
+	changedEvent, hasChanged, err := existingProject.NewChangedEvent(ctx, existingProject.ResourceOwner, projectChange.Name, projectChange.ProjectRoleAssertion, projectChange.ProjectRoleCheck)
 	if err != nil {
 		return nil, err
 	}
@@ -141,7 +141,7 @@ func (r *CommandSide) ReactivateProject(ctx context.Context, projectID string, r
 	}
 
 	projectAgg := ProjectAggregateFromWriteModel(&existingProject.WriteModel)
-	projectAgg.PushEvents(project.NewProjectDeactivatedEvent(ctx))
+	projectAgg.PushEvents(project.NewProjectReactivatedEvent(ctx))
 
 	return r.eventstore.PushAggregate(ctx, existingProject, projectAgg)
 }

internal/v2/command/project_grant.go

@@ -8,7 +8,6 @@ import (
 	"github.com/caos/zitadel/internal/telemetry/tracing"
 	"github.com/caos/zitadel/internal/v2/domain"
 	"github.com/caos/zitadel/internal/v2/repository/project"
-	"github.com/caos/zitadel/internal/v2/repository/usergrant"
 	"reflect"
 )
 
@@ -123,7 +122,7 @@ func (r *CommandSide) removeRoleFromProjectGrant(ctx context.Context, projectAgg
 		)
 	} else {
 		projectAgg.PushEvents(
-			usergrant.NewUserGrantCascadeChangedEvent(ctx, existingProjectGrant.RoleKeys),
+			project.NewGrantCascadeChangedEvent(ctx, projectGrantID, existingProjectGrant.RoleKeys),
 		)
 	}
 

internal/v2/command/project_member.go

@@ -46,7 +46,7 @@ func (r *CommandSide) addProjectMember(ctx context.Context, projectAgg *project.
 		return errors.ThrowAlreadyExists(nil, "PROJECT-PtXi1", "Errors.Project.Member.AlreadyExists")
 	}
 
-	projectAgg.PushEvents(project.NewProjectMemberAddedEvent(ctx, member.UserID, member.Roles...))
+	projectAgg.PushEvents(project.NewProjectMemberAddedEvent(ctx, projectAgg.ID(), member.UserID, member.Roles...))
 
 	return nil
 }
@@ -93,7 +93,7 @@ func (r *CommandSide) RemoveProjectMember(ctx context.Context, projectID, userID
 	}
 
 	projectAgg := ProjectAggregateFromWriteModel(&m.MemberWriteModel.WriteModel)
-	projectAgg.PushEvents(project.NewProjectMemberRemovedEvent(ctx, userID))
+	projectAgg.PushEvents(project.NewProjectMemberRemovedEvent(ctx, projectAgg.ID(), userID))
 
 	return r.eventstore.PushAggregate(ctx, m, projectAgg)
 }

internal/v2/command/project_model.go

@@ -72,6 +72,7 @@ func (wm *ProjectWriteModel) Query() *eventstore.SearchQueryBuilder {
 
 func (wm *ProjectWriteModel) NewChangedEvent(
 	ctx context.Context,
+	resourceOwner,
 	name string,
 	projectRoleAssertion,
 	projectRoleCheck bool,
@@ -79,7 +80,9 @@ func (wm *ProjectWriteModel) NewChangedEvent(
 	changes := make([]project.ProjectChanges, 0)
 	var err error
 
+	oldName := ""
 	if wm.Name != name {
+		oldName = wm.Name
 		changes = append(changes, project.ChangeName(name))
 	}
 	if wm.ProjectRoleAssertion != projectRoleAssertion {
@@ -91,7 +94,7 @@ func (wm *ProjectWriteModel) NewChangedEvent(
 	if len(changes) == 0 {
 		return nil, false, nil
 	}
-	changeEvent, err := project.NewProjectChangeEvent(ctx, changes)
+	changeEvent, err := project.NewProjectChangeEvent(ctx, resourceOwner, oldName, changes)
 	if err != nil {
 		return nil, false, err
 	}

internal/v2/command/project_role.go

@@ -51,7 +51,6 @@ func (r *CommandSide) addProjectRoles(ctx context.Context, projectAgg *project.A
 				projectRole.DisplayName,
 				projectRole.Group,
 				projectID,
-				resourceOwner,
 			),
 		)
 	}
@@ -107,7 +106,7 @@ func (r *CommandSide) RemoveProjectRole(ctx context.Context, projectID, key, res
 	}
 	aggregates := make([]eventstore.Aggregater, 0)
 	projectAgg := ProjectAggregateFromWriteModel(&existingRole.WriteModel)
-	projectAgg.PushEvents(project.NewRoleRemovedEvent(ctx, key, projectID, existingRole.ResourceOwner))
+	projectAgg.PushEvents(project.NewRoleRemovedEvent(ctx, key, projectID))
 	for _, projectGrantID := range cascadingProjectGrantIds {
 		_, err = r.removeRoleFromProjectGrant(ctx, projectAgg, projectID, projectGrantID, key, true)
 		if err != nil {

internal/v2/command/setup_step11.go

@@ -0,0 +1,35 @@
+package command
+
+import (
+	"context"
+	"github.com/caos/logging"
+	"github.com/caos/zitadel/internal/v2/domain"
+	iam_repo "github.com/caos/zitadel/internal/v2/repository/iam"
+)
+
+type Step11 struct {
+	MigrateV1EventstoreToV2 bool
+}
+
+func (s *Step11) Step() domain.Step {
+	return domain.Step11
+}
+
+func (s *Step11) execute(ctx context.Context, commandSide *CommandSide) error {
+	return commandSide.SetupStep11(ctx, s)
+}
+
+func (r *CommandSide) SetupStep11(ctx context.Context, step *Step11) error {
+	fn := func(iam *IAMWriteModel) (*iam_repo.Aggregate, error) {
+		iamAgg := IAMAggregateFromWriteModel(&iam.WriteModel)
+		uniqueConstraints := NewUniqueConstraintReadModel(ctx, r)
+		err := r.eventstore.FilterToQueryReducer(ctx, uniqueConstraints)
+		if err != nil {
+			return nil, err
+		}
+		iamAgg.PushEvents(iam_repo.NewMigrateUniqueConstraintEvent(ctx, uniqueConstraints.UniqueConstraints))
+		logging.Log("SETUP-M9fsd").Info("migrate v1 eventstore to v2")
+		return iamAgg, nil
+	}
+	return r.setup(ctx, step, fn)
+}

internal/v2/command/unique_constraints_model.go

@@ -0,0 +1,255 @@
+package command
+
+import (
+	"context"
+	"github.com/caos/logging"
+	"github.com/caos/zitadel/internal/eventstore/v2"
+	"github.com/caos/zitadel/internal/v2/domain"
+	"github.com/caos/zitadel/internal/v2/repository/iam"
+	"github.com/caos/zitadel/internal/v2/repository/idpconfig"
+	"github.com/caos/zitadel/internal/v2/repository/member"
+	"github.com/caos/zitadel/internal/v2/repository/org"
+	"github.com/caos/zitadel/internal/v2/repository/policy"
+	"github.com/caos/zitadel/internal/v2/repository/project"
+	"github.com/caos/zitadel/internal/v2/repository/user"
+	"github.com/caos/zitadel/internal/v2/repository/usergrant"
+)
+
+type UniqueConstraintReadModel struct {
+	eventstore.WriteModel
+
+	UniqueConstraints []*domain.UniqueConstraintMigration
+	commandProvider   commandProvider
+	ctx               context.Context
+}
+
+type commandProvider interface {
+	getOrgIAMPolicy(ctx context.Context, orgID string) (*domain.OrgIAMPolicy, error)
+}
+
+func NewUniqueConstraintReadModel(ctx context.Context, provider commandProvider) *UniqueConstraintReadModel {
+	return &UniqueConstraintReadModel{
+		ctx:             ctx,
+		commandProvider: provider,
+	}
+}
+
+func (rm *UniqueConstraintReadModel) AppendEvents(events ...eventstore.EventReader) {
+	rm.WriteModel.AppendEvents(events...)
+}
+
+func (rm *UniqueConstraintReadModel) Reduce() error {
+	for _, event := range rm.Events {
+		switch e := event.(type) {
+		case *org.OrgAddedEvent:
+			rm.addUniqueConstraint(e.AggregateID(), e.AggregateID(), org.NewAddOrgNameUniqueConstraint(e.Name))
+		case *org.OrgChangedEvent:
+			rm.changeUniqueConstraint(e.AggregateID(), e.AggregateID(), org.NewAddOrgNameUniqueConstraint(e.Name))
+		case *org.DomainVerificationAddedEvent:
+			rm.addUniqueConstraint(e.AggregateID(), e.AggregateID(), org.NewAddOrgNameUniqueConstraint(e.Domain))
+		case *org.DomainRemovedEvent:
+			rm.removeUniqueConstraint(e.AggregateID(), e.AggregateID(), org.UniqueOrgDomain)
+		case *iam.IDPConfigAddedEvent:
+			rm.addUniqueConstraint(e.AggregateID(), e.ConfigID, idpconfig.NewAddIDPConfigNameUniqueConstraint(e.Name, e.ResourceOwner()))
+		case *iam.IDPConfigChangedEvent:
+			rm.changeUniqueConstraint(e.AggregateID(), e.ConfigID, idpconfig.NewAddIDPConfigNameUniqueConstraint(*e.Name, e.ResourceOwner()))
+		case *iam.IDPConfigRemovedEvent:
+			rm.removeUniqueConstraint(e.AggregateID(), e.ConfigID, idpconfig.UniqueIDPConfigNameType)
+		case *org.IDPConfigAddedEvent:
+			rm.addUniqueConstraint(e.AggregateID(), e.ConfigID, idpconfig.NewAddIDPConfigNameUniqueConstraint(e.Name, e.ResourceOwner()))
+		case *org.IDPConfigChangedEvent:
+			rm.changeUniqueConstraint(e.AggregateID(), e.ConfigID, idpconfig.NewAddIDPConfigNameUniqueConstraint(*e.Name, e.ResourceOwner()))
+		case *org.IDPConfigRemovedEvent:
+			rm.removeUniqueConstraint(e.AggregateID(), e.ConfigID, idpconfig.UniqueIDPConfigNameType)
+		case *iam.MailTextAddedEvent:
+			rm.addUniqueConstraint(e.AggregateID(), e.MailTextType+e.Language, policy.NewAddMailTextUniqueConstraint(e.AggregateID(), e.MailTextType, e.Language))
+		case *org.MailTextAddedEvent:
+			rm.addUniqueConstraint(e.AggregateID(), e.MailTextType+e.Language, policy.NewAddMailTextUniqueConstraint(e.AggregateID(), e.MailTextType, e.Language))
+		case *org.MailTextRemovedEvent:
+			rm.removeUniqueConstraint(e.AggregateID(), e.MailTextType+e.Language, policy.UniqueMailText)
+		case *project.ProjectAddedEvent:
+			rm.addUniqueConstraint(e.AggregateID(), e.AggregateID(), project.NewAddProjectNameUniqueConstraint(e.Name, e.ResourceOwner()))
+		case *project.ProjectChangeEvent:
+			rm.changeUniqueConstraint(e.AggregateID(), e.AggregateID(), project.NewAddProjectNameUniqueConstraint(*e.Name, e.ResourceOwner()))
+		case *project.ProjectRemovedEvent:
+			rm.removeUniqueConstraint(e.AggregateID(), e.AggregateID(), project.UniqueProjectnameType)
+		case *project.ApplicationAddedEvent:
+			rm.addUniqueConstraint(e.AggregateID(), e.AppID, project.NewAddApplicationUniqueConstraint(e.Name, e.AggregateID()))
+		case *project.ApplicationChangedEvent:
+			rm.changeUniqueConstraint(e.AggregateID(), e.AppID, project.NewAddApplicationUniqueConstraint(e.Name, e.AggregateID()))
+		case *project.ApplicationRemovedEvent:
+			rm.removeUniqueConstraint(e.AggregateID(), e.AppID, project.UniqueAppNameType)
+		case *project.GrantAddedEvent:
+			rm.addUniqueConstraint(e.AggregateID(), e.GrantID, project.NewAddProjectGrantUniqueConstraint(e.GrantedOrgID, e.AggregateID()))
+		case *project.GrantRemovedEvent:
+			rm.removeUniqueConstraint(e.AggregateID(), e.GrantID, project.UniqueGrantType)
+		case *project.GrantMemberAddedEvent:
+			rm.addUniqueConstraint(e.AggregateID(), e.GrantID+e.UserID, project.NewAddProjectGrantMemberUniqueConstraint(e.AggregateID(), e.UserID, e.GrantID))
+		case *project.GrantMemberRemovedEvent:
+			rm.removeUniqueConstraint(e.AggregateID(), e.GrantID+e.UserID, project.UniqueProjectGrantMemberType)
+		case *project.RoleAddedEvent:
+			rm.addUniqueConstraint(e.AggregateID(), e.Key, project.NewAddProjectRoleUniqueConstraint(e.Key, e.AggregateID()))
+		case *project.RoleRemovedEvent:
+			rm.removeUniqueConstraint(e.AggregateID(), e.Key, project.UniqueRoleType)
+		case *user.HumanAddedEvent:
+			policy, err := rm.commandProvider.getOrgIAMPolicy(rm.ctx, e.ResourceOwner())
+			if err != nil {
+				logging.Log("COMMAND-0k9Gs").WithError(err).Error("could not read policy for human added event unique constraint")
+				continue
+			}
+			rm.addUniqueConstraint(e.AggregateID(), e.AggregateID(), user.NewAddUsernameUniqueConstraint(e.UserName, e.ResourceOwner(), policy.UserLoginMustBeDomain))
+		case *user.HumanRegisteredEvent:
+			policy, err := rm.commandProvider.getOrgIAMPolicy(rm.ctx, e.ResourceOwner())
+			if err != nil {
+				logging.Log("COMMAND-m9fod").WithError(err).Error("could not read policy for human registered event unique constraint")
+				continue
+			}
+			rm.addUniqueConstraint(e.AggregateID(), e.AggregateID(), user.NewAddUsernameUniqueConstraint(e.UserName, e.ResourceOwner(), policy.UserLoginMustBeDomain))
+		case *user.MachineAddedEvent:
+			policy, err := rm.commandProvider.getOrgIAMPolicy(rm.ctx, e.ResourceOwner())
+			if err != nil {
+				logging.Log("COMMAND-2n8vs").WithError(err).Error("could not read policy for machine added event unique constraint")
+				continue
+			}
+			rm.addUniqueConstraint(e.AggregateID(), e.AggregateID(), user.NewAddUsernameUniqueConstraint(e.UserName, e.ResourceOwner(), policy.UserLoginMustBeDomain))
+		case *user.UserRemovedEvent:
+			rm.removeUniqueConstraint(e.AggregateID(), e.AggregateID(), user.UniqueUsername)
+		case *user.UsernameChangedEvent:
+			policy, err := rm.commandProvider.getOrgIAMPolicy(rm.ctx, e.ResourceOwner())
+			if err != nil {
+				logging.Log("COMMAND-5n8gk").WithError(err).Error("could not read policy for username changed event unique constraint")
+				continue
+			}
+			rm.changeUniqueConstraint(e.AggregateID(), e.AggregateID(), user.NewAddUsernameUniqueConstraint(e.UserName, e.ResourceOwner(), policy.UserLoginMustBeDomain))
+		case *user.DomainClaimedEvent:
+			policy, err := rm.commandProvider.getOrgIAMPolicy(rm.ctx, e.ResourceOwner())
+			if err != nil {
+				logging.Log("COMMAND-xb8uf").WithError(err).Error("could not read policy for domain claimed event unique constraint")
+				continue
+			}
+			rm.changeUniqueConstraint(e.AggregateID(), e.AggregateID(), user.NewAddUsernameUniqueConstraint(e.UserName, e.ResourceOwner(), policy.UserLoginMustBeDomain))
+		case *user.HumanExternalIDPAddedEvent:
+			rm.addUniqueConstraint(e.AggregateID(), e.IDPConfigID+e.ExternalUserID, user.NewAddExternalIDPUniqueConstraint(e.IDPConfigID, e.ExternalUserID))
+		case *user.HumanExternalIDPRemovedEvent:
+			rm.removeUniqueConstraint(e.AggregateID(), e.IDPConfigID+e.ExternalUserID, user.UniqueExternalIDPType)
+		case *user.HumanExternalIDPCascadeRemovedEvent:
+			rm.removeUniqueConstraint(e.AggregateID(), e.IDPConfigID+e.ExternalUserID, user.UniqueExternalIDPType)
+		case *usergrant.UserGrantAddedEvent:
+			rm.addUniqueConstraint(e.AggregateID(), e.AggregateID(), usergrant.NewAddUserGrantUniqueConstraint(e.ResourceOwner(), e.UserID, e.ProjectID, e.ProjectGrantID))
+		case *usergrant.UserGrantRemovedEvent:
+			rm.removeUniqueConstraint(e.AggregateID(), e.AggregateID(), usergrant.UniqueUserGrant)
+		case *usergrant.UserGrantCascadeRemovedEvent:
+			rm.removeUniqueConstraint(e.AggregateID(), e.AggregateID(), usergrant.UniqueUserGrant)
+		case *iam.MemberAddedEvent:
+			rm.addUniqueConstraint(e.AggregateID(), e.UserID, member.NewAddMemberUniqueConstraint(e.AggregateID(), e.UserID))
+		case *iam.MemberRemovedEvent:
+			rm.removeUniqueConstraint(e.AggregateID(), e.UserID, member.UniqueMember)
+		case *org.MemberAddedEvent:
+			rm.addUniqueConstraint(e.AggregateID(), e.UserID, member.NewAddMemberUniqueConstraint(e.AggregateID(), e.UserID))
+		case *org.MemberRemovedEvent:
+			rm.removeUniqueConstraint(e.AggregateID(), e.UserID, member.UniqueMember)
+		case *project.MemberAddedEvent:
+			rm.addUniqueConstraint(e.AggregateID(), e.UserID, member.NewAddMemberUniqueConstraint(e.AggregateID(), e.UserID))
+		case *project.MemberRemovedEvent:
+			rm.removeUniqueConstraint(e.AggregateID(), e.UserID, member.UniqueMember)
+		}
+	}
+	return nil
+}
+
+func (rm *UniqueConstraintReadModel) Query() *eventstore.SearchQueryBuilder {
+	return eventstore.NewSearchQueryBuilder(eventstore.ColumnsEvent).
+		AggregateIDs(rm.AggregateID).
+		ResourceOwner(rm.ResourceOwner).
+		EventTypes(
+			org.OrgAddedEventType,
+			org.OrgChangedEventType,
+			org.OrgDomainVerifiedEventType,
+			org.OrgDomainRemovedEventType,
+			iam.IDPConfigAddedEventType,
+			iam.IDPConfigChangedEventType,
+			iam.IDPConfigRemovedEventType,
+			org.IDPConfigAddedEventType,
+			org.IDPConfigChangedEventType,
+			org.IDPConfigRemovedEventType,
+			iam.MailTextAddedEventType,
+			org.MailTextAddedEventType,
+			org.MailTextRemovedEventType,
+			project.ProjectAddedType,
+			project.ProjectChangedType,
+			project.ProjectRemovedType,
+			project.ApplicationAddedType,
+			project.ApplicationChangedType,
+			project.ApplicationRemovedType,
+			project.GrantAddedType,
+			project.GrantRemovedType,
+			project.GrantMemberAddedType,
+			project.GrantMemberRemovedType,
+			project.RoleAddedType,
+			project.RoleRemovedType,
+			user.HumanAddedType,
+			user.HumanRegisteredType,
+			user.MachineAddedEventType,
+			user.UserUserNameChangedType,
+			user.UserDomainClaimedType,
+			user.UserRemovedType,
+			user.HumanExternalIDPAddedType,
+			user.HumanExternalIDPRemovedType,
+			user.HumanExternalIDPCascadeRemovedType,
+			usergrant.UserGrantAddedType,
+			usergrant.UserGrantRemovedType,
+			usergrant.UserGrantCascadeRemovedType,
+			iam.MemberAddedEventType,
+			iam.MemberRemovedEventType,
+			org.MemberAddedEventType,
+			org.MemberRemovedEventType,
+			project.MemberAddedType,
+			project.MemberRemovedType,
+		)
+}
+
+func (rm *UniqueConstraintReadModel) getUniqueConstraint(aggregateID, objectID, constraintType string) *domain.UniqueConstraintMigration {
+	for _, uniqueConstraint := range rm.UniqueConstraints {
+		if uniqueConstraint.AggregateID == aggregateID && uniqueConstraint.ObjectID == objectID && uniqueConstraint.UniqueType == constraintType {
+			return uniqueConstraint
+		}
+	}
+	return nil
+}
+
+func (rm *UniqueConstraintReadModel) addUniqueConstraint(aggregateID, objectID string, constraint *eventstore.EventUniqueConstraint) {
+	migrateUniqueConstraint := &domain.UniqueConstraintMigration{
+		AggregateID:  aggregateID,
+		ObjectID:     objectID,
+		UniqueType:   constraint.UniqueType,
+		UniqueField:  constraint.UniqueField,
+		ErrorMessage: constraint.ErrorMessage,
+	}
+	rm.UniqueConstraints = append(rm.UniqueConstraints, migrateUniqueConstraint)
+}
+
+func (rm *UniqueConstraintReadModel) changeUniqueConstraint(aggregateID, objectID string, constraint *eventstore.EventUniqueConstraint) {
+	for i, uniqueConstraint := range rm.UniqueConstraints {
+		if uniqueConstraint.AggregateID == aggregateID && uniqueConstraint.ObjectID == objectID && uniqueConstraint.UniqueType == constraint.UniqueType {
+			rm.UniqueConstraints[i] = &domain.UniqueConstraintMigration{
+				AggregateID:  aggregateID,
+				ObjectID:     objectID,
+				UniqueType:   constraint.UniqueType,
+				UniqueField:  constraint.UniqueField,
+				ErrorMessage: constraint.ErrorMessage,
+			}
+			return
+		}
+	}
+}
+
+func (rm *UniqueConstraintReadModel) removeUniqueConstraint(aggregateID, objectID, constraintType string) {
+	for i, uniqueConstraint := range rm.UniqueConstraints {
+		if uniqueConstraint.AggregateID == aggregateID && uniqueConstraint.ObjectID == objectID && uniqueConstraint.UniqueType == constraintType {
+			copy(rm.UniqueConstraints[i:], rm.UniqueConstraints[i+1:])
+			rm.UniqueConstraints[len(rm.UniqueConstraints)-1] = nil
+			rm.UniqueConstraints = rm.UniqueConstraints[:len(rm.UniqueConstraints)-1]
+			return
+		}
+	}
+}

internal/v2/command/user.go

@@ -218,11 +218,16 @@ func (r *CommandSide) userDomainClaimed(ctx context.Context, userID string) (_ *
 	changedUserGrant := NewUserWriteModel(userID, existingUser.ResourceOwner)
 	userAgg := UserAggregateFromWriteModel(&changedUserGrant.WriteModel)
 
+	orgIAMPolicy, err := r.getOrgIAMPolicy(ctx, existingUser.ResourceOwner)
+	if err != nil {
+		return nil, nil, err
+	}
+
 	id, err := r.idGenerator.Next()
 	if err != nil {
 		return nil, nil, err
 	}
-	userAgg.PushEvents(user.NewDomainClaimedEvent(ctx, fmt.Sprintf("%s@temporary.%s", id, r.iamDomain)))
+	userAgg.PushEvents(user.NewDomainClaimedEvent(ctx, fmt.Sprintf("%s@temporary.%s", id, r.iamDomain), existingUser.UserName, orgIAMPolicy.UserLoginMustBeDomain))
 	return userAgg, changedUserGrant, nil
 }
 

internal/v2/command/user_grant.go

@@ -251,11 +251,21 @@ func (r *CommandSide) removeUserGrant(ctx context.Context, grantID, resourceOwne
 	userGrantAgg := UserGrantAggregateFromWriteModel(&removeUserGrant.WriteModel)
 	if !cascade {
 		userGrantAgg.PushEvents(
-			usergrant.NewUserGrantRemovedEvent(ctx, existingUserGrant.ResourceOwner, existingUserGrant.UserID, existingUserGrant.ProjectID),
+			usergrant.NewUserGrantRemovedEvent(
+				ctx,
+				existingUserGrant.ResourceOwner,
+				existingUserGrant.UserID,
+				existingUserGrant.ProjectID,
+				existingUserGrant.ProjectGrantID),
 		)
 	} else {
 		userGrantAgg.PushEvents(
-			usergrant.NewUserGrantCascadeRemovedEvent(ctx, existingUserGrant.ResourceOwner, existingUserGrant.UserID, existingUserGrant.ProjectID),
+			usergrant.NewUserGrantCascadeRemovedEvent(
+				ctx,
+				existingUserGrant.ResourceOwner,
+				existingUserGrant.UserID,
+				existingUserGrant.ProjectID,
+				existingUserGrant.ProjectGrantID),
 		)
 	}
 

internal/v2/command/user_human_externalidp_model.go

@@ -37,7 +37,7 @@ func (wm *HumanExternalIDPWriteModel) Reduce() error {
 		case *user.HumanExternalIDPAddedEvent:
 			wm.IDPConfigID = e.IDPConfigID
 			wm.DisplayName = e.DisplayName
-			wm.ExternalUserID = e.UserID
+			wm.ExternalUserID = e.ExternalUserID
 			wm.State = domain.ExternalIDPStateActive
 		case *user.HumanExternalIDPRemovedEvent:
 			wm.State = domain.ExternalIDPStateRemoved