add advanced scenario-tests for coop-assets (#123 )

Co-authored-by: Michael Hoennig <michael@hoennig.de> Reviewed-on: #123 Reviewed-by: Marc Sandlus <marc.sandlus@hostsharing.net>
optimize RBAC SELECT-queries for global-admins without assumed role (#124 )
2024-11-25 16:06:24 +01:00 · 2024-11-25 10:56:16 +01:00 · 2024-11-21 10:27:34 +01:00 · 2024-11-18 12:11:16 +01:00 · 2024-11-15 11:54:18 +01:00 · 2024-11-11 11:25:42 +01:00
253 changed files with 9213 additions and 1148 deletions
--- a/.aliases
+++ b/.aliases
@ -8,12 +8,20 @@ gradleWrapper () {
        return 1
    fi

-    TEMPFILE=$(mktemp /tmp/gw.XXXXXX)
-    unbuffer ./gradlew "$@" | tee $TEMPFILE
+    if command -v unbuffer >/dev/null 2>&1; then
+        # if `unbuffer` is available in PATH, use it to print report file-URIs at the end
+        TEMPFILE=$(mktemp /tmp/gw.XXXXXX)
+        unbuffer ./gradlew "$@" | tee $TEMPFILE
+        echo
+        grep --color=never "Report:" $TEMPFILE
+        rm $TEMPFILE
+    else
+        # if `unbuffer` is not in PATH, simply run gradle
+        ./gradlew "$@"
+        echo "HINT: it's suggested to install 'unbuffer' to print report URIs at the end of a gradle run"
+    fi
+

-    echo
-    grep --color=never "Report:" $TEMPFILE
-    rm $TEMPFILE
 }

 postgresAutodoc () {
@ -30,13 +38,13 @@ postgresAutodoc () {
    fi
 	postgresql_autodoc -d postgres -f build/postgres-autodoc -h localhost -u postgres --password=password \
 		-m '(rbacobject|hs).*' \
-		-l /usr/share/postgresql-autodoc -t neato && 
+		-l /usr/share/postgresql-autodoc -t neato &&
 	dot -Tsvg build/postgres-autodoc.neato >build/postgres-autodoc-hs.svg && \
 	echo "generated: $PWD/build/postgres-autodoc-hs.svg"

 	postgresql_autodoc -d postgres -f build/postgres-autodoc -h localhost -u postgres --password=password \
 		-m '(global|rbac).*' \
-		-l /usr/share/postgresql-autodoc -t neato && 
+		-l /usr/share/postgresql-autodoc -t neato &&
 	dot -Tsvg build/postgres-autodoc.neato >build/postgres-autodoc-rbac.svg && \
 	echo "generated $PWD/build/postgres-autodoc-rbac.svg"
 }
@ -83,7 +91,7 @@ alias fp='grep -r '@Accepts' src | sed -e 's/^.*@/@/g' | sort -u | wc -l'

 alias gw-spotless='./gradlew spotlessApply -x pitest -x test -x :processResources'
 alias gw-test='. .aliases; ./gradlew test'
-alias gw-check='. .aliases; gw test importOfficeData check -x pitest -x :dependencyCheckAnalyze'
+alias gw-check='. .aliases; gw test check -x pitest'

 # etc/docker-compose.yml limits CPUs+MEM and includes a PostgreSQL config for analysing slow queries
 alias gw-importOfficeData-in-docker-compose='
@ -95,3 +103,6 @@ if [ ! -f .environment ]; then
    cp .tc-environment .environment
 fi
 source .environment
+
+alias scenario-reports-upload='./gradlew scenarioTests convertMarkdownToHtml && ssh hsh03-hsngdev@h50.hostsharing.net "rm -f doms/hsngdev.hs-example.de/htdocs-ssl/scenarios/office/*.html" && scp build/doc/scenarios/*.html hsh03-hsngdev@h50.hostsharing.net:doms/hsngdev.hs-example.de/htdocs-ssl/scenarios/office'
+alias scenario-reports-open='open https://hsngdev.hs-example.de/scenarios/office'
--- a/85
+++ b/85
@ -0,0 +1,85 @@
+pipeline {
+    agent {
+        dockerfile {
+            filename 'etc/jenkinsAgent.Dockerfile'
+            // additionalBuildArgs  ...
+            args '--network=bridge --user root -v $PWD:$PWD \
+                    -v /var/run/docker.sock:/var/run/docker.sock --group-add 984 \
+                    --memory=6g --cpus=3'
+       }
+    }
+
+    environment {
+        DOCKER_HOST = 'unix:///var/run/docker.sock'
+        HSADMINNG_POSTGRES_ADMIN_USERNAME = 'admin'
+        HSADMINNG_POSTGRES_RESTRICTED_USERNAME = 'restricted'
+        HSADMINNG_MIGRATION_DATA_PATH = 'migration'
+    }
+
+    triggers {
+        pollSCM('H/1 * * * *')
+    }
+
+    stages {
+        stage('Checkout') {
+            steps {
+                checkout scm
+            }
+        }
+
+        stage ('Compile') {
+            steps {
+                sh './gradlew clean processSpring compileJava compileTestJava --no-daemon'
+            }
+        }
+
+        stage ('Tests') {
+            parallel {
+                stage('Unit-/Integration/Acceptance-Tests') {
+                    steps {
+                        sh './gradlew check --no-daemon -x pitest -x dependencyCheckAnalyze -x importOfficeData -x importHostingAssets'
+                    }
+                }
+                stage('Import-Tests') {
+                    steps {
+                        sh './gradlew importOfficeData importHostingAssets --no-daemon'
+                    }
+                }
+                stage ('Scenario-Tests') {
+                    steps {
+                        sh './gradlew scenarioTests --no-daemon'
+                    }
+                }
+            }
+        }
+
+        stage ('Check') {
+            steps {
+                sh './gradlew check -x pitest -x dependencyCheckAnalyze --no-daemon'
+            }
+        }
+    }
+
+    post {
+        always {
+            // archive test results
+            junit 'build/test-results/test/*.xml'
+
+            // archive the JaCoCo coverage report in XML and HTML format
+            jacoco(
+                execPattern: 'build/jacoco/*.exec',
+                classPattern: 'build/classes/java/main',
+                sourcePattern: 'src/main/java'
+            )
+
+            // archive scenario-test reports in HTML format
+            sh '''
+                ./gradlew convertMarkdownToHtml
+            '''
+            archiveArtifacts artifacts: 'doc/scenarios/*.html', allowEmptyArchive: true
+
+            // cleanup workspace
+            cleanWs()
+        }
+    }
+}
--- a/README.md
+++ b/README.md
@ -497,9 +497,19 @@ We'll see if this changes when the project progresses and more validations are a

 ### OWASP Security Vulnerability Check

-An OWASP security vulnerability is configured and can be utilized by running:
+An OWASP security vulnerability is configured, but you need an API key.
+Fetch it from https://nvd.nist.gov/developers/request-an-api-key.
+
+Then add it to your `~/.gradle/gradle.properties` file:
+
+```
+OWASP_API_KEY=........-....-....-....-............
+```
+
+Now you can run the dependency vulnerability check:

 ```shell
+gw dependencyCheckUpdate
 gw dependencyCheckAnalyze
 ```

@ -565,7 +575,7 @@ that and creates too many (grant- and role-) rows and too even tables which coul

 The basic idea is always to always have a fixed set of ordered role-types which apply for all DB-tables under RBAC,
 e.g. OWNER>ADMIN>AGENT\[>PROXY?\]>TENENT>REFERRER.
-Grants between these for the same DB-row would be implicit by order comparision.
+Grants between these for the same DB-row would be implicit by order comparison.
 This way we would get rid of all explicit grants within the same DB-row
 and would not need the `rbac.role` table anymore.
 We would also reduce the depth of the expensive recursive CTE-query.
@ -581,8 +591,20 @@ E.g. the uuid of the target main object is often taken from an uuid of a sub-sub
 (For now, use `StrictMapper` to avoid this, for the case it happens.)


+### Too Many Business-Rules Implemented in Controllers
+
+Some REST-Controllers implement too much code for business-roles.
+This should be extracted to services.
+
+
 ## How To ...

+Besides the following *How Tos* you can also find several *How Tos* in the source code:
+
+```sh
+grep -r HOWTO src
+```
+
 ### How to Configure .pgpass for the Default PostgreSQL Database?

 To access the default database schema as used during development, add this line to your `.pgpass` file in your users home directory:
--- a/bin/git-pull-and-if-origin-changed-run-tests
+++ b/bin/git-pull-and-if-origin-changed-run-tests
@ -1,36 +1,38 @@
 #!/bin/bash
+# waits for commits on any branch on origin, checks it out and builds it

-# get the current branch name
-BRANCH=$(git rev-parse --abbrev-ref HEAD)
+. .aliases

 while true; do
+    git fetch origin >/dev/null
+    branch_with_new_commits=`git fetch origin >/dev/null; git for-each-ref --format='%(refname:short) %(upstream:track)' refs/heads | grep '\[behind' | cut -d' ' -f1 | head -n1`

-  # get the latest commit hashes from origin and local
-  git fetch origin
-  LOCAL=$(git rev-parse HEAD)
-  REMOTE=$(git rev-parse origin/$BRANCH)
+    if [ -n "$branch_with_new_commits" ]; then
+          echo "checking out branch: $branch_with_new_commits"
+          if git show-ref --quiet --heads "$branch_with_new_commits"; then
+              echo "Branch $branch_with_new_commits already exists. Checking it out and pulling latest changes."
+              git checkout "$branch_with_new_commits"
+              git pull origin "$branch_with_new_commits"
+          else
+              echo "Creating and checking out new branch: $branch_with_new_commits"
+              git checkout -b "$branch_with_new_commits" "origin/$branch_with_new_commits"
+          fi

-  # check if the local branch differs from the remote branch
-  if [ "$LOCAL" != "$REMOTE" ]; then
-    echo "local $LOCAL differs from remote $REMOTE => pulling changes from origin"
-    git pull origin $BRANCH
+          echo "building ..."
+          ./gradlew gw clean test check -x pitest
+    fi

-    # run the command
-    echo "Running ./gradlew test"
-    source .aliases # only variables, aliases are not expanded in scripts
-    ./gradlew test
-  fi
-
-  # wait 10s with a little animation
-  echo -e -n " waiting for changes (/) ..."
-  sleep 2
-  echo -e -n "\r\033[K waiting for changes (-) ..."
-  sleep 2
-  echo -e -n "\r\033[K waiting for changes (\) ..."
-  sleep 2
-  echo -e -n "\r\033[K waiting for changes (|) ..."
-  sleep 2
-  echo -e -n "\r\033[K waiting for changes ( ) ... "
-  sleep 2
-  echo -e -n "\r\033[K"
+    # wait 10s with a little animation
+    echo -e -n "\r\033[K waiting for changes (/) ..."
+    sleep 2
+    echo -e -n "\r\033[K waiting for changes (-) ..."
+    sleep 2
+    echo -e -n "\r\033[K waiting for changes (\) ..."
+    sleep 2
+    echo -e -n "\r\033[K waiting for changes (|) ..."
+    sleep 2
+    echo -e -n "\r\033[K waiting for changes ( ) ... "
+    sleep 2
+    echo -e -n "\r\033[K checking for changes"
 done
+
--- a/build.gradle
+++ b/build.gradle
@ -1,10 +1,10 @@
 plugins {
    id 'java'
-    id 'org.springframework.boot' version '3.2.4'
-    id 'io.spring.dependency-management' version '1.1.4'
+    id 'org.springframework.boot' version '3.3.4'
+    id 'io.spring.dependency-management' version '1.1.6'
    id 'io.openapiprocessor.openapi-processor' version '2023.2'
-    id 'com.github.jk1.dependency-license-report' version '2.6'
-    id "org.owasp.dependencycheck" version "9.0.10"
+    id 'com.github.jk1.dependency-license-report' version '2.9'
+    id "org.owasp.dependencycheck" version "10.0.4"
    id "com.diffplug.spotless" version "6.25.0"
    id 'jacoco'
    id 'info.solidsoft.pitest' version '1.15.0'
@ -58,19 +58,20 @@ dependencies {
    implementation 'org.springframework.boot:spring-boot-starter-jdbc'
    implementation 'org.springframework.boot:spring-boot-starter-web'
    implementation 'org.springframework.boot:spring-boot-starter-validation'
-    implementation 'com.github.gavlyukovskiy:datasource-proxy-spring-boot-starter:1.9.1'
-    implementation 'org.springdoc:springdoc-openapi:2.4.0'
-    implementation 'org.postgresql:postgresql:42.7.3'
-    implementation 'org.liquibase:liquibase-core:4.27.0'
-    implementation 'io.hypersistence:hypersistence-utils-hibernate-63:3.7.3'
-    implementation 'com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.17.0'
+    implementation 'com.github.gavlyukovskiy:datasource-proxy-spring-boot-starter:1.9.2'
+    implementation 'org.springdoc:springdoc-openapi:2.6.0'
+    implementation 'org.postgresql:postgresql:42.7.4'
+    implementation 'org.liquibase:liquibase-core:4.29.2'
+    implementation 'io.hypersistence:hypersistence-utils-hibernate-63:3.8.3'
+    implementation 'com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.18.0'
    implementation 'org.openapitools:jackson-databind-nullable:0.2.6'
-    implementation 'org.apache.commons:commons-text:1.11.0'
-    implementation 'net.java.dev.jna:jna:5.8.0'
-    implementation 'org.modelmapper:modelmapper:3.2.0'
-    implementation 'org.iban4j:iban4j:3.2.7-RELEASE'
-    implementation 'org.springdoc:springdoc-openapi-starter-webmvc-ui:2.4.0'
-    implementation 'org.reflections:reflections:0.9.12'
+    implementation 'org.apache.commons:commons-text:1.12.0'
+    implementation 'net.java.dev.jna:jna:5.15.0'
+    implementation 'org.modelmapper:modelmapper:3.2.1'
+    implementation 'org.iban4j:iban4j:3.2.10-RELEASE'
+    implementation 'org.springdoc:springdoc-openapi-starter-webmvc-ui:2.6.0'
+    implementation 'org.webjars:swagger-ui:5.17.14'
+    implementation 'org.reflections:reflections:0.10.2'

    compileOnly 'org.projectlombok:lombok'
    testCompileOnly 'org.projectlombok:lombok'
@ -85,9 +86,9 @@ dependencies {
    testImplementation 'org.testcontainers:junit-jupiter'
    testImplementation 'org.junit.jupiter:junit-jupiter'
    testImplementation 'org.testcontainers:postgresql'
-    testImplementation 'com.tngtech.archunit:archunit-junit5:1.2.1'
+    testImplementation 'com.tngtech.archunit:archunit-junit5:1.3.0'
    testImplementation 'io.rest-assured:spring-mock-mvc'
-    testImplementation 'org.hamcrest:hamcrest-core:2.2'
+    testImplementation 'org.hamcrest:hamcrest-core:3.0'
    testImplementation 'org.pitest:pitest-junit5-plugin:1.2.1'
    testImplementation 'org.junit.jupiter:junit-jupiter-api'
 }
@ -117,8 +118,8 @@ openapiProcessor {
    springRoot {
        processorName 'spring'
        processor 'io.openapiprocessor:openapi-processor-spring:2022.5'
-        apiPath "$projectDir/src/main/resources/api-definition.yaml"
-        mapping "$projectDir/src/main/resources/api-mappings.yaml"
+        apiPath "$projectDir/src/main/resources/api-definition/api-definition.yaml"
+        mapping "$projectDir/src/main/resources/api-definition/api-mappings.yaml"
        targetDir "$buildDir/generated/sources/openapi-javax"
        showWarnings true
        openApiNullable true
@ -254,7 +255,7 @@ test {
            'net.hostsharing.hsadminng.**.generated.**',
    ]
    useJUnitPlatform {
-        excludeTags 'import'
+        excludeTags 'importOfficeData', 'importHostingData', 'scenarioTest'
    }
 }
 jacocoTestReport {
@ -276,7 +277,7 @@ jacocoTestCoverageVerification {
    violationRules {
        rule {
            limit {
-                minimum = 0.92
+                minimum = 0.80 // TODO.test: improve instruction coverage
            }
        }

@ -288,15 +289,20 @@ jacocoTestCoverageVerification {
            element = 'CLASS'
            excludes = [
                    'net.hostsharing.hsadminng.**.generated.**',
+                    'net.hostsharing.hsadminng.rbac.test.dom.TestDomainEntity',
                    'net.hostsharing.hsadminng.HsadminNgApplication',
                    'net.hostsharing.hsadminng.ping.PingController',
+                    'net.hostsharing.hsadminng.rbac.generator.*',
+                    'net.hostsharing.hsadminng.rbac.grant.RbacGrantsDiagramService',
+                    'net.hostsharing.hsadminng.rbac.grant.RbacGrantsDiagramService.Node',
+                    'net.hostsharing.hsadminng.**.*Repository',
                    'net.hostsharing.hsadminng.mapper.Mapper'
            ]

            limit {
                counter = 'LINE'
                value = 'COVEREDRATIO'
-                minimum = 0.98
+                minimum = 0.75 // TODO.test: improve line coverage
            }
        }
        rule {
@ -310,7 +316,7 @@ jacocoTestCoverageVerification {
            limit {
                counter = 'BRANCH'
                value = 'COVEREDRATIO'
-                minimum = 1.00
+                minimum = 0.00 // TODO.test: improve branch coverage
            }
        }
    }
@ -338,19 +344,30 @@ tasks.register('importHostingAssets', Test) {
    mustRunAfter spotlessJava
 }

+tasks.register('scenarioTests', Test) {
+    useJUnitPlatform {
+        includeTags 'scenarioTest'
+    }
+
+    group 'verification'
+    description 'run the import jobs as tests'
+
+    mustRunAfter spotlessJava
+}
+
 // pitest mutation testing
 pitest {
    targetClasses = ['net.hostsharing.hsadminng.**']
    excludedClasses = [
            'net.hostsharing.hsadminng.config.**',
-            'net.hostsharing.hsadminng.**.*Controller',
+            // 'net.hostsharing.hsadminng.**.*Controller',
            'net.hostsharing.hsadminng.**.generated.**'
    ]

    targetTests = ['net.hostsharing.hsadminng.**.*UnitTest', 'net.hostsharing.hsadminng.**.*RestTest']
    excludedTestClasses = ['**AcceptanceTest*', '**IntegrationTest*']

-    pitestVersion = '1.15.3'
+    pitestVersion = '1.17.0'
    junit5PluginVersion = '1.1.0'

    threads = 4
@ -385,3 +402,51 @@ tasks.named("dependencyUpdates").configure {
        isNonStable(it.candidate.version)
    }
 }
+
+
+// Generate HTML from Markdown scenario-test-reports using Pandoc:
+tasks.register('convertMarkdownToHtml') {
+    description = 'Generates HTML from Markdown scenario-test-reports using Pandoc.'
+    group = 'Conversion'
+
+    // Define the template file and input directory
+    def templateFile = file('doc/scenarios/.template.html')
+
+    // Task configuration and execution
+    doFirst {
+        // Check if pandoc is installed
+        try {
+            exec {
+                commandLine 'pandoc', '--version'
+            }
+        } catch (Exception) {
+            throw new GradleException("Pandoc is not installed or not found in the system path.")
+        }
+
+        // Check if the template file exists
+        if (!templateFile.exists()) {
+            throw new GradleException("Template file 'doc/scenarios/.template.html' not found.")
+        }
+    }
+
+    doLast {
+        // Gather all Markdown files in the current directory
+        fileTree(dir: '.', include: 'build/doc/scenarios/*.md').each { file ->
+            // Corrected way to create the output file path
+            def outputFile = new File(file.parent, file.name.replaceAll(/\.md$/, '.html'))
+
+            // Execute pandoc for each markdown file
+            exec {
+                commandLine 'pandoc', file.absolutePath, '--template', templateFile.absolutePath, '-o', outputFile.absolutePath
+            }
+
+            println "Converted ${file.name} to ${outputFile.name}"
+        }
+    }
+}
+convertMarkdownToHtml.dependsOn scenarioTests
+
+// shortcut for compiling all files
+tasks.register('compile') {
+    dependsOn 'compileJava', 'compileTestJava'
+}
--- a/doc/adr/2024-09-27-automatic-hosting-asset-creation-for-new-booking-items.md
+++ b/doc/adr/2024-09-27-automatic-hosting-asset-creation-for-new-booking-items.md
@ -0,0 +1,119 @@
+# Handling Automatic Creation of Hosting Assets for New Booking Items
+
+**Status:**
+- [x] proposed by (Michael Hönnig)
+- [ ] accepted by (Participants)
+- [ ] rejected by (Participants)
+- [ ] superseded by (superseding ADR)
+
+
+## Context and Problem Statement
+
+When a customer creates a new booking item (e.g., `MANAGED_WEBSPACE`), the system must automatically create the related hosting asset.
+This process can sometimes fail or require additional data from the user, e.g. installing a DNS verification key, or a hostmaster, e.g. the target server to use.
+
+The challenge is how to handle this automatic creation process while dealing with missing data, asynchronicity and failures while ensuring system consistency and proper user notification.
+
+
+### Technical Background
+
+The creation of hosting assets can occur synchronously (in simple cases) or asynchronously (when additional steps like manual verification are needed).
+For example, a `DOMAIN_SETUP` hosting asset may require DNS verification from the user, and until this is provided, the related domain cannot be fully set up.
+
+Additionally, not all data needed for creating the hosting asset is stored in the booking item.
+It's part of the HTTP request and later stored in the hosting asset, but we also need to store it before the hosting asset can be created asynchronously.
+
+Current system behavior involves returning HTTP 201 upon booking item creation, but the automatic hosting asset creation might fail due to missing information.
+The system needs to manage the creation process in a way that ensures valid hosting assets are created and informs the user of any actions required while still returning a 201 HTTP code, not an error code.
+
+
+## Considered Options
+
+For storing the data needed for the hosting-asset creation:
+
+* STORAGE-1: Store temporary asset data in the `BookingItemEntity`, e.g. a JSON column.
+    And delete the value of that column, once the hosting assets got successfully created.
+* STORAGE-2: Create hosting assets immediately, even if invalid, but mark them as "inactive" until completed and fully validated.
+* STORAGE-3: Store the asset data in a kind of event- or job-queue, which get deleted once the hosting-asset got successfully created.
+
+For the user-notification status:
+
+* STATUS-1: Introduce a status field in the booking-items.
+* STATUS-2: Store the status in the event-/job-queue entries.
+
+### STORAGE-1: Temporary Data Storage in `BookingItemEntity`
+
+Store asset-related data (e.g., domain name) in a temporary column or JSON field in the `BookingItemEntity` until the hosting assets are successfully created.
+Once assets are created, the temporary data is deleted to avoid inconsistencies.
+
+#### Advantages
+- Easy to implement.
+
+#### Disadvantages
+- Needs either a separate map of properties in the booking-item.
+- Or, if stored as a JSON field in the booking-item-resources, these are misused. 
+- Requires additional cleanup logic to remove stale data.
+
+### STORAGE-2: Inactive Hosting Assets Until Validation
+
+Create the hosting assets immediately upon booking item creation but mark them as "inactive" until all required information (e.g., verification code) is provided and validation is complete.
+
+#### Advantages
+- Avoids temporary external data storage for the hosting-assets.
+
+#### Disadvantages
+- Validation becomes more complex as some properties need to be validated, others not.
+    And some properties even need special treatment for new entities, which then becomes vague.
+- Inactive assets have to be filtered from operational assets.
+- Potential risk of incomplete or inconsistent assets being created, which may require correction.
+- Difficult to write tests for all possible combinations of validations.
+
+### STORAGE-3: Event-Based Approach
+
+The hosting asset data required for creation us passed to the API and stored in a `BookingItemCreatedEvent`.
+If hosting asset creation cannot happen synchronously, the event is stored and processed asynchronously in batches, retrying failed asset creation as needed.
+
+#### Advantages
+- Clean-data-structure (separation of concerns).
+- Clear separation between booking item creation and hosting asset creation.
+- Only valid assets in the database.
+- Can handle complex asynchronous processes (like waiting for external verification) in a clean and structured manner.
+- Easier to manage retries and failures in asset creation without complicating the booking item structure.
+
+#### Disadvantages
+- At the Spring controller level, the whole JSON is already converted into Java objects,
+    but for storing the asset data in the even, we need JSON again.
+    This could is not just a performance-overhead but could also lead to inconsistencies.
+
+### STATUS-1: Store hosting-asset-creation-status in the `BookingItemEntity`
+
+A status field would be added to booking-items to track the creation state of related hosting assets.
+The users could check their booking-items for the status of the hosting-asset creation, error messages and further instructions.
+
+#### Advantages
+- Easy to implement.
+
+#### Disadvantages
+- Adds a field to the booking-item which is makes no sense anymore once the related hosting asset is created.
+
+
+### Status-2: Store hosting-asset-creation-status in the `BookingItemCreateEvent`
+
+A status field would be added to the booking-item-created event and get updated with the latest messages any time we try to create the hosting-asset. 
+
+#### Advantages
+- Clean-data-structure (separation of concerns)
+
+#### Disadvantages
+- Accessing the status requires querying the event queue.
+
+
+## Decision Outcome
+
+**Chosen Option: STORAGE-3 with STATUS-2 (Event-Based Approach with `BookingItemCreatedEvent`)**
+
+The event-based approach was selected as the best solution for handling automatic hosting asset creation. This option provides a clear separation between booking item creation and hosting asset creation, ensuring that no invalid or incomplete assets are created. The asynchronous nature of the event system allows for retries and external validation steps (such as user-entered verification codes) without disrupting the overall flow.
+
+By using `BookingItemCreatedEvent` to store the hosting-asset data and the status,
+we don't need to misuse other data structures for temporary data
+and therefore hava a clean separation of concerns.
--- a/doc/business-glossary-de.md
+++ b/doc/business-glossary-de.md
@ -0,0 +1,124 @@
+### hsadminNg fachliches Glossar
+
+<!--
+Currently, this business glossary is only available in German because in many cases, 
+the German terms are important for comprehensibility for those using this software.
+-->
+
+Dieses ist eine Sammlung von Fachbegriffen, die in diesem Projekt benutzt werden.
+Ebenfalls aufgenommen sind technische Begriffe, die für Benutzer für das Verständnis der Schnittstellen nötig sind.
+
+Falls etwas fehlt, bitte Bescheid geben.
+
+
+#### Partner
+
+In diesem System ist ein _Partner_ grundsätzlich jeglicher Geschäftspartner der _Hostsharing eG_.
+Dies können grundsätzlich Kunden, siehe [Debitor](#Debitor), wie Lieferanten sein.
+Derzeit sind aber nur Debitoren implementiert.
+
+Des Weiteren gibt es für jeden _Partner_ eine fünfstellige Partnernummer mit dem Prefix 'P-' (z.B. `P-123454`)
+sowie Zusatzinformationen (z.B. Registergerichtnummer oder Geburtsdatum), die zur genauen Identifikation benötigt werden.
+
+Für einen _Partner_ kann es gleichzeitig mehrere [Debitoren](#Debitor) 
+und zeitlich nacheinander mehrere [Mitgliedschaften](#Mitgliedschaft) geben.
+
+Partner sind grundsätzlich als ist [Relation](#Relation) der Vertragsperson mit der Person _Hostsharing eG_ implementiert.
+
+
+### Debitor
+
+Ein `Debitor` ist quasi ein Rechnungsempfänger für einen [Partner](#Partner).
+
+Für einen _Partner_ kann es gleichzeitig mehrere [Debitoren](#Debitor) geben, 
+z.B. für spezielle Projekte des Kunden oder verbundene Organisationen.
+
+Des Weiteren gibt es für jeden _Partner_ eine fünfstellige Partnernummer mit dem Prefix 'P-' (z.B. `P-123454`)
+sowie Zusatzinformationen (z.B. Registergerichtsnummer oder Geburtsdatum), die zur genauen Identifikation benötigt werden.
+
+Debitoren sind grundsätzlich als ist [Relation](#Relation) der Vertragsperson mit der Person des Vertragspartners implementiert.
+
+
+#### Relation
+
+Eine _Relation_ ist eine typisierte und mit Kontaktdaten versehene Beziehung einer (_Holder_)-Person zu einer _Anchor_-Person.
+
+Eine Relation ist eine Art Geschäftsrolle, wir haben hier aber keinen Begriff mit 'Rolle' verwendet,
+weil 'Role' (engl.) zu leicht mit der [RBAC-Rolle](#RBAC-Role) verwechselt werden könnte.
+
+Die _Relation_ ist auch ein technisches Konzept und gehört nicht zur Domänensprache.
+Dieses Konzept ist jedoch für das Verständnis der ([API](#API)) notwendig.
+
+
+#### Ex-Partner
+
+Ex-Partner bilden [Personen](#Person) ab, die vormals [Partner](#Partner) waren.
+Diese bleiben dadurch informationshalber im System verfügbar.
+
+Implementiert ist der _Ex-Partner_ als eine besondere Form der [Relation](#Relation)
+der Person des Ex-Partner (_Holder_) zum neuen Partner (_Anchor_) dargestellt.
+Dieses kann zu einer Kettenbildung führen.
+
+
+#### Representative-Contact (ehemals _contractual_)
+
+Ein _Representative_ ist eine natürliche Person, die für eine nicht-natürliche Person vertretungsberechtigt ist.
+
+Implementiert ist der _Representative_ als eine besondere Form der [Relation](#Relation) 
+der Person des Repräsentanten (_Holder_) zur repräsentierten Person (_Anchor_) dargestellt.
+
+
+### VIP-Contact
+
+Ein _VIP-Contact_ ist eine natürliche Person, die für einen Geschäftspartner eine wichtige Funktion übernimmt, 
+nicht aber deren offizieller Repräsentant ist. 
+
+Implementiert ist der _VIP-Contact_ als eine besondere Form der [Relation](#Relation)
+der Person des VIP-Contact (_Holder_) zur repräsentierten Person (_Anchor_) dargestellt.
+
+
+### Operations-Contact
+
+Ein _Operations-_Contact_ ist_ eine natürliche Person, die für einen Geschäftspartner technischer Ansprechpartner ist.
+
+Ein Seiteneffekt ist, dass diese Person im Ticketsystem Znuny direkt dem Geschäftspartner zugeordnet werden kann.
+
+Im Legacy System waren das die Kontakte mit der Rolle `operation` und `silent`.
+
+Implementiert ist der _Operations-Contact_ als eine besondere Form der [Relation](#Relation)
+der Person des _Operations-Contact_ (_Holder_) zur repräsentierten Person (_Anchor_) dargestellt.
+
+
+### OperationsAlert-Contact
+
+Ein _OperationsAlert-_Contact_ ist_ eine natürliche Person, die für einen Geschäftspartner bei technischen Probleme kontaktiert werden soll.
+
+Im Legacy System waren das die Kontakte mit der Rolle `operation`.
+
+Implementiert ist der _OperationsAlert-Contact_ als eine besondere Form der [Relation](#Relation)
+der Person des _OperationsAlert-Contact_ (_Holder_) zur repräsentierten Person (_Anchor_) dargestellt.
+
+
+### Subscriber-Contact
+
+Ein _Subscriber-_Contact_ ist_ eine natürliche Person, die für einen Geschäftspartner eine bestimmte Mailingliste abonniert.
+
+Implementiert ist der _Subscriber-Contact_ als eine besondere Form der [Relation](#Relation)
+der Person des _Subscriber-Contact_ (_Holder_) zur repräsentierten Person (_Anchor_) dargestellt.
+Zusätzlich wird diese Relation mit dem Kurznamen der abonnierten Mailingliste markiert.  
+
+
+#### Anchor / Relation-Anchor
+
+siehe [Relation](#Relation)
+
+
+#### Holder / Relation-Holder
+
+siehe [Relation](#Relation)
+
+
+#### API
+
+Und API (Application-Programming-Interface) verstehen wir eine über HTTPS angesprochene programmatisch bedienbare Schnittstell 
+zur Funktionalität des hsAdmin-NG-Systems.
--- a/doc/hs-office-data-structure.md
+++ b/doc/hs-office-data-structure.md
@ -64,7 +64,7 @@ classDiagram
    }

    class partner-MeierGmbH {
-        +Numeric partnerNumber: 12345
+        +Numeric partnerNumber: P-12345
        +Relation partnerRel
    }
    partner-MeierGmbH *-- rel-MeierGmbH
--- a/doc/scenarios/.template.html
+++ b/doc/scenarios/.template.html
@ -0,0 +1,124 @@
+<!doctype html>
+<html $if(lang)$ lang="$lang$" $endif$>
+<head>
+    
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+        <!--[if lt IE 9]>
+                <script src="http://css3-mediaqueries-js.googlecode.com/svn/trunk/css3-mediaqueries.js"></script>
+        <![endif]-->
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+    <meta http-equiv="Content-Style-Type" content="text/css" />
+
+    <!-- <link rel="stylesheet" type="text/css" href="template.css" /> -->
+    <link rel="stylesheet" type="text/css" href="https://cdn.jsdelivr.net/gh/diversen/pandoc-bootstrap-adaptive-template@959c3622/template.css" />
+
+    <link href="https://vjs.zencdn.net/5.4.4/video-js.css" rel="stylesheet" />
+
+    <script src="https://code.jquery.com/jquery-2.2.1.min.js"></script>
+    <!-- <script type='text/javascript' src='menu/js/jquery.cookie.js'></script> -->
+    <!-- <script type='text/javascript' src='menu/js/jquery.hoverIntent.minified.js'></script> -->
+    <!-- <script type='text/javascript' src='menu/js/jquery.dcjqaccordion.2.7.min.js'></script> -->
+
+    <!-- <link href="menu/css/skins/blue.css" rel="stylesheet" type="text/css" /> -->
+    <!-- <link href="menu/css/skins/graphite.css" rel="stylesheet" type="text/css" /> -->
+    <!-- <link href="menu/css/skins/grey.css" rel="stylesheet" type="text/css" /> -->
+  
+    <!-- <script src="https://cdn.mathjax.org/mathjax/latest/MathJax.js?config=TeX-AMS-MML_HTMLorMML"></script> -->
+        
+  
+    <!-- <script src="script.js"></script> -->
+  
+    <!-- <script src="jquery.sticky-kit.js "></script> -->
+    <script type='text/javascript' src='https://cdn.jsdelivr.net/gh/diversen/pandoc-bootstrap-adaptive-template@959c3622/menu/js/jquery.cookie.js'></script>
+    <script type='text/javascript' src='https://cdn.jsdelivr.net/gh/diversen/pandoc-bootstrap-adaptive-template@959c3622/menu/js/jquery.hoverIntent.minified.js'></script>
+    <script type='text/javascript' src='https://cdn.jsdelivr.net/gh/diversen/pandoc-bootstrap-adaptive-template@959c3622/menu/js/jquery.dcjqaccordion.2.7.min.js'></script>
+
+    <link href="https://cdn.jsdelivr.net/gh/diversen/pandoc-bootstrap-adaptive-template@959c3622/menu/css/skins/blue.css" rel="stylesheet" type="text/css" />
+    <link href="https://cdn.jsdelivr.net/gh/diversen/pandoc-bootstrap-adaptive-template@959c3622/menu/css/skins/graphite.css" rel="stylesheet" type="text/css" />
+    <link href="https://cdn.jsdelivr.net/gh/diversen/pandoc-bootstrap-adaptive-template@959c3622/menu/css/skins/grey.css" rel="stylesheet" type="text/css" />
+    <link href="https://cdn.jsdelivr.net/gh/ryangrose/easy-pandoc-templates@948e28e5/css/elegant_bootstrap.css" rel="stylesheet" type="text/css" />
+  
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/mathjax/2.7.4/MathJax.js?config=TeX-AMS-MML_HTMLorMML"></script>
+  
+    <script src="https://cdn.jsdelivr.net/gh/diversen/pandoc-bootstrap-adaptive-template@959c3622/script.js"></script>
+  
+    <script src="https://cdn.jsdelivr.net/gh/diversen/pandoc-bootstrap-adaptive-template@959c3622/jquery.sticky-kit.js"></script>
+    <meta name="generator" content="pandoc" />
+$for(author-meta)$
+  <meta name="author" content="$author-meta$" />
+$endfor$
+$if(date-meta)$
+  <meta name="date" content="$date-meta$" />
+$endif$
+  <title>$if(title-prefix)$$title-prefix$ - $endif$$pagetitle$</title>
+  <style type="text/css">code{white-space: pre;}</style>
+$if(quotes)$
+  <style type="text/css">q { quotes: "“" "”" "‘" "’"; }</style>
+$endif$
+$if(highlighting-css)$
+  <style type="text/css">
+$highlighting-css$
+  </style>
+$endif$
+$for(css)$
+  <link rel="stylesheet" href="$css$" $if(html5)$$else$type="text/css" $endif$/>
+$endfor$
+$if(math)$
+  $math$
+$endif$
+$for(header-includes)$
+  $header-includes$
+$endfor$
+</head>
+<body>
+
+    
+  $if(title)$
+  <div class="navbar navbar-static-top">
+    <div class="navbar-inner">
+      <div class="container">
+        <span class="doc-title">$title$</span>
+        <ul class="nav pull-right doc-info">
+          $for(author)$
+          <li><p class="navbar-text">$author$</p></li>
+          $endfor$
+          $if(date)$
+          <li><p class="navbar-text">$date$</p></li>
+          $endif$
+        </ul>
+      </div>
+    </div>
+  </div>
+  $endif$
+  <div class="container">
+    <div class="row">
+      $if(toc)$
+      <div id="$idprefix$TOC" class="span3">
+        <div class="well toc">
+
+        $toc$
+
+        </div>
+      </div>
+      $endif$
+      <div class="span$if(toc)$9$else$12$endif$">
+
+      $if(abstract)$
+          <H1>$abstract-title$</H1>
+          $abstract$
+      $endif$
+
+      $for(include-before)$
+      $include-before$
+      $endfor$
+$body$
+      $for(include-after)$
+      $include-after$
+      $endfor$
+      </div>
+    </div>
+  </div>
+  <script src="https://vjs.zencdn.net/5.4.4/video.js"></script>
+
+</body>
+</html>
--- a/doc/scenarios/README.txt
+++ b/doc/scenarios/README.txt
@ -0,0 +1 @@
+find the generated ScenarioReports in build/doc/scenarios
--- a/doc/test-concept.md
+++ b/doc/test-concept.md
@ -90,6 +90,20 @@ Acceptance-tests, are blackbox-tests and do <u>not</u> count into test-code-cove
 TODO.test: Complete the Acceptance-Tests test concept.


+#### Scenario-Tests
+
+Our Scenario-tests are induced by business use-cases.
+They test from the REST API all the way down to the database.
+
+Most scenario-tests are positive tests, they test if business scenarios do work.
+But few might be negative tests, which test if specific forbidden data gets rejected.
+
+Our scenario tests also generate test-reports which contain the REST-API calls needed for each scenario.
+These reports can be used as examples for the API usage from a business perspective.
+
+There is an extra document regarding scenario-test, see [Scenario-Tests README](../src/test/java/net/hostsharing/hsadminng/hs/office/scenarios/README.md). 
+
+
 #### Performance-Tests

 Performance-critical scenarios have to be identified and a special performance-test has to be implemented.
--- a/etc/allowed-licenses.json
+++ b/etc/allowed-licenses.json
@ -1,8 +1,10 @@
 {
    "allowedLicenses": [
-        { "moduleLicense": "Apache 2.0" },
        { "moduleLicense": "Apache 2" },
+        { "moduleLicense": "Apache 2.0" },
+        { "moduleLicense": "Apache-2.0" },
        { "moduleLicense": "Apache License 2.0" },
+        { "moduleLicense": "Apache License v2.0" },
        { "moduleLicense": "Apache License, Version 2.0" },
        { "moduleLicense": "The Apache Software License, Version 2.0" },

@ -11,6 +13,8 @@
        { "moduleLicense": "BSD-3-Clause" },
        { "moduleLicense": "The BSD License" },

+        { "moduleLicense": "The New BSD License" },
+
        { "moduleLicense": "CDDL 1.1" },
        { "moduleLicense": "CDDL/GPLv2+CE" },
        { "moduleLicense": "COMMON DEVELOPMENT AND DISTRIBUTION LICENSE (CDDL) Version 1.0" },
@ -29,11 +33,22 @@
        { "moduleLicense": "GNU General Public License, version 2 with the GNU Classpath Exception" },
        { "moduleLicense": "GPL2 w/ CPE" },

+        { "moduleLicense": "LGPL, version 2.1"},
+        { "moduleLicense": "LGPL-2.1-or-later"},
+
        { "moduleLicense": "MIT License" },
        { "moduleLicense": "MIT" },
        { "moduleLicense": "The MIT License (MIT)" },
        { "moduleLicense": "The MIT License" },

-        { "moduleName": "org.springdoc:springdoc-openapi" }
+        { "moduleLicense": "WTFPL" },
+
+        {
+            "moduleLicense": null,
+            "#moduleLicense": "Apache License 2.0, see https://github.com/springdoc/springdoc-openapi/blob/main/LICENSE",
+            "moduleVersion": "2.4.0",
+            "moduleName": "org.springdoc:springdoc-openapi"
+        }
+
    ]
 }
--- a/etc/jenkinsAgent.Dockerfile
+++ b/etc/jenkinsAgent.Dockerfile
@ -0,0 +1,6 @@
+FROM eclipse-temurin:21-jdk
+RUN apt-get update && \
+    apt-get install -y bind9-utils pandoc && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/*
+
--- a/etc/owasp-dependency-check-suppression.xml
+++ b/etc/owasp-dependency-check-suppression.xml
@ -1,12 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
-    <suppress>
-        <notes><![CDATA[
-           Cyclic references are not possible if file comes in JSON text format.
-       ]]></notes>
-        <packageUrl regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@.*$</packageUrl>
-        <cpe>cpe:/a:fasterxml:jackson-databind</cpe>
-    </suppress>
    <suppress>
        <notes><![CDATA[
           Internal tooling, not exposed to the Internet.
@ -14,4 +7,10 @@
        <packageUrl regex="true">^pkg:maven/org\.pitest/pitest\-command\-line@.*$</packageUrl>
        <cpe>cpe:/a:line:line</cpe>
    </suppress>
+    <suppress>
+        <notes><![CDATA[
+           Malicious HTTP redirect in JAXB on a REST-endpoint is not that dangerous.
+        ]]></notes>
+        <cve>CVE-2024-9329</cve>
+    </suppress>
 </suppressions>
--- a/src/main/java/net/hostsharing/hsadminng/config/JsonObjectMapperConfiguration.java
+++ b/src/main/java/net/hostsharing/hsadminng/config/JsonObjectMapperConfiguration.java
@ -1,6 +1,7 @@
 package net.hostsharing.hsadminng.config;

 import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.databind.DeserializationFeature;
 import com.fasterxml.jackson.databind.SerializationFeature;
 import com.fasterxml.jackson.datatype.jsr310.JavaTimeModule;
 import org.openapitools.jackson.nullable.JsonNullableModule;
@ -9,15 +10,20 @@ import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.Primary;
 import org.springframework.http.converter.json.Jackson2ObjectMapperBuilder;

+
@Configuration
 public class JsonObjectMapperConfiguration {

    @Bean
    @Primary
    public Jackson2ObjectMapperBuilder customObjectMapper() {
+        // HOWTO: add JSON converters and specify other JSON mapping configurations
        return new Jackson2ObjectMapperBuilder()
                .modules(new JsonNullableModule(), new JavaTimeModule())
-                .featuresToEnable(JsonParser.Feature.ALLOW_COMMENTS)
+                .featuresToEnable(
+                        JsonParser.Feature.ALLOW_COMMENTS,
+                        DeserializationFeature.USE_BIG_DECIMAL_FOR_FLOATS
+                )
                .featuresToDisable(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS);
    }
 }
--- a/src/main/java/net/hostsharing/hsadminng/errors/CustomErrorResponse.java
+++ b/src/main/java/net/hostsharing/hsadminng/errors/CustomErrorResponse.java
@ -46,6 +46,7 @@ public class CustomErrorResponse {
        this.path = path;
        this.statusCode = status.value();
        this.statusPhrase = status.getReasonPhrase();
+        // HOWTO: debug serverside error response - set a breakpoint here
        this.message = message.startsWith("ERROR: [") ? message : "ERROR: [" + statusCode + "] " + message;
    }
 }
--- a/src/main/java/net/hostsharing/hsadminng/hash/HashGenerator.java
+++ b/src/main/java/net/hostsharing/hsadminng/hash/HashGenerator.java
@ -27,7 +27,7 @@ public final class HashGenerator {
            "abcdefghijklmnopqrstuvwxyz" +
                    "ABCDEFGHIJKLMNOPQRSTUVWXYZ" +
                    "0123456789/.";
-    private static boolean couldBeHashEnabled; // TODO.impl: remove after legacy data is migrated
+    private static boolean couldBeHashEnabled; // TODO.legacy: remove after legacy data is migrated

    public enum Algorithm {
        LINUX_SHA512(LinuxEtcShadowHashGenerator::hash, "6"),
--- a/src/main/java/net/hostsharing/hsadminng/hs/booking/debitor/HsBookingDebitorEntity.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/booking/debitor/HsBookingDebitorEntity.java
@ -5,8 +5,8 @@ import lombok.Builder;
 import lombok.Getter;
 import lombok.NoArgsConstructor;
 import net.hostsharing.hsadminng.errors.DisplayAs;
-import net.hostsharing.hsadminng.stringify.Stringify;
-import net.hostsharing.hsadminng.stringify.Stringifyable;
+import net.hostsharing.hsadminng.repr.Stringify;
+import net.hostsharing.hsadminng.repr.Stringifyable;

 import jakarta.persistence.Column;
 import jakarta.persistence.Entity;
@ -14,7 +14,7 @@ import jakarta.persistence.Id;
 import jakarta.persistence.Table;
 import java.util.UUID;

-import static net.hostsharing.hsadminng.stringify.Stringify.stringify;
+import static net.hostsharing.hsadminng.repr.Stringify.stringify;

 // a partial HsOfficeDebitorEntity to reduce the number of SQL queries to load the entity
@Entity
--- a/src/main/java/net/hostsharing/hsadminng/hs/booking/item/BookingItemCreatedAppEvent.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/booking/item/BookingItemCreatedAppEvent.java
@ -0,0 +1,20 @@
+package net.hostsharing.hsadminng.hs.booking.item;
+
+import lombok.Getter;
+import org.springframework.context.ApplicationEvent;
+
+import jakarta.validation.constraints.NotNull;
+
+@Getter
+public class BookingItemCreatedAppEvent extends ApplicationEvent {
+
+    private BookingItemCreatedEventEntity entity;
+
+    public BookingItemCreatedAppEvent(
+            @NotNull final Object source,
+            @NotNull final HsBookingItemRealEntity newBookingItem,
+            final String assetJson) {
+        super(source);
+        this.entity = new BookingItemCreatedEventEntity(newBookingItem, assetJson);
+    }
+}
--- a/src/main/java/net/hostsharing/hsadminng/hs/booking/item/BookingItemCreatedEventEntity.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/booking/item/BookingItemCreatedEventEntity.java
@ -0,0 +1,55 @@
+package net.hostsharing.hsadminng.hs.booking.item;
+
+import lombok.Getter;
+import lombok.NoArgsConstructor;
+import lombok.Setter;
+import lombok.ToString;
+import lombok.experimental.SuperBuilder;
+import net.hostsharing.hsadminng.persistence.BaseEntity;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.Id;
+import jakarta.persistence.JoinColumn;
+import jakarta.persistence.ManyToOne;
+import jakarta.persistence.MapsId;
+import jakarta.persistence.Table;
+import jakarta.persistence.Version;
+import jakarta.validation.constraints.NotNull;
+import java.util.UUID;
+
+
+
+@Entity
+@Table(schema = "hs_booking", name = "item_created_event")
+@SuperBuilder(toBuilder = true)
+@Getter
+@ToString
+@NoArgsConstructor
+public class BookingItemCreatedEventEntity implements BaseEntity {
+    @Id
+    @Column(name="bookingitemuuid")
+    private UUID uuid;
+
+    @MapsId
+    @ManyToOne(optional = false)
+    @JoinColumn(name = "bookingitemuuid", nullable = false)
+    private HsBookingItemRealEntity bookingItem;
+
+    @Version
+    private int version;
+
+    @Column(name = "assetjson")
+    private String assetJson;
+
+    @Setter
+    @Column(name = "statusmessage")
+    private String statusMessage;
+
+    public BookingItemCreatedEventEntity(
+            @NotNull final HsBookingItemRealEntity newBookingItem,
+            final String assetJson) {
+        this.bookingItem = newBookingItem;
+        this.assetJson = assetJson;
+    }
+}
--- a/src/main/java/net/hostsharing/hsadminng/hs/booking/item/BookingItemCreatedEventRepository.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/booking/item/BookingItemCreatedEventRepository.java
@ -0,0 +1,12 @@
+package net.hostsharing.hsadminng.hs.booking.item;
+
+import org.springframework.data.repository.Repository;
+
+import java.util.UUID;
+
+public interface BookingItemCreatedEventRepository extends Repository<BookingItemCreatedEventEntity, UUID> {
+
+    BookingItemCreatedEventEntity save(HsBookingItemRealEntity current);
+
+    BookingItemCreatedEventEntity findByBookingItem(HsBookingItemRealEntity newBookingItem);
+}
--- a/src/main/java/net/hostsharing/hsadminng/hs/booking/item/HsBookingItem.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/booking/item/HsBookingItem.java
@ -14,9 +14,9 @@ import net.hostsharing.hsadminng.hs.booking.project.HsBookingProject;
 import net.hostsharing.hsadminng.hs.booking.project.HsBookingProjectRealEntity;
 import net.hostsharing.hsadminng.hs.validation.PropertiesProvider;
 import net.hostsharing.hsadminng.mapper.PatchableMapWrapper;
-import net.hostsharing.hsadminng.rbac.object.BaseEntity;
-import net.hostsharing.hsadminng.stringify.Stringify;
-import net.hostsharing.hsadminng.stringify.Stringifyable;
+import net.hostsharing.hsadminng.persistence.BaseEntity;
+import net.hostsharing.hsadminng.repr.Stringify;
+import net.hostsharing.hsadminng.repr.Stringifyable;
 import org.hibernate.annotations.Type;

 import jakarta.persistence.CascadeType;
@ -45,7 +45,7 @@ import static java.util.Optional.ofNullable;
 import static net.hostsharing.hsadminng.mapper.PostgresDateRange.lowerInclusiveFromPostgresDateRange;
 import static net.hostsharing.hsadminng.mapper.PostgresDateRange.toPostgresDateRange;
 import static net.hostsharing.hsadminng.mapper.PostgresDateRange.upperInclusiveFromPostgresDateRange;
-import static net.hostsharing.hsadminng.stringify.Stringify.stringify;
+import static net.hostsharing.hsadminng.repr.Stringify.stringify;

@MappedSuperclass
@Getter
--- a/src/main/java/net/hostsharing/hsadminng/hs/booking/item/HsBookingItemController.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/booking/item/HsBookingItemController.java
@ -1,5 +1,7 @@
 package net.hostsharing.hsadminng.hs.booking.item;

+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.ObjectMapper;
 import net.hostsharing.hsadminng.context.Context;
 import net.hostsharing.hsadminng.hs.booking.generated.api.v1.api.HsBookingItemsApi;
 import net.hostsharing.hsadminng.hs.booking.generated.api.v1.model.HsBookingItemInsertResource;
@ -12,6 +14,7 @@ import net.hostsharing.hsadminng.mapper.KeyValueMap;
 import net.hostsharing.hsadminng.mapper.StrictMapper;
 import net.hostsharing.hsadminng.persistence.EntityManagerWrapper;
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.ApplicationEventPublisher;
 import org.springframework.http.ResponseEntity;
 import org.springframework.transaction.annotation.Transactional;
 import org.springframework.web.bind.annotation.RestController;
@ -22,6 +25,7 @@ import java.util.List;
 import java.util.UUID;
 import java.util.function.BiConsumer;

+import static java.util.Optional.ofNullable;
 import static net.hostsharing.hsadminng.mapper.PostgresDateRange.toPostgresDateRange;

@RestController
@ -33,9 +37,15 @@ public class HsBookingItemController implements HsBookingItemsApi {
    @Autowired
    private StrictMapper mapper;

+    @Autowired
+    private ApplicationEventPublisher applicationEventPublisher;
+
    @Autowired
    private HsBookingItemRbacRepository bookingItemRepo;

+    @Autowired
+    private ObjectMapper jsonMapper;
+
    @Autowired
    private EntityManagerWrapper em;

@ -63,7 +73,8 @@ public class HsBookingItemController implements HsBookingItemsApi {
        context.define(currentSubject, assumedRoles);

        final var entityToSave = mapper.map(body, HsBookingItemRbacEntity.class, RESOURCE_TO_ENTITY_POSTMAPPER);
-        final var mapped = new BookingItemEntitySaveProcessor(em, entityToSave)
+        final var saveProcessor = new BookingItemEntitySaveProcessor(em, entityToSave);
+        final var mapped = saveProcessor
                .preprocessEntity()
                .validateEntity()
                .prepareForSave()
@ -71,6 +82,7 @@ public class HsBookingItemController implements HsBookingItemsApi {
                .validateContext()
                .mapUsing(e -> mapper.map(e, HsBookingItemResource.class, ITEM_TO_RESOURCE_POSTMAPPER))
                .revampProperties();
+        publishSavedEvent(saveProcessor, body);

        final var uri =
                MvcUriComponentsBuilder.fromController(getClass())
@ -130,6 +142,16 @@ public class HsBookingItemController implements HsBookingItemsApi {
        return ResponseEntity.ok(mapped);
    }

+    private void publishSavedEvent(final BookingItemEntitySaveProcessor saveProcessor, final HsBookingItemInsertResource body) {
+        try {
+            final var bookingItemRealEntity = em.getReference(HsBookingItemRealEntity.class, saveProcessor.getEntity().getUuid());
+            applicationEventPublisher.publishEvent(new BookingItemCreatedAppEvent(
+                    this, bookingItemRealEntity, jsonMapper.writeValueAsString(body.getHostingAsset())));
+        } catch (JsonProcessingException e) {
+            throw new RuntimeException(e);
+        }
+    }
+
    final BiConsumer<HsBookingItem, HsBookingItemResource> ITEM_TO_RESOURCE_POSTMAPPER = (entity, resource) -> {
        resource.setValidFrom(entity.getValidity().lower());
        if (entity.getValidity().hasUpperBound()) {
@ -141,6 +163,9 @@ public class HsBookingItemController implements HsBookingItemsApi {

    final BiConsumer<HsBookingItemInsertResource, HsBookingItemRbacEntity> RESOURCE_TO_ENTITY_POSTMAPPER = (resource, entity) -> {
        entity.setProject(em.find(HsBookingProjectRealEntity.class, resource.getProjectUuid()));
+        ofNullable(resource.getParentItemUuid())
+                .map(parentItemUuid -> em.find(HsBookingItemRealEntity.class, parentItemUuid))
+                .ifPresent(entity::setParentItem);
        entity.setValidity(toPostgresDateRange(LocalDate.now(), resource.getValidTo()));
        entity.putResources(KeyValueMap.from(resource.getResources()));
    };
--- a/src/main/java/net/hostsharing/hsadminng/hs/booking/item/validators/BookingItemEntitySaveProcessor.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/booking/item/validators/BookingItemEntitySaveProcessor.java
@ -1,5 +1,6 @@
 package net.hostsharing.hsadminng.hs.booking.item.validators;

+import lombok.Getter;
 import net.hostsharing.hsadminng.errors.MultiValidationException;
 import net.hostsharing.hsadminng.hs.booking.generated.api.v1.model.HsBookingItemResource;
 import net.hostsharing.hsadminng.hs.booking.item.HsBookingItem;
@ -20,7 +21,11 @@ public class BookingItemEntitySaveProcessor {
    private final HsEntityValidator<HsBookingItem> validator;
    private String expectedStep = "preprocessEntity";
    private final EntityManager em;
+
+    @Getter
    private HsBookingItem entity;
+
+    @Getter
    private HsBookingItemResource resource;

    public BookingItemEntitySaveProcessor(final EntityManager em, final HsBookingItem entity) {
@ -43,7 +48,7 @@ public class BookingItemEntitySaveProcessor {
        return this;
    }

-    // TODO.impl: remove once the migration of legacy data is done
+    // TODO.legacy: remove once the migration of legacy data is done
    /// validates the entity itself including its properties, but ignoring some error messages for import of legacy data
    public BookingItemEntitySaveProcessor validateEntityIgnoring(final String... ignoreRegExp) {
        step("validateEntity", "prepareForSave");
--- a/src/main/java/net/hostsharing/hsadminng/hs/booking/item/validators/HsDomainSetupBookingItemValidator.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/booking/item/validators/HsDomainSetupBookingItemValidator.java
@ -13,27 +13,21 @@ import static net.hostsharing.hsadminng.hs.hosting.asset.validators.Dns.REGISTRA
 import static net.hostsharing.hsadminng.hs.validation.StringProperty.stringProperty;

 class HsDomainSetupBookingItemValidator extends HsBookingItemEntityValidator {
+    public static final String DOMAIN_NAME_PROPERTY_NAME = "domainName";

    public static final String FQDN_REGEX = "^((?!-)[A-Za-z0-9-]{1,63}(?<!-)\\.)+[A-Za-z]{2,12}";
-    public static final String DOMAIN_NAME_PROPERTY_NAME = "domainName";
-    public static final String TARGET_UNIX_USER_PROPERTY_NAME = "targetUnixUser";
    public static final String WEBSPACE_NAME_REGEX = "[a-z][a-z0-9]{2}[0-9]{2}";
    public static final String TARGET_UNIX_USER_NAME_REGEX = "^"+WEBSPACE_NAME_REGEX+"$|^"+WEBSPACE_NAME_REGEX+"-[a-z0-9\\._-]+$";
    public static final String VERIFICATION_CODE_PROPERTY_NAME = "verificationCode";

    HsDomainSetupBookingItemValidator() {
        super(
+                // TODO.spec: feels wrong
                stringProperty(DOMAIN_NAME_PROPERTY_NAME).writeOnce()
                        .maxLength(253)
                        .matchesRegEx(FQDN_REGEX).describedAs("is not a (non-top-level) fully qualified domain name")
                        .notMatchesRegEx(REGISTRAR_LEVEL_DOMAINS).describedAs("is a forbidden registrar-level domain name")
                        .required(),
-                // TODO.legacy: remove the following property once we give up legacy compatibility
-                stringProperty(TARGET_UNIX_USER_PROPERTY_NAME).writeOnce()
-                        .maxLength(253)
-                        .matchesRegEx(TARGET_UNIX_USER_NAME_REGEX).describedAs("is not a valid unix-user name")
-                        .writeOnce()
-                        .required(),
                stringProperty(VERIFICATION_CODE_PROPERTY_NAME)
                        .minLength(12)
                        .maxLength(64)
@ -55,6 +49,11 @@ class HsDomainSetupBookingItemValidator extends HsBookingItemEntityValidator {
    }

    private static String generateVerificationCode(final EntityManager em, final PropertiesProvider propertiesProvider) {
+        final var userDefinedVerificationCode = propertiesProvider.getDirectValue(VERIFICATION_CODE_PROPERTY_NAME, String.class);
+        if (userDefinedVerificationCode != null) {
+            return userDefinedVerificationCode;
+        }
+
        final var alphaNumeric = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
        final var secureRandom = new SecureRandom();
        final var sb = new StringBuilder();
--- a/src/main/java/net/hostsharing/hsadminng/hs/booking/project/HsBookingProject.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/booking/project/HsBookingProject.java
@ -3,31 +3,15 @@ package net.hostsharing.hsadminng.hs.booking.project;
 import lombok.*;
 import lombok.experimental.SuperBuilder;
 import net.hostsharing.hsadminng.hs.booking.debitor.HsBookingDebitorEntity;
-import net.hostsharing.hsadminng.hs.office.debitor.HsOfficeDebitorEntity;
-import net.hostsharing.hsadminng.hs.office.relation.HsOfficeRelationRbacEntity;
-import net.hostsharing.hsadminng.rbac.generator.RbacView;
-import net.hostsharing.hsadminng.rbac.generator.RbacView.SQL;
-import net.hostsharing.hsadminng.rbac.object.BaseEntity;
-import net.hostsharing.hsadminng.stringify.Stringify;
-import net.hostsharing.hsadminng.stringify.Stringifyable;
+import net.hostsharing.hsadminng.persistence.BaseEntity;
+import net.hostsharing.hsadminng.repr.Stringify;
+import net.hostsharing.hsadminng.repr.Stringifyable;

 import jakarta.persistence.*;
-import java.io.IOException;
 import java.util.UUID;

 import static java.util.Optional.ofNullable;
-import static net.hostsharing.hsadminng.hs.office.relation.HsOfficeRelationType.DEBITOR;
-import static net.hostsharing.hsadminng.rbac.generator.RbacView.Column.dependsOnColumn;
-import static net.hostsharing.hsadminng.rbac.generator.RbacView.ColumnValue.usingCase;
-import static net.hostsharing.hsadminng.rbac.generator.RbacView.ColumnValue.usingDefaultCase;
-import static net.hostsharing.hsadminng.rbac.generator.RbacView.GLOBAL;
-import static net.hostsharing.hsadminng.rbac.generator.RbacView.Nullable.NOT_NULL;
-import static net.hostsharing.hsadminng.rbac.generator.RbacView.Permission.*;
-import static net.hostsharing.hsadminng.rbac.generator.RbacView.Role.*;
-import static net.hostsharing.hsadminng.rbac.generator.RbacView.SQL.directlyFetchedByDependsOnColumn;
-import static net.hostsharing.hsadminng.rbac.generator.RbacView.SQL.fetchedBySql;
-import static net.hostsharing.hsadminng.rbac.generator.RbacView.rbacViewFor;
-import static net.hostsharing.hsadminng.stringify.Stringify.stringify;
+import static net.hostsharing.hsadminng.repr.Stringify.stringify;

@MappedSuperclass
@Getter
@ -66,50 +50,4 @@ public abstract class HsBookingProject implements Stringifyable, BaseEntity<HsBo
        return ofNullable(debitor).map(HsBookingDebitorEntity::toShortString).orElse("D-???????") +
                ":" + caption;
    }
-
-    public static RbacView rbac() {
-        return rbacViewFor("project", HsBookingProjectRbacEntity.class)
-                .withIdentityView(SQL.query("""
-                        SELECT bookingProject.uuid as uuid, debitorIV.idName || '-' || base.cleanIdentifier(bookingProject.caption) as idName
-                            FROM hs_booking.project bookingProject
-                            JOIN hs_office.debitor_iv debitorIV ON debitorIV.uuid = bookingProject.debitorUuid
-                        """))
-                .withRestrictedViewOrderBy(SQL.expression("caption"))
-                .withUpdatableColumns("version", "caption")
-
-                .importEntityAlias("debitor", HsOfficeDebitorEntity.class, usingDefaultCase(),
-                        dependsOnColumn("debitorUuid"),
-                        directlyFetchedByDependsOnColumn(),
-                        NOT_NULL)
-
-                .importEntityAlias("debitorRel", HsOfficeRelationRbacEntity.class, usingCase(DEBITOR),
-                        dependsOnColumn("debitorUuid"),
-                        fetchedBySql("""
-                                SELECT ${columns}
-                                    FROM hs_office.relation debitorRel
-                                    JOIN hs_office.debitor debitor ON debitor.debitorRelUuid = debitorRel.uuid
-                                    WHERE debitor.uuid = ${REF}.debitorUuid
-                                """),
-                        NOT_NULL)
-                .toRole("debitorRel", ADMIN).grantPermission(INSERT)
-                .toRole(GLOBAL, ADMIN).grantPermission(DELETE)
-
-                .createRole(OWNER, (with) -> {
-                    with.incomingSuperRole("debitorRel", AGENT).unassumed();
-                })
-                .createSubRole(ADMIN, (with) -> {
-                    with.permission(UPDATE);
-                })
-                .createSubRole(AGENT)
-                .createSubRole(TENANT, (with) -> {
-                    with.outgoingSubRole("debitorRel", TENANT);
-                    with.permission(SELECT);
-                })
-
-                .limitDiagramTo("project", "debitorRel", "rbac.global");
-    }
-
-    public static void main(String[] args) throws IOException {
-        rbac().generateWithBaseFileName("6-hs-booking/620-booking-project/6203-hs-booking-project-rbac");
-    }
 }
--- a/src/main/java/net/hostsharing/hsadminng/hs/hosting/asset/HsHostingAsset.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/hosting/asset/HsHostingAsset.java
@ -14,9 +14,9 @@ import net.hostsharing.hsadminng.hs.booking.project.HsBookingProject;
 import net.hostsharing.hsadminng.hs.office.contact.HsOfficeContactRealEntity;
 import net.hostsharing.hsadminng.hs.validation.PropertiesProvider;
 import net.hostsharing.hsadminng.mapper.PatchableMapWrapper;
-import net.hostsharing.hsadminng.rbac.object.BaseEntity;
-import net.hostsharing.hsadminng.stringify.Stringify;
-import net.hostsharing.hsadminng.stringify.Stringifyable;
+import net.hostsharing.hsadminng.persistence.BaseEntity;
+import net.hostsharing.hsadminng.repr.Stringify;
+import net.hostsharing.hsadminng.repr.Stringifyable;
 import org.hibernate.annotations.Type;

 import jakarta.persistence.CascadeType;
@ -42,7 +42,7 @@ import java.util.Optional;
 import java.util.UUID;

 import static java.util.Collections.emptyMap;
-import static net.hostsharing.hsadminng.stringify.Stringify.stringify;
+import static net.hostsharing.hsadminng.repr.Stringify.stringify;

@MappedSuperclass
@Getter
@ -89,10 +89,9 @@ public abstract class HsHostingAsset implements Stringifyable, BaseEntity<HsHost
    @JoinColumn(name = "alarmcontactuuid")
    private HsOfficeContactRealEntity alarmContact;

-    @Builder.Default
    @OneToMany(cascade = CascadeType.REFRESH, orphanRemoval = true, fetch = FetchType.LAZY)
    @JoinColumn(name = "parentassetuuid", referencedColumnName = "uuid")
-    private List<HsHostingAssetRealEntity> subHostingAssets = new ArrayList<>();
+    private List<HsHostingAssetRealEntity> subHostingAssets;

    @Column(name = "identifier")
    private String identifier; // e.g. vm1234, xyz00, example.org, xyz00_abc
@ -125,6 +124,13 @@ public abstract class HsHostingAsset implements Stringifyable, BaseEntity<HsHost
        PatchableMapWrapper.of(configWrapper, (newWrapper) -> {configWrapper = newWrapper;}, config).assign(newConfig);
    }

+    public List<HsHostingAssetRealEntity> getSubHostingAssets() {
+        if (subHostingAssets == null) {
+            subHostingAssets = new ArrayList<>();
+        }
+        return subHostingAssets;
+    }
+
    @Override
    public PatchableMapWrapper<Object> directProps() {
        return getConfig();
--- a/src/main/java/net/hostsharing/hsadminng/hs/hosting/asset/HsHostingAssetRealRepository.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/hosting/asset/HsHostingAssetRealRepository.java
@ -3,6 +3,7 @@ package net.hostsharing.hsadminng.hs.hosting.asset;
 import org.springframework.data.jpa.repository.Query;
 import org.springframework.data.repository.Repository;

+import jakarta.validation.constraints.NotNull;
 import java.util.List;
 import java.util.Optional;
 import java.util.UUID;
@ -13,6 +14,18 @@ public interface HsHostingAssetRealRepository extends HsHostingAssetRepository<H

    List<HsHostingAssetRealEntity> findByIdentifier(String assetIdentifier);

+    default List<HsHostingAssetRealEntity> findByTypeAndIdentifier(@NotNull HsHostingAssetType type,  @NotNull String identifier) {
+        return findByTypeAndIdentifierImpl(type.name(), identifier);
+    }
+
+    @Query("""
+            select ha
+              from HsHostingAssetRealEntity ha
+             where cast(ha.type as String) = :type
+               and ha.identifier = :identifier
+            """)
+    List<HsHostingAssetRealEntity> findByTypeAndIdentifierImpl(@NotNull String type, @NotNull String identifier);
+
    @Query(value = """
        select ha.uuid,
               ha.alarmcontactuuid,
--- a/src/main/java/net/hostsharing/hsadminng/hs/hosting/asset/factories/DomainSetupHostingAssetFactory.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/hosting/asset/factories/DomainSetupHostingAssetFactory.java
@ -0,0 +1,159 @@
+package net.hostsharing.hsadminng.hs.hosting.asset.factories;
+
+import net.hostsharing.hsadminng.hs.booking.generated.api.v1.model.HsHostingAssetAutoInsertResource;
+import net.hostsharing.hsadminng.hs.booking.generated.api.v1.model.HsHostingAssetSubInsertResource;
+import net.hostsharing.hsadminng.hs.booking.generated.api.v1.model.HsHostingAssetTypeResource;
+import net.hostsharing.hsadminng.hs.booking.item.HsBookingItemRealEntity;
+import net.hostsharing.hsadminng.hs.hosting.asset.HsHostingAsset;
+import net.hostsharing.hsadminng.hs.hosting.asset.HsHostingAssetRealEntity;
+import net.hostsharing.hsadminng.hs.hosting.asset.HsHostingAssetType;
+import net.hostsharing.hsadminng.hs.office.contact.HsOfficeContactRealEntity;
+import net.hostsharing.hsadminng.lambda.Reducer;
+import net.hostsharing.hsadminng.mapper.StandardMapper;
+import net.hostsharing.hsadminng.mapper.ToStringConverter;
+import net.hostsharing.hsadminng.persistence.EntityManagerWrapper;
+
+import jakarta.validation.ValidationException;
+import java.net.IDN;
+import java.util.List;
+import java.util.Optional;
+import java.util.UUID;
+import java.util.function.Function;
+
+import static net.hostsharing.hsadminng.hs.hosting.asset.HsHostingAssetType.DOMAIN_DNS_SETUP;
+import static net.hostsharing.hsadminng.hs.hosting.asset.HsHostingAssetType.DOMAIN_HTTP_SETUP;
+import static net.hostsharing.hsadminng.hs.hosting.asset.HsHostingAssetType.DOMAIN_MBOX_SETUP;
+import static net.hostsharing.hsadminng.hs.hosting.asset.HsHostingAssetType.DOMAIN_SMTP_SETUP;
+
+public class DomainSetupHostingAssetFactory extends HostingAssetFactory {
+
+    public DomainSetupHostingAssetFactory(
+            final EntityManagerWrapper emw,
+            final HsBookingItemRealEntity newBookingItemRealEntity,
+            final HsHostingAssetAutoInsertResource asset,
+            final StandardMapper standardMapper) {
+        super(emw, newBookingItemRealEntity, asset, standardMapper);
+    }
+
+    @Override
+    protected HsHostingAsset create() {
+        final var domainSetupAsset = createDomainSetupAsset(getDomainName());
+        final var subHostingAssets = domainSetupAsset.getSubHostingAssets();
+
+        // TODO.legacy: as long as we need to be compatible, we always do all technical domain-setups
+
+        final var domainHttpSetupAssetResource = findSubHostingAssetResource(HsHostingAssetTypeResource.DOMAIN_HTTP_SETUP);
+        final var assignedToUnixUserAssetEntity = domainHttpSetupAssetResource
+                .map(HsHostingAssetSubInsertResource::getAssignedToAssetUuid)
+                .map(uuid -> emw.find(HsHostingAssetRealEntity.class, uuid))
+                .orElseThrow(() -> new ValidationException("DOMAIN_HTTP_SETUP subAsset with assignedToAssetUuid required in compatibility mode"));
+
+        subHostingAssets.add(
+                createDomainSubSetupAssetEntity(
+                        domainSetupAsset,
+                        DOMAIN_HTTP_SETUP,
+                        builder -> builder
+                                .assignedToAsset(assignedToUnixUserAssetEntity)
+                                .identifier(getDomainName() + "|HTTP")
+                                .caption("HTTP-Setup für " + IDN.toUnicode(getDomainName())))
+        );
+
+        // Do not add to subHostingAssets in compatibility mode, in this case, DNS setup works via file system.
+        // The entity is created just for validation purposes.
+        createDomainSubSetupAssetEntity(
+                domainSetupAsset,
+                DOMAIN_DNS_SETUP,
+                builder -> builder
+                        .assignedToAsset(assignedToUnixUserAssetEntity.getParentAsset())
+                        .identifier(getDomainName() + "|DNS")
+                        .caption("DNS-Setup für " + IDN.toUnicode(getDomainName())));
+
+        subHostingAssets.add(
+            createDomainSubSetupAssetEntity(
+                    domainSetupAsset,
+                    DOMAIN_MBOX_SETUP,
+                    builder -> builder
+                            .assignedToAsset(assignedToUnixUserAssetEntity.getParentAsset())
+                            .identifier(getDomainName() + "|MBOX")
+                            .caption("MBOX-Setup für " + IDN.toUnicode(getDomainName())))
+        );
+
+        subHostingAssets.add(
+            createDomainSubSetupAssetEntity(
+                    domainSetupAsset,
+                    DOMAIN_SMTP_SETUP,
+                    builder -> builder
+                            .assignedToAsset(assignedToUnixUserAssetEntity.getParentAsset())
+                            .identifier(getDomainName() + "|SMTP")
+                            .caption("SMTP-Setup für " + IDN.toUnicode(getDomainName())))
+        );
+
+        return domainSetupAsset;
+    }
+
+    private HsHostingAssetRealEntity createDomainSetupAsset(final String domainName) {
+        return HsHostingAssetRealEntity.builder()
+                .bookingItem(fromBookingItem)
+                .type(HsHostingAssetType.DOMAIN_SETUP)
+                .identifier(domainName)
+                .caption(asset.getCaption() != null ? asset.getCaption() : domainName)
+                .alarmContact(ref(HsOfficeContactRealEntity.class, asset.getAlarmContactUuid()))
+                // the sub-hosting-assets get added later
+                .build();
+    }
+
+    private HsHostingAssetRealEntity createDomainSubSetupAssetEntity(
+            final HsHostingAssetRealEntity domainSetupAsset,
+            final HsHostingAssetType subAssetType,
+            final Function<HsHostingAssetRealEntity.HsHostingAssetRealEntityBuilder<?, ?>, HsHostingAssetRealEntity.HsHostingAssetRealEntityBuilder<?, ?>> builderTransformer) {
+        final var resourceType = HsHostingAssetTypeResource.valueOf(subAssetType.name());
+
+        final var subAssetResourceOptional = findSubHostingAssetResource(resourceType);
+
+        subAssetResourceOptional.ifPresentOrElse(
+            this::verifyNotOverspecified,
+            () -> { throw new ValidationException("sub-asset of type " + resourceType.name() + " required in legacy mode, but missing"); }
+        );
+
+        return builderTransformer.apply(
+                        HsHostingAssetRealEntity.builder()
+                                .type(subAssetType)
+                                .parentAsset(domainSetupAsset))
+                .build();
+    }
+
+    private Optional<HsHostingAssetSubInsertResource> findSubHostingAssetResource(final HsHostingAssetTypeResource resourceType) {
+        return getSubHostingAssetResources().stream()
+                .filter(ha -> ha.getType() == resourceType)
+                .reduce(Reducer::toSingleElement);
+    }
+
+    // TODO.legacy: while we need to stay compatible, only default values can be used, thus only the type can be specified
+    private void verifyNotOverspecified(final HsHostingAssetSubInsertResource givenSubAssetResource) {
+        final var convert = new ToStringConverter().ignoring("assignedToAssetUuid");
+        final var expectedSubAssetResource = new HsHostingAssetSubInsertResource();
+        expectedSubAssetResource.setType(givenSubAssetResource.getType());
+        if ( !convert.from(givenSubAssetResource).equals(convert.from(expectedSubAssetResource)) ) {
+            throw new ValidationException("sub asset " + givenSubAssetResource.getType() + " is over-specified, in compatibility mode, only default values allowed");
+        }
+
+    }
+
+    private String getDomainName() {
+        return asset.getIdentifier();
+    }
+
+    private List<HsHostingAssetSubInsertResource> getSubHostingAssetResources() {
+        return asset.getSubHostingAssets();
+    }
+
+    @Override
+    protected void persist(final HsHostingAsset newHostingAsset) {
+        super.persist(newHostingAsset);
+        newHostingAsset.getSubHostingAssets().forEach(super::persist);
+    }
+
+    private <T> T ref(final Class<T> entityClass, final UUID uuid) {
+        return uuid != null ? emw.getReference(entityClass, uuid) : null;
+    }
+}
--- a/src/main/java/net/hostsharing/hsadminng/hs/hosting/asset/factories/HostingAssetFactory.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/hosting/asset/factories/HostingAssetFactory.java
@ -0,0 +1,41 @@
+package net.hostsharing.hsadminng.hs.hosting.asset.factories;
+
+import jakarta.validation.ValidationException;
+import lombok.RequiredArgsConstructor;
+import net.hostsharing.hsadminng.hs.booking.generated.api.v1.model.HsHostingAssetAutoInsertResource;
+import net.hostsharing.hsadminng.hs.booking.item.HsBookingItemRealEntity;
+import net.hostsharing.hsadminng.hs.hosting.asset.HsHostingAsset;
+import net.hostsharing.hsadminng.hs.hosting.asset.validators.HostingAssetEntitySaveProcessor;
+import net.hostsharing.hsadminng.mapper.StandardMapper;
+import net.hostsharing.hsadminng.persistence.EntityManagerWrapper;
+
+
+@RequiredArgsConstructor
+abstract class HostingAssetFactory {
+
+    final EntityManagerWrapper emw;
+    final HsBookingItemRealEntity fromBookingItem;
+    final HsHostingAssetAutoInsertResource asset;
+    final StandardMapper standardMapper;
+
+    protected abstract HsHostingAsset create();
+
+    public String createAndPersist() {
+        try {
+            final HsHostingAsset newHostingAsset = create();
+            persist(newHostingAsset);
+            return null;
+        } catch (final ValidationException exc) {
+            return exc.getMessage();
+        }
+    }
+
+    protected void persist(final HsHostingAsset newHostingAsset) {
+        new HostingAssetEntitySaveProcessor(emw, newHostingAsset)
+                .preprocessEntity()
+                .validateEntity()
+                .prepareForSave()
+                .save()
+                .validateContext();
+    }
+}
--- a/src/main/java/net/hostsharing/hsadminng/hs/hosting/asset/factories/HsBookingItemCreatedListener.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/hosting/asset/factories/HsBookingItemCreatedListener.java
@ -0,0 +1,76 @@
+package net.hostsharing.hsadminng.hs.hosting.asset.factories;
+
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import jakarta.validation.ValidationException;
+import jakarta.validation.constraints.NotNull;
+import lombok.SneakyThrows;
+import net.hostsharing.hsadminng.hs.booking.generated.api.v1.model.HsHostingAssetAutoInsertResource;
+import net.hostsharing.hsadminng.hs.booking.item.BookingItemCreatedAppEvent;
+import net.hostsharing.hsadminng.hs.booking.item.HsBookingItemRealEntity;
+import net.hostsharing.hsadminng.hs.hosting.asset.HsHostingAsset;
+import net.hostsharing.hsadminng.mapper.StandardMapper;
+import net.hostsharing.hsadminng.persistence.EntityManagerWrapper;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.ApplicationListener;
+import org.springframework.stereotype.Component;
+
+@Component
+public class HsBookingItemCreatedListener implements ApplicationListener<BookingItemCreatedAppEvent> {
+
+    @Autowired
+    private EntityManagerWrapper emw;
+
+    @Autowired
+    private ObjectMapper jsonMapper;
+
+    @Autowired
+    private StandardMapper standardMapper;
+
+    @Override
+    @SneakyThrows
+    public void onApplicationEvent(@NotNull BookingItemCreatedAppEvent bookingItemCreatedAppEvent) {
+        if (containsAssetJson(bookingItemCreatedAppEvent)) {
+            createRelatedHostingAsset(bookingItemCreatedAppEvent);
+        }
+    }
+
+    private static boolean containsAssetJson(final BookingItemCreatedAppEvent bookingItemCreatedAppEvent) {
+        return bookingItemCreatedAppEvent.getEntity().getAssetJson() != null;
+    }
+
+    private void createRelatedHostingAsset(final BookingItemCreatedAppEvent event) throws JsonProcessingException {
+        final var newBookingItemRealEntity = event.getEntity().getBookingItem();
+        final var asset = jsonMapper.readValue(event.getEntity().getAssetJson(), HsHostingAssetAutoInsertResource.class);
+        final var factory = switch (newBookingItemRealEntity.getType()) {
+            case PRIVATE_CLOUD, CLOUD_SERVER, MANAGED_SERVER ->
+                    forNowNoAutomaticHostingAssetCreationPossible(emw, newBookingItemRealEntity, asset, standardMapper);
+            case MANAGED_WEBSPACE -> new ManagedWebspaceHostingAssetFactory(emw, newBookingItemRealEntity, asset, standardMapper);
+            case DOMAIN_SETUP -> new DomainSetupHostingAssetFactory(emw, newBookingItemRealEntity, asset, standardMapper);
+        };
+        if (factory != null) {
+            final var statusMessage = factory.createAndPersist();
+            // TODO.impl: once we implement retry, we need to amend this code (persist/merge/delete)
+            if (statusMessage != null) {
+                event.getEntity().setStatusMessage(statusMessage);
+                emw.persist(event.getEntity());
+            }
+        }
+    }
+
+    private HostingAssetFactory forNowNoAutomaticHostingAssetCreationPossible(
+            final EntityManagerWrapper emw,
+            final HsBookingItemRealEntity fromBookingItem,
+            final HsHostingAssetAutoInsertResource asset,
+            final StandardMapper standardMapper
+    ) {
+        return new HostingAssetFactory(emw, fromBookingItem, asset, standardMapper) {
+
+            @Override
+            protected HsHostingAsset create() {
+                // TODO.impl: we should validate the asset JSON, but some violations are un-avoidable at that stage
+                throw new ValidationException("waiting for manual setup of hosting asset for booking item of type " + fromBookingItem.getType());
+            }
+        };
+    }
+}
--- a/src/main/java/net/hostsharing/hsadminng/hs/hosting/asset/factories/ManagedWebspaceHostingAssetFactory.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/hosting/asset/factories/ManagedWebspaceHostingAssetFactory.java
@ -0,0 +1,51 @@
+package net.hostsharing.hsadminng.hs.hosting.asset.factories;
+
+import net.hostsharing.hsadminng.hs.booking.generated.api.v1.model.HsHostingAssetAutoInsertResource;
+import net.hostsharing.hsadminng.hs.booking.generated.api.v1.model.HsHostingAssetTypeResource;
+import net.hostsharing.hsadminng.hs.booking.item.HsBookingItemRealEntity;
+import net.hostsharing.hsadminng.hs.hosting.asset.HsHostingAsset;
+import net.hostsharing.hsadminng.hs.hosting.asset.HsHostingAssetRealEntity;
+import net.hostsharing.hsadminng.mapper.StandardMapper;
+import net.hostsharing.hsadminng.persistence.EntityManagerWrapper;
+
+import jakarta.validation.ValidationException;
+
+import java.util.Optional;
+
+
+public class ManagedWebspaceHostingAssetFactory extends HostingAssetFactory {
+
+    public ManagedWebspaceHostingAssetFactory(
+            final EntityManagerWrapper emw,
+            final HsBookingItemRealEntity newBookingItemRealEntity,
+            final HsHostingAssetAutoInsertResource asset,
+            final StandardMapper standardMapper) {
+        super(emw, newBookingItemRealEntity, asset, standardMapper);
+    }
+
+    @Override
+    protected HsHostingAsset create() {
+        if (asset.getType() != HsHostingAssetTypeResource.MANAGED_WEBSPACE) {
+            throw new ValidationException("requires MANAGED_WEBSPACE hosting asset, but got " +
+                    Optional.of(asset)
+                            .map(HsHostingAssetAutoInsertResource::getType)
+                            .map(Enum::name)
+                            .orElse(null));
+        }
+        final var managedWebspaceHostingAsset = standardMapper.map(asset, HsHostingAssetRealEntity.class);
+        managedWebspaceHostingAsset.setBookingItem(fromBookingItem);
+        emw.createQuery(
+                "SELECT asset FROM HsHostingAssetRealEntity asset WHERE asset.bookingItem.uuid=:bookingItemUuid",
+                HsHostingAssetRealEntity.class)
+                .setParameter("bookingItemUuid", fromBookingItem.getParentItem().getUuid())
+                .getResultStream().findFirst()
+                .ifPresent(managedWebspaceHostingAsset::setParentAsset);
+
+        return managedWebspaceHostingAsset;
+    }
+
+    @Override
+    protected void persist(final HsHostingAsset newManagedWebspaceHostingAsset) {
+        super.persist(newManagedWebspaceHostingAsset);
+    }
+}
--- a/src/main/java/net/hostsharing/hsadminng/hs/hosting/asset/validators/HostingAssetEntitySaveProcessor.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/hosting/asset/validators/HostingAssetEntitySaveProcessor.java
@ -42,7 +42,7 @@ public class HostingAssetEntitySaveProcessor {
        return this;
    }

-    // TODO.impl: remove once the migration of legacy data is done
+    // TODO.legacy: remove once the migration of legacy data is done
    /// validates the entity itself including its properties, but ignoring some error messages for import of legacy data
    public HostingAssetEntitySaveProcessor validateEntityIgnoring(final String... ignoreRegExp) {
        step("validateEntity", "prepareForSave");
--- a/src/main/java/net/hostsharing/hsadminng/hs/hosting/asset/validators/HsDomainDnsSetupHostingAssetValidator.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/hosting/asset/validators/HsDomainDnsSetupHostingAssetValidator.java
@ -15,7 +15,7 @@ import static net.hostsharing.hsadminng.hs.validation.BooleanProperty.booleanPro
 import static net.hostsharing.hsadminng.hs.validation.IntegerProperty.integerProperty;
 import static net.hostsharing.hsadminng.hs.validation.StringProperty.stringProperty;

-// TODO.impl: make package private once we've migrated the legacy data
+// TODO.legacy: make package private once we've migrated the legacy data
 public class HsDomainDnsSetupHostingAssetValidator extends HostingAssetEntityValidator {

    // according to  RFC 1035 (section 5) and RFC 1034
@ -33,7 +33,7 @@ public class HsDomainDnsSetupHostingAssetValidator extends HostingAssetEntityVal
            RR_REGEX_NAME  + RR_REGEX_IN + RR_REGEX_TTL + RR_RECORD_TYPE + RR_RECORD_DATA + RR_COMMENT;
    public static final String IDENTIFIER_SUFFIX = "|DNS";

-    private static List<String> zoneFileErrors = null; // TODO.impl: remove once legacy data is migrated
+    private static List<String> zoneFileErrors = null; // TODO.legacy: remove once legacy data is migrated

    HsDomainDnsSetupHostingAssetValidator() {
        super(
--- a/src/main/java/net/hostsharing/hsadminng/hs/office/bankaccount/HsOfficeBankAccountEntity.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/bankaccount/HsOfficeBankAccountEntity.java
@ -3,10 +3,10 @@ package net.hostsharing.hsadminng.hs.office.bankaccount;
 import lombok.*;
 import lombok.experimental.FieldNameConstants;
 import net.hostsharing.hsadminng.errors.DisplayAs;
-import net.hostsharing.hsadminng.rbac.object.BaseEntity;
+import net.hostsharing.hsadminng.persistence.BaseEntity;
 import net.hostsharing.hsadminng.rbac.generator.RbacView;
-import net.hostsharing.hsadminng.stringify.Stringify;
-import net.hostsharing.hsadminng.stringify.Stringifyable;
+import net.hostsharing.hsadminng.repr.Stringify;
+import net.hostsharing.hsadminng.repr.Stringifyable;

 import jakarta.persistence.*;
 import java.io.IOException;
@ -16,7 +16,7 @@ import static net.hostsharing.hsadminng.rbac.generator.RbacView.*;
 import static net.hostsharing.hsadminng.rbac.generator.RbacView.Permission.*;
 import static net.hostsharing.hsadminng.rbac.generator.RbacView.RbacSubjectReference.UserRole.CREATOR;
 import static net.hostsharing.hsadminng.rbac.generator.RbacView.Role.*;
-import static net.hostsharing.hsadminng.stringify.Stringify.stringify;
+import static net.hostsharing.hsadminng.repr.Stringify.stringify;

@Entity
@Table(schema = "hs_office", name = "bankaccount_rv")
--- a/src/main/java/net/hostsharing/hsadminng/hs/office/contact/HsOfficeContact.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/contact/HsOfficeContact.java
@ -11,9 +11,9 @@ import lombok.experimental.FieldNameConstants;
 import lombok.experimental.SuperBuilder;
 import net.hostsharing.hsadminng.errors.DisplayAs;
 import net.hostsharing.hsadminng.mapper.PatchableMapWrapper;
-import net.hostsharing.hsadminng.rbac.object.BaseEntity;
-import net.hostsharing.hsadminng.stringify.Stringify;
-import net.hostsharing.hsadminng.stringify.Stringifyable;
+import net.hostsharing.hsadminng.persistence.BaseEntity;
+import net.hostsharing.hsadminng.repr.Stringify;
+import net.hostsharing.hsadminng.repr.Stringifyable;
 import org.hibernate.annotations.GenericGenerator;
 import org.hibernate.annotations.Type;

@ -27,7 +27,7 @@ import java.util.HashMap;
 import java.util.Map;
 import java.util.UUID;

-import static net.hostsharing.hsadminng.stringify.Stringify.stringify;
+import static net.hostsharing.hsadminng.repr.Stringify.stringify;

@MappedSuperclass
@Getter
@ -54,8 +54,14 @@ public class HsOfficeContact implements Stringifyable, BaseEntity<HsOfficeContac
    @Column(name = "caption")
    private String caption;

+    @Builder.Default
+    @Setter(AccessLevel.NONE)
+    @Type(JsonType.class)
    @Column(name = "postaladdress")
-    private String postalAddress; // multiline free-format text
+    private Map<String, String> postalAddress = new HashMap<>();
+
+    @Transient
+    private PatchableMapWrapper<String> postalAddressWrapper;

    @Builder.Default
    @Setter(AccessLevel.NONE)
@ -75,6 +81,17 @@ public class HsOfficeContact implements Stringifyable, BaseEntity<HsOfficeContac
    @Transient
    private PatchableMapWrapper<String> phoneNumbersWrapper;

+    public PatchableMapWrapper<String> getPostalAddress() {
+        return PatchableMapWrapper.of(
+                postalAddressWrapper,
+                (newWrapper) -> {postalAddressWrapper = newWrapper;},
+                postalAddress);
+    }
+
+    public void putPostalAddress(Map<String, String> newPostalAddress) {
+        getPostalAddress().assign(newPostalAddress);
+    }
+
    public PatchableMapWrapper<String> getEmailAddresses() {
        return PatchableMapWrapper.of(
                emailAddressesWrapper,
--- a/src/main/java/net/hostsharing/hsadminng/hs/office/contact/HsOfficeContactEntityPatcher.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/contact/HsOfficeContactEntityPatcher.java
@ -18,7 +18,8 @@ class HsOfficeContactEntityPatcher implements EntityPatcher<HsOfficeContactPatch
    @Override
    public void apply(final HsOfficeContactPatchResource resource) {
        OptionalFromJson.of(resource.getCaption()).ifPresent(entity::setCaption);
-        OptionalFromJson.of(resource.getPostalAddress()).ifPresent(entity::setPostalAddress);
+        Optional.ofNullable(resource.getPostalAddress())
+                .ifPresent(r -> entity.getPostalAddress().patch(KeyValueMap.from(resource.getPostalAddress())));
        Optional.ofNullable(resource.getEmailAddresses())
                .ifPresent(r -> entity.getEmailAddresses().patch(KeyValueMap.from(resource.getEmailAddresses())));
        Optional.ofNullable(resource.getPhoneNumbers())
--- a/src/main/java/net/hostsharing/hsadminng/hs/office/coopassets/HsOfficeCoopAssetsTransactionController.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/coopassets/HsOfficeCoopAssetsTransactionController.java
@ -1,10 +1,15 @@
 package net.hostsharing.hsadminng.hs.office.coopassets;

 import net.hostsharing.hsadminng.context.Context;
-import net.hostsharing.hsadminng.hs.office.generated.api.v1.api.HsOfficeCoopAssetsApi;
-import net.hostsharing.hsadminng.hs.office.generated.api.v1.model.*;
 import net.hostsharing.hsadminng.errors.MultiValidationException;
-import net.hostsharing.hsadminng.mapper.StandardMapper;
+import net.hostsharing.hsadminng.hs.office.generated.api.v1.api.HsOfficeCoopAssetsApi;
+import net.hostsharing.hsadminng.hs.office.generated.api.v1.model.HsOfficeCoopAssetsTransactionInsertResource;
+import net.hostsharing.hsadminng.hs.office.generated.api.v1.model.HsOfficeCoopAssetsTransactionResource;
+import net.hostsharing.hsadminng.hs.office.generated.api.v1.model.HsOfficeCoopAssetsTransactionTypeResource;
+import net.hostsharing.hsadminng.hs.office.membership.HsOfficeMembershipEntity;
+import net.hostsharing.hsadminng.hs.office.membership.HsOfficeMembershipRepository;
+import net.hostsharing.hsadminng.mapper.StrictMapper;
+import net.hostsharing.hsadminng.persistence.EntityManagerWrapper;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.format.annotation.DateTimeFormat;
 import org.springframework.format.annotation.DateTimeFormat.ISO;
@ -14,13 +19,19 @@ import org.springframework.web.bind.annotation.RestController;
 import org.springframework.web.servlet.mvc.method.annotation.MvcUriComponentsBuilder;

 import jakarta.persistence.EntityNotFoundException;
+import jakarta.validation.ValidationException;
 import java.time.LocalDate;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.UUID;
 import java.util.function.BiConsumer;

-import static net.hostsharing.hsadminng.hs.office.generated.api.v1.model.HsOfficeCoopAssetsTransactionTypeResource.*;
+import static java.util.Optional.ofNullable;
+import static net.hostsharing.hsadminng.hs.office.generated.api.v1.model.HsOfficeCoopAssetsTransactionTypeResource.CLEARING;
+import static net.hostsharing.hsadminng.hs.office.generated.api.v1.model.HsOfficeCoopAssetsTransactionTypeResource.DEPOSIT;
+import static net.hostsharing.hsadminng.hs.office.generated.api.v1.model.HsOfficeCoopAssetsTransactionTypeResource.DISBURSAL;
+import static net.hostsharing.hsadminng.hs.office.generated.api.v1.model.HsOfficeCoopAssetsTransactionTypeResource.LOSS;
+import static net.hostsharing.hsadminng.hs.office.generated.api.v1.model.HsOfficeCoopAssetsTransactionTypeResource.TRANSFER;

@RestController
 public class HsOfficeCoopAssetsTransactionController implements HsOfficeCoopAssetsApi {
@ -29,14 +40,20 @@ public class HsOfficeCoopAssetsTransactionController implements HsOfficeCoopAsse
    private Context context;

    @Autowired
-    private StandardMapper mapper;
+    private StrictMapper mapper;
+
+    @Autowired
+    private EntityManagerWrapper emw;

    @Autowired
    private HsOfficeCoopAssetsTransactionRepository coopAssetsTransactionRepo;

+    @Autowired
+    private HsOfficeMembershipRepository membershipRepo;
+
    @Override
    @Transactional(readOnly = true)
-    public ResponseEntity<List<HsOfficeCoopAssetsTransactionResource>> listCoopAssets(
+    public ResponseEntity<List<HsOfficeCoopAssetsTransactionResource>> getListOfCoopAssets(
            final String currentSubject,
            final String assumedRoles,
            final UUID membershipUuid,
@ -49,13 +66,13 @@ public class HsOfficeCoopAssetsTransactionController implements HsOfficeCoopAsse
                fromValueDate,
                toValueDate);

-        final var resources = mapper.mapList(entities, HsOfficeCoopAssetsTransactionResource.class);
+        final var resources = mapper.mapList(entities, HsOfficeCoopAssetsTransactionResource.class, ENTITY_TO_RESOURCE_POSTMAPPER);
        return ResponseEntity.ok(resources);
    }

    @Override
    @Transactional
-    public ResponseEntity<HsOfficeCoopAssetsTransactionResource> addCoopAssetsTransaction(
+    public ResponseEntity<HsOfficeCoopAssetsTransactionResource> postNewCoopAssetTransaction(
            final String currentSubject,
            final String assumedRoles,
            final HsOfficeCoopAssetsTransactionInsertResource requestBody) {
@ -63,7 +80,10 @@ public class HsOfficeCoopAssetsTransactionController implements HsOfficeCoopAsse
        context.define(currentSubject, assumedRoles);
        validate(requestBody);

-        final var entityToSave = mapper.map(requestBody, HsOfficeCoopAssetsTransactionEntity.class, RESOURCE_TO_ENTITY_POSTMAPPER);
+        final var entityToSave = mapper.map(
+                requestBody,
+                HsOfficeCoopAssetsTransactionEntity.class,
+                RESOURCE_TO_ENTITY_POSTMAPPER);
        final var saved = coopAssetsTransactionRepo.save(entityToSave);

        final var uri =
@ -71,15 +91,14 @@ public class HsOfficeCoopAssetsTransactionController implements HsOfficeCoopAsse
                        .path("/api/hs/office/coopassetstransactions/{id}")
                        .buildAndExpand(saved.getUuid())
                        .toUri();
-        final var mapped = mapper.map(saved, HsOfficeCoopAssetsTransactionResource.class);
+        final var mapped = mapper.map(saved, HsOfficeCoopAssetsTransactionResource.class, ENTITY_TO_RESOURCE_POSTMAPPER);
        return ResponseEntity.created(uri).body(mapped);
    }

    @Override
    @Transactional(readOnly = true)
-
-    public ResponseEntity<HsOfficeCoopAssetsTransactionResource> getCoopAssetTransactionByUuid(
-        final String currentSubject, final String assumedRoles, final UUID assetTransactionUuid) {
+    public ResponseEntity<HsOfficeCoopAssetsTransactionResource> getSingleCoopAssetTransactionByUuid(
+            final String currentSubject, final String assumedRoles, final UUID assetTransactionUuid) {

        context.define(currentSubject, assumedRoles);

@ -102,7 +121,7 @@ public class HsOfficeCoopAssetsTransactionController implements HsOfficeCoopAsse
    private static void validateDebitTransaction(
            final HsOfficeCoopAssetsTransactionInsertResource requestBody,
            final ArrayList<String> violations) {
-        if (List.of(DEPOSIT, ADOPTION).contains(requestBody.getTransactionType())
+        if (List.of(DEPOSIT, HsOfficeCoopAssetsTransactionTypeResource.ADOPTION).contains(requestBody.getTransactionType())
                && requestBody.getAssetValue().signum() < 0) {
            violations.add("for %s, assetValue must be positive but is \"%.2f\"".formatted(
                    requestBody.getTransactionType(), requestBody.getAssetValue()));
@ -128,10 +147,111 @@ public class HsOfficeCoopAssetsTransactionController implements HsOfficeCoopAsse
        }
    }

-    final BiConsumer<HsOfficeCoopAssetsTransactionInsertResource, HsOfficeCoopAssetsTransactionEntity> RESOURCE_TO_ENTITY_POSTMAPPER = (resource, entity) -> {
-        if ( resource.getReverseEntryUuid() != null ) {
-            entity.setAdjustedAssetTx(coopAssetsTransactionRepo.findByUuid(resource.getReverseEntryUuid())
-                    .orElseThrow(() -> new EntityNotFoundException("ERROR: [400] reverseEntityUuid %s not found".formatted(resource.getReverseEntryUuid()))));
+    final BiConsumer<HsOfficeCoopAssetsTransactionEntity, HsOfficeCoopAssetsTransactionResource> ENTITY_TO_RESOURCE_POSTMAPPER = (entity, resource) -> {
+        resource.setMembershipUuid(entity.getMembership().getUuid());
+        resource.setMembershipMemberNumber(entity.getMembership().getTaggedMemberNumber());
+
+        if (entity.getReversalAssetTx() != null) {
+            resource.getReversalAssetTx().setRevertedAssetTxUuid(entity.getUuid());
+            resource.getReversalAssetTx().setMembershipUuid(entity.getMembership().getUuid());
+            resource.getReversalAssetTx().setMembershipMemberNumber(entity.getTaggedMemberNumber());
+        }
+
+        if (entity.getRevertedAssetTx() != null) {
+            resource.getRevertedAssetTx().setReversalAssetTxUuid(entity.getUuid());
+            resource.getRevertedAssetTx().setMembershipUuid(entity.getMembership().getUuid());
+            resource.getRevertedAssetTx().setMembershipMemberNumber(entity.getTaggedMemberNumber());
+        }
+
+        if (entity.getAdoptionAssetTx() != null) {
+            resource.getAdoptionAssetTx().setTransferAssetTxUuid(entity.getUuid());
+            resource.getAdoptionAssetTx().setMembershipUuid(entity.getAdoptionAssetTx().getMembership().getUuid());
+            resource.getAdoptionAssetTx().setMembershipMemberNumber(entity.getAdoptionAssetTx().getTaggedMemberNumber());
+        }
+
+        if (entity.getTransferAssetTx() != null) {
+            resource.getTransferAssetTx().setAdoptionAssetTxUuid(entity.getUuid());
+            resource.getTransferAssetTx().setMembershipUuid(entity.getTransferAssetTx().getMembership().getUuid());
+            resource.getTransferAssetTx().setMembershipMemberNumber(entity.getTransferAssetTx().getTaggedMemberNumber());
        }
    };
-};
+
+    final BiConsumer<HsOfficeCoopAssetsTransactionInsertResource, HsOfficeCoopAssetsTransactionEntity> RESOURCE_TO_ENTITY_POSTMAPPER = (resource, entity) -> {
+
+        if (resource.getMembershipUuid() != null) {
+            final HsOfficeMembershipEntity membership = ofNullable(emw.find(HsOfficeMembershipEntity.class, resource.getMembershipUuid()))
+                    .orElseThrow(() -> new EntityNotFoundException("ERROR: [400] membership.uuid %s not found".formatted(
+                            resource.getMembershipUuid())));
+            entity.setMembership(membership);
+        }
+        if (resource.getRevertedAssetTxUuid() != null) {
+            final var revertedAssetTx = coopAssetsTransactionRepo.findByUuid(resource.getRevertedAssetTxUuid())
+                    .orElseThrow(() -> new EntityNotFoundException("ERROR: [400] revertedEntityUuid %s not found".formatted(
+                            resource.getRevertedAssetTxUuid())));
+            entity.setRevertedAssetTx(revertedAssetTx);
+            if (resource.getAssetValue().negate().compareTo(revertedAssetTx.getAssetValue()) != 0) {
+                throw new ValidationException("given assetValue=" + resource.getAssetValue() +
+                        " but must be negative value from reverted asset tx: " + revertedAssetTx.getAssetValue());
+            }
+        }
+
+        final var adoptingMembership = determineAdoptingMembership(resource);
+        if (adoptingMembership != null) {
+            final var adoptingAssetTx = coopAssetsTransactionRepo.save(createAdoptingAssetTx(entity, adoptingMembership));
+            entity.setAdoptionAssetTx(adoptingAssetTx);
+        }
+    };
+
+    private HsOfficeMembershipEntity determineAdoptingMembership(final HsOfficeCoopAssetsTransactionInsertResource resource) {
+        final var adoptingMembershipUuid = resource.getAdoptingMembershipUuid();
+        final var adoptingMembershipMemberNumber = resource.getAdoptingMembershipMemberNumber();
+        if (adoptingMembershipUuid != null && adoptingMembershipMemberNumber != null) {
+            throw new IllegalArgumentException(
+                // @formatter:off
+                resource.getTransactionType() == TRANSFER
+                    ? "[400] either adoptingMembership.uuid or adoptingMembership.memberNumber can be given, not both"
+                    : "[400] adoptingMembership.uuid and adoptingMembership.memberNumber must not be given for transactionType="
+                            + resource.getTransactionType());
+                // @formatter:on
+        }
+
+        if (adoptingMembershipUuid != null) {
+            final var adoptingMembership = membershipRepo.findByUuid(adoptingMembershipUuid);
+            return adoptingMembership.orElseThrow(() ->
+                    new ValidationException(
+                            "adoptingMembership.uuid='" + adoptingMembershipUuid + "' not found or not accessible"));
+        }
+
+        if (adoptingMembershipMemberNumber != null) {
+            final var adoptingMemberNumber = Integer.valueOf(adoptingMembershipMemberNumber.substring("M-".length()));
+            final var adoptingMembership = membershipRepo.findMembershipByMemberNumber(adoptingMemberNumber);
+            if (adoptingMembership != null) {
+                return adoptingMembership;
+            }
+            throw new ValidationException("adoptingMembership.memberNumber='" + adoptingMembershipMemberNumber
+                    + "' not found or not accessible");
+        }
+
+        if (resource.getTransactionType() == TRANSFER) {
+            throw new ValidationException(
+                    "either adoptingMembership.uuid or adoptingMembership.memberNumber must be given for transactionType="
+                            + TRANSFER);
+        }
+
+        return null;
+    }
+
+    private HsOfficeCoopAssetsTransactionEntity createAdoptingAssetTx(
+            final HsOfficeCoopAssetsTransactionEntity transferAssetTxEntity,
+            final HsOfficeMembershipEntity adoptingMembership) {
+        return HsOfficeCoopAssetsTransactionEntity.builder()
+                .membership(adoptingMembership)
+                .transactionType(HsOfficeCoopAssetsTransactionType.ADOPTION)
+                .transferAssetTx(transferAssetTxEntity)
+                .assetValue(transferAssetTxEntity.getAssetValue().negate())
+                .comment(transferAssetTxEntity.getComment())
+                .reference(transferAssetTxEntity.getReference())
+                .valueDate(transferAssetTxEntity.getValueDate())
+                .build();
+    }
+}
--- a/src/main/java/net/hostsharing/hsadminng/hs/office/coopassets/HsOfficeCoopAssetsTransactionEntity.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/coopassets/HsOfficeCoopAssetsTransactionEntity.java
@ -8,10 +8,10 @@ import lombok.NoArgsConstructor;
 import lombok.Setter;
 import net.hostsharing.hsadminng.errors.DisplayAs;
 import net.hostsharing.hsadminng.hs.office.membership.HsOfficeMembershipEntity;
-import net.hostsharing.hsadminng.rbac.object.BaseEntity;
+import net.hostsharing.hsadminng.persistence.BaseEntity;
 import net.hostsharing.hsadminng.rbac.generator.RbacView;
-import net.hostsharing.hsadminng.stringify.Stringify;
-import net.hostsharing.hsadminng.stringify.Stringifyable;
+import net.hostsharing.hsadminng.repr.Stringify;
+import net.hostsharing.hsadminng.repr.Stringifyable;
 import org.hibernate.annotations.GenericGenerator;

 import jakarta.persistence.*;
@ -31,7 +31,7 @@ import static net.hostsharing.hsadminng.rbac.generator.RbacView.Role.ADMIN;
 import static net.hostsharing.hsadminng.rbac.generator.RbacView.Role.AGENT;
 import static net.hostsharing.hsadminng.rbac.generator.RbacView.SQL.directlyFetchedByDependsOnColumn;
 import static net.hostsharing.hsadminng.rbac.generator.RbacView.rbacViewFor;
-import static net.hostsharing.hsadminng.stringify.Stringify.stringify;
+import static net.hostsharing.hsadminng.repr.Stringify.stringify;

@Entity
@Table(schema = "hs_office", name = "coopassettx_rv")
@ -50,8 +50,10 @@ public class HsOfficeCoopAssetsTransactionEntity implements Stringifyable, BaseE
            .withProp(HsOfficeCoopAssetsTransactionEntity::getAssetValue)
            .withProp(HsOfficeCoopAssetsTransactionEntity::getReference)
            .withProp(HsOfficeCoopAssetsTransactionEntity::getComment)
-            .withProp(at -> ofNullable(at.getAdjustedAssetTx()).map(HsOfficeCoopAssetsTransactionEntity::toShortString).orElse(null))
-            .withProp(at -> ofNullable(at.getAdjustmentAssetTx()).map(HsOfficeCoopAssetsTransactionEntity::toShortString).orElse(null))
+            .withProp(HsOfficeCoopAssetsTransactionEntity::getRevertedAssetTx)
+            .withProp(HsOfficeCoopAssetsTransactionEntity::getReversalAssetTx)
+            .withProp(HsOfficeCoopAssetsTransactionEntity::getAdoptionAssetTx)
+            .withProp(HsOfficeCoopAssetsTransactionEntity::getTransferAssetTx)
            .quotedValues(false);

    @Id
@ -77,7 +79,7 @@ public class HsOfficeCoopAssetsTransactionEntity implements Stringifyable, BaseE
     * The signed value which directly affects the booking balance.
     *
     * <p>This means, that a DEPOSIT is always positive, a DISBURSAL is always negative,
-     * but an ADJUSTMENT can bei either positive or negative.
+     * but an REVERSAL can bei either positive or negative.
     * See {@link HsOfficeCoopAssetsTransactionType} for</p> more information.
     */
    @Column(name = "assetvalue")
@ -95,15 +97,23 @@ public class HsOfficeCoopAssetsTransactionEntity implements Stringifyable, BaseE
    @Column(name = "comment")
    private String comment;

-    /**
-     * Optionally, the UUID of the corresponding transaction for an adjustment transaction.
-     */
-    @OneToOne
-    @JoinColumn(name = "adjustedassettxuuid")
-    private HsOfficeCoopAssetsTransactionEntity adjustedAssetTx;
+    // Optionally, the UUID of the corresponding transaction for a reversal transaction.
+    @OneToOne(cascade = CascadeType.PERSIST) // TODO.impl: can probably be removed after office data migration
+    @JoinColumn(name = "revertedassettxuuid")
+    private HsOfficeCoopAssetsTransactionEntity revertedAssetTx;

-    @OneToOne(mappedBy = "adjustedAssetTx")
-    private HsOfficeCoopAssetsTransactionEntity adjustmentAssetTx;
+    // and the other way around
+    @OneToOne(mappedBy = "revertedAssetTx")
+    private HsOfficeCoopAssetsTransactionEntity reversalAssetTx;
+
+    // Optionally, the UUID of the corresponding transaction for a transfer transaction.
+    @OneToOne(cascade = CascadeType.PERSIST) // TODO.impl: can probably be removed after office data migration
+    @JoinColumn(name = "assetadoptiontxuuid")
+    private HsOfficeCoopAssetsTransactionEntity adoptionAssetTx;
+
+    // and the other way around
+    @OneToOne(mappedBy = "adoptionAssetTx")
+    private HsOfficeCoopAssetsTransactionEntity transferAssetTx;

    @Override
    public HsOfficeCoopAssetsTransactionEntity load() {
--- a/src/main/java/net/hostsharing/hsadminng/hs/office/coopassets/HsOfficeCoopAssetsTransactionType.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/coopassets/HsOfficeCoopAssetsTransactionType.java
@ -4,7 +4,7 @@ public enum HsOfficeCoopAssetsTransactionType {
    /**
     * correction of wrong bookings, value can be positive or negative
     */
-    ADJUSTMENT,
+    REVERSAL,

    /**
     * payment received from member after signing shares, value >0
--- a/src/main/java/net/hostsharing/hsadminng/hs/office/coopshares/HsOfficeCoopSharesTransactionController.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/coopshares/HsOfficeCoopSharesTransactionController.java
@ -38,7 +38,7 @@ public class HsOfficeCoopSharesTransactionController implements HsOfficeCoopShar

    @Override
    @Transactional(readOnly = true)
-    public ResponseEntity<List<HsOfficeCoopSharesTransactionResource>> listCoopShares(
+    public ResponseEntity<List<HsOfficeCoopSharesTransactionResource>> getListOfCoopShares(
            final String currentSubject,
            final String assumedRoles,
            final UUID membershipUuid,
@ -57,7 +57,7 @@ public class HsOfficeCoopSharesTransactionController implements HsOfficeCoopShar

    @Override
    @Transactional
-    public ResponseEntity<HsOfficeCoopSharesTransactionResource> addCoopSharesTransaction(
+    public ResponseEntity<HsOfficeCoopSharesTransactionResource> postNewCoopSharesTransaction(
            final String currentSubject,
            final String assumedRoles,
            final HsOfficeCoopSharesTransactionInsertResource requestBody) {
@ -80,7 +80,7 @@ public class HsOfficeCoopSharesTransactionController implements HsOfficeCoopShar

    @Override
    @Transactional(readOnly = true)
-    public ResponseEntity<HsOfficeCoopSharesTransactionResource> getCoopShareTransactionByUuid(
+    public ResponseEntity<HsOfficeCoopSharesTransactionResource> getSingleCoopShareTransactionByUuid(
        final String currentSubject, final String assumedRoles, final UUID shareTransactionUuid) {

            context.define(currentSubject, assumedRoles);
@ -131,9 +131,9 @@ public class HsOfficeCoopSharesTransactionController implements HsOfficeCoopShar
    }

    final BiConsumer<HsOfficeCoopSharesTransactionInsertResource, HsOfficeCoopSharesTransactionEntity> RESOURCE_TO_ENTITY_POSTMAPPER = (resource, entity) -> {
-        if ( resource.getAdjustedShareTxUuid() != null ) {
-            entity.setAdjustedShareTx(coopSharesTransactionRepo.findByUuid(resource.getAdjustedShareTxUuid())
-                .orElseThrow(() -> new EntityNotFoundException("ERROR: [400] adjustedShareTxUuid %s not found".formatted(resource.getAdjustedShareTxUuid()))));
+        if ( resource.getRevertedShareTxUuid() != null ) {
+            entity.setRevertedShareTx(coopSharesTransactionRepo.findByUuid(resource.getRevertedShareTxUuid())
+                .orElseThrow(() -> new EntityNotFoundException("ERROR: [400] revertedShareTxUuid %s not found".formatted(resource.getRevertedShareTxUuid()))));
        }
    };
 }
--- a/src/main/java/net/hostsharing/hsadminng/hs/office/coopshares/HsOfficeCoopSharesTransactionEntity.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/coopshares/HsOfficeCoopSharesTransactionEntity.java
@ -8,10 +8,10 @@ import lombok.Setter;
 import net.hostsharing.hsadminng.errors.DisplayAs;
 import net.hostsharing.hsadminng.hs.office.membership.HsOfficeMembershipEntity;
 import net.hostsharing.hsadminng.rbac.generator.RbacView;
-import net.hostsharing.hsadminng.rbac.object.BaseEntity;
+import net.hostsharing.hsadminng.persistence.BaseEntity;
 import net.hostsharing.hsadminng.rbac.generator.RbacView.SQL;
-import net.hostsharing.hsadminng.stringify.Stringify;
-import net.hostsharing.hsadminng.stringify.Stringifyable;
+import net.hostsharing.hsadminng.repr.Stringify;
+import net.hostsharing.hsadminng.repr.Stringifyable;

 import jakarta.persistence.*;
 import java.io.IOException;
@ -29,7 +29,7 @@ import static net.hostsharing.hsadminng.rbac.generator.RbacView.Role.ADMIN;
 import static net.hostsharing.hsadminng.rbac.generator.RbacView.Role.AGENT;
 import static net.hostsharing.hsadminng.rbac.generator.RbacView.SQL.directlyFetchedByDependsOnColumn;
 import static net.hostsharing.hsadminng.rbac.generator.RbacView.rbacViewFor;
-import static net.hostsharing.hsadminng.stringify.Stringify.stringify;
+import static net.hostsharing.hsadminng.repr.Stringify.stringify;

@Entity
@Table(schema = "hs_office", name = "coopsharetx_rv")
@ -48,8 +48,8 @@ public class HsOfficeCoopSharesTransactionEntity implements Stringifyable, BaseE
            .withProp(HsOfficeCoopSharesTransactionEntity::getShareCount)
            .withProp(HsOfficeCoopSharesTransactionEntity::getReference)
            .withProp(HsOfficeCoopSharesTransactionEntity::getComment)
-            .withProp(at -> ofNullable(at.getAdjustedShareTx()).map(HsOfficeCoopSharesTransactionEntity::toShortString).orElse(null))
-            .withProp(at -> ofNullable(at.getAdjustmentShareTx()).map(HsOfficeCoopSharesTransactionEntity::toShortString).orElse(null))
+            .withProp(at -> ofNullable(at.getRevertedShareTx()).map(HsOfficeCoopSharesTransactionEntity::toShortString).orElse(null))
+            .withProp(at -> ofNullable(at.getReversalShareTx()).map(HsOfficeCoopSharesTransactionEntity::toShortString).orElse(null))
        .quotedValues(false);

    @Id
@ -71,7 +71,7 @@ public class HsOfficeCoopSharesTransactionEntity implements Stringifyable, BaseE
     * The signed value which directly affects the booking balance.
     *
     * <p>This means, that a SUBSCRIPTION is always positive, a CANCELLATION is always negative,
-     * but an ADJUSTMENT can bei either positive or negative.
+     * but an REVERSAL can bei either positive or negative.
     * See {@link HsOfficeCoopSharesTransactionType} for</p> more information.
     */
    @Column(name = "valuedate")
@ -93,14 +93,14 @@ public class HsOfficeCoopSharesTransactionEntity implements Stringifyable, BaseE
    private String comment;

    /**
-     * Optionally, the UUID of the corresponding transaction for an adjustment transaction.
+     * Optionally, the UUID of the corresponding transaction for a REVERSAL transaction.
     */
    @OneToOne
-    @JoinColumn(name = "adjustedsharetxuuid")
-    private HsOfficeCoopSharesTransactionEntity adjustedShareTx;
+    @JoinColumn(name = "revertedsharetxuuid")
+    private HsOfficeCoopSharesTransactionEntity revertedShareTx;

-    @OneToOne(mappedBy = "adjustedShareTx")
-    private HsOfficeCoopSharesTransactionEntity adjustmentShareTx;
+    @OneToOne(mappedBy = "revertedShareTx")
+    private HsOfficeCoopSharesTransactionEntity reversalShareTx;

    @Override
    public HsOfficeCoopSharesTransactionEntity load() {
--- a/src/main/java/net/hostsharing/hsadminng/hs/office/coopshares/HsOfficeCoopSharesTransactionType.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/coopshares/HsOfficeCoopSharesTransactionType.java
@ -2,9 +2,9 @@ package net.hostsharing.hsadminng.hs.office.coopshares;

 public enum HsOfficeCoopSharesTransactionType {
    /**
-     * correction of wrong bookings, with either positive or negative value
+     * reversal of wrong bookings, with either positive or negative value identical to reversed transaction
     */
-    ADJUSTMENT,
+    REVERSAL,

    /**
     * shares signed, e.g. with the declaration of accession, value >0
--- a/src/main/java/net/hostsharing/hsadminng/hs/office/debitor/HsOfficeDebitorController.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/debitor/HsOfficeDebitorController.java
@ -22,8 +22,10 @@ import jakarta.persistence.PersistenceContext;
 import jakarta.validation.ValidationException;
 import java.util.List;
 import java.util.UUID;
+import java.util.function.BiConsumer;

 import static net.hostsharing.hsadminng.hs.office.relation.HsOfficeRelationType.DEBITOR;
+import static net.hostsharing.hsadminng.repr.TaggedNumber.cropTag;

@RestController

@ -49,24 +51,24 @@ public class HsOfficeDebitorController implements HsOfficeDebitorsApi {

    @Override
    @Transactional(readOnly = true)
-    public ResponseEntity<List<HsOfficeDebitorResource>> listDebitors(
+    public ResponseEntity<List<HsOfficeDebitorResource>> getListOfDebitors(
            final String currentSubject,
            final String assumedRoles,
            final String name,
-            final Integer debitorNumber) {
+            final String debitorNumber) {
        context.define(currentSubject, assumedRoles);

        final var entities = debitorNumber != null
-                ? debitorRepo.findDebitorByDebitorNumber(debitorNumber)
+                ? debitorRepo.findDebitorByDebitorNumber(cropTag("D-", debitorNumber))
                : debitorRepo.findDebitorByOptionalNameLike(name);

-        final var resources = mapper.mapList(entities, HsOfficeDebitorResource.class);
+        final var resources = mapper.mapList(entities, HsOfficeDebitorResource.class, ENTITY_TO_RESOURCE_POSTMAPPER);
        return ResponseEntity.ok(resources);
    }

    @Override
    @Transactional
-    public ResponseEntity<HsOfficeDebitorResource> addDebitor(
+    public ResponseEntity<HsOfficeDebitorResource> postNewDebitor(
            String currentSubject,
            String assumedRoles,
            HsOfficeDebitorInsertResource body) {
@ -77,16 +79,13 @@ public class HsOfficeDebitorController implements HsOfficeDebitorsApi {
                "ERROR: [400] exactly one of debitorRel and debitorRelUuid must be supplied, but found both");
        Validate.isTrue(body.getDebitorRel() != null || body.getDebitorRelUuid() != null,
                "ERROR: [400] exactly one of debitorRel and debitorRelUuid must be supplied, but found none");
-        Validate.isTrue(body.getDebitorRel() == null ||
-                    body.getDebitorRel().getType() == null || DEBITOR.name().equals(body.getDebitorRel().getType()),
-                "ERROR: [400] debitorRel.type must be '"+DEBITOR.name()+"' or null for default");
        Validate.isTrue(body.getDebitorRel() == null || body.getDebitorRel().getMark() == null,
                "ERROR: [400] debitorRel.mark must be null");

        final var entityToSave = mapper.map(body, HsOfficeDebitorEntity.class);
-        if ( body.getDebitorRel() != null ) {
-            body.getDebitorRel().setType(DEBITOR.name());
+        if (body.getDebitorRel() != null) {
            final var debitorRel = mapper.map("debitorRel.", body.getDebitorRel(), HsOfficeRelationRealEntity.class);
+            debitorRel.setType(DEBITOR);
            entityValidator.validateEntityExists("debitorRel.anchorUuid", debitorRel.getAnchor());
            entityValidator.validateEntityExists("debitorRel.holderUuid", debitorRel.getHolder());
            entityValidator.validateEntityExists("debitorRel.contactUuid", debitorRel.getContact());
@ -95,7 +94,10 @@ public class HsOfficeDebitorController implements HsOfficeDebitorsApi {
            final var debitorRelOptional = relrealRepo.findByUuid(body.getDebitorRelUuid());
            debitorRelOptional.ifPresentOrElse(
                    debitorRel -> {entityToSave.setDebitorRel(relrealRepo.save(debitorRel));},
-                    () -> { throw new ValidationException("Unable to find RealRelation by debitorRelUuid: " + body.getDebitorRelUuid());});
+                    () -> {
+                        throw new ValidationException(
+                                "Unable to find RealRelation by debitorRelUuid: " + body.getDebitorRelUuid());
+                    });
        }

        final var savedEntity = debitorRepo.save(entityToSave);
@ -107,13 +109,13 @@ public class HsOfficeDebitorController implements HsOfficeDebitorsApi {
                        .path("/api/hs/office/debitors/{id}")
                        .buildAndExpand(savedEntity.getUuid())
                        .toUri();
-        final var mapped = mapper.map(savedEntity, HsOfficeDebitorResource.class);
+        final var mapped = mapper.map(savedEntity, HsOfficeDebitorResource.class, ENTITY_TO_RESOURCE_POSTMAPPER);
        return ResponseEntity.created(uri).body(mapped);
    }

    @Override
    @Transactional(readOnly = true)
-    public ResponseEntity<HsOfficeDebitorResource> getDebitorByUuid(
+    public ResponseEntity<HsOfficeDebitorResource> getSingleDebitorByUuid(
            final String currentSubject,
            final String assumedRoles,
            final UUID debitorUuid) {
@ -124,7 +126,7 @@ public class HsOfficeDebitorController implements HsOfficeDebitorsApi {
        if (result.isEmpty()) {
            return ResponseEntity.notFound().build();
        }
-        return ResponseEntity.ok(mapper.map(result.get(), HsOfficeDebitorResource.class));
+        return ResponseEntity.ok(mapper.map(result.get(), HsOfficeDebitorResource.class, ENTITY_TO_RESOURCE_POSTMAPPER));
    }

    @Override
@ -159,7 +161,11 @@ public class HsOfficeDebitorController implements HsOfficeDebitorsApi {

        final var saved = debitorRepo.save(current);
        Hibernate.initialize(saved);
-        final var mapped = mapper.map(saved, HsOfficeDebitorResource.class);
+        final var mapped = mapper.map(saved, HsOfficeDebitorResource.class, ENTITY_TO_RESOURCE_POSTMAPPER);
        return ResponseEntity.ok(mapped);
    }
+
+    final BiConsumer<HsOfficeDebitorEntity, HsOfficeDebitorResource> ENTITY_TO_RESOURCE_POSTMAPPER = (entity, resource) -> {
+        resource.setDebitorNumber(entity.getTaggedDebitorNumber());
+    };
 }
--- a/src/main/java/net/hostsharing/hsadminng/hs/office/debitor/HsOfficeDebitorEntity.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/debitor/HsOfficeDebitorEntity.java
@ -11,11 +11,11 @@ import net.hostsharing.hsadminng.hs.office.partner.HsOfficePartnerEntity;
 import net.hostsharing.hsadminng.hs.office.relation.HsOfficeRelation;
 import net.hostsharing.hsadminng.hs.office.relation.HsOfficeRelationRealEntity;
 import net.hostsharing.hsadminng.hs.office.relation.HsOfficeRelationRbacEntity;
-import net.hostsharing.hsadminng.rbac.object.BaseEntity;
+import net.hostsharing.hsadminng.persistence.BaseEntity;
 import net.hostsharing.hsadminng.rbac.generator.RbacView;
 import net.hostsharing.hsadminng.rbac.generator.RbacView.SQL;
-import net.hostsharing.hsadminng.stringify.Stringify;
-import net.hostsharing.hsadminng.stringify.Stringifyable;
+import net.hostsharing.hsadminng.repr.Stringify;
+import net.hostsharing.hsadminng.repr.Stringifyable;
 import org.hibernate.annotations.GenericGenerator;
 import org.hibernate.annotations.JoinFormula;
 import org.hibernate.annotations.NotFound;
@ -51,7 +51,7 @@ import static net.hostsharing.hsadminng.rbac.generator.RbacView.Role.*;
 import static net.hostsharing.hsadminng.rbac.generator.RbacView.SQL.directlyFetchedByDependsOnColumn;
 import static net.hostsharing.hsadminng.rbac.generator.RbacView.SQL.fetchedBySql;
 import static net.hostsharing.hsadminng.rbac.generator.RbacView.rbacViewFor;
-import static net.hostsharing.hsadminng.stringify.Stringify.stringify;
+import static net.hostsharing.hsadminng.repr.Stringify.stringify;

@Entity
@Table(schema = "hs_office", name = "debitor_rv")
@ -142,19 +142,14 @@ public class HsOfficeDebitorEntity implements BaseEntity<HsOfficeDebitorEntity>,
        return this;
    }

-    private String getDebitorNumberString() {
+    public String getTaggedDebitorNumber() {
        return ofNullable(partner)
                .filter(partner -> debitorNumberSuffix != null)
                .map(HsOfficePartnerEntity::getPartnerNumber)
-                .map(Object::toString)
-                .map(partnerNumber -> partnerNumber + debitorNumberSuffix)
+                .map(partnerNumber -> DEBITOR_NUMBER_TAG + partnerNumber + debitorNumberSuffix)
                .orElse(null);
    }

-    public Integer getDebitorNumber() {
-        return ofNullable(getDebitorNumberString()).map(Integer::parseInt).orElse(null);
-    }
-
    @Override
    public String toString() {
        return stringify.apply(this);
@ -162,7 +157,7 @@ public class HsOfficeDebitorEntity implements BaseEntity<HsOfficeDebitorEntity>,

    @Override
    public String toShortString() {
-        return DEBITOR_NUMBER_TAG + getDebitorNumberString();
+        return getTaggedDebitorNumber();
    }

    public static RbacView rbac() {
--- a/src/main/java/net/hostsharing/hsadminng/hs/office/debitor/HsOfficeDebitorRepository.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/debitor/HsOfficeDebitorRepository.java
@ -16,13 +16,16 @@ public interface HsOfficeDebitorRepository extends Repository<HsOfficeDebitorEnt
            JOIN HsOfficePartnerEntity partner
                    ON partner.partnerRel.holder = debitor.debitorRel.anchor
                        AND partner.partnerRel.type = 'PARTNER' AND debitor.debitorRel.type = 'DEBITOR'
-                WHERE cast(partner.partnerNumber as integer) = :partnerNumber
-                  AND cast(debitor.debitorNumberSuffix as integer) = :debitorNumberSuffix
-               """)
-     List<HsOfficeDebitorEntity> findDebitorByDebitorNumber(int partnerNumber, byte debitorNumberSuffix);
+                WHERE partner.partnerNumber = :partnerNumber
+                  AND debitor.debitorNumberSuffix = :debitorNumberSuffix
+            """)
+     List<HsOfficeDebitorEntity> findDebitorByDebitorNumber(int partnerNumber, String debitorNumberSuffix);

    default List<HsOfficeDebitorEntity> findDebitorByDebitorNumber(int debitorNumber) {
-        return  findDebitorByDebitorNumber( debitorNumber/100, (byte) (debitorNumber%100));
+        final var partnerNumber = debitorNumber / 100;
+        final String suffix = String.format("%02d", debitorNumber % 100);
+        final var result = findDebitorByDebitorNumber(partnerNumber, suffix);
+        return result;
    }

    @Query("""
--- a/src/main/java/net/hostsharing/hsadminng/hs/office/membership/HsOfficeMembershipController.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/membership/HsOfficeMembershipController.java
@ -16,8 +16,10 @@ import java.util.List;
 import java.util.UUID;
 import java.util.function.BiConsumer;

-@RestController
+import static java.util.Optional.ofNullable;
+import static net.hostsharing.hsadminng.repr.TaggedNumber.cropTag;

+@RestController
 public class HsOfficeMembershipController implements HsOfficeMembershipsApi {

    @Autowired
@ -31,16 +33,18 @@ public class HsOfficeMembershipController implements HsOfficeMembershipsApi {

    @Override
    @Transactional(readOnly = true)
-    public ResponseEntity<List<HsOfficeMembershipResource>> listMemberships(
+    public ResponseEntity<List<HsOfficeMembershipResource>> getListOfMemberships(
            final String currentSubject,
            final String assumedRoles,
-            UUID partnerUuid,
-            Integer memberNumber) {
+            final UUID partnerUuid,
+            final String memberNumber) {
        context.define(currentSubject, assumedRoles);

-        final var entities = ( memberNumber != null)
-                    ? List.of(membershipRepo.findMembershipByMemberNumber(memberNumber))
-                    : membershipRepo.findMembershipsByOptionalPartnerUuid(partnerUuid);
+        final var entities = (memberNumber != null)
+                ? ofNullable(membershipRepo.findMembershipByMemberNumber(
+                    cropTag(HsOfficeMembershipEntity.MEMBER_NUMBER_TAG, memberNumber))).stream()
+                    .toList()
+                : membershipRepo.findMembershipsByOptionalPartnerUuid(partnerUuid);

        final var resources = mapper.mapList(entities, HsOfficeMembershipResource.class,
                SEPA_MANDATE_ENTITY_TO_RESOURCE_POSTMAPPER);
@ -49,7 +53,7 @@ public class HsOfficeMembershipController implements HsOfficeMembershipsApi {

    @Override
    @Transactional
-    public ResponseEntity<HsOfficeMembershipResource> addMembership(
+    public ResponseEntity<HsOfficeMembershipResource> postNewMembership(
            final String currentSubject,
            final String assumedRoles,
            final HsOfficeMembershipInsertResource body) {
@ -72,7 +76,7 @@ public class HsOfficeMembershipController implements HsOfficeMembershipsApi {

    @Override
    @Transactional(readOnly = true)
-    public ResponseEntity<HsOfficeMembershipResource> getMembershipByUuid(
+    public ResponseEntity<HsOfficeMembershipResource> getSingleMembershipByUuid(
            final String currentSubject,
            final String assumedRoles,
            final UUID membershipUuid) {
@ -123,7 +127,7 @@ public class HsOfficeMembershipController implements HsOfficeMembershipsApi {
    }

    final BiConsumer<HsOfficeMembershipEntity, HsOfficeMembershipResource> SEPA_MANDATE_ENTITY_TO_RESOURCE_POSTMAPPER = (entity, resource) -> {
-        // TODO.refa: this should be possible via ModelMapper config
+        resource.setMemberNumber(entity.getTaggedMemberNumber());
        resource.setValidFrom(entity.getValidity().lower());
        if (entity.getValidity().hasUpperBound()) {
            resource.setValidTo(entity.getValidity().upper().minusDays(1));
--- a/src/main/java/net/hostsharing/hsadminng/hs/office/membership/HsOfficeMembershipEntity.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/membership/HsOfficeMembershipEntity.java
@ -9,12 +9,12 @@ import lombok.NoArgsConstructor;
 import lombok.Setter;
 import net.hostsharing.hsadminng.errors.DisplayAs;
 import net.hostsharing.hsadminng.hs.office.relation.HsOfficeRelationRbacEntity;
-import net.hostsharing.hsadminng.rbac.object.BaseEntity;
+import net.hostsharing.hsadminng.persistence.BaseEntity;
 import net.hostsharing.hsadminng.hs.office.partner.HsOfficePartnerEntity;
 import net.hostsharing.hsadminng.rbac.generator.RbacView;
 import net.hostsharing.hsadminng.rbac.generator.RbacView.SQL;
-import net.hostsharing.hsadminng.stringify.Stringify;
-import net.hostsharing.hsadminng.stringify.Stringifyable;
+import net.hostsharing.hsadminng.repr.Stringify;
+import net.hostsharing.hsadminng.repr.Stringifyable;
 import org.hibernate.annotations.Type;

 import jakarta.persistence.Column;
@ -53,7 +53,7 @@ import static net.hostsharing.hsadminng.rbac.generator.RbacView.Role.OWNER;
 import static net.hostsharing.hsadminng.rbac.generator.RbacView.Role.TENANT;
 import static net.hostsharing.hsadminng.rbac.generator.RbacView.SQL.fetchedBySql;
 import static net.hostsharing.hsadminng.rbac.generator.RbacView.rbacViewFor;
-import static net.hostsharing.hsadminng.stringify.Stringify.stringify;
+import static net.hostsharing.hsadminng.repr.Stringify.stringify;

@Entity
@Table(schema = "hs_office", name = "membership_rv")
@ -130,6 +130,7 @@ public class HsOfficeMembershipEntity implements BaseEntity<HsOfficeMembershipEn
        }
        return validity;
    }
+
    public Integer getMemberNumber() {
        if (partner == null || partner.getPartnerNumber() == null || memberNumberSuffix == null ) {
            return null;
@ -138,6 +139,10 @@ public class HsOfficeMembershipEntity implements BaseEntity<HsOfficeMembershipEn
        return getPartner().getPartnerNumber() * 100 + Integer.parseInt(memberNumberSuffix, 10);
    }

+    public String getTaggedMemberNumber() {
+        return MEMBER_NUMBER_TAG + getMemberNumber();
+    }
+
    @Override
    public String toString() {
        return stringify.apply(this);
--- a/src/main/java/net/hostsharing/hsadminng/hs/office/membership/HsOfficeMembershipRepository.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/membership/HsOfficeMembershipRepository.java
@ -14,14 +14,16 @@ public interface HsOfficeMembershipRepository extends Repository<HsOfficeMembers

    HsOfficeMembershipEntity save(final HsOfficeMembershipEntity entity);

+    List<HsOfficeMembershipEntity> findAll();

    @Query("""
            SELECT membership FROM HsOfficeMembershipEntity membership
                WHERE ( CAST(:partnerUuid as org.hibernate.type.UUIDCharType) IS NULL
                        OR membership.partner.uuid = :partnerUuid )
                ORDER BY membership.partner.partnerNumber, membership.memberNumberSuffix
-               """)
+            """)
    List<HsOfficeMembershipEntity> findMembershipsByOptionalPartnerUuid(UUID partnerUuid);
+
    @Query("""
            SELECT membership FROM HsOfficeMembershipEntity membership
                WHERE (:partnerNumber = membership.partner.partnerNumber) 
@ -31,10 +33,12 @@ public interface HsOfficeMembershipRepository extends Repository<HsOfficeMembers
    HsOfficeMembershipEntity findMembershipByPartnerNumberAndSuffix(
            @NotNull Integer partnerNumber,
            @NotNull String suffix);
+
    default HsOfficeMembershipEntity findMembershipByMemberNumber(Integer memberNumber) {
        final var partnerNumber = memberNumber / 100;
-        final var suffix = memberNumber % 100;
-        return findMembershipByPartnerNumberAndSuffix(partnerNumber, String.format("%02d", suffix));
+        final String suffix = String.format("%02d", memberNumber % 100);
+        final var result = findMembershipByPartnerNumberAndSuffix(partnerNumber, suffix);
+        return result;
    }

    long count();
--- a/src/main/java/net/hostsharing/hsadminng/hs/office/partner/HsOfficePartnerController.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/partner/HsOfficePartnerController.java
@ -13,7 +13,7 @@ import net.hostsharing.hsadminng.hs.office.relation.HsOfficeRelationRealEntity;
 import net.hostsharing.hsadminng.hs.office.relation.HsOfficeRelationRealRepository;
 import net.hostsharing.hsadminng.hs.office.relation.HsOfficeRelationType;
 import net.hostsharing.hsadminng.mapper.StandardMapper;
-import net.hostsharing.hsadminng.rbac.object.BaseEntity;
+import net.hostsharing.hsadminng.persistence.BaseEntity;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
@ -27,6 +27,7 @@ import java.util.List;
 import java.util.UUID;

 import static net.hostsharing.hsadminng.hs.office.relation.HsOfficeRelationType.EX_PARTNER;
+import static net.hostsharing.hsadminng.repr.TaggedNumber.cropTag;

@RestController

@ -143,13 +144,14 @@ public class HsOfficePartnerController implements HsOfficePartnersApi {

    private void optionallyCreateExPartnerRelation(final HsOfficePartnerEntity saved, final HsOfficeRelationRealEntity previousPartnerRel) {
        if (!saved.getPartnerRel().getUuid().equals(previousPartnerRel.getUuid())) {
+            // TODO.impl: we also need to use the new partner-person as the anchor
            relationRepo.save(previousPartnerRel.toBuilder().uuid(null).type(EX_PARTNER).build());
        }
    }

    private HsOfficePartnerEntity createPartnerEntity(final HsOfficePartnerInsertResource body) {
        final var entityToSave = new HsOfficePartnerEntity();
-        entityToSave.setPartnerNumber(body.getPartnerNumber());
+        entityToSave.setPartnerNumber(cropTag(HsOfficePartnerEntity.PARTNER_NUMBER_TAG, body.getPartnerNumber()));
        entityToSave.setPartnerRel(persistPartnerRel(body.getPartnerRel()));
        entityToSave.setDetails(mapper.map(body.getDetails(), HsOfficePartnerDetailsEntity.class));
        return entityToSave;
--- a/src/main/java/net/hostsharing/hsadminng/hs/office/partner/HsOfficePartnerDetailsEntity.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/partner/HsOfficePartnerDetailsEntity.java
@ -2,11 +2,11 @@ package net.hostsharing.hsadminng.hs.office.partner;

 import lombok.*;
 import net.hostsharing.hsadminng.errors.DisplayAs;
-import net.hostsharing.hsadminng.rbac.object.BaseEntity;
+import net.hostsharing.hsadminng.persistence.BaseEntity;
 import net.hostsharing.hsadminng.rbac.generator.RbacView;
 import net.hostsharing.hsadminng.rbac.generator.RbacView.SQL;
-import net.hostsharing.hsadminng.stringify.Stringify;
-import net.hostsharing.hsadminng.stringify.Stringifyable;
+import net.hostsharing.hsadminng.repr.Stringify;
+import net.hostsharing.hsadminng.repr.Stringifyable;

 import jakarta.persistence.*;
 import java.io.IOException;
@ -17,7 +17,7 @@ import static net.hostsharing.hsadminng.rbac.generator.RbacView.GLOBAL;
 import static net.hostsharing.hsadminng.rbac.generator.RbacView.Permission.*;
 import static net.hostsharing.hsadminng.rbac.generator.RbacView.Role.*;
 import static net.hostsharing.hsadminng.rbac.generator.RbacView.rbacViewFor;
-import static net.hostsharing.hsadminng.stringify.Stringify.stringify;
+import static net.hostsharing.hsadminng.repr.Stringify.stringify;

@Entity
@Table(schema = "hs_office", name = "partner_details_rv")
--- a/src/main/java/net/hostsharing/hsadminng/hs/office/partner/HsOfficePartnerEntity.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/partner/HsOfficePartnerEntity.java
@ -10,12 +10,12 @@ import net.hostsharing.hsadminng.hs.office.contact.HsOfficeContact;
 import net.hostsharing.hsadminng.hs.office.person.HsOfficePersonEntity;
 import net.hostsharing.hsadminng.hs.office.relation.HsOfficeRelationRealEntity;
 import net.hostsharing.hsadminng.hs.office.relation.HsOfficeRelationRbacEntity;
-import net.hostsharing.hsadminng.rbac.object.BaseEntity;
+import net.hostsharing.hsadminng.persistence.BaseEntity;
 import net.hostsharing.hsadminng.hs.office.relation.HsOfficeRelation;
 import net.hostsharing.hsadminng.rbac.generator.RbacView;
 import net.hostsharing.hsadminng.rbac.generator.RbacView.SQL;
-import net.hostsharing.hsadminng.stringify.Stringify;
-import net.hostsharing.hsadminng.stringify.Stringifyable;
+import net.hostsharing.hsadminng.repr.Stringify;
+import net.hostsharing.hsadminng.repr.Stringifyable;
 import org.hibernate.annotations.NotFound;
 import org.hibernate.annotations.NotFoundAction;

@ -33,7 +33,7 @@ import static net.hostsharing.hsadminng.rbac.generator.RbacView.Role.*;
 import static net.hostsharing.hsadminng.rbac.generator.RbacView.SQL.directlyFetchedByDependsOnColumn;
 import static net.hostsharing.hsadminng.rbac.generator.RbacView.rbacViewFor;
 import static java.util.Optional.ofNullable;
-import static net.hostsharing.hsadminng.stringify.Stringify.stringify;
+import static net.hostsharing.hsadminng.repr.Stringify.stringify;

@Entity
@Table(schema = "hs_office", name = "partner_rv")
--- a/src/main/java/net/hostsharing/hsadminng/hs/office/person/HsOfficePersonEntity.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/person/HsOfficePersonEntity.java
@ -3,11 +3,11 @@ package net.hostsharing.hsadminng.hs.office.person;
 import lombok.*;
 import lombok.experimental.FieldNameConstants;
 import net.hostsharing.hsadminng.errors.DisplayAs;
-import net.hostsharing.hsadminng.rbac.object.BaseEntity;
+import net.hostsharing.hsadminng.persistence.BaseEntity;
 import net.hostsharing.hsadminng.rbac.generator.RbacView;
 import net.hostsharing.hsadminng.rbac.generator.RbacView.SQL;
-import net.hostsharing.hsadminng.stringify.Stringify;
-import net.hostsharing.hsadminng.stringify.Stringifyable;
+import net.hostsharing.hsadminng.repr.Stringify;
+import net.hostsharing.hsadminng.repr.Stringifyable;
 import org.apache.commons.lang3.StringUtils;

 import jakarta.persistence.*;
@ -19,8 +19,9 @@ import static net.hostsharing.hsadminng.rbac.generator.RbacView.Permission.*;
 import static net.hostsharing.hsadminng.rbac.generator.RbacView.RbacSubjectReference.UserRole.CREATOR;
 import static net.hostsharing.hsadminng.rbac.generator.RbacView.Role.*;
 import static net.hostsharing.hsadminng.rbac.generator.RbacView.rbacViewFor;
-import static net.hostsharing.hsadminng.stringify.Stringify.stringify;
+import static net.hostsharing.hsadminng.repr.Stringify.stringify;

+// TODO.refa: split HsOfficePersonEntity into Real+Rbac-Entity
@Entity
@Table(schema = "hs_office", name = "person_rv")
@Getter
--- a/src/main/java/net/hostsharing/hsadminng/hs/office/person/HsOfficePersonTypeConverter.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/person/HsOfficePersonTypeConverter.java
@ -4,6 +4,7 @@ import jakarta.persistence.AttributeConverter;
 import jakarta.persistence.Converter;
 import java.util.stream.Stream;

+// HOWTO: convert data types for exchange between PostgreSQL and Java/Hibernate/JPA-Entities
@Converter(autoApply = true)
 public class HsOfficePersonTypeConverter implements AttributeConverter<HsOfficePersonType, String> {

--- a/src/main/java/net/hostsharing/hsadminng/hs/office/relation/HsOfficeRelation.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/relation/HsOfficeRelation.java
@ -5,15 +5,15 @@ import lombok.experimental.FieldNameConstants;
 import lombok.experimental.SuperBuilder;
 import net.hostsharing.hsadminng.hs.office.contact.HsOfficeContactRealEntity;
 import net.hostsharing.hsadminng.hs.office.person.HsOfficePersonEntity;
-import net.hostsharing.hsadminng.rbac.object.BaseEntity;
-import net.hostsharing.hsadminng.stringify.Stringify;
-import net.hostsharing.hsadminng.stringify.Stringifyable;
+import net.hostsharing.hsadminng.persistence.BaseEntity;
+import net.hostsharing.hsadminng.repr.Stringify;
+import net.hostsharing.hsadminng.repr.Stringifyable;

 import jakarta.persistence.*;
 import jakarta.persistence.Column;
 import java.util.UUID;

-import static net.hostsharing.hsadminng.stringify.Stringify.stringify;
+import static net.hostsharing.hsadminng.repr.Stringify.stringify;

@MappedSuperclass
@NoArgsConstructor(access = AccessLevel.PROTECTED)
--- a/src/main/java/net/hostsharing/hsadminng/hs/office/relation/HsOfficeRelationController.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/relation/HsOfficeRelationController.java
@ -37,7 +37,7 @@ public class HsOfficeRelationController implements HsOfficeRelationsApi {
    private HsOfficePersonRepository holderRepo;

    @Autowired
-    private HsOfficeContactRealRepository contactrealRepo;
+    private HsOfficeContactRealRepository realContactRepo;

    @PersistenceContext
    private EntityManager em;
@ -48,11 +48,16 @@ public class HsOfficeRelationController implements HsOfficeRelationsApi {
            final String currentSubject,
            final String assumedRoles,
            final UUID personUuid,
-            final HsOfficeRelationTypeResource relationType) {
+            final HsOfficeRelationTypeResource relationType,
+            final String personData,
+            final String contactData) {
        context.define(currentSubject, assumedRoles);

-        final var entities = relationRbacRepo.findRelationRelatedToPersonUuidAndRelationType(personUuid,
-                mapper.map(relationType, HsOfficeRelationType.class));
+        final List<HsOfficeRelationRbacEntity> entities =
+                relationRbacRepo.findRelationRelatedToPersonUuidRelationTypePersonAndContactData(
+                        personUuid,
+                        relationType == null ? null : HsOfficeRelationType.valueOf(relationType.name()),
+                        personData, contactData);

        final var resources = mapper.mapList(entities, HsOfficeRelationResource.class,
                RELATION_ENTITY_TO_RESOURCE_POSTMAPPER);
@ -77,7 +82,7 @@ public class HsOfficeRelationController implements HsOfficeRelationsApi {
        entityToSave.setHolder(holderRepo.findByUuid(body.getHolderUuid()).orElseThrow(
                () -> new NoSuchElementException("cannot find Person by holderUuid: " + body.getHolderUuid())
        ));
-        entityToSave.setContact(contactrealRepo.findByUuid(body.getContactUuid()).orElseThrow(
+        entityToSave.setContact(realContactRepo.findByUuid(body.getContactUuid()).orElseThrow(
                () -> new NoSuchElementException("cannot find Contact by contactUuid: " + body.getContactUuid())
        ));

@ -144,7 +149,6 @@ public class HsOfficeRelationController implements HsOfficeRelationsApi {
        return ResponseEntity.ok(mapped);
    }

-
    final BiConsumer<HsOfficeRelationRbacEntity, HsOfficeRelationResource> RELATION_ENTITY_TO_RESOURCE_POSTMAPPER = (entity, resource) -> {
        resource.setAnchor(mapper.map(entity.getAnchor(), HsOfficePersonResource.class));
        resource.setHolder(mapper.map(entity.getHolder(), HsOfficePersonResource.class));
--- a/src/main/java/net/hostsharing/hsadminng/hs/office/relation/HsOfficeRelationRbacRepository.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/relation/HsOfficeRelationRbacRepository.java
@ -12,26 +12,62 @@ public interface HsOfficeRelationRbacRepository extends Repository<HsOfficeRelat

    Optional<HsOfficeRelationRbacEntity> findByUuid(UUID id);

-    default List<HsOfficeRelationRbacEntity> findRelationRelatedToPersonUuidAndRelationType(@NotNull UUID personUuid, HsOfficeRelationType relationType) {
-        return findRelationRelatedToPersonUuidAndRelationTypeString(personUuid, relationType.toString());
-    }
-
    @Query(value = """
            SELECT p.* FROM hs_office.relation_rv AS p
                WHERE p.anchorUuid = :personUuid OR p.holderUuid = :personUuid
-               """, nativeQuery = true)
+            """, nativeQuery = true)
    List<HsOfficeRelationRbacEntity> findRelationRelatedToPersonUuid(@NotNull UUID personUuid);

+    /**
+     * Finds relations by a conjunction of optional criteria, including anchorPerson, holderPerson and contact data.
+     *      *
+     * @param personUuid the optional UUID of the anchorPerson or holderPerson
+     * @param relationType the type of the relation
+     * @param personData a string to match the persons tradeName, familyName or givenName (use '%' for wildcard), case ignored
+     * @param contactData a string to match the contacts caption, postalAddress, emailAddresses or phoneNumbers (use '%' for wildcard), case ignored
+     * @return a list of (accessible) relations which match all given criteria
+     */
+    default List<HsOfficeRelationRbacEntity> findRelationRelatedToPersonUuidRelationTypePersonAndContactData(
+            final UUID personUuid,
+            final HsOfficeRelationType relationType,
+            final String personData,
+            final String contactData) {
+        return findRelationRelatedToPersonUuidRelationTypePersonAndContactDataImpl(
+                personUuid, toStringOrNull(relationType), toSqlLikeOperand(personData), toSqlLikeOperand(contactData));
+    }
+
    @Query(value = """
-            SELECT p.* FROM hs_office.relation_rv AS p
-                WHERE (:relationType IS NULL OR p.type = cast(:relationType AS hs_office.RelationType))
-                    AND ( p.anchorUuid = :personUuid OR p.holderUuid = :personUuid)
-               """, nativeQuery = true)
-    List<HsOfficeRelationRbacEntity> findRelationRelatedToPersonUuidAndRelationTypeString(@NotNull UUID personUuid, String relationType);
+            SELECT rel FROM HsOfficeRelationRbacEntity AS rel
+                WHERE (:relationType IS NULL OR CAST(rel.type AS String) = :relationType)
+                    AND ( :personUuid IS NULL
+                            OR rel.anchor.uuid = :personUuid OR rel.holder.uuid = :personUuid )
+                    AND ( :personData IS NULL
+                            OR lower(rel.anchor.tradeName) LIKE :personData OR lower(rel.holder.tradeName) LIKE :personData
+                            OR lower(rel.anchor.familyName) LIKE :personData OR lower(rel.holder.familyName) LIKE :personData
+                            OR lower(rel.anchor.givenName) LIKE :personData OR lower(rel.holder.givenName) LIKE :personData )
+                    AND ( :contactData IS NULL
+                            OR lower(rel.contact.caption) LIKE :contactData
+                            OR lower(CAST(rel.contact.postalAddress AS String)) LIKE :contactData
+                            OR lower(CAST(rel.contact.emailAddresses AS String)) LIKE :contactData
+                            OR lower(CAST(rel.contact.phoneNumbers AS String)) LIKE :contactData )
+            """)
+    List<HsOfficeRelationRbacEntity> findRelationRelatedToPersonUuidRelationTypePersonAndContactDataImpl(
+            final UUID personUuid,
+            final String relationType,
+            final String personData,
+            final String contactData);

    HsOfficeRelationRbacEntity save(final HsOfficeRelationRbacEntity entity);

    long count();

    int deleteByUuid(UUID uuid);
+
+    private static String toSqlLikeOperand(final String text) {
+        return text == null ? null : ("%" + text.toLowerCase() + "%");
+    }
+
+    private static String toStringOrNull(final HsOfficeRelationType relationType) {
+        return relationType == null ? null : relationType.name();
+    }
 }
--- a/src/main/java/net/hostsharing/hsadminng/hs/office/relation/HsOfficeRelationRealRepository.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/relation/HsOfficeRelationRealRepository.java
@ -13,7 +13,7 @@ public interface HsOfficeRelationRealRepository extends Repository<HsOfficeRelat
    Optional<HsOfficeRelationRealEntity> findByUuid(UUID id);

    default List<HsOfficeRelationRealEntity> findRelationRelatedToPersonUuidAndRelationType(@NotNull UUID personUuid, HsOfficeRelationType relationType) {
-        return findRelationRelatedToPersonUuidAndRelationTypeString(personUuid, relationType.toString());
+        return findRelationRelatedToPersonUuidAndRelationTypeString(personUuid, relationType == null ? null : relationType.toString());
    }

    @Query(value = """
--- a/src/main/java/net/hostsharing/hsadminng/hs/office/relation/HsOfficeRelationType.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/relation/HsOfficeRelationType.java
@ -8,5 +8,6 @@ public enum HsOfficeRelationType {
    VIP_CONTACT,
    DEBITOR,
    OPERATIONS,
+    OPERATIONS_ALERT,
    SUBSCRIBER
 }
--- a/src/main/java/net/hostsharing/hsadminng/hs/office/sepamandate/HsOfficeSepaMandateController.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/sepamandate/HsOfficeSepaMandateController.java
@ -131,7 +131,7 @@ public class HsOfficeSepaMandateController implements HsOfficeSepaMandatesApi {
        if (entity.getValidity().hasUpperBound()) {
            resource.setValidTo(entity.getValidity().upper().minusDays(1));
        }
-        resource.getDebitor().setDebitorNumber(entity.getDebitor().getDebitorNumber());
+        resource.getDebitor().setDebitorNumber(entity.getDebitor().getTaggedDebitorNumber());
    };

    final BiConsumer<HsOfficeSepaMandateInsertResource, HsOfficeSepaMandateEntity> SEPA_MANDATE_RESOURCE_TO_ENTITY_POSTMAPPER = (resource, entity) -> {
--- a/src/main/java/net/hostsharing/hsadminng/hs/office/sepamandate/HsOfficeSepaMandateEntity.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/sepamandate/HsOfficeSepaMandateEntity.java
@ -7,10 +7,10 @@ import net.hostsharing.hsadminng.errors.DisplayAs;
 import net.hostsharing.hsadminng.hs.office.bankaccount.HsOfficeBankAccountEntity;
 import net.hostsharing.hsadminng.hs.office.debitor.HsOfficeDebitorEntity;
 import net.hostsharing.hsadminng.hs.office.relation.HsOfficeRelationRbacEntity;
-import net.hostsharing.hsadminng.rbac.object.BaseEntity;
+import net.hostsharing.hsadminng.persistence.BaseEntity;
 import net.hostsharing.hsadminng.rbac.generator.RbacView;
-import net.hostsharing.hsadminng.stringify.Stringify;
-import net.hostsharing.hsadminng.stringify.Stringifyable;
+import net.hostsharing.hsadminng.repr.Stringify;
+import net.hostsharing.hsadminng.repr.Stringifyable;
 import org.hibernate.annotations.Type;

 import jakarta.persistence.*;
@ -30,7 +30,7 @@ import static net.hostsharing.hsadminng.rbac.generator.RbacView.RbacSubjectRefer
 import static net.hostsharing.hsadminng.rbac.generator.RbacView.Role.*;
 import static net.hostsharing.hsadminng.rbac.generator.RbacView.SQL.*;
 import static net.hostsharing.hsadminng.rbac.generator.RbacView.rbacViewFor;
-import static net.hostsharing.hsadminng.stringify.Stringify.stringify;
+import static net.hostsharing.hsadminng.repr.Stringify.stringify;

@Entity
@Table(schema = "hs_office", name = "sepamandate_rv")
--- a/src/main/java/net/hostsharing/hsadminng/hs/validation/IntegerProperty.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/validation/IntegerProperty.java
@ -56,6 +56,10 @@ public class IntegerProperty<P extends IntegerProperty<P>> extends ValidatablePr
        return unit;
    }

+    public Integer min() {
+        return min;
+    }
+
    public Integer max() {
        return max;
    }
--- a/src/main/java/net/hostsharing/hsadminng/hs/validation/PasswordProperty.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/validation/PasswordProperty.java
@ -31,7 +31,7 @@ public class PasswordProperty extends StringProperty<PasswordProperty> {

    @Override
    protected void validate(final List<String> result, final String propValue, final PropertiesProvider propProvider) {
-        // TODO.impl: remove after legacy data is migrated
+        // TODO.legacy: remove after legacy data is migrated
        if (HashGenerator.using(hashedUsing).couldBeHash(propValue) && propValue.length() > this.maxLength()) {
            // already hashed => do not validate
            return;
--- a/src/main/java/net/hostsharing/hsadminng/hs/validation/StringProperty.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/validation/StringProperty.java
@ -3,6 +3,7 @@ package net.hostsharing.hsadminng.hs.validation;
 import lombok.AccessLevel;
 import lombok.Setter;
 import net.hostsharing.hsadminng.mapper.Array;
+import org.apache.commons.lang3.ArrayUtils;

 import java.util.Arrays;
 import java.util.List;
@ -83,11 +84,15 @@ public class StringProperty<P extends StringProperty<P>> extends ValidatableProp
    }

    /// predefined values, similar to fixed values in a combobox
-    public P provided(final String... provided) {
-        this.provided = provided;
+    public P provided(final String firstProvidedValue, final String... moreProvidedValues) {
+        this.provided = ArrayUtils.addAll(new String[]{firstProvidedValue}, moreProvidedValues);
        return self();
    }

+    public String[] provided() {
+        return this.provided;
+    }
+
    /**
     * The property value is not disclosed in error messages.
     *
@ -109,7 +114,11 @@ public class StringProperty<P extends StringProperty<P>> extends ValidatableProp

    @Override
    protected String display(final String propValue) {
-        return undisclosed ? "provided value" : ("'" + propValue + "'");
+        return undisclosed
+            ? "provided value"
+            : propValue != null
+                ? ("'" + propValue + "'")
+                : null;
    }

    @Override
--- a/src/main/java/net/hostsharing/hsadminng/lambda/Reducer.java
+++ b/src/main/java/net/hostsharing/hsadminng/lambda/Reducer.java
@ -0,0 +1,11 @@
+package net.hostsharing.hsadminng.lambda;
+
+import lombok.experimental.UtilityClass;
+
+@UtilityClass
+public class Reducer {
+    public static  <T> T toSingleElement(T ignoredLast, T ignoredNext) {
+        throw new AssertionError("only a single entity expected");
+    }
+
+}
--- a/src/main/java/net/hostsharing/hsadminng/mapper/Mapper.java
+++ b/src/main/java/net/hostsharing/hsadminng/mapper/Mapper.java
@ -1,11 +1,11 @@
 package net.hostsharing.hsadminng.mapper;

+import net.hostsharing.hsadminng.persistence.EntityManagerWrapper;
 import org.modelmapper.ModelMapper;
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.util.ReflectionUtils;

-import jakarta.persistence.EntityManager;
 import jakarta.persistence.ManyToOne;
-import jakarta.persistence.PersistenceContext;
 import jakarta.validation.ValidationException;
 import java.lang.reflect.Field;
 import java.util.List;
@ -21,10 +21,10 @@ import static net.hostsharing.hsadminng.errors.DisplayAs.DisplayName;
 */
 abstract class Mapper extends ModelMapper {

-    @PersistenceContext
-    EntityManager em;
+    EntityManagerWrapper em;

-    Mapper() {
+    Mapper(@Autowired final EntityManagerWrapper em) {
+        this.em = em;
        getConfiguration().setAmbiguityIgnored(true);
    }

--- a/src/main/java/net/hostsharing/hsadminng/mapper/StandardMapper.java
+++ b/src/main/java/net/hostsharing/hsadminng/mapper/StandardMapper.java
@ -1,5 +1,7 @@
 package net.hostsharing.hsadminng.mapper;

+import net.hostsharing.hsadminng.persistence.EntityManagerWrapper;
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Component;

 /**
@ -8,7 +10,8 @@ import org.springframework.stereotype.Component;
@Component
 public class StandardMapper extends Mapper {

-    public StandardMapper() {
+    public StandardMapper(@Autowired final EntityManagerWrapper em) {
+        super(em);
        getConfiguration().setAmbiguityIgnored(true);
    }
 }
--- a/src/main/java/net/hostsharing/hsadminng/mapper/StrictMapper.java
+++ b/src/main/java/net/hostsharing/hsadminng/mapper/StrictMapper.java
@ -1,5 +1,7 @@
 package net.hostsharing.hsadminng.mapper;

+import net.hostsharing.hsadminng.persistence.EntityManagerWrapper;
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Component;

 import static org.modelmapper.convention.MatchingStrategies.STRICT;
@ -13,7 +15,8 @@ import static org.modelmapper.convention.MatchingStrategies.STRICT;
@Component
 public class StrictMapper extends Mapper {

-    public StrictMapper() {
+    public StrictMapper(@Autowired final EntityManagerWrapper em) {
+        super(em);
        getConfiguration().setMatchingStrategy(STRICT);
    }
 }
--- a/src/main/java/net/hostsharing/hsadminng/mapper/ToStringConverter.java
+++ b/src/main/java/net/hostsharing/hsadminng/mapper/ToStringConverter.java
@ -0,0 +1,44 @@
+package net.hostsharing.hsadminng.mapper;
+
+import java.util.*;
+
+import static java.util.stream.Collectors.joining;
+
+public class ToStringConverter {
+
+    final public Set<String> ignoredFields = new HashSet<>();
+
+    public ToStringConverter ignoring(final String fieldName) {
+        ignoredFields.add(fieldName);
+        return this;
+    }
+
+    public String from(final Object obj) {
+        return "{ " +
+            Arrays.stream(obj.getClass().getDeclaredFields())
+                    .filter(f -> !ignoredFields.contains(f.getName()))
+                    .map(field -> {
+                        try {
+                            field.setAccessible(true);
+                            return field.getName() + ": " + field.get(obj);
+                        } catch (IllegalAccessException e) {
+                            // ignore inaccessible fields
+                            return null;
+                        }
+                    })
+                    .filter(Objects::nonNull)
+                    .collect(joining(", "))
+        + " }";
+    }
+
+    public String from(final Map<?, ?> map) {
+        return "{ "
+            + map.keySet().stream()
+                .filter(key -> !ignoredFields.contains(key.toString()))
+                .sorted()
+                .map(k -> Map.entry(k, map.get(k)))
+                .map(e -> e.getKey() + ": " + e.getValue())
+                .collect(joining(", "))
+            + " }";
+    }
+}
--- a/src/main/java/net/hostsharing/hsadminng/persistence/BaseEntity.java
+++ b/src/main/java/net/hostsharing/hsadminng/persistence/BaseEntity.java
@ -1,11 +1,10 @@
-package net.hostsharing.hsadminng.rbac.object;
+package net.hostsharing.hsadminng.persistence;


 import org.hibernate.Hibernate;

 import java.util.UUID;

-// TODO.impl: this class does not really belong into this package, but there is no right place yet
 public interface BaseEntity<T extends BaseEntity<?>> {
    UUID getUuid();

--- a/src/main/java/net/hostsharing/hsadminng/persistence/EntityExistsValidator.java
+++ b/src/main/java/net/hostsharing/hsadminng/persistence/EntityExistsValidator.java
@ -1,7 +1,6 @@
 package net.hostsharing.hsadminng.persistence;

 import net.hostsharing.hsadminng.errors.DisplayAs.DisplayName;
-import net.hostsharing.hsadminng.rbac.object.BaseEntity;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;

--- a/src/main/java/net/hostsharing/hsadminng/rbac/generator/RbacView.java
+++ b/src/main/java/net/hostsharing/hsadminng/rbac/generator/RbacView.java
@ -2,7 +2,7 @@ package net.hostsharing.hsadminng.rbac.generator;

 import lombok.EqualsAndHashCode;
 import lombok.Getter;
-import net.hostsharing.hsadminng.rbac.object.BaseEntity;
+import net.hostsharing.hsadminng.persistence.BaseEntity;
 import org.reflections.Reflections;
 import org.reflections.scanners.TypeAnnotationsScanner;

--- a/src/main/java/net/hostsharing/hsadminng/rbac/grant/RbacGrantsDiagramService.java
+++ b/src/main/java/net/hostsharing/hsadminng/rbac/grant/RbacGrantsDiagramService.java
@ -30,7 +30,7 @@ public class RbacGrantsDiagramService {
        try (BufferedWriter writer = new BufferedWriter(new FileWriter(fileName))) {
            writer.write("""
                    ### all grants to %s
-                                        
+
                    ```mermaid
                    %s
                    ```
@ -62,7 +62,7 @@ public class RbacGrantsDiagramService {
    @PersistenceContext
    private EntityManager em;

-    private Map<UUID, List<RawRbacGrantEntity>> descendantsByUuid = new HashMap<>();
+    private final Map<UUID, List<RawRbacGrantEntity>> descendantsByUuid = new HashMap<>();

    public String allGrantsTocurrentSubject(final EnumSet<Include> includes) {
        final var graph = new LimitedHashSet<RawRbacGrantEntity>();
@ -231,8 +231,7 @@ public class RbacGrantsDiagramService {
        }
    }

-}
-
-record Node(String idName, UUID uuid) {
+    record Node(String idName, UUID uuid) {

+    }
 }
--- a/src/main/java/net/hostsharing/hsadminng/rbac/test/cust/TestCustomerEntity.java
+++ b/src/main/java/net/hostsharing/hsadminng/rbac/test/cust/TestCustomerEntity.java
@ -5,7 +5,7 @@ import lombok.Getter;
 import lombok.NoArgsConstructor;
 import lombok.Setter;
 import lombok.ToString;
-import net.hostsharing.hsadminng.rbac.object.BaseEntity;
+import net.hostsharing.hsadminng.persistence.BaseEntity;
 import net.hostsharing.hsadminng.rbac.generator.RbacView;
 import net.hostsharing.hsadminng.rbac.generator.RbacView.SQL;

--- a/src/main/java/net/hostsharing/hsadminng/rbac/test/dom/TestDomainEntity.java
+++ b/src/main/java/net/hostsharing/hsadminng/rbac/test/dom/TestDomainEntity.java
@ -4,7 +4,7 @@ import lombok.AllArgsConstructor;
 import lombok.Getter;
 import lombok.NoArgsConstructor;
 import lombok.Setter;
-import net.hostsharing.hsadminng.rbac.object.BaseEntity;
+import net.hostsharing.hsadminng.persistence.BaseEntity;
 import net.hostsharing.hsadminng.rbac.generator.RbacView;
 import net.hostsharing.hsadminng.rbac.generator.RbacView.SQL;
 import net.hostsharing.hsadminng.rbac.test.pac.TestPackageEntity;
--- a/src/main/java/net/hostsharing/hsadminng/rbac/test/pac/TestPackageEntity.java
+++ b/src/main/java/net/hostsharing/hsadminng/rbac/test/pac/TestPackageEntity.java
@ -4,7 +4,7 @@ import lombok.AllArgsConstructor;
 import lombok.Getter;
 import lombok.NoArgsConstructor;
 import lombok.Setter;
-import net.hostsharing.hsadminng.rbac.object.BaseEntity;
+import net.hostsharing.hsadminng.persistence.BaseEntity;
 import net.hostsharing.hsadminng.rbac.generator.RbacView;
 import net.hostsharing.hsadminng.rbac.generator.RbacView.SQL;
 import net.hostsharing.hsadminng.rbac.test.cust.TestCustomerEntity;
--- a/src/main/java/net/hostsharing/hsadminng/stringify/Stringify.java
+++ b/src/main/java/net/hostsharing/hsadminng/stringify/Stringify.java
@ -1,4 +1,4 @@
-package net.hostsharing.hsadminng.stringify;
+package net.hostsharing.hsadminng.repr;

 import net.hostsharing.hsadminng.errors.DisplayAs;

@ -80,12 +80,6 @@ public final class Stringify<B> {
                .map(prop -> PropertyValue.of(prop, prop.getter.apply(object)))
                .filter(Objects::nonNull)
                .filter(PropertyValue::nonEmpty)
-                .map(propVal -> {
-                    if (propVal.rawValue instanceof Stringifyable stringifyable) {
-                        return new PropertyValue<>(propVal.prop, propVal.rawValue, stringifyable.toShortString());
-                    }
-                    return propVal;
-                })
                .map(propVal -> propName(propVal, "=") + optionallyQuoted(propVal))
                .collect(Collectors.joining(separator));
        return idProp != null
@ -131,7 +125,11 @@ public final class Stringify<B> {
    private record PropertyValue<B>(Property<B> prop, Object rawValue, String value) {

        static <B> PropertyValue<B> of(Property<B> prop, Object rawValue) {
-            return rawValue != null ? new PropertyValue<>(prop, rawValue, rawValue.toString()) : null;
+            return rawValue != null ? new PropertyValue<>(prop, rawValue, toStringOrShortString(rawValue)) : null;
+        }
+
+        private static String toStringOrShortString(final Object rawValue) {
+            return rawValue instanceof Stringifyable stringifyable ? stringifyable.toShortString() : rawValue.toString();
        }

        boolean nonEmpty() {
--- a/src/main/java/net/hostsharing/hsadminng/stringify/Stringifyable.java
+++ b/src/main/java/net/hostsharing/hsadminng/stringify/Stringifyable.java
@ -1,4 +1,4 @@
-package net.hostsharing.hsadminng.stringify;
+package net.hostsharing.hsadminng.repr;

 public interface Stringifyable {

--- a/src/main/java/net/hostsharing/hsadminng/repr/TaggedNumber.java
+++ b/src/main/java/net/hostsharing/hsadminng/repr/TaggedNumber.java
@ -0,0 +1,15 @@
+package net.hostsharing.hsadminng.repr;
+
+import lombok.experimental.UtilityClass;
+
+@UtilityClass
+public class TaggedNumber {
+
+    public static Integer cropTag(final String tag, final String taggedNumber) {
+        return taggedNumber.startsWith(tag) ? Integer.valueOf(taggedNumber.substring(tag.length())) : invalidTag(tag, taggedNumber);
+    }
+
+    private static Integer invalidTag(final String tag, final String taggedNumber) {
+        throw new IllegalArgumentException("Expected " + tag + "... but got: " + taggedNumber);
+    }
+}
--- a/src/main/java/net/hostsharing/hsadminng/system/SystemProcess.java
+++ b/src/main/java/net/hostsharing/hsadminng/system/SystemProcess.java
@ -14,6 +14,7 @@ public class SystemProcess {

    @Getter
    private String stdOut;
+
    @Getter
    private String stdErr;

@ -21,7 +22,6 @@ public class SystemProcess {
        this.processBuilder = new ProcessBuilder(command);
    }

-
    public String getCommand() {
        return processBuilder.command().toString();
    }
--- a/src/main/resources/api-definition/api-definition.yaml
+++ b/src/main/resources/api-definition/api-definition.yaml
--- a/src/main/resources/api-definition/api-mappings.yaml
+++ b/src/main/resources/api-definition/api-mappings.yaml
--- a/src/main/resources/api-definition/hs-booking/hs-booking-item-schemas.yaml
+++ b/src/main/resources/api-definition/hs-booking/hs-booking-item-schemas.yaml
@ -10,6 +10,7 @@ components:
                - CLOUD_SERVER
                - MANAGED_SERVER
                - MANAGED_WEBSPACE
+                - DOMAIN_SETUP

        HsBookingItem:
            type: object
@ -51,7 +52,11 @@ components:
        HsBookingItemInsert:
            type: object
            properties:
-                projectUuid:
+                project.uuid:
+                    type: string
+                    format: uuid
+                    nullable: false
+                parentItem.uuid:
                    type: string
                    format: uuid
                    nullable: false
@ -68,9 +73,11 @@ components:
                    nullable: true
                resources:
                    $ref: '#/components/schemas/BookingResources'
+                hostingAsset:
+                    $ref: '../hs-hosting/hs-hosting-asset-schemas.yaml#/components/schemas/HsHostingAssetAutoInsert'
            required:
                - caption
-                - projectUuid
+                - project.uuid
                - validFrom
                - resources
            additionalProperties: false
--- a/src/main/resources/api-definition/hs-booking/hs-booking-project-schemas.yaml
+++ b/src/main/resources/api-definition/hs-booking/hs-booking-project-schemas.yaml
@ -25,7 +25,7 @@ components:
        HsBookingProjectInsert:
            type: object
            properties:
-                debitorUuid:
+                debitor.uuid:
                    type: string
                    format: uuid
                    nullable: false
@ -35,6 +35,6 @@ components:
                    maxLength: 80
                    nullable: false
            required:
-                - debitorUuid
+                - debitor.uuid
                - caption
            additionalProperties: false
--- a/src/main/resources/api-definition/hs-hosting/hs-hosting-asset-schemas.yaml
+++ b/src/main/resources/api-definition/hs-hosting/hs-hosting-asset-schemas.yaml
@ -54,7 +54,7 @@ components:
                caption:
                    type: string
                    nullable: true
-                alarmContactUuid:
+                alarmContact.uuid:
                    type: string
                    format: uuid
                    nullable: true
@ -64,11 +64,11 @@ components:
        HsHostingAssetInsert:
            type: object
            properties:
-                bookingItemUuid:
+                bookingItem.uuid:
                    type: string
                    format: uuid
                    nullable: true
-                parentAssetUuid:
+                parentAsset.uuid:
                    type: string
                    format: uuid
                    nullable: true
@ -84,7 +84,7 @@ components:
                    minLength: 3
                    maxLength: 80
                    nullable: false
-                alarmContactUuid:
+                alarmContact.uuid:
                    type: string
                    format: uuid
                    nullable: true
@ -94,7 +94,68 @@ components:
                - type
                - identifier
                - caption
-                - config
+            additionalProperties: false
+
+        HsHostingAssetAutoInsert:
+            type: object
+            properties:
+                parentAsset.uuid:
+                    type: string
+                    format: uuid
+                    nullable: true
+                assignedToAsset.uuid:
+                    type: string
+                    format: uuid
+                type:
+                    $ref: '#/components/schemas/HsHostingAssetType'
+                identifier:
+                    type: string
+                    minLength: 3
+                    maxLength: 80
+                    nullable: false
+                caption:
+                    type: string
+                    minLength: 3
+                    maxLength: 80
+                    nullable: false
+                alarmContact.uuid:
+                    type: string
+                    format: uuid
+                    nullable: true
+                config:
+                    $ref: '#/components/schemas/HsHostingAssetConfiguration'
+                subHostingAssets:
+                    type: array
+                    items:
+                        $ref: '#/components/schemas/HsHostingAssetSubInsert'
+            required:
+                - identifier
+            additionalProperties: false
+
+        HsHostingAssetSubInsert:
+            type: object
+            properties:
+                type:
+                    $ref: '#/components/schemas/HsHostingAssetType'
+                identifier:
+                    type: string
+                    minLength: 3
+                    maxLength: 80
+                    nullable: false
+                caption:
+                    type: string
+                    minLength: 3
+                    maxLength: 80
+                    nullable: false
+                assignedToAsset.uuid:
+                    type: string
+                    format: uuid
+                alarmContact.uuid:
+                    type: string
+                    format: uuid
+                    nullable: true
+                config:
+                    $ref: '#/components/schemas/HsHostingAssetConfiguration'
            additionalProperties: false

        HsHostingAssetConfiguration:
--- a/src/main/resources/api-definition/hs-office/hs-office-contact-schemas.yaml
+++ b/src/main/resources/api-definition/hs-office/hs-office-contact-schemas.yaml
@ -12,7 +12,7 @@ components:
                caption:
                    type: string
                postalAddress:
-                    type: string
+                    $ref: '#/components/schemas/HsOfficeContactPostalAddress'
                emailAddresses:
                    $ref: '#/components/schemas/HsOfficeContactEmailAddresses'
                phoneNumbers:
@ -24,7 +24,7 @@ components:
                caption:
                    type: string
                postalAddress:
-                    type: string
+                    $ref: '#/components/schemas/HsOfficeContactPostalAddress'
                emailAddresses:
                    $ref: '#/components/schemas/HsOfficeContactEmailAddresses'
                phoneNumbers:
@ -39,21 +39,48 @@ components:
                    type: string
                    nullable: true
                postalAddress:
-                    type: string
-                    nullable: true
+                    $ref: '#/components/schemas/HsOfficeContactPostalAddress'
                emailAddresses:
                    $ref: '#/components/schemas/HsOfficeContactEmailAddresses'
                phoneNumbers:
                    $ref: '#/components/schemas/HsOfficeContactPhoneNumbers'

+        HsOfficeContactPostalAddress:
+            # forces generating a java.lang.Object containing a Map, instead of a class with fixed properties
+            anyOf:
+                - type: object
+                  properties:
+                      firm:
+                          type: string
+                          nullable: true
+                      name:
+                          type: string
+                          nullable: true
+                      co:
+                          type: string
+                          nullable: true
+                      street:
+                          type: string
+                          nullable: true
+                      zipcode:
+                          type: string
+                          nullable: true
+                      city:
+                          type: string
+                          nullable: true
+                      country:
+                          type: string
+                          nullable: true
+                  additionalProperties: true
+
        HsOfficeContactEmailAddresses:
-            # forces generating a java.lang.Object containing a Map, instead of class HsOfficeContactEmailAddresses
+            # forces generating a java.lang.Object containing a Map, instead of a class with fixed properties
            anyOf:
                - type: object
                  additionalProperties: true

        HsOfficeContactPhoneNumbers:
-            # forces generating a java.lang.Object containing a Map, instead of class HsOfficeContactEmailAddresses
+            # forces generating a java.lang.Object containing a Map, instead of a class with fixed properties
            anyOf:
                - type: object
                  properties:
--- a/src/main/resources/api-definition/hs-office/hs-office-coopassets-schemas.yaml
+++ b/src/main/resources/api-definition/hs-office/hs-office-coopassets-schemas.yaml
@ -6,7 +6,7 @@ components:
        HsOfficeCoopAssetsTransactionType:
            type: string
            enum:
-                - ADJUSTMENT
+                - REVERSAL
                - DEPOSIT
                - DISBURSAL
                - TRANSFER
@ -20,6 +20,15 @@ components:
                uuid:
                    type: string
                    format: uuid
+                membership.uuid:
+                    type: string
+                    format: uuid
+                    nullable: false
+                membership.memberNumber:
+                    type: string
+                    minLength: 9
+                    maxLength: 9
+                    pattern: 'M-[0-9]{7}'
                transactionType:
                    $ref: '#/components/schemas/HsOfficeCoopAssetsTransactionType'
                assetValue:
@ -32,20 +41,36 @@ components:
                    type: string
                comment:
                    type: string
-                adjustedAssetTx:
-                    $ref: '#/components/schemas/HsOfficeReferencedCoopAssetsTransaction'
-                adjustmentAssetTx:
-                    $ref: '#/components/schemas/HsOfficeReferencedCoopAssetsTransaction'
+                adoptionAssetTx:
+                    # a TRANSFER tx must refer to the related ADOPTION tx
+                    $ref: '#/components/schemas/HsOfficeRelatedCoopAssetsTransaction'
+                transferAssetTx:
+                    # an ADOPTION tx must refer to the related TRANSFER tx
+                    $ref: '#/components/schemas/HsOfficeRelatedCoopAssetsTransaction'
+                revertedAssetTx:
+                    # a REVERSAL tx must refer to the related tx, which can be of any type but REVERSAL
+                    $ref: '#/components/schemas/HsOfficeRelatedCoopAssetsTransaction'
+                reversalAssetTx:
+                    # a reverted tx, which can be any but REVERSAL, must refer to the related REVERSAL tx
+                    $ref: '#/components/schemas/HsOfficeRelatedCoopAssetsTransaction'

-        HsOfficeReferencedCoopAssetsTransaction:
+        HsOfficeRelatedCoopAssetsTransaction:
            description:
-                Similar to `HsOfficeCoopAssetsTransaction` but without the self-referencing properties 
-                (`adjustedAssetTx` and `adjustmentAssetTx`), to avoid recursive JSON.
+                Similar to `HsOfficeCoopAssetsTransaction` but just the UUID of the related property, to avoid recursive JSON.
            type: object
            properties:
                uuid:
                    type: string
                    format: uuid
+                membership.uuid:
+                    type: string
+                    format: uuid
+                    nullable: false
+                membership.memberNumber:
+                    type: string
+                    minLength: 9
+                    maxLength: 9
+                    pattern: 'M-[0-9]{7}'
                transactionType:
                    $ref: '#/components/schemas/HsOfficeCoopAssetsTransactionType'
                assetValue:
@ -58,11 +83,27 @@ components:
                    type: string
                comment:
                    type: string
+                adoptionAssetTx.uuid:
+                    description: a TRANSFER tx must refer to the related ADOPTION tx
+                    type: string
+                    format: uuid
+                transferAssetTx.uuid:
+                    description: an ADOPTION tx must refer to the related TRANSFER tx
+                    type: string
+                    format: uuid
+                revertedAssetTx.uuid:
+                    description: a REVERSAL tx must refer to the related tx, which can be of any type but REVERSAL
+                    type: string
+                    format: uuid
+                reversalAssetTx.uuid:
+                    description: a reverted tx, which can be any but REVERSAL, must refer to the related REVERSAL tx
+                    type: string
+                    format: uuid

        HsOfficeCoopAssetsTransactionInsert:
            type: object
            properties:
-                membershipUuid:
+                membership.uuid:
                    type: string
                    format: uuid
                    nullable: false
@ -80,11 +121,19 @@ components:
                    maxLength: 48
                comment:
                    type: string
-                reverseEntryUuid:
+                revertedAssetTx.uuid:
                    type: string
                    format: uuid
+                adoptingMembership.uuid:
+                    type: string
+                    format: uuid
+                adoptingMembership.memberNumber:
+                    type: string
+                    minLength: 9
+                    maxLength: 9
+                    pattern: 'M-[0-9]{7}'
            required:
-                - membershipUuid
+                - membership.uuid
                - transactionType
                - assetValue
                - valueDate
--- a/src/main/resources/api-definition/hs-office/hs-office-coopassets-with-uuid.yaml
+++ b/src/main/resources/api-definition/hs-office/hs-office-coopassets-with-uuid.yaml
@ -2,7 +2,7 @@ get:
    tags:
        - hs-office-coopAssets
    description: 'Fetch a single asset transaction by its uuid, if visible for the current subject.'
-    operationId: getCoopAssetTransactionByUuid
+    operationId: getSingleCoopAssetTransactionByUuid
    parameters:
        - $ref: 'auth.yaml#/components/parameters/currentSubject'
        - $ref: 'auth.yaml#/components/parameters/assumedRoles'
--- a/src/main/resources/api-definition/hs-office/hs-office-coopassets.yaml
+++ b/src/main/resources/api-definition/hs-office/hs-office-coopassets.yaml
@ -3,7 +3,7 @@ get:
  description: Returns the list of (optionally filtered) cooperative asset transactions which are visible to the current subject or any of it's assumed roles.
  tags:
    - hs-office-coopAssets
-  operationId: listCoopAssets
+  operationId: getListOfCoopAssets
  parameters:
    - $ref: 'auth.yaml#/components/parameters/currentSubject'
    - $ref: 'auth.yaml#/components/parameters/assumedRoles'
@ -46,7 +46,7 @@ post:
  summary: Adds a new cooperative asset transaction.
  tags:
    - hs-office-coopAssets
-  operationId: addCoopAssetsTransaction
+  operationId: postNewCoopAssetTransaction
  parameters:
    - $ref: 'auth.yaml#/components/parameters/currentSubject'
    - $ref: 'auth.yaml#/components/parameters/assumedRoles'
--- a/src/main/resources/api-definition/hs-office/hs-office-coopshares-schemas.yaml
+++ b/src/main/resources/api-definition/hs-office/hs-office-coopshares-schemas.yaml
@ -6,7 +6,7 @@ components:
        HsOfficeCoopSharesTransactionType:
            type: string
            enum:
-                - ADJUSTMENT
+                - REVERSAL
                - SUBSCRIPTION
                - CANCELLATION

@ -16,6 +16,10 @@ components:
                uuid:
                    type: string
                    format: uuid
+                membership.uuid:
+                    type: string
+                    format: uuid
+                    nullable: false
                transactionType:
                    $ref: '#/components/schemas/HsOfficeCoopSharesTransactionType'
                shareCount:
@ -27,20 +31,24 @@ components:
                    type: string
                comment:
                    type: string
-                adjustedShareTx:
+                revertedShareTx:
                    $ref: '#/components/schemas/HsOfficeReferencedCoopSharesTransaction'
-                adjustmentShareTx:
+                reversalShareTx:
                    $ref: '#/components/schemas/HsOfficeReferencedCoopSharesTransaction'

        HsOfficeReferencedCoopSharesTransaction:
            description:
                Similar to `HsOfficeCoopSharesTransaction` but without the self-referencing properties
-                (`adjustedShareTx` and `adjustmentShareTx`), to avoid recursive JSON.
+                (`revertedShareTx` and `reversalShareTx`), to avoid recursive JSON.
            type: object
            properties:
                uuid:
                    type: string
                    format: uuid
+                membership.uuid:
+                    type: string
+                    format: uuid
+                    nullable: false
                transactionType:
                    $ref: '#/components/schemas/HsOfficeCoopSharesTransactionType'
                shareCount:
@ -56,7 +64,7 @@ components:
        HsOfficeCoopSharesTransactionInsert:
            type: object
            properties:
-                membershipUuid:
+                membership.uuid:
                    type: string
                    format: uuid
                    nullable: false
@ -73,11 +81,11 @@ components:
                    maxLength: 48
                comment:
                    type: string
-                adjustedShareTxUuid:
+                revertedShareTx.uuid:
                    type: string
                    format: uuid
            required:
-                - membershipUuid
+                - membership.uuid
                - transactionType
                - shareCount
                - valueDate
--- a/src/main/resources/api-definition/hs-office/hs-office-coopshares-with-uuid.yaml
+++ b/src/main/resources/api-definition/hs-office/hs-office-coopshares-with-uuid.yaml
@ -2,7 +2,7 @@ get:
    tags:
        - hs-office-coopShares
    description: 'Fetch a single share transaction by its uuid, if visible for the current subject.'
-    operationId: getCoopShareTransactionByUuid
+    operationId: getSingleCoopShareTransactionByUuid
    parameters:
        - $ref: 'auth.yaml#/components/parameters/currentSubject'
        - $ref: 'auth.yaml#/components/parameters/assumedRoles'
--- a/src/main/resources/api-definition/hs-office/hs-office-coopshares.yaml
+++ b/src/main/resources/api-definition/hs-office/hs-office-coopshares.yaml
@ -3,7 +3,7 @@ get:
  description: Returns the list of (optionally filtered) cooperative share transactions which are visible to the current subject or any of it's assumed roles.
  tags:
    - hs-office-coopShares
-  operationId: listCoopShares
+  operationId: getListOfCoopShares
  parameters:
    - $ref: 'auth.yaml#/components/parameters/currentSubject'
    - $ref: 'auth.yaml#/components/parameters/assumedRoles'
@ -46,7 +46,7 @@ post:
  summary: Adds a new cooperative share transaction.
  tags:
    - hs-office-coopShares
-  operationId: addCoopSharesTransaction
+  operationId: postNewCoopSharesTransaction
  parameters:
    - $ref: 'auth.yaml#/components/parameters/currentSubject'
    - $ref: 'auth.yaml#/components/parameters/assumedRoles'
--- a/src/main/resources/api-definition/hs-office/hs-office-debitor-schemas.yaml
+++ b/src/main/resources/api-definition/hs-office/hs-office-debitor-schemas.yaml
@ -12,15 +12,13 @@ components:
                debitorRel:
                    $ref: 'hs-office-relation-schemas.yaml#/components/schemas/HsOfficeRelation'
                debitorNumber:
-                    type: integer
-                    format: int32
-                    minimum: 1000000
-                    maximum: 9999999
+                    type: string
+                    minLength: 9
+                    maxLength: 9
+                    pattern: 'D-[0-9]{7}'
                debitorNumberSuffix:
-                    type: integer
-                    format: int8
-                    minimum: 00
-                    maximum: 99
+                    type: string
+                    pattern: '^[0-9][0-9]$'
                partner:
                    $ref: 'hs-office-partner-schemas.yaml#/components/schemas/HsOfficePartner'
                billable:
@ -43,7 +41,7 @@ components:
        HsOfficeDebitorPatch:
            type: object
            properties:
-                debitorRelUuid:
+                debitorRel.uuid:
                    type: string
                    format: uuid
                    nullable: true
@ -63,7 +61,7 @@ components:
                vatReverseCharge:
                    type: boolean
                    nullable: false
-                refundBankAccountUuid:
+                refundBankAccount.uuid:
                    type: string
                    format: uuid
                    nullable: true
@ -76,15 +74,13 @@ components:
            type: object
            properties:
                debitorRel:
-                    $ref: 'hs-office-relation-schemas.yaml#/components/schemas/HsOfficeRelationInsert'
-                debitorRelUuid:
+                    $ref: 'hs-office-relation-schemas.yaml#/components/schemas/HsOfficeRelationSubInsert'
+                debitorRel.uuid:
                    type: string
                    format: uuid
                debitorNumberSuffix:
-                    type: integer
-                    format: int8
-                    minimum: 00
-                    maximum: 99
+                    type: string
+                    pattern: '^[0-9][0-9]$'
                billable:
                    type: boolean
                vatId:
@ -96,7 +92,7 @@ components:
                    type: boolean
                vatReverseCharge:
                    type: boolean
-                refundBankAccountUuid:
+                refundBankAccount.uuid:
                    type: string
                    format: uuid
                defaultPrefix:
--- a/src/main/resources/api-definition/hs-office/hs-office-debitors-with-uuid.yaml
+++ b/src/main/resources/api-definition/hs-office/hs-office-debitors-with-uuid.yaml
@ -2,7 +2,7 @@ get:
    tags:
        - hs-office-debitors
    description: 'Fetch a single debitor by its uuid, if visible for the current subject.'
-    operationId: getDebitorByUuid
+    operationId: getSingleDebitorByUuid
    parameters:
        - $ref: 'auth.yaml#/components/parameters/currentSubject'
        - $ref: 'auth.yaml#/components/parameters/assumedRoles'
--- a/src/main/resources/api-definition/hs-office/hs-office-debitors.yaml
+++ b/src/main/resources/api-definition/hs-office/hs-office-debitors.yaml
@ -3,7 +3,7 @@ get:
    description: Returns the list of (optionally filtered) debitors which are visible to the current subject or any of it's assumed roles.
    tags:
        - hs-office-debitors
-    operationId: listDebitors
+    operationId: getListOfDebitors
    parameters:
        - $ref: 'auth.yaml#/components/parameters/currentSubject'
        - $ref: 'auth.yaml#/components/parameters/assumedRoles'
@ -17,7 +17,10 @@ get:
          in: query
          required: false
          schema:
-              type: integer
+              type: string
+              minLength: 9
+              maxLength: 9
+              pattern: 'D-[0-9]{7}'
          description: Debitor number of the requested debitor.
    responses:
        "200":
@ -37,7 +40,7 @@ post:
    summary: Adds a new debitor.
    tags:
        - hs-office-debitors
-    operationId: addDebitor
+    operationId: postNewDebitor
    parameters:
        - $ref: 'auth.yaml#/components/parameters/currentSubject'
        - $ref: 'auth.yaml#/components/parameters/assumedRoles'
--- a/src/main/resources/api-definition/hs-office/hs-office-membership-schemas.yaml
+++ b/src/main/resources/api-definition/hs-office/hs-office-membership-schemas.yaml
@ -26,9 +26,10 @@ components:
                mainDebitor:
                    $ref: 'hs-office-debitor-schemas.yaml#/components/schemas/HsOfficeDebitor'
                memberNumber:
-                    type: integer
-                    minimum: 1000000
-                    maximum: 9999999
+                    type: string
+                    minLength: 9
+                    maxLength: 9
+                    pattern: 'M-[0-9]{7}'
                memberNumberSuffix:
                    type: string
                    minLength: 2
@ -62,7 +63,7 @@ components:
        HsOfficeMembershipInsert:
            type: object
            properties:
-                partnerUuid:
+                partner.uuid:
                    type: string
                    format: uuid
                    nullable: false
@ -86,7 +87,7 @@ components:
                    nullable: false
                    type: boolean
            required:
-                - partnerUuid
+                - partner.uuid
                - memberNumberSuffix
                - validFrom
                - membershipFeeBillable
--- a/src/main/resources/api-definition/hs-office/hs-office-memberships-with-uuid.yaml
+++ b/src/main/resources/api-definition/hs-office/hs-office-memberships-with-uuid.yaml
@ -2,7 +2,7 @@ get:
    tags:
        - hs-office-memberships
    description: 'Fetch a single membership by its uuid, if visible for the current subject.'
-    operationId: getMembershipByUuid
+    operationId: getSingleMembershipByUuid
    parameters:
        - $ref: 'auth.yaml#/components/parameters/currentSubject'
        - $ref: 'auth.yaml#/components/parameters/assumedRoles'
--- a/src/main/resources/api-definition/hs-office/hs-office-memberships.yaml
+++ b/src/main/resources/api-definition/hs-office/hs-office-memberships.yaml
@ -4,7 +4,7 @@ get:
        The list can optionally be filtered by either the `partnerUuid` or the `memberNumber` - not both at the same time.
    tags:
        - hs-office-memberships
-    operationId: listMemberships
+    operationId: getListOfMemberships
    parameters:
        - $ref: 'auth.yaml#/components/parameters/currentSubject'
        - $ref: 'auth.yaml#/components/parameters/assumedRoles'
@ -19,7 +19,10 @@ get:
          in: query
          required: false
          schema:
-              type: integer
+              type: string
+              minLength: 9
+              maxLength: 9
+              pattern: 'M-[0-9]{7}'
          description: Member number, exclusive to `partnerUuid`.
    responses:
        "200":
@ -39,7 +42,7 @@ post:
    summary: Adds a new membership.
    tags:
        - hs-office-memberships
-    operationId: addMembership
+    operationId: postNewMembership
    parameters:
        - $ref: 'auth.yaml#/components/parameters/currentSubject'
        - $ref: 'auth.yaml#/components/parameters/assumedRoles'
--- a/src/main/resources/api-definition/hs-office/hs-office-partner-schemas.yaml
+++ b/src/main/resources/api-definition/hs-office/hs-office-partner-schemas.yaml
@ -10,10 +10,10 @@ components:
                    type: string
                    format: uuid
                partnerNumber:
-                    type: integer
-                    format: int8
-                    minimum: 10000
-                    maximum: 99999
+                    type: string
+                    minLength: 7
+                    maxLength: 7
+                    pattern: 'P-[0-9]{5}'
                partnerRel:
                    $ref: 'hs-office-relation-schemas.yaml#/components/schemas/HsOfficeRelation'
                details:
@ -50,7 +50,7 @@ components:
        HsOfficePartnerPatch:
            type: object
            properties:
-                partnerRelUuid:
+                partnerRel.uuid:
                    type: string
                    format: uuid
                    nullable: true
@ -86,10 +86,10 @@ components:
            type: object
            properties:
                partnerNumber:
-                    type: integer
-                    format: int8
-                    minimum: 10000
-                    maximum: 99999
+                    type: string
+                    minLength: 7
+                    maxLength: 7
+                    pattern: 'P-[0-9]{5}'
                partnerRel:
                    $ref: '#/components/schemas/HsOfficePartnerRelInsert'
                details:
@ -103,19 +103,19 @@ components:
            type: object
            nullable: false
            properties:
-                anchorUuid:
+                anchor.uuid:
                    type: string
                    format: uuid
-                holderUuid:
+                holder.uuid:
                    type: string
                    format: uuid
-                contactUuid:
+                contact.uuid:
                    type: string
                    format: uuid
            required:
-                - anchorUuid
-                - holderUuid
-                - relContactUuid
+                - anchor.uuid
+                - holder.uuid
+                - relContact.uuid

        HsOfficePartnerDetailsInsert:
            type: object
--- a/src/main/resources/api-definition/hs-office/hs-office-relation-schemas.yaml
+++ b/src/main/resources/api-definition/hs-office/hs-office-relation-schemas.yaml
@ -13,6 +13,7 @@ components:
                - REPRESENTATIVE
                - VIP_CONTACT
                - OPERATIONS
+                - OPERATIONS_ALERT
                - SUBSCRIBER

        HsOfficeRelation:
@ -36,18 +37,19 @@ components:
        HsOfficeRelationPatch:
            type: object
            properties:
-                contactUuid:
+                contact.uuid:
                    type: string
                    format: uuid
                    nullable: true

+        # arbitrary relation with explicit type
        HsOfficeRelationInsert:
            type: object
            properties:
-                anchorUuid:
+                anchor.uuid:
                    type: string
                    format: uuid
-                holderUuid:
+                holder.uuid:
                    type: string
                    format: uuid
                type:
@ -56,11 +58,32 @@ components:
                mark:
                    type: string
                    nullable: true
-                contactUuid:
+                contact.uuid:
                    type: string
                    format: uuid
            required:
-              - anchorUuid
-              - holderUuid
+              - anchor.uuid
+              - holder.uuid
              - type
-              - contactUuid
+              - contact.uuid
+
+        # relation created as a sub-element with implicitly known type
+        HsOfficeRelationSubInsert:
+            type: object
+            properties:
+                anchor.uuid:
+                    type: string
+                    format: uuid
+                holder.uuid:
+                    type: string
+                    format: uuid
+                mark:
+                    type: string
+                    nullable: true
+                contact.uuid:
+                    type: string
+                    format: uuid
+            required:
+                - anchor.uuid
+                - holder.uuid
+                - contact.uuid
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Michael Hoennig	3532e3a46c	add advanced scenario-tests for coop-assets (#123 ) Co-authored-by: Michael Hoennig <michael@hoennig.de> Reviewed-on: #123 Reviewed-by: Marc Sandlus <marc.sandlus@hostsharing.net>	2024-11-25 16:06:24 +01:00
Michael Hoennig	7883052864	optimize RBAC SELECT-queries for global-admins without assumed role (#124 ) Co-authored-by: Michael Hoennig <michael@hoennig.de> Reviewed-on: #124 Reviewed-by: Marc Sandlus <marc.sandlus@hostsharing.net>	2024-11-25 10:56:16 +01:00
Timotheus Pokorra	d7caf3b0f8	TP-20240927-importfixes (#115 ) Co-authored-by: Timotheus Pokorra <timotheus.pokorra@solidcharity.com> Co-authored-by: Dev und Test fuer hsadminng <hsh03-hsngdev@h50.hostsharing.net> Reviewed-on: #115 Reviewed-by: Michael Hoennig <michael.hoennig@hostsharing.net> Co-authored-by: Timotheus Pokorra <timotheus.pokorra@hostsharing.net> Co-committed-by: Timotheus Pokorra <timotheus.pokorra@hostsharing.net>	2024-11-21 10:27:34 +01:00
Michael Hoennig	35db9aad43	feature/prefixes-for-partner-member-debitor-in-api (#122 ) Co-authored-by: Michael Hoennig <michael@hoennig.de> Reviewed-on: #122 Reviewed-by: Timotheus Pokorra <timotheus.pokorra@hostsharing.net>	2024-11-18 12:11:16 +01:00
Michael Hoennig	c98a5acb38	OfficeScenarioTests CoopShares+Assets (#121 ) Co-authored-by: Michael Hoennig <michael@hoennig.de> Reviewed-on: #121 Reviewed-by: Marc Sandlus <marc.sandlus@hostsharing.net>	2024-11-15 11:54:18 +01:00
Michael Hoennig	8f410198e9	feature/use-dot-uuid-in-api (#120 ) Co-authored-by: Michael Hoennig <michael@hoennig.de> Reviewed-on: #120 Reviewed-by: Marc Sandlus <marc.sandlus@hostsharing.net>	2024-11-11 11:25:42 +01:00
Michael Hoennig	e97b177a92	feature/use-case-acceptance-tests-3 (#119 ) Co-authored-by: Michael Hoennig <michael@hoennig.de> Reviewed-on: #119 Reviewed-by: Marc Sandlus <marc.sandlus@hostsharing.net>	2024-11-07 10:11:46 +01:00
Michael Hoennig	6191bf16e0	feature/split-up-postalAddress (#118 ) Co-authored-by: Michael Hoennig <michael@hoennig.de> Reviewed-on: #118 Reviewed-by: Marc Sandlus <marc.sandlus@hostsharing.net>	2024-11-06 12:24:37 +01:00
Michael Hoennig	63af33d003	feature/use-case-acceptance-tests-2 (#117 ) Co-authored-by: Michael Hoennig <michael@hoennig.de> Reviewed-on: #117 Reviewed-by: Marc Sandlus <marc.sandlus@hostsharing.net>	2024-11-05 13:58:31 +01:00
Michael Hoennig	3b94f117fb	feature/use-case-acceptance-tests (#116 ) Co-authored-by: Michael Hoennig <michael@hoennig.de> Reviewed-on: #116 Reviewed-by: Marc Sandlus <marc.sandlus@hostsharing.net>	2024-10-30 11:40:36 +01:00
Michael Hoennig	c181500a1d	feature/add-jenkinsfile (#114 ) Co-authored-by: Michael Hoennig <michael@hoennig.de> Co-authored-by: Michael Hönnig <michael@hoennig.de> Reviewed-on: #114 Reviewed-by: Timotheus Pokorra <timotheus.pokorra@hostsharing.net>	2024-10-14 10:36:50 +02:00
Michael Hoennig	c26ae77a09	feature/api-for-email-address-search-in-contacts (#113 ) Co-authored-by: Michael Hoennig <michael@hoennig.de> Co-authored-by: Michael Hönnig <michael@hoennig.de> Reviewed-on: #113 Reviewed-by: Marc Sandlus <marc.sandlus@hostsharing.net>	2024-10-11 17:06:44 +02:00
Michael Hoennig	cb8a5190ce	fix allowed licenses, do version upgrades upgrade and improve test coverage (#112 ) Co-authored-by: Michael Hoennig <michael@hoennig.de> Reviewed-on: #112 Reviewed-by: Marc Sandlus <marc.sandlus@hostsharing.net>	2024-10-10 09:31:43 +02:00
Michael Hoennig	60341bf644	add DomainSetup-HostingAssets for new BookingItem via created-event (#111 ) Co-authored-by: Michael Hoennig <michael@hoennig.de> Reviewed-on: #111 Reviewed-by: Timotheus Pokorra <timotheus.pokorra@hostsharing.net>	2024-10-08 11:48:31 +02:00
Michael Hoennig	cc2b04472f	application-event for booking-item-created with domain-setup-example (#110 ) Co-authored-by: Michael Hoennig <michael@hoennig.de> Reviewed-on: #110 Reviewed-by: Marc Sandlus <marc.sandlus@hostsharing.net>	2024-09-27 11:19:01 +02:00
Michael Hoennig	4811c0328c	fix Error code 500 in Relation.find without type (NullPointerException) (#109 ) Co-authored-by: Michael Hoennig <michael@hoennig.de> Reviewed-on: #109 Reviewed-by: Marc Sandlus <marc.sandlus@hostsharing.net>	2024-09-27 11:00:58 +02:00
				`@ -0,0 +1 @@`
				`find the generated ScenarioReports in build/doc/scenarios`