feat: mail tempaltes/texts and step 10 (#1266)

* feat: mail template/text events

* feat: mail template/text events

* feat: mail template/text on iam and org

* feat: setup step 10

* fix: add template event

* fix: add unique constraints

* Update internal/static/i18n/de.yaml

Co-authored-by: Livio Amstutz <[email protected]>

* Update internal/static/i18n/de.yaml

Co-authored-by: Livio Amstutz <[email protected]>

* Update internal/static/i18n/de.yaml

Co-authored-by: Livio Amstutz <[email protected]>

* Update internal/static/i18n/de.yaml

Co-authored-by: Livio Amstutz <[email protected]>

* Update internal/v2/command/iam_policy_mail_template.go

Co-authored-by: Livio Amstutz <[email protected]>

* Update internal/v2/command/org_policy_mail_text.go

Co-authored-by: Livio Amstutz <[email protected]>

* Update internal/v2/command/iam_policy_mail_template.go

Co-authored-by: Livio Amstutz <[email protected]>

* Update internal/v2/command/iam_policy_mail_text.go

Co-authored-by: Livio Amstutz <[email protected]>

* Update internal/v2/command/iam_policy_mail_text.go

Co-authored-by: Livio Amstutz <[email protected]>

* Update internal/v2/command/org_policy_mail_template.go

Co-authored-by: Livio Amstutz <[email protected]>

* Update internal/v2/command/org_policy_mail_template.go

Co-authored-by: Livio Amstutz <[email protected]>

* Update internal/v2/command/org_policy_mail_text.go

Co-authored-by: Livio Amstutz <[email protected]>

* fix: org iam policy

Co-authored-by: Livio Amstutz <[email protected]>

internal/v2/command/iam_converter.go

@@ -52,6 +52,27 @@ func writeModelToLabelPolicy(wm *LabelPolicyWriteModel) *domain.LabelPolicy {
 	}
 }
 
+func writeModelToMailTemplate(wm *MailTemplateWriteModel) *domain.MailTemplate {
+	return &domain.MailTemplate{
+		ObjectRoot: writeModelToObjectRoot(wm.WriteModel),
+		Template:   wm.Template,
+	}
+}
+
+func writeModelToMailText(wm *MailTextWriteModel) *domain.MailText {
+	return &domain.MailText{
+		ObjectRoot:   writeModelToObjectRoot(wm.WriteModel),
+		MailTextType: wm.MailTextType,
+		Language:     wm.Language,
+		Title:        wm.Title,
+		PreHeader:    wm.PreHeader,
+		Subject:      wm.Subject,
+		Greeting:     wm.Greeting,
+		Text:         wm.Text,
+		ButtonText:   wm.ButtonText,
+	}
+}
+
 func writeModelToOrgIAMPolicy(wm *IAMOrgIAMPolicyWriteModel) *domain.OrgIAMPolicy {
 	return &domain.OrgIAMPolicy{
 		ObjectRoot:            writeModelToObjectRoot(wm.PolicyOrgIAMWriteModel.WriteModel),
@@ -59,6 +80,28 @@ func writeModelToOrgIAMPolicy(wm *IAMOrgIAMPolicyWriteModel) *domain.OrgIAMPolic
 	}
 }
 
+func writeModelToMailTemplatePolicy(wm *MailTemplateWriteModel) *domain.MailTemplate {
+	return &domain.MailTemplate{
+		ObjectRoot: writeModelToObjectRoot(wm.WriteModel),
+		Template:   wm.Template,
+	}
+}
+
+func writeModelToMailTextPolicy(wm *MailTextWriteModel) *domain.MailText {
+	return &domain.MailText{
+		ObjectRoot:   writeModelToObjectRoot(wm.WriteModel),
+		State:        wm.State,
+		MailTextType: wm.MailTextType,
+		Language:     wm.Language,
+		Title:        wm.Title,
+		PreHeader:    wm.PreHeader,
+		Subject:      wm.Subject,
+		Greeting:     wm.Greeting,
+		Text:         wm.Text,
+		ButtonText:   wm.ButtonText,
+	}
+}
+
 func writeModelToPasswordAgePolicy(wm *PasswordAgePolicyWriteModel) *domain.PasswordAgePolicy {
 	return &domain.PasswordAgePolicy{
 		ObjectRoot:     writeModelToObjectRoot(wm.WriteModel),

internal/v2/command/iam_policy_mail_template.go

@@ -0,0 +1,83 @@
+package command
+
+import (
+	"context"
+	caos_errs "github.com/caos/zitadel/internal/errors"
+	"github.com/caos/zitadel/internal/telemetry/tracing"
+	"github.com/caos/zitadel/internal/v2/domain"
+	iam_repo "github.com/caos/zitadel/internal/v2/repository/iam"
+)
+
+func (r *CommandSide) AddDefaultMailTemplate(ctx context.Context, policy *domain.MailTemplate) (*domain.MailTemplate, error) {
+	addedPolicy := NewIAMMailTemplateWriteModel()
+	iamAgg := IAMAggregateFromWriteModel(&addedPolicy.MailTemplateWriteModel.WriteModel)
+	err := r.addDefaultMailTemplate(ctx, nil, addedPolicy, policy)
+	if err != nil {
+		return nil, err
+	}
+
+	err = r.eventstore.PushAggregate(ctx, addedPolicy, iamAgg)
+	if err != nil {
+		return nil, err
+	}
+
+	return writeModelToMailTemplatePolicy(&addedPolicy.MailTemplateWriteModel), nil
+}
+
+func (r *CommandSide) addDefaultMailTemplate(ctx context.Context, iamAgg *iam_repo.Aggregate, addedPolicy *IAMMailTemplateWriteModel, policy *domain.MailTemplate) error {
+	if !policy.IsValid() {
+		return caos_errs.ThrowPreconditionFailed(nil, "IAM-fm9sd", "Errors.IAM.MailTemplate.Invalid")
+	}
+	err := r.eventstore.FilterToQueryReducer(ctx, addedPolicy)
+	if err != nil {
+		return err
+	}
+	if addedPolicy.State == domain.PolicyStateActive {
+		return caos_errs.ThrowAlreadyExists(nil, "IAM-5n8fs", "Errors.IAM.MailTemplate.AlreadyExists")
+	}
+
+	iamAgg.PushEvents(iam_repo.NewMailTemplateAddedEvent(ctx, policy.Template))
+
+	return nil
+}
+
+func (r *CommandSide) ChangeDefaultMailTemplate(ctx context.Context, policy *domain.MailTemplate) (*domain.MailTemplate, error) {
+	if !policy.IsValid() {
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "IAM-4m9ds", "Errors.IAM.MailTemplate.Invalid")
+	}
+	existingPolicy, err := r.defaultMailTemplateWriteModelByID(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	if existingPolicy.State == domain.PolicyStateUnspecified || existingPolicy.State == domain.PolicyStateRemoved {
+		return nil, caos_errs.ThrowNotFound(nil, "IAM-2N8fs", "Errors.IAM.MailTemplate.NotFound")
+	}
+
+	changedEvent, hasChanged := existingPolicy.NewChangedEvent(ctx, policy.Template)
+	if !hasChanged {
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "IAM-3nfsG", "Errors.IAM.MailTemplate.NotChanged")
+	}
+
+	iamAgg := IAMAggregateFromWriteModel(&existingPolicy.MailTemplateWriteModel.WriteModel)
+	iamAgg.PushEvents(changedEvent)
+
+	err = r.eventstore.PushAggregate(ctx, existingPolicy, iamAgg)
+	if err != nil {
+		return nil, err
+	}
+
+	return writeModelToMailTemplatePolicy(&existingPolicy.MailTemplateWriteModel), nil
+}
+
+func (r *CommandSide) defaultMailTemplateWriteModelByID(ctx context.Context) (policy *IAMMailTemplateWriteModel, err error) {
+	ctx, span := tracing.NewSpan(ctx)
+	defer func() { span.EndWithError(err) }()
+
+	writeModel := NewIAMMailTemplateWriteModel()
+	err = r.eventstore.FilterToQueryReducer(ctx, writeModel)
+	if err != nil {
+		return nil, err
+	}
+	return writeModel, nil
+}

internal/v2/command/iam_policy_mail_template_model.go

@@ -0,0 +1,65 @@
+package command
+
+import (
+	"context"
+	"reflect"
+
+	"github.com/caos/zitadel/internal/eventstore/v2"
+	"github.com/caos/zitadel/internal/v2/domain"
+	"github.com/caos/zitadel/internal/v2/repository/iam"
+	"github.com/caos/zitadel/internal/v2/repository/policy"
+)
+
+type IAMMailTemplateWriteModel struct {
+	MailTemplateWriteModel
+}
+
+func NewIAMMailTemplateWriteModel() *IAMMailTemplateWriteModel {
+	return &IAMMailTemplateWriteModel{
+		MailTemplateWriteModel{
+			WriteModel: eventstore.WriteModel{
+				AggregateID:   domain.IAMID,
+				ResourceOwner: domain.IAMID,
+			},
+		},
+	}
+}
+
+func (wm *IAMMailTemplateWriteModel) AppendEvents(events ...eventstore.EventReader) {
+	for _, event := range events {
+		switch e := event.(type) {
+		case *iam.MailTemplateAddedEvent:
+			wm.MailTemplateWriteModel.AppendEvents(&e.MailTemplateAddedEvent)
+		case *iam.MailTemplateChangedEvent:
+			wm.MailTemplateWriteModel.AppendEvents(&e.MailTemplateChangedEvent)
+		}
+	}
+}
+
+func (wm *IAMMailTemplateWriteModel) Reduce() error {
+	return wm.MailTemplateWriteModel.Reduce()
+}
+
+func (wm *IAMMailTemplateWriteModel) Query() *eventstore.SearchQueryBuilder {
+	return eventstore.NewSearchQueryBuilder(eventstore.ColumnsEvent, iam.AggregateType).
+		AggregateIDs(wm.MailTemplateWriteModel.AggregateID).
+		ResourceOwner(wm.ResourceOwner)
+}
+
+func (wm *IAMMailTemplateWriteModel) NewChangedEvent(
+	ctx context.Context,
+	template []byte,
+) (*iam.MailTemplateChangedEvent, bool) {
+	changes := make([]policy.MailTemplateChanges, 0)
+	if !reflect.DeepEqual(wm.Template, template) {
+		changes = append(changes, policy.ChangeTemplate(template))
+	}
+	if len(changes) == 0 {
+		return nil, false
+	}
+	changedEvent, err := iam.NewMailTemplateChangedEvent(ctx, changes)
+	if err != nil {
+		return nil, false
+	}
+	return changedEvent, true
+}

internal/v2/command/iam_policy_mail_text.go

@@ -0,0 +1,103 @@
+package command
+
+import (
+	"context"
+	caos_errs "github.com/caos/zitadel/internal/errors"
+	"github.com/caos/zitadel/internal/telemetry/tracing"
+	"github.com/caos/zitadel/internal/v2/domain"
+	iam_repo "github.com/caos/zitadel/internal/v2/repository/iam"
+)
+
+func (r *CommandSide) AddDefaultMailText(ctx context.Context, policy *domain.MailText) (*domain.MailText, error) {
+	addedPolicy := NewIAMMailTextWriteModel(policy.MailTextType, policy.Language)
+	iamAgg := IAMAggregateFromWriteModel(&addedPolicy.MailTextWriteModel.WriteModel)
+	err := r.addDefaultMailText(ctx, nil, addedPolicy, policy)
+	if err != nil {
+		return nil, err
+	}
+
+	err = r.eventstore.PushAggregate(ctx, addedPolicy, iamAgg)
+	if err != nil {
+		return nil, err
+	}
+
+	return writeModelToMailTextPolicy(&addedPolicy.MailTextWriteModel), nil
+}
+
+func (r *CommandSide) addDefaultMailText(ctx context.Context, iamAgg *iam_repo.Aggregate, addedPolicy *IAMMailTextWriteModel, mailText *domain.MailText) error {
+	if !mailText.IsValid() {
+		return caos_errs.ThrowPreconditionFailed(nil, "IAM-3n8fs", "Errors.IAM.MailText.Invalid")
+	}
+	err := r.eventstore.FilterToQueryReducer(ctx, addedPolicy)
+	if err != nil {
+		return err
+	}
+	if addedPolicy.State == domain.PolicyStateActive {
+		return caos_errs.ThrowAlreadyExists(nil, "IAM-9o0pM", "Errors.IAM.MailText.AlreadyExists")
+	}
+
+	iamAgg.PushEvents(
+		iam_repo.NewMailTextAddedEvent(
+			ctx,
+			mailText.MailTextType,
+			mailText.Language,
+			mailText.Title,
+			mailText.PreHeader,
+			mailText.Subject,
+			mailText.Greeting,
+			mailText.Text,
+			mailText.ButtonText),
+	)
+
+	return nil
+}
+
+func (r *CommandSide) ChangeDefaultMailText(ctx context.Context, mailText *domain.MailText) (*domain.MailText, error) {
+	if !mailText.IsValid() {
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "IAM-kd9fs", "Errors.IAM.MailText.Invalid")
+	}
+	existingPolicy, err := r.defaultMailTextWriteModelByID(ctx, mailText.MailTextType, mailText.Language)
+	if err != nil {
+		return nil, err
+	}
+
+	if existingPolicy.State == domain.PolicyStateUnspecified || existingPolicy.State == domain.PolicyStateRemoved {
+		return nil, caos_errs.ThrowNotFound(nil, "IAM-2N8fs", "Errors.IAM.MailText.NotFound")
+	}
+
+	changedEvent, hasChanged := existingPolicy.NewChangedEvent(
+		ctx,
+		mailText.MailTextType,
+		mailText.Language,
+		mailText.Title,
+		mailText.PreHeader,
+		mailText.Subject,
+		mailText.Greeting,
+		mailText.Text,
+		mailText.ButtonText)
+	if !hasChanged {
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "IAM-m9L0s", "Errors.IAM.MailText.NotChanged")
+	}
+
+	iamAgg := IAMAggregateFromWriteModel(&existingPolicy.MailTextWriteModel.WriteModel)
+	iamAgg.PushEvents(changedEvent)
+
+	err = r.eventstore.PushAggregate(ctx, existingPolicy, iamAgg)
+	if err != nil {
+		return nil, err
+	}
+
+	return writeModelToMailTextPolicy(&existingPolicy.MailTextWriteModel), nil
+}
+
+func (r *CommandSide) defaultMailTextWriteModelByID(ctx context.Context, mailTextType, language string) (policy *IAMMailTextWriteModel, err error) {
+	ctx, span := tracing.NewSpan(ctx)
+	defer func() { span.EndWithError(err) }()
+
+	writeModel := NewIAMMailTextWriteModel(mailTextType, language)
+	err = r.eventstore.FilterToQueryReducer(ctx, writeModel)
+	if err != nil {
+		return nil, err
+	}
+	return writeModel, nil
+}

internal/v2/command/iam_policy_mail_text_model.go

@@ -0,0 +1,87 @@
+package command
+
+import (
+	"context"
+	"github.com/caos/zitadel/internal/eventstore/v2"
+	"github.com/caos/zitadel/internal/v2/domain"
+	"github.com/caos/zitadel/internal/v2/repository/iam"
+	"github.com/caos/zitadel/internal/v2/repository/policy"
+)
+
+type IAMMailTextWriteModel struct {
+	MailTextWriteModel
+}
+
+func NewIAMMailTextWriteModel(mailTextType, language string) *IAMMailTextWriteModel {
+	return &IAMMailTextWriteModel{
+		MailTextWriteModel{
+			WriteModel: eventstore.WriteModel{
+				AggregateID:   domain.IAMID,
+				ResourceOwner: domain.IAMID,
+			},
+			MailTextType: mailTextType,
+			Language:     language,
+		},
+	}
+}
+
+func (wm *IAMMailTextWriteModel) AppendEvents(events ...eventstore.EventReader) {
+	for _, event := range events {
+		switch e := event.(type) {
+		case *iam.MailTextAddedEvent:
+			wm.MailTextWriteModel.AppendEvents(&e.MailTextAddedEvent)
+		case *iam.MailTextChangedEvent:
+			wm.MailTextWriteModel.AppendEvents(&e.MailTextChangedEvent)
+		}
+	}
+}
+
+func (wm *IAMMailTextWriteModel) Reduce() error {
+	return wm.MailTextWriteModel.Reduce()
+}
+
+func (wm *IAMMailTextWriteModel) Query() *eventstore.SearchQueryBuilder {
+	return eventstore.NewSearchQueryBuilder(eventstore.ColumnsEvent, iam.AggregateType).
+		AggregateIDs(wm.MailTextWriteModel.AggregateID).
+		ResourceOwner(wm.ResourceOwner)
+}
+
+func (wm *IAMMailTextWriteModel) NewChangedEvent(
+	ctx context.Context,
+	mailTextType,
+	language,
+	title,
+	preHeader,
+	subject,
+	greeting,
+	text,
+	buttonText string,
+) (*iam.MailTextChangedEvent, bool) {
+	changes := make([]policy.MailTextChanges, 0)
+	if wm.Title != title {
+		changes = append(changes, policy.ChangeTitle(title))
+	}
+	if wm.PreHeader != preHeader {
+		changes = append(changes, policy.ChangePreHeader(preHeader))
+	}
+	if wm.Subject != subject {
+		changes = append(changes, policy.ChangeSubject(subject))
+	}
+	if wm.Greeting != greeting {
+		changes = append(changes, policy.ChangeGreeting(greeting))
+	}
+	if wm.Text != text {
+		changes = append(changes, policy.ChangeText(text))
+	}
+	if wm.ButtonText != buttonText {
+		changes = append(changes, policy.ChangeButtonText(buttonText))
+	}
+	if len(changes) == 0 {
+		return nil, false
+	}
+	changedEvent, err := iam.NewMailTextChangedEvent(ctx, mailTextType, language, changes)
+	if err != nil {
+		return nil, false
+	}
+	return changedEvent, true
+}

internal/v2/command/org_policy_label.go

@@ -8,8 +8,8 @@ import (
 	"github.com/caos/zitadel/internal/v2/repository/org"
 )
 
-func (r *CommandSide) AddLabelPolicy(ctx context.Context, policy *domain.LabelPolicy) (*domain.LabelPolicy, error) {
-	addedPolicy := NewOrgLabelPolicyWriteModel(policy.AggregateID)
+func (r *CommandSide) AddLabelPolicy(ctx context.Context, resourceOwner string, policy *domain.LabelPolicy) (*domain.LabelPolicy, error) {
+	addedPolicy := NewOrgLabelPolicyWriteModel(resourceOwner)
 	err := r.eventstore.FilterToQueryReducer(ctx, addedPolicy)
 	if err != nil {
 		return nil, err
@@ -29,8 +29,8 @@ func (r *CommandSide) AddLabelPolicy(ctx context.Context, policy *domain.LabelPo
 	return writeModelToLabelPolicy(&addedPolicy.LabelPolicyWriteModel), nil
 }
 
-func (r *CommandSide) ChangeLabelPolicy(ctx context.Context, policy *domain.LabelPolicy) (*domain.LabelPolicy, error) {
-	existingPolicy := NewOrgLabelPolicyWriteModel(policy.AggregateID)
+func (r *CommandSide) ChangeLabelPolicy(ctx context.Context, resourceOwner string, policy *domain.LabelPolicy) (*domain.LabelPolicy, error) {
+	existingPolicy := NewOrgLabelPolicyWriteModel(resourceOwner)
 	err := r.eventstore.FilterToQueryReducer(ctx, existingPolicy)
 	if err != nil {
 		return nil, err

internal/v2/command/org_policy_login.go

@@ -10,8 +10,8 @@ import (
 	"github.com/caos/zitadel/internal/v2/repository/org"
 )
 
-func (r *CommandSide) AddLoginPolicy(ctx context.Context, policy *domain.LoginPolicy) (*domain.LoginPolicy, error) {
-	addedPolicy := NewOrgLoginPolicyWriteModel(policy.AggregateID)
+func (r *CommandSide) AddLoginPolicy(ctx context.Context, resourceOwner string, policy *domain.LoginPolicy) (*domain.LoginPolicy, error) {
+	addedPolicy := NewOrgLoginPolicyWriteModel(resourceOwner)
 	err := r.eventstore.FilterToQueryReducer(ctx, addedPolicy)
 	if err != nil {
 		return nil, err
@@ -31,8 +31,8 @@ func (r *CommandSide) AddLoginPolicy(ctx context.Context, policy *domain.LoginPo
 	return writeModelToLoginPolicy(&addedPolicy.LoginPolicyWriteModel), nil
 }
 
-func (r *CommandSide) ChangeLoginPolicy(ctx context.Context, policy *domain.LoginPolicy) (*domain.LoginPolicy, error) {
-	existingPolicy := NewOrgLoginPolicyWriteModel(policy.AggregateID)
+func (r *CommandSide) ChangeLoginPolicy(ctx context.Context, resourceOwner string, policy *domain.LoginPolicy) (*domain.LoginPolicy, error) {
+	existingPolicy := NewOrgLoginPolicyWriteModel(resourceOwner)
 	err := r.eventstore.FilterToQueryReducer(ctx, existingPolicy)
 	if err != nil {
 		return nil, err
@@ -71,8 +71,8 @@ func (r *CommandSide) RemoveLoginPolicy(ctx context.Context, orgID string) error
 	return r.eventstore.PushAggregate(ctx, existingPolicy, orgAgg)
 }
 
-func (r *CommandSide) AddIDPProviderToLoginPolicy(ctx context.Context, idpProvider *domain.IDPProvider) (*domain.IDPProvider, error) {
-	idpModel := NewOrgIdentityProviderWriteModel(idpProvider.AggregateID, idpProvider.IDPConfigID)
+func (r *CommandSide) AddIDPProviderToLoginPolicy(ctx context.Context, resourceOwner string, idpProvider *domain.IDPProvider) (*domain.IDPProvider, error) {
+	idpModel := NewOrgIdentityProviderWriteModel(resourceOwner, idpProvider.IDPConfigID)
 	err := r.eventstore.FilterToQueryReducer(ctx, idpModel)
 	if err != nil {
 		return nil, err
@@ -91,8 +91,8 @@ func (r *CommandSide) AddIDPProviderToLoginPolicy(ctx context.Context, idpProvid
 	return writeModelToIDPProvider(&idpModel.IdentityProviderWriteModel), nil
 }
 
-func (r *CommandSide) RemoveIDPProviderFromLoginPolicy(ctx context.Context, idpProvider *domain.IDPProvider, cascadeExternalIDPs ...*domain.ExternalIDP) error {
-	idpModel := NewOrgIdentityProviderWriteModel(idpProvider.AggregateID, idpProvider.IDPConfigID)
+func (r *CommandSide) RemoveIDPProviderFromLoginPolicy(ctx context.Context, resourceOwner string, idpProvider *domain.IDPProvider, cascadeExternalIDPs ...*domain.ExternalIDP) error {
+	idpModel := NewOrgIdentityProviderWriteModel(resourceOwner, idpProvider.IDPConfigID)
 	err := r.eventstore.FilterToQueryReducer(ctx, idpModel)
 	if err != nil {
 		return err

internal/v2/command/org_policy_mail_template.go

@@ -0,0 +1,77 @@
+package command
+
+import (
+	"context"
+
+	caos_errs "github.com/caos/zitadel/internal/errors"
+	"github.com/caos/zitadel/internal/v2/domain"
+	"github.com/caos/zitadel/internal/v2/repository/org"
+)
+
+func (r *CommandSide) AddMailTemplate(ctx context.Context, resourceOwner string, policy *domain.MailTemplate) (*domain.MailTemplate, error) {
+	if !policy.IsValid() {
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "ORG-3m9fs", "Errors.Org.MailTemplate.Invalid")
+	}
+	addedPolicy := NewOrgMailTemplateWriteModel(resourceOwner)
+	err := r.eventstore.FilterToQueryReducer(ctx, addedPolicy)
+	if err != nil {
+		return nil, err
+	}
+	if addedPolicy.State == domain.PolicyStateActive {
+		return nil, caos_errs.ThrowAlreadyExists(nil, "Org-9kufs", "Errors.Org.MailTemplate.AlreadyExists")
+	}
+
+	orgAgg := OrgAggregateFromWriteModel(&addedPolicy.MailTemplateWriteModel.WriteModel)
+	orgAgg.PushEvents(org.NewMailTemplateAddedEvent(ctx, policy.Template))
+
+	err = r.eventstore.PushAggregate(ctx, addedPolicy, orgAgg)
+	if err != nil {
+		return nil, err
+	}
+
+	return writeModelToMailTemplate(&addedPolicy.MailTemplateWriteModel), nil
+}
+
+func (r *CommandSide) ChangeMailTemplate(ctx context.Context, resourceOwner string, policy *domain.MailTemplate) (*domain.MailTemplate, error) {
+	if !policy.IsValid() {
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "ORG-9f9ds", "Errors.Org.MailTemplate.Invalid")
+	}
+	existingPolicy := NewOrgMailTemplateWriteModel(resourceOwner)
+	err := r.eventstore.FilterToQueryReducer(ctx, existingPolicy)
+	if err != nil {
+		return nil, err
+	}
+	if existingPolicy.State == domain.PolicyStateUnspecified || existingPolicy.State == domain.PolicyStateRemoved {
+		return nil, caos_errs.ThrowNotFound(nil, "Org-5m9ie", "Errors.Org.MailTemplate.NotFound")
+	}
+
+	changedEvent, hasChanged := existingPolicy.NewChangedEvent(ctx, policy.Template)
+	if !hasChanged {
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "Org-4M9vs", "Errors.Org.MailTemplate.NotChanged")
+	}
+
+	orgAgg := OrgAggregateFromWriteModel(&existingPolicy.MailTemplateWriteModel.WriteModel)
+	orgAgg.PushEvents(changedEvent)
+
+	err = r.eventstore.PushAggregate(ctx, existingPolicy, orgAgg)
+	if err != nil {
+		return nil, err
+	}
+
+	return writeModelToMailTemplate(&existingPolicy.MailTemplateWriteModel), nil
+}
+
+func (r *CommandSide) RemoveMailTemplate(ctx context.Context, orgID string) error {
+	existingPolicy := NewOrgMailTemplateWriteModel(orgID)
+	err := r.eventstore.FilterToQueryReducer(ctx, existingPolicy)
+	if err != nil {
+		return err
+	}
+	if existingPolicy.State == domain.PolicyStateUnspecified || existingPolicy.State == domain.PolicyStateRemoved {
+		return caos_errs.ThrowNotFound(nil, "Org-3b8Jf", "Errors.Org.MailTemplate.NotFound")
+	}
+	orgAgg := OrgAggregateFromWriteModel(&existingPolicy.WriteModel)
+	orgAgg.PushEvents(org.NewMailTemplateRemovedEvent(ctx))
+
+	return r.eventstore.PushAggregate(ctx, existingPolicy, orgAgg)
+}

internal/v2/command/org_policy_mail_template_model.go

@@ -0,0 +1,67 @@
+package command
+
+import (
+	"context"
+	"reflect"
+
+	"github.com/caos/zitadel/internal/eventstore/v2"
+	"github.com/caos/zitadel/internal/v2/repository/org"
+	"github.com/caos/zitadel/internal/v2/repository/policy"
+)
+
+type OrgMailTemplateWriteModel struct {
+	MailTemplateWriteModel
+}
+
+func NewOrgMailTemplateWriteModel(orgID string) *OrgMailTemplateWriteModel {
+	return &OrgMailTemplateWriteModel{
+		MailTemplateWriteModel{
+			WriteModel: eventstore.WriteModel{
+				AggregateID:   orgID,
+				ResourceOwner: orgID,
+			},
+		},
+	}
+}
+
+func (wm *OrgMailTemplateWriteModel) AppendEvents(events ...eventstore.EventReader) {
+	for _, event := range events {
+		switch e := event.(type) {
+		case *org.MailTemplateAddedEvent:
+			wm.MailTemplateWriteModel.AppendEvents(&e.MailTemplateAddedEvent)
+		case *org.MailTemplateChangedEvent:
+			wm.MailTemplateWriteModel.AppendEvents(&e.MailTemplateChangedEvent)
+		}
+	}
+}
+
+func (wm *OrgMailTemplateWriteModel) Reduce() error {
+	return wm.MailTemplateWriteModel.Reduce()
+}
+
+func (wm *OrgMailTemplateWriteModel) Query() *eventstore.SearchQueryBuilder {
+	query := eventstore.NewSearchQueryBuilder(eventstore.ColumnsEvent, org.AggregateType).
+		AggregateIDs(wm.MailTemplateWriteModel.AggregateID)
+	if wm.ResourceOwner != "" {
+		query.ResourceOwner(wm.ResourceOwner)
+	}
+	return query
+}
+
+func (wm *OrgMailTemplateWriteModel) NewChangedEvent(
+	ctx context.Context,
+	template []byte,
+) (*org.MailTemplateChangedEvent, bool) {
+	changes := make([]policy.MailTemplateChanges, 0)
+	if !reflect.DeepEqual(wm.Template, template) {
+		changes = append(changes, policy.ChangeTemplate(template))
+	}
+	if len(changes) == 0 {
+		return nil, false
+	}
+	changedEvent, err := org.NewMailTemplateChangedEvent(ctx, changes)
+	if err != nil {
+		return nil, false
+	}
+	return changedEvent, true
+}

internal/v2/command/org_policy_mail_text.go

@@ -0,0 +1,97 @@
+package command
+
+import (
+	"context"
+
+	caos_errs "github.com/caos/zitadel/internal/errors"
+	"github.com/caos/zitadel/internal/v2/domain"
+	"github.com/caos/zitadel/internal/v2/repository/org"
+)
+
+func (r *CommandSide) AddMailText(ctx context.Context, resourceOwner string, mailText *domain.MailText) (*domain.MailText, error) {
+	if !mailText.IsValid() {
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "Org-4778u", "Errors.Org.MailText.Invalid")
+	}
+	addedPolicy := NewOrgMailTextWriteModel(resourceOwner, mailText.MailTextType, mailText.Language)
+	err := r.eventstore.FilterToQueryReducer(ctx, addedPolicy)
+	if err != nil {
+		return nil, err
+	}
+	if addedPolicy.State == domain.PolicyStateActive {
+		return nil, caos_errs.ThrowAlreadyExists(nil, "Org-9kufs", "Errors.Org.MailText.AlreadyExists")
+	}
+
+	orgAgg := OrgAggregateFromWriteModel(&addedPolicy.MailTextWriteModel.WriteModel)
+	orgAgg.PushEvents(
+		org.NewMailTextAddedEvent(
+			ctx,
+			resourceOwner,
+			mailText.MailTextType,
+			mailText.Language,
+			mailText.Title,
+			mailText.PreHeader,
+			mailText.Subject,
+			mailText.Greeting,
+			mailText.Text,
+			mailText.ButtonText))
+
+	err = r.eventstore.PushAggregate(ctx, addedPolicy, orgAgg)
+	if err != nil {
+		return nil, err
+	}
+
+	return writeModelToMailText(&addedPolicy.MailTextWriteModel), nil
+}
+
+func (r *CommandSide) ChangeMailText(ctx context.Context, resourceOwner string, mailText *domain.MailText) (*domain.MailText, error) {
+	if !mailText.IsValid() {
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "Org-3m9fs", "Errors.Org.MailText.Invalid")
+	}
+	existingPolicy := NewOrgMailTextWriteModel(resourceOwner, mailText.MailTextType, mailText.Language)
+	err := r.eventstore.FilterToQueryReducer(ctx, existingPolicy)
+	if err != nil {
+		return nil, err
+	}
+	if existingPolicy.State == domain.PolicyStateUnspecified || existingPolicy.State == domain.PolicyStateRemoved {
+		return nil, caos_errs.ThrowNotFound(nil, "Org-3n8fM", "Errors.Org.MailText.NotFound")
+	}
+
+	changedEvent, hasChanged := existingPolicy.NewChangedEvent(
+		ctx,
+		mailText.MailTextType,
+		mailText.Language,
+		mailText.Title,
+		mailText.PreHeader,
+		mailText.Subject,
+		mailText.Greeting,
+		mailText.Text,
+		mailText.ButtonText)
+	if !hasChanged {
+		return nil, caos_errs.ThrowPreconditionFailed(nil, "Org-2n9fs", "Errors.Org.MailText.NotChanged")
+	}
+
+	orgAgg := OrgAggregateFromWriteModel(&existingPolicy.MailTextWriteModel.WriteModel)
+	orgAgg.PushEvents(changedEvent)
+
+	err = r.eventstore.PushAggregate(ctx, existingPolicy, orgAgg)
+	if err != nil {
+		return nil, err
+	}
+
+	return writeModelToMailText(&existingPolicy.MailTextWriteModel), nil
+}
+
+func (r *CommandSide) RemoveMailText(ctx context.Context, resourceOwner, mailTextType, language string) error {
+	existingPolicy := NewOrgMailTextWriteModel(resourceOwner, mailTextType, language)
+	err := r.eventstore.FilterToQueryReducer(ctx, existingPolicy)
+	if err != nil {
+		return err
+	}
+	if existingPolicy.State == domain.PolicyStateUnspecified || existingPolicy.State == domain.PolicyStateRemoved {
+		return caos_errs.ThrowNotFound(nil, "Org-3b8Jf", "Errors.Org.MailText.NotFound")
+	}
+	orgAgg := OrgAggregateFromWriteModel(&existingPolicy.WriteModel)
+	orgAgg.PushEvents(org.NewMailTextRemovedEvent(ctx, mailTextType, language, resourceOwner))
+
+	return r.eventstore.PushAggregate(ctx, existingPolicy, orgAgg)
+}

internal/v2/command/org_policy_mail_text_model.go

@@ -0,0 +1,89 @@
+package command
+
+import (
+	"context"
+	"github.com/caos/zitadel/internal/eventstore/v2"
+	"github.com/caos/zitadel/internal/v2/repository/org"
+	"github.com/caos/zitadel/internal/v2/repository/policy"
+)
+
+type OrgMailTextWriteModel struct {
+	MailTextWriteModel
+}
+
+func NewOrgMailTextWriteModel(orgID, mailTextType, language string) *OrgMailTextWriteModel {
+	return &OrgMailTextWriteModel{
+		MailTextWriteModel{
+			WriteModel: eventstore.WriteModel{
+				AggregateID:   orgID,
+				ResourceOwner: orgID,
+			},
+			MailTextType: mailTextType,
+			Language:     language,
+		},
+	}
+}
+
+func (wm *OrgMailTextWriteModel) AppendEvents(events ...eventstore.EventReader) {
+	for _, event := range events {
+		switch e := event.(type) {
+		case *org.MailTextAddedEvent:
+			wm.MailTextWriteModel.AppendEvents(&e.MailTextAddedEvent)
+		case *org.MailTextChangedEvent:
+			wm.MailTextWriteModel.AppendEvents(&e.MailTextChangedEvent)
+		}
+	}
+}
+
+func (wm *OrgMailTextWriteModel) Reduce() error {
+	return wm.MailTextWriteModel.Reduce()
+}
+
+func (wm *OrgMailTextWriteModel) Query() *eventstore.SearchQueryBuilder {
+	query := eventstore.NewSearchQueryBuilder(eventstore.ColumnsEvent, org.AggregateType).
+		AggregateIDs(wm.MailTextWriteModel.AggregateID)
+	if wm.ResourceOwner != "" {
+		query.ResourceOwner(wm.ResourceOwner)
+	}
+	return query
+}
+
+func (wm *OrgMailTextWriteModel) NewChangedEvent(
+	ctx context.Context,
+	mailTextType,
+	language,
+	title,
+	preHeader,
+	subject,
+	greeting,
+	text,
+	buttonText string,
+) (*org.MailTextChangedEvent, bool) {
+	changes := make([]policy.MailTextChanges, 0)
+	if wm.Title != title {
+		changes = append(changes, policy.ChangeTitle(title))
+	}
+	if wm.PreHeader != preHeader {
+		changes = append(changes, policy.ChangePreHeader(preHeader))
+	}
+	if wm.Subject != subject {
+		changes = append(changes, policy.ChangeSubject(subject))
+	}
+	if wm.Greeting != greeting {
+		changes = append(changes, policy.ChangeGreeting(greeting))
+	}
+	if wm.Text != text {
+		changes = append(changes, policy.ChangeText(text))
+	}
+	if wm.ButtonText != buttonText {
+		changes = append(changes, policy.ChangeButtonText(buttonText))
+	}
+	if len(changes) == 0 {
+		return nil, false
+	}
+	changedEvent, err := org.NewMailTextChangedEvent(ctx, mailTextType, language, changes)
+	if err != nil {
+		return nil, false
+	}
+	return changedEvent, true
+}

internal/v2/command/org_policy_org_iam.go

@@ -8,8 +8,8 @@ import (
 	"github.com/caos/zitadel/internal/v2/repository/org"
 )
 
-func (r *CommandSide) AddOrgIAMPolicy(ctx context.Context, policy *domain.OrgIAMPolicy) (*domain.OrgIAMPolicy, error) {
-	addedPolicy := NewORGOrgIAMPolicyWriteModel(policy.AggregateID)
+func (r *CommandSide) AddOrgIAMPolicy(ctx context.Context, resourceOwner string, policy *domain.OrgIAMPolicy) (*domain.OrgIAMPolicy, error) {
+	addedPolicy := NewORGOrgIAMPolicyWriteModel(resourceOwner)
 	orgAgg := OrgAggregateFromWriteModel(&addedPolicy.PolicyOrgIAMWriteModel.WriteModel)
 	err := r.addOrgIAMPolicy(ctx, orgAgg, addedPolicy, policy)
 	if err != nil {
@@ -40,8 +40,8 @@ func (r *CommandSide) addOrgIAMPolicy(ctx context.Context, orgAgg *org.Aggregate
 	return nil
 }
 
-func (r *CommandSide) ChangeOrgIAMPolicy(ctx context.Context, policy *domain.OrgIAMPolicy) (*domain.OrgIAMPolicy, error) {
-	existingPolicy, err := r.orgIAMPolicyWriteModelByID(ctx, policy.AggregateID)
+func (r *CommandSide) ChangeOrgIAMPolicy(ctx context.Context, resourceOwner string, policy *domain.OrgIAMPolicy) (*domain.OrgIAMPolicy, error) {
+	existingPolicy, err := r.orgIAMPolicyWriteModelByID(ctx, resourceOwner)
 	if err != nil {
 		return nil, err
 	}

internal/v2/command/org_policy_password_age.go

@@ -8,8 +8,8 @@ import (
 	"github.com/caos/zitadel/internal/v2/repository/org"
 )
 
-func (r *CommandSide) AddPasswordAgePolicy(ctx context.Context, policy *domain.PasswordAgePolicy) (*domain.PasswordAgePolicy, error) {
-	addedPolicy := NewOrgPasswordAgePolicyWriteModel(policy.AggregateID)
+func (r *CommandSide) AddPasswordAgePolicy(ctx context.Context, resourceOwner string, policy *domain.PasswordAgePolicy) (*domain.PasswordAgePolicy, error) {
+	addedPolicy := NewOrgPasswordAgePolicyWriteModel(resourceOwner)
 	err := r.eventstore.FilterToQueryReducer(ctx, addedPolicy)
 	if err != nil {
 		return nil, err
@@ -29,8 +29,8 @@ func (r *CommandSide) AddPasswordAgePolicy(ctx context.Context, policy *domain.P
 	return writeModelToPasswordAgePolicy(&addedPolicy.PasswordAgePolicyWriteModel), nil
 }
 
-func (r *CommandSide) ChangePasswordAgePolicy(ctx context.Context, policy *domain.PasswordAgePolicy) (*domain.PasswordAgePolicy, error) {
-	existingPolicy := NewOrgPasswordAgePolicyWriteModel(policy.AggregateID)
+func (r *CommandSide) ChangePasswordAgePolicy(ctx context.Context, resourceOwner string, policy *domain.PasswordAgePolicy) (*domain.PasswordAgePolicy, error) {
+	existingPolicy := NewOrgPasswordAgePolicyWriteModel(resourceOwner)
 	err := r.eventstore.FilterToQueryReducer(ctx, existingPolicy)
 	if err != nil {
 		return nil, err

internal/v2/command/org_policy_password_complexity.go

@@ -20,11 +20,11 @@ func (r *CommandSide) getOrgPasswordComplexityPolicy(ctx context.Context, orgID
 	return r.getDefaultPasswordComplexityPolicy(ctx)
 }
 
-func (r *CommandSide) AddPasswordComplexityPolicy(ctx context.Context, policy *domain.PasswordComplexityPolicy) (*domain.PasswordComplexityPolicy, error) {
+func (r *CommandSide) AddPasswordComplexityPolicy(ctx context.Context, resourceOwner string, policy *domain.PasswordComplexityPolicy) (*domain.PasswordComplexityPolicy, error) {
 	if err := policy.IsValid(); err != nil {
 		return nil, err
 	}
-	addedPolicy := NewOrgPasswordComplexityPolicyWriteModel(policy.AggregateID)
+	addedPolicy := NewOrgPasswordComplexityPolicyWriteModel(resourceOwner)
 	err := r.eventstore.FilterToQueryReducer(ctx, addedPolicy)
 	if err != nil {
 		return nil, err
@@ -44,12 +44,12 @@ func (r *CommandSide) AddPasswordComplexityPolicy(ctx context.Context, policy *d
 	return writeModelToPasswordComplexityPolicy(&addedPolicy.PasswordComplexityPolicyWriteModel), nil
 }
 
-func (r *CommandSide) ChangePasswordComplexityPolicy(ctx context.Context, policy *domain.PasswordComplexityPolicy) (*domain.PasswordComplexityPolicy, error) {
+func (r *CommandSide) ChangePasswordComplexityPolicy(ctx context.Context, resourceOwner string, policy *domain.PasswordComplexityPolicy) (*domain.PasswordComplexityPolicy, error) {
 	if err := policy.IsValid(); err != nil {
 		return nil, err
 	}
 
-	existingPolicy := NewOrgPasswordComplexityPolicyWriteModel(policy.AggregateID)
+	existingPolicy := NewOrgPasswordComplexityPolicyWriteModel(resourceOwner)
 	err := r.eventstore.FilterToQueryReducer(ctx, existingPolicy)
 	if err != nil {
 		return nil, err

internal/v2/command/org_policy_password_lockout.go

@@ -8,8 +8,8 @@ import (
 	"github.com/caos/zitadel/internal/v2/repository/org"
 )
 
-func (r *CommandSide) AddPasswordLockoutPolicy(ctx context.Context, policy *domain.PasswordLockoutPolicy) (*domain.PasswordLockoutPolicy, error) {
-	addedPolicy := NewOrgPasswordLockoutPolicyWriteModel(policy.AggregateID)
+func (r *CommandSide) AddPasswordLockoutPolicy(ctx context.Context, resourceOwner string, policy *domain.PasswordLockoutPolicy) (*domain.PasswordLockoutPolicy, error) {
+	addedPolicy := NewOrgPasswordLockoutPolicyWriteModel(resourceOwner)
 	err := r.eventstore.FilterToQueryReducer(ctx, addedPolicy)
 	if err != nil {
 		return nil, err
@@ -29,8 +29,8 @@ func (r *CommandSide) AddPasswordLockoutPolicy(ctx context.Context, policy *doma
 	return writeModelToPasswordLockoutPolicy(&addedPolicy.PasswordLockoutPolicyWriteModel), nil
 }
 
-func (r *CommandSide) ChangePasswordLockoutPolicy(ctx context.Context, policy *domain.PasswordLockoutPolicy) (*domain.PasswordLockoutPolicy, error) {
-	existingPolicy := NewOrgPasswordLockoutPolicyWriteModel(policy.AggregateID)
+func (r *CommandSide) ChangePasswordLockoutPolicy(ctx context.Context, resourceOwner string, policy *domain.PasswordLockoutPolicy) (*domain.PasswordLockoutPolicy, error) {
+	existingPolicy := NewOrgPasswordLockoutPolicyWriteModel(resourceOwner)
 	err := r.eventstore.FilterToQueryReducer(ctx, existingPolicy)
 	if err != nil {
 		return nil, err

internal/v2/command/policy_mail_template_model.go

@@ -0,0 +1,32 @@
+package command
+
+import (
+	"github.com/caos/zitadel/internal/eventstore/v2"
+	"github.com/caos/zitadel/internal/v2/domain"
+	"github.com/caos/zitadel/internal/v2/repository/policy"
+)
+
+type MailTemplateWriteModel struct {
+	eventstore.WriteModel
+
+	Template []byte
+
+	State domain.PolicyState
+}
+
+func (wm *MailTemplateWriteModel) Reduce() error {
+	for _, event := range wm.Events {
+		switch e := event.(type) {
+		case *policy.MailTemplateAddedEvent:
+			wm.Template = e.Template
+			wm.State = domain.PolicyStateActive
+		case *policy.MailTemplateChangedEvent:
+			if e.Template != nil {
+				wm.Template = *e.Template
+			}
+		case *policy.MailTemplateRemovedEvent:
+			wm.State = domain.PolicyStateRemoved
+		}
+	}
+	return wm.WriteModel.Reduce()
+}

internal/v2/command/policy_mail_text_model.go

@@ -0,0 +1,65 @@
+package command
+
+import (
+	"github.com/caos/zitadel/internal/eventstore/v2"
+	"github.com/caos/zitadel/internal/v2/domain"
+	"github.com/caos/zitadel/internal/v2/repository/policy"
+)
+
+type MailTextWriteModel struct {
+	eventstore.WriteModel
+
+	MailTextType string
+	Language     string
+	Title        string
+	PreHeader    string
+	Subject      string
+	Greeting     string
+	Text         string
+	ButtonText   string
+
+	State domain.PolicyState
+}
+
+func (wm *MailTextWriteModel) Reduce() error {
+	for _, event := range wm.Events {
+		switch e := event.(type) {
+		case *policy.MailTextAddedEvent:
+			if wm.MailTextType != e.MailTextType || wm.Language != e.Language {
+				continue
+			}
+			wm.Title = e.Title
+			wm.PreHeader = e.PreHeader
+			wm.Subject = e.Subject
+			wm.Greeting = e.Greeting
+			wm.Text = e.Text
+			wm.ButtonText = e.ButtonText
+			wm.State = domain.PolicyStateActive
+		case *policy.MailTextChangedEvent:
+			if wm.MailTextType != e.MailTextType || wm.Language != e.Language {
+				continue
+			}
+			if e.Title != nil {
+				wm.Title = *e.Title
+			}
+			if e.PreHeader != nil {
+				wm.PreHeader = *e.PreHeader
+			}
+			if e.Subject != nil {
+				wm.Subject = *e.Subject
+			}
+			if e.Greeting != nil {
+				wm.Greeting = *e.Greeting
+			}
+			if e.Text != nil {
+				wm.Text = *e.Text
+			}
+			if e.ButtonText != nil {
+				wm.ButtonText = *e.ButtonText
+			}
+		case *policy.MailTextRemovedEvent:
+			wm.State = domain.PolicyStateRemoved
+		}
+	}
+	return wm.WriteModel.Reduce()
+}

internal/v2/command/setup_step10.go

@@ -2,15 +2,14 @@ package command
 
 import (
 	"context"
-	iam_model "github.com/caos/zitadel/internal/iam/model"
-
+	"github.com/caos/logging"
 	"github.com/caos/zitadel/internal/v2/domain"
 	iam_repo "github.com/caos/zitadel/internal/v2/repository/iam"
 )
 
 type Step10 struct {
-	DefaultMailTemplate iam_model.MailTemplate
-	DefaultMailTexts    []iam_model.MailText
+	DefaultMailTemplate domain.MailTemplate
+	DefaultMailTexts    []domain.MailText
 }
 
 func (s *Step10) Step() domain.Step {
@@ -23,23 +22,19 @@ func (s *Step10) execute(ctx context.Context, commandSide *CommandSide) error {
 
 func (r *CommandSide) SetupStep10(ctx context.Context, step *Step10) error {
 	fn := func(iam *IAMWriteModel) (*iam_repo.Aggregate, error) {
-		//multiFactorModel := NewIAMMultiFactorWriteModel()
-		//iamAgg := IAMAggregateFromWriteModel(&multiFactorModel.MultiFactoryWriteModel.WriteModel)
-		//if !step.Passwordless {
-		//	return iamAgg, nil
-		//}
-		//err := setPasswordlessAllowedInPolicy(ctx, r, iamAgg)
-		//if err != nil {
-		//	return nil, err
-		//}
-		//logging.Log("SETUP-AEG2t").Info("allowed passwordless in login policy")
-		//err = r.addMultiFactorToDefaultLoginPolicy(ctx, iamAgg, multiFactorModel, domain.MultiFactorTypeU2FWithPIN)
-		//if err != nil {
-		//	return nil, err
-		//}
-		//logging.Log("SETUP-ADfng").Info("added passwordless to MFA login policy")
-		//return iamAgg, err
-		return nil, nil
+		iamAgg := IAMAggregateFromWriteModel(&iam.WriteModel)
+		err := r.addDefaultMailTemplate(ctx, iamAgg, NewIAMMailTemplateWriteModel(), &step.DefaultMailTemplate)
+		if err != nil {
+			return nil, err
+		}
+		for _, text := range step.DefaultMailTexts {
+			r.addDefaultMailText(ctx, iamAgg, NewIAMMailTextWriteModel(text.MailTextType, text.Language), &text)
+			if err != nil {
+				return nil, err
+			}
+		}
+		logging.Log("SETUP-3N9fs").Info("default mail template/text set up")
+		return iamAgg, nil
 	}
 	return r.setup(ctx, step, fn)
 }