snapshot of https://github.com/ory/kratos.git (master, 2026-09-15; blobs > 131072B omitted)

continuity/container.go

@@ -0,0 +1,67 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package continuity
+
+import (
+	"time"
+
+	"github.com/gofrs/uuid"
+	"github.com/pkg/errors"
+
+	"github.com/ory/herodot"
+	"github.com/ory/x/pointerx"
+	"github.com/ory/x/sqlxx"
+
+	"github.com/ory/kratos/x"
+)
+
+type Container struct {
+	ID         uuid.UUID  `json:"id" db:"id" rw:"r"`
+	NID        uuid.UUID  `json:"-" db:"nid"`
+	Name       string     `json:"name" db:"name"`
+	IdentityID *uuid.UUID `json:"identity_id" db:"identity_id"`
+
+	// ExpiresAt defines when this container expires.
+	ExpiresAt time.Time `json:"expires_at" db:"expires_at"`
+
+	// Payload is the container's payload.
+	Payload sqlxx.NullJSONRawMessage `json:"payload" db:"payload"`
+
+	// CreatedAt is a helper struct field for gobuffalo.pop.
+	CreatedAt time.Time `json:"created_at" db:"created_at"`
+
+	// UpdatedAt is a helper struct field for gobuffalo.pop.
+	UpdatedAt time.Time `json:"updated_at" db:"updated_at"`
+}
+
+func (c *Container) UTC() *Container {
+	c.CreatedAt = c.CreatedAt.UTC()
+	c.UpdatedAt = c.UpdatedAt.UTC()
+	c.ExpiresAt = c.ExpiresAt.UTC()
+	return c
+}
+
+func (Container) TableName() string { return "continuity_containers" }
+
+func NewContainer(name string, o managerOptions) *Container {
+	return &Container{
+		ID:         uuid.Nil,
+		Name:       name,
+		IdentityID: x.PointToUUID(o.iid),
+		ExpiresAt:  time.Now().Add(o.ttl).UTC().Truncate(time.Second),
+		Payload:    sqlxx.NullJSONRawMessage(o.payload),
+	}
+}
+
+func (c *Container) Valid(identity uuid.UUID) error {
+	if c.ExpiresAt.Before(time.Now()) {
+		return errors.WithStack(herodot.ErrBadRequest().WithReasonf("You must restart the flow because the resumable session has expired."))
+	}
+
+	if identity != uuid.Nil && pointerx.Deref(c.IdentityID) != identity {
+		return errors.WithStack(herodot.ErrForbidden().WithReasonf("The flow has been blocked for security reasons because it was initiated by another person.."))
+	}
+
+	return nil
+}

continuity/container_reference_store.go

@@ -0,0 +1,58 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package continuity
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/gofrs/uuid"
+	"github.com/gorilla/sessions"
+	"github.com/pkg/errors"
+
+	"github.com/ory/kratos/x"
+)
+
+// ContainerReferenceStore abstracts where a continuity container's ID is
+// stored between Pause and Continue/Abort calls.
+type ContainerReferenceStore interface {
+	Store(ctx context.Context, w http.ResponseWriter, r *http.Request, name string, id uuid.UUID) error
+	Retrieve(ctx context.Context, w http.ResponseWriter, r *http.Request, name string) (uuid.UUID, error)
+	Clear(ctx context.Context, w http.ResponseWriter, r *http.Request, name string) error
+}
+
+// CookieReferenceStore stores the container ID in an HTTP cookie.
+type CookieReferenceStore struct {
+	cs sessions.StoreExact
+}
+
+func NewCookieReferenceStore(cs sessions.StoreExact) *CookieReferenceStore {
+	return &CookieReferenceStore{cs: cs}
+}
+
+func (s *CookieReferenceStore) Store(_ context.Context, w http.ResponseWriter, r *http.Request, name string, id uuid.UUID) error {
+	return x.SessionPersistValues(w, r, s.cs, CookieName, map[string]any{
+		name: id.String(),
+	})
+}
+
+func (s *CookieReferenceStore) Retrieve(_ context.Context, w http.ResponseWriter, r *http.Request, name string) (uuid.UUID, error) {
+	str, err := x.SessionGetString(r, s.cs, CookieName, name)
+	if err != nil {
+		_ = x.SessionUnsetKey(w, r, s.cs, CookieName, name)
+		return uuid.Nil, errors.WithStack(ErrNotResumable().WithDebugf("%+v", err))
+	}
+
+	sid, err := uuid.FromString(str)
+	if err != nil {
+		_ = x.SessionUnsetKey(w, r, s.cs, CookieName, name)
+		return uuid.Nil, errors.WithStack(ErrNotResumable().WithDebug("session id is not a valid uuid"))
+	}
+
+	return sid, nil
+}
+
+func (s *CookieReferenceStore) Clear(_ context.Context, w http.ResponseWriter, r *http.Request, name string) error {
+	return x.SessionUnsetKey(w, r, s.cs, CookieName, name)
+}

continuity/container_test.go

@@ -0,0 +1,69 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package continuity
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/gofrs/uuid"
+	"github.com/stretchr/testify/require"
+
+	"github.com/ory/kratos/x"
+)
+
+func TestContainer(t *testing.T) {
+	id := x.NewUUID()
+	for k, tc := range []struct {
+		c    *Container
+		i    uuid.UUID
+		pass bool
+	}{
+		{
+			c: &Container{
+				ExpiresAt: time.Now().Add(-time.Minute),
+			},
+			pass: false,
+		},
+		{
+			c: &Container{
+				ExpiresAt: time.Now().Add(-time.Minute),
+			},
+			i:    x.NewUUID(),
+			pass: false,
+		},
+		{
+			c: &Container{
+				IdentityID: x.PointToUUID(x.NewUUID()),
+				ExpiresAt:  time.Now().Add(-time.Minute),
+			},
+			i:    x.NewUUID(),
+			pass: false,
+		},
+		{
+			c: &Container{
+				ExpiresAt: time.Now().Add(time.Minute),
+			},
+			pass: true,
+		},
+		{
+			c: &Container{
+				IdentityID: x.PointToUUID(id),
+				ExpiresAt:  time.Now().Add(time.Minute),
+			},
+			i:    id,
+			pass: true,
+		},
+	} {
+		t.Run(fmt.Sprintf("case=%d", k), func(t *testing.T) {
+			err := tc.c.Valid(tc.i)
+			if tc.pass {
+				require.NoError(t, err)
+			} else {
+				require.Error(t, err)
+			}
+		})
+	}
+}

continuity/internal_context_reference_store.go

@@ -0,0 +1,59 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package continuity
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/gofrs/uuid"
+	"github.com/pkg/errors"
+	"github.com/tidwall/gjson"
+	"github.com/tidwall/sjson"
+
+	"github.com/ory/herodot"
+	"github.com/ory/kratos/selfservice/flow"
+)
+
+const InternalContextKey = "continuity_container_id"
+
+// InternalContextReferenceStore stores the container ID in a flow's
+// InternalContext. Used for native/API flows where cookies are not available.
+// This store only modifies the in-memory InternalContext — the caller is
+// responsible for persisting the flow to the database.
+type InternalContextReferenceStore struct {
+	ic flow.InternalContexter
+}
+
+func NewInternalContextReferenceStore(ic flow.InternalContexter) *InternalContextReferenceStore {
+	return &InternalContextReferenceStore{ic: ic}
+}
+
+func (s *InternalContextReferenceStore) Store(_ context.Context, _ http.ResponseWriter, _ *http.Request, _ string, id uuid.UUID) error {
+	s.ic.EnsureInternalContext()
+	raw, err := sjson.SetBytes(s.ic.GetInternalContext(), InternalContextKey, id.String())
+	if err != nil {
+		return errors.WithStack(err)
+	}
+	s.ic.SetInternalContext(raw)
+	return nil
+}
+
+func (s *InternalContextReferenceStore) Retrieve(_ context.Context, _ http.ResponseWriter, _ *http.Request, _ string) (uuid.UUID, error) {
+	cidStr := gjson.GetBytes(s.ic.GetInternalContext(), InternalContextKey).String()
+	if cidStr == "" {
+		return uuid.Nil, errors.WithStack(ErrNotResumable().WithDebug("no continuity container ID in flow internal context"))
+	}
+	cid, err := uuid.FromString(cidStr)
+	if err != nil {
+		return uuid.Nil, errors.WithStack(herodot.ErrBadRequest().WithReasonf("Invalid continuity container ID in flow context."))
+	}
+	return cid, nil
+}
+
+// Clear is a no-op: InternalContext entries are cleaned up when the flow
+// expires, so there is no separate reference to remove.
+func (s *InternalContextReferenceStore) Clear(_ context.Context, _ http.ResponseWriter, _ *http.Request, _ string) error {
+	return nil
+}

continuity/manager.go

@@ -0,0 +1,197 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package continuity
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"net/http"
+	"time"
+
+	"github.com/gofrs/uuid"
+	"github.com/pkg/errors"
+
+	"github.com/ory/herodot"
+	"github.com/ory/kratos/identity"
+	"github.com/ory/x/otelx"
+	"github.com/ory/x/sqlcon"
+)
+
+func ErrNotResumable() *herodot.DefaultError {
+	return herodot.ErrBadRequest().WithError("no resumable session found").WithReasonf("The browser does not contain the necessary cookie to resume the session. This is a security violation and was blocked. Please clear your browser's cookies and cache and try again!")
+}
+
+const CookieName = "ory_kratos_continuity"
+
+type (
+	ManagementProvider interface {
+		ContinuityManager() *Manager
+	}
+	managerDependencies interface {
+		PersistenceProvider
+		otelx.Provider
+	}
+	Manager struct {
+		d managerDependencies
+	}
+)
+
+func NewManager(d managerDependencies) *Manager {
+	return &Manager{d: d}
+}
+
+type managerOptions struct {
+	iid          uuid.UUID
+	ttl          time.Duration
+	setExpiresIn time.Duration
+	payload      json.RawMessage
+	payloadRaw   any
+}
+
+type ManagerOption func(*managerOptions) error
+
+func newManagerOptions(opts []ManagerOption) (*managerOptions, error) {
+	var o = &managerOptions{
+		ttl: time.Minute * 10,
+	}
+	for _, opt := range opts {
+		if err := opt(o); err != nil {
+			return nil, err
+		}
+	}
+	return o, nil
+}
+
+func WithIdentity(i *identity.Identity) ManagerOption {
+	return func(o *managerOptions) error {
+		if i != nil {
+			o.iid = i.ID
+		}
+		return nil
+	}
+}
+
+func WithLifespan(ttl time.Duration) ManagerOption {
+	return func(o *managerOptions) error {
+		o.ttl = ttl
+		return nil
+	}
+}
+
+func WithPayload(payload any) ManagerOption {
+	return func(o *managerOptions) error {
+		var b bytes.Buffer
+		if err := json.NewEncoder(&b).Encode(payload); err != nil {
+			return errors.WithStack(err)
+		}
+		o.payload = b.Bytes()
+		o.payloadRaw = payload
+		return nil
+	}
+}
+
+func WithExpireInsteadOfDelete(duration time.Duration) ManagerOption {
+	return func(o *managerOptions) error {
+		o.setExpiresIn = duration
+		return nil
+	}
+}
+
+func (m *Manager) Pause(ctx context.Context, w http.ResponseWriter, r *http.Request, name string, store ContainerReferenceStore, opts ...ManagerOption) (containerID uuid.UUID, err error) {
+	ctx, span := m.d.Tracer(ctx).Tracer().Start(ctx, "continuity.ManagerDefault.Pause")
+	defer otelx.End(span, &err)
+	if len(name) == 0 {
+		return uuid.Nil, errors.Errorf("continuity container name must be set")
+	}
+
+	o, err := newManagerOptions(opts)
+	if err != nil {
+		return uuid.Nil, err
+	}
+	c := NewContainer(name, *o)
+
+	if err := m.d.ContinuityPersister().SaveContinuitySession(ctx, c); err != nil {
+		return uuid.Nil, errors.WithStack(err)
+	}
+
+	if err := store.Store(ctx, w, r, name, c.ID); err != nil {
+		return uuid.Nil, err
+	}
+
+	return c.ID, nil
+}
+
+func (m *Manager) Continue(ctx context.Context, w http.ResponseWriter, r *http.Request, name string, store ContainerReferenceStore, opts ...ManagerOption) (container *Container, err error) {
+	ctx, span := m.d.Tracer(ctx).Tracer().Start(ctx, "continuity.ManagerDefault.Continue")
+	defer otelx.End(span, &err)
+
+	o, err := newManagerOptions(opts)
+	if err != nil {
+		return nil, err
+	}
+
+	sid, err := store.Retrieve(ctx, w, r, name)
+	if err != nil {
+		return nil, err
+	}
+
+	container, err = m.d.ContinuityPersister().GetContinuitySession(ctx, sid)
+	if errors.Is(err, sqlcon.ErrNoRows()) {
+		_ = store.Clear(ctx, w, r, name)
+		return nil, errors.WithStack(ErrNotResumable().WithDebugf("Resumable ID could not be found in the datastore: %+v", err))
+	} else if err != nil {
+		_ = store.Clear(ctx, w, r, name)
+		return nil, err
+	} else if container.ExpiresAt.Before(time.Now()) {
+		_ = store.Clear(ctx, w, r, name)
+		return nil, errors.WithStack(ErrNotResumable().WithDebugf("Resumable session has expired"))
+	}
+
+	if err := container.Valid(o.iid); err != nil {
+		return nil, err
+	}
+
+	if o.payloadRaw != nil && container.Payload != nil {
+		if err := json.NewDecoder(bytes.NewBuffer(container.Payload)).Decode(o.payloadRaw); err != nil {
+			return nil, errors.WithStack(err)
+		}
+	}
+
+	if o.setExpiresIn > 0 {
+		if err := m.d.ContinuityPersister().SetContinuitySessionExpiry(
+			ctx, container.ID,
+			time.Now().UTC().Add(o.setExpiresIn).Truncate(time.Second),
+		); err != nil && !errors.Is(err, sqlcon.ErrNoRows()) {
+			return nil, err
+		}
+	} else {
+		_ = store.Clear(ctx, w, r, name)
+		if err := m.d.ContinuityPersister().DeleteContinuitySession(ctx, container.ID); err != nil && !errors.Is(err, sqlcon.ErrNoRows()) {
+			return nil, err
+		}
+	}
+
+	return container, nil
+}
+
+func (m Manager) Abort(ctx context.Context, w http.ResponseWriter, r *http.Request, name string, store ContainerReferenceStore) (err error) {
+	ctx, span := m.d.Tracer(ctx).Tracer().Start(ctx, "continuity.ManagerDefault.Abort")
+	defer otelx.End(span, &err)
+
+	sid, err := store.Retrieve(ctx, w, r, name)
+	if errors.Is(err, ErrNotResumable()) {
+		return nil
+	} else if err != nil {
+		return err
+	}
+
+	_ = store.Clear(ctx, w, r, name)
+
+	if err := m.d.ContinuityPersister().DeleteContinuitySession(ctx, sid); err != nil && !errors.Is(err, sqlcon.ErrNoRows()) {
+		return errors.WithStack(err)
+	}
+
+	return nil
+}

continuity/manager_options_test.go

@@ -0,0 +1,50 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package continuity
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestManagerOptions(t *testing.T) {
+	for k, tc := range []struct {
+		err  bool
+		e    func(t *testing.T, actual *managerOptions)
+		opts []ManagerOption
+	}{
+		{
+			e: func(t *testing.T, actual *managerOptions) {
+				assert.EqualValues(t, time.Minute*10, actual.ttl)
+			},
+		},
+		{
+			opts: []ManagerOption{WithLifespan(time.Minute * 5)},
+			e: func(t *testing.T, actual *managerOptions) {
+				assert.EqualValues(t, time.Minute*5, actual.ttl)
+			},
+		},
+		{
+			opts: []ManagerOption{WithPayload(map[string]interface{}{"foo": "bar"})},
+			e: func(t *testing.T, actual *managerOptions) {
+				assert.EqualValues(t, map[string]interface{}{"foo": "bar"}, actual.payloadRaw)
+				assert.JSONEq(t, `{"foo":"bar"}`, string(actual.payload))
+			},
+		},
+	} {
+		t.Run(fmt.Sprintf("case=%d", k), func(t *testing.T) {
+			o, err := newManagerOptions(tc.opts)
+			if tc.err {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			tc.e(t, o)
+		})
+	}
+}

continuity/manager_test.go

@@ -0,0 +1,335 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package continuity_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/tidwall/gjson"
+
+	"github.com/ory/herodot"
+	"github.com/ory/kratos/continuity"
+	"github.com/ory/kratos/identity"
+	"github.com/ory/kratos/pkg"
+	"github.com/ory/kratos/pkg/testhelpers"
+	"github.com/ory/kratos/x"
+	"github.com/ory/x/configx"
+	"github.com/ory/x/ioutilx"
+	"github.com/ory/x/logrusx"
+)
+
+type persisterTestCase struct {
+	ro          []continuity.ManagerOption
+	wo          []continuity.ManagerOption
+	expected    *persisterTestPayload
+	expectedErr error
+}
+
+type persisterTestPayload struct {
+	Foo string `json:"foo"`
+}
+
+func TestManager(t *testing.T) {
+	_, reg := pkg.NewFastRegistryWithMocks(t,
+		configx.WithValues(testhelpers.DefaultIdentitySchemaConfig("file://../test/stub/identity/empty.schema.json")),
+	)
+
+	i := identity.NewIdentity("")
+	require.NoError(t, reg.PrivilegedIdentityPool().CreateIdentity(t.Context(), i))
+
+	newServer := func(t *testing.T, p *continuity.Manager, tc *persisterTestCase) *httptest.Server {
+		writer := herodot.NewJSONWriter(logrusx.New("", ""))
+		router := http.NewServeMux()
+		router.HandleFunc("PUT /{name}", func(w http.ResponseWriter, r *http.Request) {
+			store := continuity.NewCookieReferenceStore(reg.ContinuityCookieManager(r.Context()))
+			if _, err := p.Pause(r.Context(), w, r, r.PathValue("name"), store, tc.ro...); err != nil {
+				writer.WriteError(w, r, err)
+				return
+			}
+			w.WriteHeader(http.StatusNoContent)
+		})
+
+		router.HandleFunc("POST /{name}", func(w http.ResponseWriter, r *http.Request) {
+			store := continuity.NewCookieReferenceStore(reg.ContinuityCookieManager(r.Context()))
+			if _, err := p.Pause(r.Context(), w, r, r.PathValue("name"), store, tc.ro...); err != nil {
+				writer.WriteError(w, r, err)
+				return
+			}
+
+			c, err := p.Continue(r.Context(), w, r, r.PathValue("name"), store, tc.wo...)
+			if err != nil {
+				writer.WriteError(w, r, err)
+				return
+			}
+			writer.Write(w, r, c)
+		})
+
+		router.HandleFunc("GET /{name}", func(w http.ResponseWriter, r *http.Request) {
+			store := continuity.NewCookieReferenceStore(reg.ContinuityCookieManager(r.Context()))
+			c, err := p.Continue(r.Context(), w, r, r.PathValue("name"), store, tc.ro...)
+			if err != nil {
+				writer.WriteError(w, r, err)
+				return
+			}
+			writer.Write(w, r, c)
+		})
+
+		router.HandleFunc("DELETE /{name}", func(w http.ResponseWriter, r *http.Request) {
+			store := continuity.NewCookieReferenceStore(reg.ContinuityCookieManager(r.Context()))
+			err := p.Abort(r.Context(), w, r, r.PathValue("name"), store)
+			if err != nil {
+				writer.WriteError(w, r, err)
+				return
+			}
+			w.WriteHeader(http.StatusNoContent)
+		})
+
+		ts := httptest.NewServer(router)
+		t.Cleanup(ts.Close)
+		return ts
+	}
+
+	newClient := func() *http.Client {
+		return &http.Client{Jar: testhelpers.EasyCookieJar(t, nil), Transport: testhelpers.NewTestTransport(t)}
+	}
+
+	p := reg.ContinuityManager()
+	cl := newClient()
+
+	t.Run("case=continue cookie resets when signature is invalid", func(t *testing.T) {
+		ts := newServer(t, p, new(persisterTestCase))
+		href := ts.URL + "/" + x.NewUUID().String()
+
+		res, err := cl.Do(testhelpers.NewTestHTTPRequest(t, "PUT", href, nil))
+		require.NoError(t, err)
+		require.NoError(t, res.Body.Close())
+		require.Equal(t, http.StatusNoContent, res.StatusCode)
+
+		req := testhelpers.NewTestHTTPRequest(t, "GET", href, nil)
+		require.Len(t, res.Cookies(), 1)
+		for _, c := range res.Cookies() {
+			// Change something in the string
+			c.Value = strings.Replace(c.Value, "a", "b", 1)
+			req.AddCookie(c)
+		}
+		res, err = testhelpers.NewTestClient(t).Do(req)
+		require.NoError(t, err)
+		t.Cleanup(func() { require.NoError(t, res.Body.Close()) })
+
+		require.Equal(t, http.StatusBadRequest, res.StatusCode)
+		body := ioutilx.MustReadAll(res.Body)
+		assert.Contains(t, gjson.GetBytes(body, "error.reason").String(), continuity.ErrNotResumable().ReasonField)
+
+		require.Len(t, res.Cookies(), 1, "continuing the flow with a broken cookie should instruct the browser to forget it")
+		assert.EqualValues(t, res.Cookies()[0].Name, continuity.CookieName)
+	})
+
+	t.Run("case=can deal with duplicate cookies", func(t *testing.T) {
+		tc := &persisterTestCase{expected: &persisterTestPayload{"bar"}}
+		ts := newServer(t, p, tc)
+		href := ts.URL + "/" + x.NewUUID().String()
+
+		res, err := testhelpers.NewTestClient(t).Do(testhelpers.NewTestHTTPRequest(t, "PUT", href, nil))
+		require.NoError(t, err)
+		require.NoError(t, res.Body.Close())
+		require.Equal(t, http.StatusNoContent, res.StatusCode)
+
+		// We change the key to another one
+		href = ts.URL + "/" + x.NewUUID().String()
+		req := testhelpers.NewTestHTTPRequest(t, "GET", href, nil)
+		require.Len(t, res.Cookies(), 1)
+		for _, c := range res.Cookies() {
+			req.AddCookie(c)
+		}
+
+		tc.ro = []continuity.ManagerOption{continuity.WithPayload(&persisterTestPayload{"bar"})}
+		res, err = testhelpers.NewTestClient(t).Do(testhelpers.NewTestHTTPRequest(t, "PUT", href, nil))
+		require.NoError(t, err)
+		require.NoError(t, res.Body.Close())
+		require.Equal(t, http.StatusNoContent, res.StatusCode)
+
+		require.Len(t, res.Cookies(), 1)
+		for _, c := range res.Cookies() {
+			req.AddCookie(c)
+		}
+
+		res, err = testhelpers.NewTestClient(t).Do(req)
+		require.NoError(t, err)
+		t.Cleanup(func() { require.NoError(t, res.Body.Close()) })
+
+		require.Len(t, res.Cookies(), 1, "continuing the flow with a broken cookie should instruct the browser to forget it")
+		assert.EqualValues(t, res.Cookies()[0].Name, continuity.CookieName)
+
+		var b bytes.Buffer
+		require.NoError(t, json.NewEncoder(&b).Encode(tc.expected))
+		body := ioutilx.MustReadAll(res.Body)
+		assert.JSONEq(t, b.String(), gjson.GetBytes(body, "payload").Raw, "%s", body)
+		assert.Contains(t, href, gjson.GetBytes(body, "name").String(), "%s", body)
+	})
+
+	t.Run("case=pause and use session with expiry", func(t *testing.T) {
+		cl := newClient()
+
+		tc := &persisterTestCase{
+			ro: []continuity.ManagerOption{continuity.WithPayload(&persisterTestPayload{"bar"}), continuity.WithExpireInsteadOfDelete(time.Minute)},
+			wo: []continuity.ManagerOption{continuity.WithPayload(&persisterTestPayload{}), continuity.WithExpireInsteadOfDelete(time.Minute)},
+		}
+		ts := newServer(t, p, tc)
+		genid := func() string {
+			return ts.URL + "/" + x.NewUUID().String()
+		}
+
+		href := genid()
+		res, err := cl.Do(testhelpers.NewTestHTTPRequest(t, "PUT", href, nil))
+		require.NoError(t, err)
+		require.NoError(t, res.Body.Close())
+		require.Equal(t, http.StatusNoContent, res.StatusCode)
+
+		res, err = cl.Do(testhelpers.NewTestHTTPRequest(t, "GET", href, nil))
+		require.NoError(t, err)
+		require.NoError(t, res.Body.Close())
+		require.Equal(t, http.StatusOK, res.StatusCode)
+
+		res, err = cl.Do(testhelpers.NewTestHTTPRequest(t, "GET", href, nil))
+		require.NoError(t, err)
+		require.NoError(t, res.Body.Close())
+		require.Equal(t, http.StatusOK, res.StatusCode)
+
+		tc.ro = []continuity.ManagerOption{continuity.WithPayload(&persisterTestPayload{"bar"}), continuity.WithExpireInsteadOfDelete(-time.Minute)}
+		tc.wo = []continuity.ManagerOption{continuity.WithPayload(&persisterTestPayload{""}), continuity.WithExpireInsteadOfDelete(-time.Minute)}
+
+		res, err = cl.Do(testhelpers.NewTestHTTPRequest(t, "GET", href, nil))
+		require.NoError(t, err)
+		require.NoError(t, res.Body.Close())
+		require.Equal(t, http.StatusOK, res.StatusCode)
+
+		res, err = cl.Do(testhelpers.NewTestHTTPRequest(t, "GET", href, nil))
+		require.NoError(t, err)
+		require.Equal(t, http.StatusBadRequest, res.StatusCode)
+		body := ioutilx.MustReadAll(res.Body)
+		require.NoError(t, res.Body.Close())
+		assert.Contains(t, gjson.GetBytes(body, "error.reason").String(), continuity.ErrNotResumable().ReasonField)
+	})
+
+	for k, tc := range []persisterTestCase{
+		{},
+		{
+			ro:       []continuity.ManagerOption{continuity.WithPayload(&persisterTestPayload{"bar"})},
+			wo:       []continuity.ManagerOption{continuity.WithPayload(&persisterTestPayload{})},
+			expected: &persisterTestPayload{"bar"},
+		},
+		{
+			ro: []continuity.ManagerOption{continuity.WithIdentity(i)},
+			wo: []continuity.ManagerOption{continuity.WithIdentity(i)},
+		},
+	} {
+		t.Run(fmt.Sprintf("case=%d", k), func(t *testing.T) {
+			cl := newClient()
+			ts := newServer(t, p, &tc)
+			genid := func() string {
+				return ts.URL + "/" + x.NewUUID().String()
+			}
+
+			t.Run("case=resume non-existing session", func(t *testing.T) {
+				href := genid()
+				res, err := cl.Do(testhelpers.NewTestHTTPRequest(t, "GET", href, nil))
+				require.NoError(t, err)
+				t.Cleanup(func() { require.NoError(t, res.Body.Close()) })
+
+				body := ioutilx.MustReadAll(res.Body)
+				require.Equal(t, http.StatusBadRequest, res.StatusCode)
+				assert.Contains(t, gjson.GetBytes(body, "error.reason").String(), continuity.ErrNotResumable().ReasonField)
+			})
+
+			t.Run("case=pause and resume session", func(t *testing.T) {
+				href := genid()
+				res, err := cl.Do(testhelpers.NewTestHTTPRequest(t, "PUT", href, nil))
+				require.NoError(t, err)
+				require.NoError(t, res.Body.Close())
+				require.Equal(t, http.StatusNoContent, res.StatusCode)
+
+				res, err = cl.Do(testhelpers.NewTestHTTPRequest(t, "GET", href, nil))
+				require.NoError(t, err)
+				t.Cleanup(func() { require.NoError(t, res.Body.Close()) })
+
+				body := ioutilx.MustReadAll(res.Body)
+				if tc.expectedErr != nil {
+					require.Equal(t, http.StatusGone, res.StatusCode, "%s", body)
+					return
+				}
+
+				require.Equal(t, http.StatusOK, res.StatusCode, "%s", body)
+
+				var b bytes.Buffer
+				require.NoError(t, json.NewEncoder(&b).Encode(tc.expected))
+				assert.JSONEq(t, b.String(), gjson.GetBytes(body, "payload").Raw, "%s", body)
+				assert.Contains(t, href, gjson.GetBytes(body, "name").String(), "%s", body)
+			})
+
+			t.Run("case=pause and retry session", func(t *testing.T) {
+				href := genid()
+				res, err := cl.Do(testhelpers.NewTestHTTPRequest(t, "PUT", href, nil))
+				require.NoError(t, err)
+				require.NoError(t, res.Body.Close())
+				require.Equal(t, http.StatusNoContent, res.StatusCode)
+
+				res, err = cl.Do(testhelpers.NewTestHTTPRequest(t, "GET", href, nil))
+				require.NoError(t, err)
+				t.Cleanup(func() { require.NoError(t, res.Body.Close()) })
+
+				res, err = cl.Do(testhelpers.NewTestHTTPRequest(t, "GET", href, nil))
+				require.NoError(t, err)
+				require.Equal(t, http.StatusBadRequest, res.StatusCode)
+				body := ioutilx.MustReadAll(res.Body)
+				t.Cleanup(func() { require.NoError(t, res.Body.Close()) })
+				assert.Contains(t, gjson.GetBytes(body, "error.reason").String(), continuity.ErrNotResumable().ReasonField)
+			})
+
+			t.Run("case=pause and resume session in the same request", func(t *testing.T) {
+				href := genid()
+				res, err := cl.Do(testhelpers.NewTestHTTPRequest(t, "POST", href, nil))
+				require.NoError(t, err)
+				require.Equal(t, http.StatusOK, res.StatusCode)
+				t.Cleanup(func() { require.NoError(t, res.Body.Close()) })
+
+				var b bytes.Buffer
+				require.NoError(t, json.NewEncoder(&b).Encode(tc.expected))
+
+				body := ioutilx.MustReadAll(res.Body)
+				assert.JSONEq(t, b.String(), gjson.GetBytes(body, "payload").Raw, "%s", body)
+				assert.Contains(t, href, gjson.GetBytes(body, "name").String(), "%s", body)
+			})
+
+			t.Run("case=pause, abort, and continue session with failure", func(t *testing.T) {
+				href := genid()
+				res, err := cl.Do(testhelpers.NewTestHTTPRequest(t, "PUT", href, nil))
+				require.NoError(t, err)
+				require.NoError(t, res.Body.Close())
+				require.Equal(t, http.StatusNoContent, res.StatusCode)
+
+				res, err = cl.Do(testhelpers.NewTestHTTPRequest(t, "DELETE", href, nil))
+				require.NoError(t, err)
+				t.Cleanup(func() { require.NoError(t, res.Body.Close()) })
+				require.Equal(t, http.StatusNoContent, res.StatusCode)
+
+				res, err = cl.Do(testhelpers.NewTestHTTPRequest(t, "GET", href, nil))
+				require.NoError(t, err)
+				t.Cleanup(func() { require.NoError(t, res.Body.Close()) })
+
+				require.Equal(t, http.StatusBadRequest, res.StatusCode)
+				body := ioutilx.MustReadAll(res.Body)
+				assert.Contains(t, gjson.GetBytes(body, "error.reason").String(), continuity.ErrNotResumable().ReasonField)
+			})
+		})
+	}
+}

continuity/persistence.go

@@ -0,0 +1,23 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package continuity
+
+import (
+	"context"
+	"time"
+
+	"github.com/gofrs/uuid"
+)
+
+type PersistenceProvider interface {
+	ContinuityPersister() Persister
+}
+
+type Persister interface {
+	SaveContinuitySession(ctx context.Context, c *Container) error
+	GetContinuitySession(ctx context.Context, id uuid.UUID) (*Container, error)
+	DeleteContinuitySession(ctx context.Context, id uuid.UUID) error
+	SetContinuitySessionExpiry(ctx context.Context, id uuid.UUID, expiresAt time.Time) error
+	DeleteExpiredContinuitySessions(ctx context.Context, deleteOlder time.Time, pageSize int) error
+}

continuity/test/persistence.go

@@ -0,0 +1,151 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package test
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/gofrs/uuid"
+
+	"github.com/ory/kratos/pkg/testhelpers"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/ory/kratos/continuity"
+	"github.com/ory/kratos/identity"
+	"github.com/ory/kratos/persistence"
+	"github.com/ory/kratos/x"
+	"github.com/ory/x/sqlcon"
+	"github.com/ory/x/sqlxx"
+)
+
+func TestPersister(ctx context.Context, p interface {
+	persistence.Persister
+	continuity.Persister
+	identity.PrivilegedPool
+}) func(t *testing.T) {
+	var createIdentity = func(t *testing.T) *identity.Identity {
+		id := identity.Identity{}
+		require.NoError(t, p.CreateIdentity(ctx, &id))
+		return &id
+	}
+
+	var createContainer = func(t *testing.T) continuity.Container {
+		m := sqlxx.NullJSONRawMessage(`{"foo": "bar"}`)
+		return continuity.Container{Name: "foo", IdentityID: x.PointToUUID(createIdentity(t).ID),
+			ExpiresAt: time.Now().Add(time.Hour).UTC().Truncate(time.Second),
+			Payload:   m,
+		}
+	}
+
+	return func(t *testing.T) {
+		nid, p := testhelpers.NewNetworkUnlessExisting(t, ctx, p)
+
+		t.Run("case=not found", func(t *testing.T) {
+			_, err := p.GetContinuitySession(ctx, x.NewUUID())
+			require.EqualError(t, err, sqlcon.ErrNoRows().Error())
+		})
+
+		t.Run("case=save and find", func(t *testing.T) {
+			expected := createContainer(t)
+			require.NoError(t, p.SaveContinuitySession(ctx, &expected))
+
+			actual, err := p.GetContinuitySession(ctx, expected.ID)
+			require.NoError(t, err)
+			actual.UpdatedAt, actual.CreatedAt, expected.UpdatedAt, expected.CreatedAt = time.Time{}, time.Time{}, time.Time{}, time.Time{}
+			assert.EqualValues(t, expected.UTC(), actual.UTC())
+		})
+
+		t.Run("case=save and delete", func(t *testing.T) {
+			expected := createContainer(t)
+
+			require.NoError(t, p.SaveContinuitySession(ctx, &expected))
+			require.NotEqual(t, uuid.Nil, expected.ID)
+			require.NoError(t, p.DeleteContinuitySession(ctx, expected.ID))
+
+			_, err := p.GetContinuitySession(ctx, expected.ID)
+			require.EqualError(t, err, sqlcon.ErrNoRows().Error())
+		})
+
+		t.Run("case=network", func(t *testing.T) {
+			var id uuid.UUID
+
+			t.Run("sets id on creation", func(t *testing.T) {
+				expected := createContainer(t)
+				require.NoError(t, p.SaveContinuitySession(ctx, &expected))
+
+				// The persister assigns the ID; callers must not choose it.
+				require.NotEqual(t, uuid.Nil, expected.ID)
+				id = expected.ID
+				assert.EqualValues(t, nid, expected.NID)
+
+				actual, err := p.GetContinuitySession(ctx, id)
+				require.NoError(t, err)
+				assert.EqualValues(t, id, actual.ID)
+				assert.EqualValues(t, nid, actual.NID)
+			})
+
+			t.Run("can not get on another network", func(t *testing.T) {
+				_, p := testhelpers.NewNetwork(t, ctx, p)
+				_, err := p.GetLoginFlow(ctx, id)
+				require.ErrorIs(t, err, sqlcon.ErrNoRows())
+			})
+
+			t.Run("can not delete on another network", func(t *testing.T) {
+				_, p := testhelpers.NewNetwork(t, ctx, p)
+				err := p.DeleteContinuitySession(ctx, id)
+				require.ErrorIs(t, err, sqlcon.ErrNoRows())
+			})
+		})
+
+		t.Run("case=set expiry", func(t *testing.T) {
+			// Create a new continuity session
+			expected := createContainer(t)
+			require.NoError(t, p.SaveContinuitySession(ctx, &expected))
+
+			// Set the expiry of the continuity session
+			newExpiry := time.Now().Add(48 * time.Hour).UTC().Truncate(time.Second)
+			require.NoError(t, p.SetContinuitySessionExpiry(ctx, expected.ID, newExpiry))
+
+			// Retrieve the continuity session
+			actual, err := p.GetContinuitySession(ctx, expected.ID)
+			require.NoError(t, err)
+
+			// Check if the expiry has been updated
+			assert.EqualValues(t, newExpiry, actual.ExpiresAt)
+
+			t.Run("can not update on another network", func(t *testing.T) {
+				_, p := testhelpers.NewNetwork(t, ctx, p)
+				newExpiry := time.Now().Add(12 * time.Hour).UTC().Truncate(time.Second)
+				err := p.SetContinuitySessionExpiry(ctx, expected.ID, newExpiry)
+				require.ErrorIs(t, err, sqlcon.ErrNoRows())
+			})
+		})
+
+		t.Run("case=cleanup", func(t *testing.T) {
+			yesterday := time.Now().Add(-24 * time.Hour).UTC().Truncate(time.Second)
+			m := sqlxx.NullJSONRawMessage(`{"foo": "bar"}`)
+			expected := continuity.Container{Name: "foo", IdentityID: x.PointToUUID(createIdentity(t).ID),
+				ExpiresAt: yesterday,
+				Payload:   m,
+			}
+
+			t.Run("can cleanup", func(t *testing.T) {
+				require.NoError(t, p.SaveContinuitySession(ctx, &expected))
+
+				// The persister assigns the ID; callers must not choose it.
+				require.NotEqual(t, uuid.Nil, expected.ID)
+				assert.EqualValues(t, nid, expected.NID)
+
+				require.NoError(t, p.DeleteExpiredContinuitySessions(ctx, time.Now(), 5))
+
+				_, err := p.GetContinuitySession(ctx, expected.ID)
+				require.Error(t, err)
+			})
+		})
+	}
+}