snapshot of https://github.com/ory/kratos.git (master, 2026-09-15; blobs > 131072B omitted)

driver/config/.snapshots/TestCourierEmailHTTP-case=configs_set.json

@@ -0,0 +1,15 @@
+{
+  "auth": {
+    "config": {
+      "password": "YourPass",
+      "user": "YourUsername"
+    },
+    "type": "basic_auth"
+  },
+  "body": "file://some.jsonnet",
+  "header": {
+    "Content-Type": "application/json"
+  },
+  "method": "POST",
+  "url": "https://example.com/email"
+}

driver/config/.snapshots/TestCourierSMS-case=configs_set.json

@@ -0,0 +1,15 @@
+{
+  "auth": {
+    "config": {
+      "password": "YourPass",
+      "user": "YourUsername"
+    },
+    "type": "basic_auth"
+  },
+  "body": "base64://e30=",
+  "header": {
+    "Content-Type": "application/x-www-form-urlencoded"
+  },
+  "method": "POST",
+  "url": "https://api.twilio.com/2010-04-01/Accounts/YourAccountID/Messages.json"
+}

driver/config/.snapshots/TestCourierSMS-case=defaults.json

@@ -0,0 +1 @@
+null

driver/config/.snapshots/TestDefaultWebhookHeaderAllowlist.json

@@ -0,0 +1,19 @@
+[
+  "Accept",
+  "Accept-Encoding",
+  "Accept-Language",
+  "Content-Length",
+  "Content-Type",
+  "Origin",
+  "Priority",
+  "Referer",
+  "Sec-Ch-Ua",
+  "Sec-Ch-Ua-Mobile",
+  "Sec-Ch-Ua-Platform",
+  "Sec-Fetch-Dest",
+  "Sec-Fetch-Mode",
+  "Sec-Fetch-Site",
+  "Sec-Fetch-User",
+  "True-Client-Ip",
+  "User-Agent"
+]

driver/config/buildinfo.go

@@ -0,0 +1,10 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package config
+
+var (
+	Version = "master"
+	Date    = "undefined"
+	Commit  = "undefined"
+)

driver/config/handler.go

@@ -0,0 +1,26 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package config
+
+import (
+	"crypto/sha256"
+	"fmt"
+	"net/http"
+
+	"github.com/knadh/koanf/parsers/json"
+
+	"github.com/ory/x/httprouterx"
+)
+
+func RegisterConfigHashRoute(c Provider, router *httprouterx.RouterAdmin) {
+	router.GET("/health/config", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "text/plain")
+		if revision := c.Config().GetProvider(r.Context()).String("revision"); len(revision) > 0 {
+			_, _ = fmt.Fprintf(w, "%s", revision)
+		} else {
+			bytes, _ := c.Config().GetProvider(r.Context()).Marshal(json.Parser())
+			_, _ = fmt.Fprintf(w, "%x", sha256.Sum256(bytes))
+		}
+	})
+}

driver/config/handler_test.go

@@ -0,0 +1,70 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package config_test
+
+import (
+	"context"
+	"io"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/ory/kratos/driver/config"
+	"github.com/ory/kratos/pkg"
+	"github.com/ory/x/contextx"
+	"github.com/ory/x/httprouterx"
+)
+
+type configProvider struct {
+	cfg *config.Config
+}
+
+func (c *configProvider) Config() *config.Config {
+	return c.cfg
+}
+
+func TestNewConfigHashHandler(t *testing.T) {
+	ctx := context.Background()
+	cfg := pkg.NewConfigurationWithDefaults(t)
+	router := httprouterx.NewRouterAdmin()
+	config.RegisterConfigHashRoute(&configProvider{cfg: cfg}, router)
+	ts := contextx.NewConfigurableTestServer(router)
+	t.Cleanup(ts.Close)
+
+	// first request, get baseline hash
+	res, err := ts.Client(ctx).Get(ts.URL + "/health/config")
+	require.NoError(t, err)
+	defer func() { _ = res.Body.Close() }()
+	require.Equal(t, 200, res.StatusCode)
+	first, err := io.ReadAll(res.Body)
+	require.NoError(t, err)
+
+	// second request, no config change
+	res, err = ts.Client(ctx).Get(ts.URL + "/health/config")
+	require.NoError(t, err)
+	defer func() { _ = res.Body.Close() }()
+	require.Equal(t, 200, res.StatusCode)
+	second, err := io.ReadAll(res.Body)
+	require.NoError(t, err)
+	assert.Equal(t, first, second)
+
+	// third request, with config change
+	res, err = ts.Client(contextx.WithConfigValue(ctx, config.ViperKeySessionDomain, "foobar")).Get(ts.URL + "/health/config")
+	require.NoError(t, err)
+	defer func() { _ = res.Body.Close() }()
+	require.Equal(t, 200, res.StatusCode)
+	third, err := io.ReadAll(res.Body)
+	require.NoError(t, err)
+	assert.NotEqual(t, first, third)
+
+	// fourth request, no config change
+	res, err = ts.Client(ctx).Get(ts.URL + "/health/config")
+	require.NoError(t, err)
+	defer func() { _ = res.Body.Close() }()
+	require.Equal(t, 200, res.StatusCode)
+	fourth, err := io.ReadAll(res.Body)
+	require.NoError(t, err)
+	assert.Equal(t, first, fourth)
+}

driver/config/stub/.defaults-password.yml

@@ -0,0 +1,6 @@
+selfservice:
+  methods:
+    password:
+      enabled: true
+  flows:
+    recovery: false

driver/config/stub/.defaults-verification.yml

@@ -0,0 +1,28 @@
+selfservice:
+  methods:
+    password:
+      enabled: true
+
+  flows:
+    settings:
+      privileged_session_max_age: 1m
+      after:
+        hooks:
+          profile:
+            - hook: show_verification_ui
+
+    verification:
+      enabled: true
+      lifespan: 5s
+      after:
+        default_browser_return_url: http://127.0.0.1:4455/
+
+    logout:
+      after:
+        default_browser_return_url: http://127.0.0.1:4455/auth/login
+
+identity:
+  default_schema_id: default
+  schemas:
+    - id: default
+      url: file://test/e2e/profiles/verification/identity.traits.schema.json

driver/config/stub/.defaults.yml

@@ -0,0 +1,2 @@
+selfservice:
+

driver/config/stub/.identity.invalid.json

@@ -0,0 +1,17 @@
+{
+  "$id": "ory://identity-invalid-schema",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "IdentityInvalidSchema",
+  "type": "object",
+  "properties": {
+    "traits": {
+      "type": "object",
+      "properties": {},
+      "required": [
+        "other",
+        "email"
+      ],
+      "additionalProperties": true
+    }
+  }
+}

driver/config/stub/.identity.other.json

@@ -0,0 +1,32 @@
+{
+  "$id": "ory://identity-other-schema",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "IdentityOtherSchema",
+  "type": "object",
+  "properties": {
+    "traits": {
+      "type": "object",
+      "properties": {
+        "other": {
+          "type": "string"
+        },
+        "email": {
+          "type": "string",
+          "title": "email",
+          "ory.sh/kratos": {
+            "credentials": {
+              "password": {
+                "identifier": true
+              }
+            }
+          }
+        }
+      },
+      "required": [
+        "other",
+        "email"
+      ],
+      "additionalProperties": true
+    }
+  }
+}

driver/config/stub/.identity.test.json

@@ -0,0 +1,28 @@
+{
+  "$id": "ory://identity-test-schema",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "IdentitySchema",
+  "type": "object",
+  "properties": {
+    "traits": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "object",
+          "properties": {
+            "first": {
+              "type": "string"
+            },
+            "last": {
+              "type": "string"
+            }
+          }
+        }
+      },
+      "required": [
+        "name"
+      ],
+      "additionalProperties": true
+    }
+  }
+}

driver/config/stub/.kratos.courier.channels.yaml

@@ -0,0 +1,16 @@
+courier:
+  smtp:
+    connection_uri: smtp://username:password@smtp.example.com:587
+  channels:
+    - id: phone
+      request_config:
+        url: https://ory.sh
+        method: GET
+        body: base64://ZnVuY3Rpb24oY3R4KSB7CkJvZHk6IGN0eC5ib2R5LApUbzogY3R4LnRvLEZyb206IGN0eC5mcm9tCn0=
+        headers:
+          Content-Type: application/x-www-form-urlencoded
+        auth:
+          type: basic_auth
+          config:
+            user: ABC
+            password: DEF

driver/config/stub/.kratos.courier.email.http.yaml

@@ -0,0 +1,24 @@
+dsn: sqlite://foo.db?mode=memory&_fk=true
+
+selfservice:
+  default_browser_return_url: https://example.com/return_to
+
+identity:
+  default_schema_id: default
+  schemas:
+    - id: default
+      url: base64://ewogICIkaWQiOiAib3J5Oi8vaWRlbnRpdHktdGVzdC1zY2hlbWEiLAogICIkc2NoZW1hIjogImh0dHA6Ly9qc29uLXNjaGVtYS5vcmcvZHJhZnQtMDcvc2NoZW1hIyIsCiAgInRpdGxlIjogIklkZW50aXR5U2NoZW1hIiwKICAidHlwZSI6ICJvYmplY3QiLAogICJwcm9wZXJ0aWVzIjogewogICAgInRyYWl0cyI6IHsKICAgICAgInR5cGUiOiAib2JqZWN0IiwKICAgICAgInByb3BlcnRpZXMiOiB7CiAgICAgICAgIm5hbWUiOiB7CiAgICAgICAgICAidHlwZSI6ICJvYmplY3QiLAogICAgICAgICAgInByb3BlcnRpZXMiOiB7CiAgICAgICAgICAgICJmaXJzdCI6IHsKICAgICAgICAgICAgICAidHlwZSI6ICJzdHJpbmciCiAgICAgICAgICAgIH0sCiAgICAgICAgICAgICJsYXN0IjogewogICAgICAgICAgICAgICJ0eXBlIjogInN0cmluZyIKICAgICAgICAgICAgfQogICAgICAgICAgfQogICAgICAgIH0KICAgICAgfSwKICAgICAgInJlcXVpcmVkIjogWwogICAgICAgICJuYW1lIgogICAgICBdLAogICAgICAiYWRkaXRpb25hbFByb3BlcnRpZXMiOiB0cnVlCiAgICB9CiAgfQp9
+
+courier:
+  delivery_strategy: http
+  http:
+    request_config:
+      url: https://example.com/email
+      body: file://some.jsonnet
+      header:
+        'Content-Type': 'application/json'
+      auth:
+        type: basic_auth
+        config:
+          user: YourUsername
+          password: YourPass

driver/config/stub/.kratos.courier.message_retries.yaml

@@ -0,0 +1,2 @@
+courier:
+  message_retries: 10

driver/config/stub/.kratos.courier.remote.invalid.subject.yaml

@@ -0,0 +1,30 @@
+dsn: sqlite://foo.db?mode=memory&_fk=true
+
+selfservice:
+  default_browser_return_url: http://return-to-3-test.ory.sh/
+
+identity:
+  default_schema_id: default
+  schemas:
+    - id: default
+      url: base64://ewogICIkaWQiOiAib3J5Oi8vaWRlbnRpdHktdGVzdC1zY2hlbWEiLAogICIkc2NoZW1hIjogImh0dHA6Ly9qc29uLXNjaGVtYS5vcmcvZHJhZnQtMDcvc2NoZW1hIyIsCiAgInRpdGxlIjogIklkZW50aXR5U2NoZW1hIiwKICAidHlwZSI6ICJvYmplY3QiLAogICJwcm9wZXJ0aWVzIjogewogICAgInRyYWl0cyI6IHsKICAgICAgInR5cGUiOiAib2JqZWN0IiwKICAgICAgInByb3BlcnRpZXMiOiB7CiAgICAgICAgIm5hbWUiOiB7CiAgICAgICAgICAidHlwZSI6ICJvYmplY3QiLAogICAgICAgICAgInByb3BlcnRpZXMiOiB7CiAgICAgICAgICAgICJmaXJzdCI6IHsKICAgICAgICAgICAgICAidHlwZSI6ICJzdHJpbmciCiAgICAgICAgICAgIH0sCiAgICAgICAgICAgICJsYXN0IjogewogICAgICAgICAgICAgICJ0eXBlIjogInN0cmluZyIKICAgICAgICAgICAgfQogICAgICAgICAgfQogICAgICAgIH0KICAgICAgfSwKICAgICAgInJlcXVpcmVkIjogWwogICAgICAgICJuYW1lIgogICAgICBdLAogICAgICAiYWRkaXRpb25hbFByb3BlcnRpZXMiOiB0cnVlCiAgICB9CiAgfQp9
+
+courier:
+  smtp:
+    connection_uri: smtp://stub-url
+  templates:
+    recovery:
+      invalid:
+        email:
+          body:
+            html: base64://SGksCgp5b3UgKG9yIHNvbWVvbmUgZWxzZSkgZW50ZXJlZCB0aGlzIGVtYWlsIGFkZHJlc3Mgd2hlbiB0cnlpbmcgdG8gcmVjb3ZlciBhY2Nlc3MgdG8gYW4gYWNjb3VudC4KCkhvd2V2ZXIsIHRoaXMgZW1haWwgYWRkcmVzcyBpcyBub3Qgb24gb3VyIGRhdGFiYXNlIG9mIHJlZ2lzdGVyZWQgdXNlcnMgYW5kIHRoZXJlZm9yZSB0aGUgYXR0ZW1wdCBoYXMgZmFpbGVkLgoKSWYgdGhpcyB3YXMgeW91LCBjaGVjayBpZiB5b3Ugc2lnbmVkIHVwIHVzaW5nIGEgZGlmZmVyZW50IGFkZHJlc3MuCgpJZiB0aGlzIHdhcyBub3QgeW91LCBwbGVhc2UgaWdub3JlIHRoaXMgZW1haWwu
+          # omit subject to verify it is validated
+      valid:
+        # omit template_root as it is not required on valid
+        email:
+          body:
+            plaintext: base64://e3sgZGVmaW5lIGFmLVpBIH19CkhhbGxvLAoKSGVyc3RlbCBqb3UgcmVrZW5pbmcgZGV1ciBoaWVyZGllIHNrYWtlbCB0ZSB2b2xnOgp7ey0gZW5kIC19fQoKe3sgZGVmaW5lIGVuLVVTIH19CkhpLAoKcGxlYXNlIHJlY292ZXIgYWNjZXNzIHRvIHlvdXIgYWNjb3VudCBieSBjbGlja2luZyB0aGUgZm9sbG93aW5nIGxpbms6Cnt7LSBlbmQgLX19Cgp7ey0gaWYgZXEgLmxhbmcgImFmLVpBIiAtfX0KCnt7IHRlbXBsYXRlICJhZi1aQSIgLiB9fQoKe3stIGVsc2UgLX19Cgp7eyB0ZW1wbGF0ZSAiZW4tVVMiIH19Cgp7ey0gZW5kIC19fQp7eyAuUmVjb3ZlcnlVUkwgfX0K
+            html: base64://e3sgZGVmaW5lIGFmLVpBIH19CkhhbGxvLAoKSGVyc3RlbCBqb3UgcmVrZW5pbmcgZGV1ciBoaWVyZGllIHNrYWtlbCB0ZSB2b2xnOgp7ey0gZW5kIC19fQoKe3sgZGVmaW5lIGVuLVVTIH19CkhpLAoKcGxlYXNlIHJlY292ZXIgYWNjZXNzIHRvIHlvdXIgYWNjb3VudCBieSBjbGlja2luZyB0aGUgZm9sbG93aW5nIGxpbms6Cnt7LSBlbmQgLX19Cgp7ey0gaWYgZXEgLmxhbmcgImFmLVpBIiAtfX0KCnt7IHRlbXBsYXRlICJhZi1aQSIgLiB9fQoKe3stIGVsc2UgLX19Cgp7eyB0ZW1wbGF0ZSAiZW4tVVMiIH19Cgp7ey0gZW5kIC19fQo8YSBocmVmPSJ7eyAuUmVjb3ZlcnlVUkwgfX0iPnt7IC5SZWNvdmVyeVVSTCB9fTwvYT4=
+          subject: base64://UmVjb3ZlciBhY2Nlc3MgdG8geW91ciBhY2NvdW50
+    # omit verification here to test templates override fallback
+  template_override_path: "../../courier/template/courier/builtin/templates"

driver/config/stub/.kratos.courier.remote.partial.templates.yaml

@@ -0,0 +1,26 @@
+dsn: sqlite://foo.db?mode=memory&_fk=true
+
+selfservice:
+  default_browser_return_url: http://return-to-3-test.ory.sh/
+
+identity:
+  default_schema_id: default
+  schemas:
+    - id: default
+      url: base64://ewogICIkaWQiOiAib3J5Oi8vaWRlbnRpdHktdGVzdC1zY2hlbWEiLAogICIkc2NoZW1hIjogImh0dHA6Ly9qc29uLXNjaGVtYS5vcmcvZHJhZnQtMDcvc2NoZW1hIyIsCiAgInRpdGxlIjogIklkZW50aXR5U2NoZW1hIiwKICAidHlwZSI6ICJvYmplY3QiLAogICJwcm9wZXJ0aWVzIjogewogICAgInRyYWl0cyI6IHsKICAgICAgInR5cGUiOiAib2JqZWN0IiwKICAgICAgInByb3BlcnRpZXMiOiB7CiAgICAgICAgIm5hbWUiOiB7CiAgICAgICAgICAidHlwZSI6ICJvYmplY3QiLAogICAgICAgICAgInByb3BlcnRpZXMiOiB7CiAgICAgICAgICAgICJmaXJzdCI6IHsKICAgICAgICAgICAgICAidHlwZSI6ICJzdHJpbmciCiAgICAgICAgICAgIH0sCiAgICAgICAgICAgICJsYXN0IjogewogICAgICAgICAgICAgICJ0eXBlIjogInN0cmluZyIKICAgICAgICAgICAgfQogICAgICAgICAgfQogICAgICAgIH0KICAgICAgfSwKICAgICAgInJlcXVpcmVkIjogWwogICAgICAgICJuYW1lIgogICAgICBdLAogICAgICAiYWRkaXRpb25hbFByb3BlcnRpZXMiOiB0cnVlCiAgICB9CiAgfQp9
+
+courier:
+  smtp:
+    connection_uri: smtp://stub-url
+  templates:
+    recovery:
+      invalid:
+        email:
+          body:
+            plaintext: base64://SGksCgp5b3UgKG9yIHNvbWVvbmUgZWxzZSkgZW50ZXJlZCB0aGlzIGVtYWlsIGFkZHJlc3Mgd2hlbiB0cnlpbmcgdG8gcmVjb3ZlciBhY2Nlc3MgdG8gYW4gYWNjb3VudC4KCkhvd2V2ZXIsIHRoaXMgZW1haWwgYWRkcmVzcyBpcyBub3Qgb24gb3VyIGRhdGFiYXNlIG9mIHJlZ2lzdGVyZWQgdXNlcnMgYW5kIHRoZXJlZm9yZSB0aGUgYXR0ZW1wdCBoYXMgZmFpbGVkLgoKSWYgdGhpcyB3YXMgeW91LCBjaGVjayBpZiB5b3Ugc2lnbmVkIHVwIHVzaW5nIGEgZGlmZmVyZW50IGFkZHJlc3MuCgpJZiB0aGlzIHdhcyBub3QgeW91LCBwbGVhc2UgaWdub3JlIHRoaXMgZW1haWwu
+            html: base64://SGksCgp5b3UgKG9yIHNvbWVvbmUgZWxzZSkgZW50ZXJlZCB0aGlzIGVtYWlsIGFkZHJlc3Mgd2hlbiB0cnlpbmcgdG8gcmVjb3ZlciBhY2Nlc3MgdG8gYW4gYWNjb3VudC4KCkhvd2V2ZXIsIHRoaXMgZW1haWwgYWRkcmVzcyBpcyBub3Qgb24gb3VyIGRhdGFiYXNlIG9mIHJlZ2lzdGVyZWQgdXNlcnMgYW5kIHRoZXJlZm9yZSB0aGUgYXR0ZW1wdCBoYXMgZmFpbGVkLgoKSWYgdGhpcyB3YXMgeW91LCBjaGVjayBpZiB5b3Ugc2lnbmVkIHVwIHVzaW5nIGEgZGlmZmVyZW50IGFkZHJlc3MuCgpJZiB0aGlzIHdhcyBub3QgeW91LCBwbGVhc2UgaWdub3JlIHRoaXMgZW1haWwu
+    verification:
+      valid:
+        email:
+          subject: base64://VmVyaWZpY2F0aW9uIEVtYWls
+  template_override_path: "../../courier/template/courier/builtin/templates"

driver/config/stub/.kratos.courier.remote.templates.yaml

@@ -0,0 +1,30 @@
+dsn: sqlite://foo.db?mode=memory&_fk=true
+
+selfservice:
+  default_browser_return_url: http://return-to-3-test.ory.sh/
+
+identity:
+  default_schema_id: default
+  schemas:
+    - id: default
+      url: base64://ewogICIkaWQiOiAib3J5Oi8vaWRlbnRpdHktdGVzdC1zY2hlbWEiLAogICIkc2NoZW1hIjogImh0dHA6Ly9qc29uLXNjaGVtYS5vcmcvZHJhZnQtMDcvc2NoZW1hIyIsCiAgInRpdGxlIjogIklkZW50aXR5U2NoZW1hIiwKICAidHlwZSI6ICJvYmplY3QiLAogICJwcm9wZXJ0aWVzIjogewogICAgInRyYWl0cyI6IHsKICAgICAgInR5cGUiOiAib2JqZWN0IiwKICAgICAgInByb3BlcnRpZXMiOiB7CiAgICAgICAgIm5hbWUiOiB7CiAgICAgICAgICAidHlwZSI6ICJvYmplY3QiLAogICAgICAgICAgInByb3BlcnRpZXMiOiB7CiAgICAgICAgICAgICJmaXJzdCI6IHsKICAgICAgICAgICAgICAidHlwZSI6ICJzdHJpbmciCiAgICAgICAgICAgIH0sCiAgICAgICAgICAgICJsYXN0IjogewogICAgICAgICAgICAgICJ0eXBlIjogInN0cmluZyIKICAgICAgICAgICAgfQogICAgICAgICAgfQogICAgICAgIH0KICAgICAgfSwKICAgICAgInJlcXVpcmVkIjogWwogICAgICAgICJuYW1lIgogICAgICBdLAogICAgICAiYWRkaXRpb25hbFByb3BlcnRpZXMiOiB0cnVlCiAgICB9CiAgfQp9
+
+courier:
+  smtp:
+    connection_uri: smtp://stub-url
+  templates:
+    recovery:
+      invalid:
+        email:
+          body:
+            plaintext: base64://SGksCgp5b3UgKG9yIHNvbWVvbmUgZWxzZSkgZW50ZXJlZCB0aGlzIGVtYWlsIGFkZHJlc3Mgd2hlbiB0cnlpbmcgdG8gcmVjb3ZlciBhY2Nlc3MgdG8gYW4gYWNjb3VudC4KCkhvd2V2ZXIsIHRoaXMgZW1haWwgYWRkcmVzcyBpcyBub3Qgb24gb3VyIGRhdGFiYXNlIG9mIHJlZ2lzdGVyZWQgdXNlcnMgYW5kIHRoZXJlZm9yZSB0aGUgYXR0ZW1wdCBoYXMgZmFpbGVkLgoKSWYgdGhpcyB3YXMgeW91LCBjaGVjayBpZiB5b3Ugc2lnbmVkIHVwIHVzaW5nIGEgZGlmZmVyZW50IGFkZHJlc3MuCgpJZiB0aGlzIHdhcyBub3QgeW91LCBwbGVhc2UgaWdub3JlIHRoaXMgZW1haWwu
+            html: base64://SGksCgp5b3UgKG9yIHNvbWVvbmUgZWxzZSkgZW50ZXJlZCB0aGlzIGVtYWlsIGFkZHJlc3Mgd2hlbiB0cnlpbmcgdG8gcmVjb3ZlciBhY2Nlc3MgdG8gYW4gYWNjb3VudC4KCkhvd2V2ZXIsIHRoaXMgZW1haWwgYWRkcmVzcyBpcyBub3Qgb24gb3VyIGRhdGFiYXNlIG9mIHJlZ2lzdGVyZWQgdXNlcnMgYW5kIHRoZXJlZm9yZSB0aGUgYXR0ZW1wdCBoYXMgZmFpbGVkLgoKSWYgdGhpcyB3YXMgeW91LCBjaGVjayBpZiB5b3Ugc2lnbmVkIHVwIHVzaW5nIGEgZGlmZmVyZW50IGFkZHJlc3MuCgpJZiB0aGlzIHdhcyBub3QgeW91LCBwbGVhc2UgaWdub3JlIHRoaXMgZW1haWwu
+          subject: base64://QWNjb3VudCBBY2Nlc3MgQXR0ZW1wdGVk
+      valid:
+        email:
+          body:
+            plaintext: base64://e3sgZGVmaW5lIGFmLVpBIH19CkhhbGxvLAoKSGVyc3RlbCBqb3UgcmVrZW5pbmcgZGV1ciBoaWVyZGllIHNrYWtlbCB0ZSB2b2xnOgp7ey0gZW5kIC19fQoKe3sgZGVmaW5lIGVuLVVTIH19CkhpLAoKcGxlYXNlIHJlY292ZXIgYWNjZXNzIHRvIHlvdXIgYWNjb3VudCBieSBjbGlja2luZyB0aGUgZm9sbG93aW5nIGxpbms6Cnt7LSBlbmQgLX19Cgp7ey0gaWYgZXEgLmxhbmcgImFmLVpBIiAtfX0KCnt7IHRlbXBsYXRlICJhZi1aQSIgLiB9fQoKe3stIGVsc2UgLX19Cgp7eyB0ZW1wbGF0ZSAiZW4tVVMiIH19Cgp7ey0gZW5kIC19fQp7eyAuUmVjb3ZlcnlVUkwgfX0K
+            html: base64://e3sgZGVmaW5lIGFmLVpBIH19CkhhbGxvLAoKSGVyc3RlbCBqb3UgcmVrZW5pbmcgZGV1ciBoaWVyZGllIHNrYWtlbCB0ZSB2b2xnOgp7ey0gZW5kIC19fQoKe3sgZGVmaW5lIGVuLVVTIH19CkhpLAoKcGxlYXNlIHJlY292ZXIgYWNjZXNzIHRvIHlvdXIgYWNjb3VudCBieSBjbGlja2luZyB0aGUgZm9sbG93aW5nIGxpbms6Cnt7LSBlbmQgLX19Cgp7ey0gaWYgZXEgLmxhbmcgImFmLVpBIiAtfX0KCnt7IHRlbXBsYXRlICJhZi1aQSIgLiB9fQoKe3stIGVsc2UgLX19Cgp7eyB0ZW1wbGF0ZSAiZW4tVVMiIH19Cgp7ey0gZW5kIC19fQo8YSBocmVmPSJ7eyAuUmVjb3ZlcnlVUkwgfX0iPnt7IC5SZWNvdmVyeVVSTCB9fTwvYT4=
+          subject: base64://UmVjb3ZlciBhY2Nlc3MgdG8geW91ciBhY2NvdW50
+    # omit verification here to test templates override fallback
+  template_override_path: "../../courier/template/courier/builtin/templates"

driver/config/stub/.kratos.courier.sms.yaml

@@ -0,0 +1,28 @@
+dsn: sqlite://foo.db?mode=memory&_fk=true
+
+selfservice:
+  default_browser_return_url: http://return-to-3-test.ory.sh/
+
+identity:
+  default_schema_id: default
+  schemas:
+    - id: default
+      url: base64://ewogICIkaWQiOiAib3J5Oi8vaWRlbnRpdHktdGVzdC1zY2hlbWEiLAogICIkc2NoZW1hIjogImh0dHA6Ly9qc29uLXNjaGVtYS5vcmcvZHJhZnQtMDcvc2NoZW1hIyIsCiAgInRpdGxlIjogIklkZW50aXR5U2NoZW1hIiwKICAidHlwZSI6ICJvYmplY3QiLAogICJwcm9wZXJ0aWVzIjogewogICAgInRyYWl0cyI6IHsKICAgICAgInR5cGUiOiAib2JqZWN0IiwKICAgICAgInByb3BlcnRpZXMiOiB7CiAgICAgICAgIm5hbWUiOiB7CiAgICAgICAgICAidHlwZSI6ICJvYmplY3QiLAogICAgICAgICAgInByb3BlcnRpZXMiOiB7CiAgICAgICAgICAgICJmaXJzdCI6IHsKICAgICAgICAgICAgICAidHlwZSI6ICJzdHJpbmciCiAgICAgICAgICAgIH0sCiAgICAgICAgICAgICJsYXN0IjogewogICAgICAgICAgICAgICJ0eXBlIjogInN0cmluZyIKICAgICAgICAgICAgfQogICAgICAgICAgfQogICAgICAgIH0KICAgICAgfSwKICAgICAgInJlcXVpcmVkIjogWwogICAgICAgICJuYW1lIgogICAgICBdLAogICAgICAiYWRkaXRpb25hbFByb3BlcnRpZXMiOiB0cnVlCiAgICB9CiAgfQp9
+
+courier:
+  smtp:
+    connection_uri: smtp://foo:bar@baz/
+  sms:
+    enabled: true
+    from: '+49123456789'
+    request_config:
+      url: https://api.twilio.com/2010-04-01/Accounts/YourAccountID/Messages.json
+      method: POST
+      body: base64://e30=
+      header:
+        'Content-Type': 'application/x-www-form-urlencoded'
+      auth:
+        type: basic_auth
+        config:
+          user: YourUsername
+          password: YourPass

driver/config/stub/.kratos.invalid.identities.yaml

@@ -0,0 +1,14 @@
+dsn: sqlite://foo.db?mode=memory&_fk=true
+
+selfservice:
+  default_browser_return_url: http://return-to-3-test.ory.sh/
+
+identity:
+  default_schema_id: other
+  schemas:
+    - id: other
+      url: file://stub/.identity.invalid.json
+
+courier:
+  smtp:
+    connection_uri: smtp://foo:bar@baz/

driver/config/stub/.kratos.mock.identities.yaml

@@ -0,0 +1,16 @@
+dsn: sqlite://foo.db?mode=memory&_fk=true
+
+selfservice:
+  default_browser_return_url: http://return-to-3-test.ory.sh/
+
+identity:
+  default_schema_id: default
+  schemas:
+    - id: default
+      url: http://test.kratos.ory.sh/default-identity.schema.json
+    - id: other
+      url: http://test.kratos.ory.sh/other-identity.schema.json
+
+courier:
+  smtp:
+    connection_uri: smtp://foo:bar@baz/

driver/config/stub/.kratos.notify-unknown-recipients.yml

@@ -0,0 +1,6 @@
+selfservice:
+  flows:
+    recovery:
+      notify_unknown_recipients: true
+    verification:
+      notify_unknown_recipients: true

driver/config/stub/.kratos.oauth2_provider.yaml

@@ -0,0 +1,5 @@
+oauth2_provider:
+  url: https://oauth2_provider/
+  headers:
+    Authorization: Basic
+  override_return_to: true

driver/config/stub/.kratos.passkey.options.yaml

@@ -0,0 +1,54 @@
+serve:
+  admin:
+    base_url: http://admin.kratos.ory.sh
+    port: 1234
+    host: admin.kratos.ory.sh
+  public:
+    base_url: http://public.kratos.ory.sh
+    port: 1235
+    host: public.kratos.ory.sh
+
+dsn: sqlite://foo.db?mode=memory&_fk=true
+
+log:
+  level: debug
+
+courier:
+  smtp:
+    connection_uri: smtp://foo:bar@baz/
+
+identity:
+  default_schema_id: default
+  schemas:
+    - id: default
+      url: base64://ewogICIkaWQiOiAib3J5Oi8vaWRlbnRpdHktdGVzdC1zY2hlbWEiLAogICIkc2NoZW1hIjogImh0dHA6Ly9qc29uLXNjaGVtYS5vcmcvZHJhZnQtMDcvc2NoZW1hIyIsCiAgInRpdGxlIjogIklkZW50aXR5U2NoZW1hIiwKICAidHlwZSI6ICJvYmplY3QiLAogICJwcm9wZXJ0aWVzIjogewogICAgInRyYWl0cyI6IHsKICAgICAgInR5cGUiOiAib2JqZWN0IiwKICAgICAgInByb3BlcnRpZXMiOiB7CiAgICAgICAgIm5hbWUiOiB7CiAgICAgICAgICAidHlwZSI6ICJvYmplY3QiLAogICAgICAgICAgInByb3BlcnRpZXMiOiB7CiAgICAgICAgICAgICJmaXJzdCI6IHsKICAgICAgICAgICAgICAidHlwZSI6ICJzdHJpbmciCiAgICAgICAgICAgIH0sCiAgICAgICAgICAgICJsYXN0IjogewogICAgICAgICAgICAgICJ0eXBlIjogInN0cmluZyIKICAgICAgICAgICAgfQogICAgICAgICAgfQogICAgICAgIH0KICAgICAgfSwKICAgICAgInJlcXVpcmVkIjogWwogICAgICAgICJuYW1lIgogICAgICBdLAogICAgICAiYWRkaXRpb25hbFByb3BlcnRpZXMiOiB0cnVlCiAgICB9CiAgfQp9
+
+secrets:
+  cookie:
+    - session-key-7f8a9b77-1
+  cipher:
+    - secret-thirty-two-character-long
+
+ciphers:
+  algorithm: xchacha20-poly1305
+
+selfservice:
+  default_browser_return_url: http://return-to-3-test.ory.sh/
+  methods:
+    passkey:
+      enabled: true
+      config:
+        rp:
+          id: example.com
+          display_name: Example
+          origins:
+            - https://example.com
+        authenticator_selection:
+          attachment: "cross-platform"
+          resident_key: "discouraged"
+          user_verification: "required"
+        attestation:
+          preference: "direct"
+        timeouts:
+          registration: "30s"
+          login: "45s"

driver/config/stub/.kratos.passkey.yaml

@@ -0,0 +1,45 @@
+serve:
+  admin:
+    base_url: http://admin.kratos.ory.sh
+    port: 1234
+    host: admin.kratos.ory.sh
+  public:
+    base_url: http://public.kratos.ory.sh
+    port: 1235
+    host: public.kratos.ory.sh
+
+dsn: sqlite://foo.db?mode=memory&_fk=true
+
+log:
+  level: debug
+
+courier:
+  smtp:
+    connection_uri: smtp://foo:bar@baz/
+
+identity:
+  default_schema_id: default
+  schemas:
+    - id: default
+      url: base64://ewogICIkaWQiOiAib3J5Oi8vaWRlbnRpdHktdGVzdC1zY2hlbWEiLAogICIkc2NoZW1hIjogImh0dHA6Ly9qc29uLXNjaGVtYS5vcmcvZHJhZnQtMDcvc2NoZW1hIyIsCiAgInRpdGxlIjogIklkZW50aXR5U2NoZW1hIiwKICAidHlwZSI6ICJvYmplY3QiLAogICJwcm9wZXJ0aWVzIjogewogICAgInRyYWl0cyI6IHsKICAgICAgInR5cGUiOiAib2JqZWN0IiwKICAgICAgInByb3BlcnRpZXMiOiB7CiAgICAgICAgIm5hbWUiOiB7CiAgICAgICAgICAidHlwZSI6ICJvYmplY3QiLAogICAgICAgICAgInByb3BlcnRpZXMiOiB7CiAgICAgICAgICAgICJmaXJzdCI6IHsKICAgICAgICAgICAgICAidHlwZSI6ICJzdHJpbmciCiAgICAgICAgICAgIH0sCiAgICAgICAgICAgICJsYXN0IjogewogICAgICAgICAgICAgICJ0eXBlIjogInN0cmluZyIKICAgICAgICAgICAgfQogICAgICAgICAgfQogICAgICAgIH0KICAgICAgfSwKICAgICAgInJlcXVpcmVkIjogWwogICAgICAgICJuYW1lIgogICAgICBdLAogICAgICAiYWRkaXRpb25hbFByb3BlcnRpZXMiOiB0cnVlCiAgICB9CiAgfQp9
+
+secrets:
+  cookie:
+    - session-key-7f8a9b77-1
+  cipher:
+    - secret-thirty-two-character-long
+
+ciphers:
+  algorithm: xchacha20-poly1305
+
+selfservice:
+  default_browser_return_url: http://return-to-3-test.ory.sh/
+  methods:
+    passkey:
+      enabled: true
+      config:
+        rp:
+          id: example.com
+          display_name: Example
+          origins:
+            - https://example.com

driver/config/stub/.kratos.webauthn.invalid.yaml

@@ -0,0 +1,257 @@
+# serve controls the configuration for the http(s) daemon
+serve:
+  admin:
+    base_url: http://admin.kratos.ory.sh
+    port: 1234
+    host: admin.kratos.ory.sh
+  public:
+    base_url: http://public.kratos.ory.sh
+    port: 1235
+    host: public.kratos.ory.sh
+
+dsn: sqlite://foo.db?mode=memory&_fk=true
+
+log:
+  level: debug
+
+courier:
+  smtp:
+    connection_uri: smtp://foo:bar@baz/
+
+identity:
+  default_schema_id: default
+  schemas:
+    - id: default
+      url: base64://ewogICIkaWQiOiAib3J5Oi8vaWRlbnRpdHktdGVzdC1zY2hlbWEiLAogICIkc2NoZW1hIjogImh0dHA6Ly9qc29uLXNjaGVtYS5vcmcvZHJhZnQtMDcvc2NoZW1hIyIsCiAgInRpdGxlIjogIklkZW50aXR5U2NoZW1hIiwKICAidHlwZSI6ICJvYmplY3QiLAogICJwcm9wZXJ0aWVzIjogewogICAgInRyYWl0cyI6IHsKICAgICAgInR5cGUiOiAib2JqZWN0IiwKICAgICAgInByb3BlcnRpZXMiOiB7CiAgICAgICAgIm5hbWUiOiB7CiAgICAgICAgICAidHlwZSI6ICJvYmplY3QiLAogICAgICAgICAgInByb3BlcnRpZXMiOiB7CiAgICAgICAgICAgICJmaXJzdCI6IHsKICAgICAgICAgICAgICAidHlwZSI6ICJzdHJpbmciCiAgICAgICAgICAgIH0sCiAgICAgICAgICAgICJsYXN0IjogewogICAgICAgICAgICAgICJ0eXBlIjogInN0cmluZyIKICAgICAgICAgICAgfQogICAgICAgICAgfQogICAgICAgIH0KICAgICAgfSwKICAgICAgInJlcXVpcmVkIjogWwogICAgICAgICJuYW1lIgogICAgICBdLAogICAgICAiYWRkaXRpb25hbFByb3BlcnRpZXMiOiB0cnVlCiAgICB9CiAgfQp9
+    - id: other
+      url: base64://ewogICIkaWQiOiAib3J5Oi8vaWRlbnRpdHktb3RoZXItc2NoZW1hIiwKICAiJHNjaGVtYSI6ICJodHRwOi8vanNvbi1zY2hlbWEub3JnL2RyYWZ0LTA3L3NjaGVtYSMiLAogICJ0aXRsZSI6ICJJZGVudGl0eU90aGVyU2NoZW1hIiwKICAidHlwZSI6ICJvYmplY3QiLAogICJwcm9wZXJ0aWVzIjogewogICAgInRyYWl0cyI6IHsKICAgICAgInR5cGUiOiAib2JqZWN0IiwKICAgICAgInByb3BlcnRpZXMiOiB7CiAgICAgICAgIm90aGVyIjogewogICAgICAgICAgInR5cGUiOiAic3RyaW5nIgogICAgICAgIH0sCiAgICAgICAgImVtYWlsIjogewogICAgICAgICAgInR5cGUiOiAic3RyaW5nIiwKICAgICAgICAgICJ0aXRsZSI6ICJlbWFpbCIsCiAgICAgICAgICAib3J5LnNoL2tyYXRvcyI6IHsKICAgICAgICAgICAgImNyZWRlbnRpYWxzIjogewogICAgICAgICAgICAgICJwYXNzd29yZCI6IHsKICAgICAgICAgICAgICAgICJpZGVudGlmaWVyIjogdHJ1ZQogICAgICAgICAgICAgIH0KICAgICAgICAgICAgfQogICAgICAgICAgfQogICAgICAgIH0KICAgICAgfSwKICAgICAgInJlcXVpcmVkIjogWwogICAgICAgICJvdGhlciIsCiAgICAgICAgImVtYWlsIgogICAgICBdLAogICAgICAiYWRkaXRpb25hbFByb3BlcnRpZXMiOiB0cnVlCiAgICB9CiAgfQp9
+
+hashers:
+  argon2:
+    memory: 1MB
+    iterations: 2
+    parallelism: 4
+    salt_length: 16
+    key_length: 32
+    dedicated_memory: 1GB
+    expected_duration: 500ms
+    expected_deviation: 500ms
+
+secrets:
+  cookie:
+    - session-key-7f8a9b77-1
+    - session-key-7f8a9b77-2
+  cipher:
+    - secret-thirty-two-character-long
+
+ciphers:
+  algorithm: xchacha20-poly1305
+
+selfservice:
+  default_browser_return_url: http://return-to-3-test.ory.sh/
+  allowed_return_urls:
+    - http://return-to-1-test.ory.sh/
+    - http://return-to-2-test.ory.sh/
+    - http://*.wildcards.ory.sh
+    - http://*.sh
+    - http://*.com
+    - http://*.com.pl
+    - http://*
+    - /return-to-relative-test/
+  methods:
+    totp:
+      enabled: true
+      config:
+        issuer: issuer.ory.sh
+    password:
+      enabled: true
+    oidc:
+      enabled: true
+      config:
+        providers:
+          - id: github
+            provider: github
+            client_id: a
+            client_secret: b
+            mapper_url: http://test.kratos.ory.sh/default-identity.schema.json
+    webauthn:
+      enabled: true
+      config:
+        rp:
+          id: https://example.com/webauthn
+          display_name: Webauthn
+          origin: https://origin-a.example.com
+          origins:
+            - https://origin-a.example.com
+            - https://origin-b.example.com
+            - https://origin-c.example.com
+  flows:
+    error:
+      ui_url: http://test.kratos.ory.sh/error
+
+    logout:
+      after:
+        default_browser_return_url: http://test.kratos.ory.sh:4000/
+
+    recovery:
+      enabled: true
+      ui_url: http://test.kratos.ory.sh/recovery
+      lifespan: 98m
+      after:
+        default_browser_return_url: http://test.kratos.ory.sh/dashboard
+        hooks:
+          - hook: web_hook
+            config:
+              url: https://test.kratos.ory.sh/after_recovery_hook
+              method: GET
+              headers: 
+                X-Custom-Header: test
+              body: /path/to/template.jsonnet
+
+    verification:
+      enabled: true
+      lifespan: 97m
+      ui_url: http://test.kratos.ory.sh/verification
+      after:
+        default_browser_return_url: http://test.kratos.ory.sh/dashboard
+        hooks:
+          - hook: web_hook
+            config:
+              url: https://test.kratos.ory.sh/after_verification_hook
+              method: GET
+              headers: 
+                X-Custom-Header: test
+              body: /path/to/template.jsonnet
+
+    settings:
+      ui_url: http://test.kratos.ory.sh/settings
+      lifespan: 99m
+      privileged_session_max_age: 5m
+      after:
+        default_browser_return_url: https://self-service/settings/return_to
+        password:
+          default_browser_return_url: https://self-service/settings/password/return_to
+          hooks:
+            - hook: web_hook
+              config:
+                url: https://test.kratos.ory.sh/after_settings_password_hook
+                method: POST
+                headers: 
+                  X-Custom-Header: test
+                body: /path/to/template.jsonnet
+        profile:
+          hooks:
+            - hook: web_hook
+              config:
+                url: https://test.kratos.ory.sh/after_settings_profile_hook
+                method: POST
+                headers: 
+                  X-Custom-Header: test
+                body: /path/to/template.jsonnet
+        hooks:
+          - hook: web_hook
+            config:
+              url: https://test.kratos.ory.sh/after_settings_global_hook
+              method: POST
+              headers: 
+                X-Custom-Header: test
+              body: /path/to/template.jsonnet
+
+    login:
+      ui_url: http://test.kratos.ory.sh/login
+      lifespan: 99m
+      before:
+        hooks:
+          - hook: web_hook
+            config:
+              url: https://test.kratos.ory.sh/before_login_hook
+              method: POST
+              headers: 
+                X-Custom-Header: test
+      after:
+        default_browser_return_url: https://self-service/login/return_to
+        password:
+          default_browser_return_url: https://self-service/login/password/return_to
+          hooks:
+            - hook: revoke_active_sessions
+            - hook: require_verified_address
+            - hook: web_hook
+              config:
+                url: https://test.kratos.ory.sh/after_login_password_hook
+                method: POST
+                headers: 
+                  X-Custom-Header: test
+                body: /path/to/template.jsonnet
+                auth:
+                  type: basic_auth
+                  config:
+                    user: test-user
+                    password: super-secret
+        oidc:
+          hooks:
+            - hook: web_hook
+              config:
+                url: https://test.kratos.ory.sh/after_login_oidc_hook
+                method: GET
+                headers: 
+                  X-Custom-Header: test
+                body: /path/to/template.jsonnet
+            - hook: revoke_active_sessions
+        hooks:
+          - hook: web_hook
+            config:
+              url: https://test.kratos.ory.sh/after_login_global_hook
+              method: POST
+              headers: 
+                X-Custom-Header: test
+              body: /path/to/template.jsonnet
+
+    registration:
+      enabled: true
+      ui_url: http://test.kratos.ory.sh/register
+      lifespan: 98m
+      before:
+        hooks:
+          - hook: web_hook
+            config:
+              url: https://test.kratos.ory.sh/before_registration_hook
+              method: GET
+              headers: 
+                X-Custom-Header: test
+      after:
+        default_browser_return_url: https://self-service/registration/return_to
+        password:
+          hooks:
+            - hook: session
+            - hook: web_hook
+              config:
+                url: https://test.kratos.ory.sh/after_registration_password_hook
+                method: POST
+                headers: 
+                  X-Custom-Header: test
+                body: /path/to/template.jsonnet
+        hooks:
+          - hook: web_hook
+            config:
+              url: https://test.kratos.ory.sh/after_registration_global_hook
+              method: POST
+              headers: 
+                X-Custom-Header: test
+              body: /path/to/template.jsonnet
+              auth:
+                type: api_key
+                config:
+                  name: My-Key
+                  value: My-Key-Value
+                  in: header
+        oidc:
+          default_browser_return_url: https://self-service/registration/oidc/return_to
+          hooks:
+            - hook: web_hook
+              config:
+                url: https://test.kratos.ory.sh/after_registration_oidc_hook
+                method: GET
+                headers: 
+                  X-Custom-Header: test
+                body: /path/to/template.jsonnet
+            - hook: session

driver/config/stub/.kratos.webauthn.origin.yaml

@@ -0,0 +1,253 @@
+# serve controls the configuration for the http(s) daemon
+serve:
+  admin:
+    base_url: http://admin.kratos.ory.sh
+    port: 1234
+    host: admin.kratos.ory.sh
+  public:
+    base_url: http://public.kratos.ory.sh
+    port: 1235
+    host: public.kratos.ory.sh
+
+dsn: sqlite://foo.db?mode=memory&_fk=true
+
+log:
+  level: debug
+
+courier:
+  smtp:
+    connection_uri: smtp://foo:bar@baz/
+
+identity:
+  default_schema_id: default
+  schemas:
+    - id: default
+      url: base64://ewogICIkaWQiOiAib3J5Oi8vaWRlbnRpdHktdGVzdC1zY2hlbWEiLAogICIkc2NoZW1hIjogImh0dHA6Ly9qc29uLXNjaGVtYS5vcmcvZHJhZnQtMDcvc2NoZW1hIyIsCiAgInRpdGxlIjogIklkZW50aXR5U2NoZW1hIiwKICAidHlwZSI6ICJvYmplY3QiLAogICJwcm9wZXJ0aWVzIjogewogICAgInRyYWl0cyI6IHsKICAgICAgInR5cGUiOiAib2JqZWN0IiwKICAgICAgInByb3BlcnRpZXMiOiB7CiAgICAgICAgIm5hbWUiOiB7CiAgICAgICAgICAidHlwZSI6ICJvYmplY3QiLAogICAgICAgICAgInByb3BlcnRpZXMiOiB7CiAgICAgICAgICAgICJmaXJzdCI6IHsKICAgICAgICAgICAgICAidHlwZSI6ICJzdHJpbmciCiAgICAgICAgICAgIH0sCiAgICAgICAgICAgICJsYXN0IjogewogICAgICAgICAgICAgICJ0eXBlIjogInN0cmluZyIKICAgICAgICAgICAgfQogICAgICAgICAgfQogICAgICAgIH0KICAgICAgfSwKICAgICAgInJlcXVpcmVkIjogWwogICAgICAgICJuYW1lIgogICAgICBdLAogICAgICAiYWRkaXRpb25hbFByb3BlcnRpZXMiOiB0cnVlCiAgICB9CiAgfQp9
+    - id: other
+      url: base64://ewogICIkaWQiOiAib3J5Oi8vaWRlbnRpdHktb3RoZXItc2NoZW1hIiwKICAiJHNjaGVtYSI6ICJodHRwOi8vanNvbi1zY2hlbWEub3JnL2RyYWZ0LTA3L3NjaGVtYSMiLAogICJ0aXRsZSI6ICJJZGVudGl0eU90aGVyU2NoZW1hIiwKICAidHlwZSI6ICJvYmplY3QiLAogICJwcm9wZXJ0aWVzIjogewogICAgInRyYWl0cyI6IHsKICAgICAgInR5cGUiOiAib2JqZWN0IiwKICAgICAgInByb3BlcnRpZXMiOiB7CiAgICAgICAgIm90aGVyIjogewogICAgICAgICAgInR5cGUiOiAic3RyaW5nIgogICAgICAgIH0sCiAgICAgICAgImVtYWlsIjogewogICAgICAgICAgInR5cGUiOiAic3RyaW5nIiwKICAgICAgICAgICJ0aXRsZSI6ICJlbWFpbCIsCiAgICAgICAgICAib3J5LnNoL2tyYXRvcyI6IHsKICAgICAgICAgICAgImNyZWRlbnRpYWxzIjogewogICAgICAgICAgICAgICJwYXNzd29yZCI6IHsKICAgICAgICAgICAgICAgICJpZGVudGlmaWVyIjogdHJ1ZQogICAgICAgICAgICAgIH0KICAgICAgICAgICAgfQogICAgICAgICAgfQogICAgICAgIH0KICAgICAgfSwKICAgICAgInJlcXVpcmVkIjogWwogICAgICAgICJvdGhlciIsCiAgICAgICAgImVtYWlsIgogICAgICBdLAogICAgICAiYWRkaXRpb25hbFByb3BlcnRpZXMiOiB0cnVlCiAgICB9CiAgfQp9
+
+hashers:
+  argon2:
+    memory: 1MB
+    iterations: 2
+    parallelism: 4
+    salt_length: 16
+    key_length: 32
+    dedicated_memory: 1GB
+    expected_duration: 500ms
+    expected_deviation: 500ms
+
+secrets:
+  cookie:
+    - session-key-7f8a9b77-1
+    - session-key-7f8a9b77-2
+  cipher:
+    - secret-thirty-two-character-long
+
+ciphers:
+  algorithm: xchacha20-poly1305
+
+selfservice:
+  default_browser_return_url: http://return-to-3-test.ory.sh/
+  allowed_return_urls:
+    - http://return-to-1-test.ory.sh/
+    - http://return-to-2-test.ory.sh/
+    - http://*.wildcards.ory.sh
+    - http://*.sh
+    - http://*.com
+    - http://*.com.pl
+    - http://*
+    - /return-to-relative-test/
+  methods:
+    totp:
+      enabled: true
+      config:
+        issuer: issuer.ory.sh
+    password:
+      enabled: true
+    oidc:
+      enabled: true
+      config:
+        providers:
+          - id: github
+            provider: github
+            client_id: a
+            client_secret: b
+            mapper_url: http://test.kratos.ory.sh/default-identity.schema.json
+    webauthn:
+      enabled: true
+      config:
+        rp:
+          id: https://example.com/webauthn
+          display_name: Webauthn
+          origin: https://origin-a.example.com
+  flows:
+    error:
+      ui_url: http://test.kratos.ory.sh/error
+
+    logout:
+      after:
+        default_browser_return_url: http://test.kratos.ory.sh:4000/
+
+    recovery:
+      enabled: true
+      ui_url: http://test.kratos.ory.sh/recovery
+      lifespan: 98m
+      after:
+        default_browser_return_url: http://test.kratos.ory.sh/dashboard
+        hooks:
+          - hook: web_hook
+            config:
+              url: https://test.kratos.ory.sh/after_recovery_hook
+              method: GET
+              headers: 
+                X-Custom-Header: test
+              body: /path/to/template.jsonnet
+
+    verification:
+      enabled: true
+      lifespan: 97m
+      ui_url: http://test.kratos.ory.sh/verification
+      after:
+        default_browser_return_url: http://test.kratos.ory.sh/dashboard
+        hooks:
+          - hook: web_hook
+            config:
+              url: https://test.kratos.ory.sh/after_verification_hook
+              method: GET
+              headers: 
+                X-Custom-Header: test
+              body: /path/to/template.jsonnet
+
+    settings:
+      ui_url: http://test.kratos.ory.sh/settings
+      lifespan: 99m
+      privileged_session_max_age: 5m
+      after:
+        default_browser_return_url: https://self-service/settings/return_to
+        password:
+          default_browser_return_url: https://self-service/settings/password/return_to
+          hooks:
+            - hook: web_hook
+              config:
+                url: https://test.kratos.ory.sh/after_settings_password_hook
+                method: POST
+                headers: 
+                  X-Custom-Header: test
+                body: /path/to/template.jsonnet
+        profile:
+          hooks:
+            - hook: web_hook
+              config:
+                url: https://test.kratos.ory.sh/after_settings_profile_hook
+                method: POST
+                headers: 
+                  X-Custom-Header: test
+                body: /path/to/template.jsonnet
+        hooks:
+          - hook: web_hook
+            config:
+              url: https://test.kratos.ory.sh/after_settings_global_hook
+              method: POST
+              headers: 
+                X-Custom-Header: test
+              body: /path/to/template.jsonnet
+
+    login:
+      ui_url: http://test.kratos.ory.sh/login
+      lifespan: 99m
+      before:
+        hooks:
+          - hook: web_hook
+            config:
+              url: https://test.kratos.ory.sh/before_login_hook
+              method: POST
+              headers: 
+                X-Custom-Header: test
+      after:
+        default_browser_return_url: https://self-service/login/return_to
+        password:
+          default_browser_return_url: https://self-service/login/password/return_to
+          hooks:
+            - hook: revoke_active_sessions
+            - hook: require_verified_address
+            - hook: web_hook
+              config:
+                url: https://test.kratos.ory.sh/after_login_password_hook
+                method: POST
+                headers: 
+                  X-Custom-Header: test
+                body: /path/to/template.jsonnet
+                auth:
+                  type: basic_auth
+                  config:
+                    user: test-user
+                    password: super-secret
+        oidc:
+          hooks:
+            - hook: web_hook
+              config:
+                url: https://test.kratos.ory.sh/after_login_oidc_hook
+                method: GET
+                headers: 
+                  X-Custom-Header: test
+                body: /path/to/template.jsonnet
+            - hook: revoke_active_sessions
+        hooks:
+          - hook: web_hook
+            config:
+              url: https://test.kratos.ory.sh/after_login_global_hook
+              method: POST
+              headers: 
+                X-Custom-Header: test
+              body: /path/to/template.jsonnet
+
+    registration:
+      enabled: true
+      ui_url: http://test.kratos.ory.sh/register
+      lifespan: 98m
+      before:
+        hooks:
+          - hook: web_hook
+            config:
+              url: https://test.kratos.ory.sh/before_registration_hook
+              method: GET
+              headers: 
+                X-Custom-Header: test
+      after:
+        default_browser_return_url: https://self-service/registration/return_to
+        password:
+          hooks:
+            - hook: session
+            - hook: web_hook
+              config:
+                url: https://test.kratos.ory.sh/after_registration_password_hook
+                method: POST
+                headers: 
+                  X-Custom-Header: test
+                body: /path/to/template.jsonnet
+        hooks:
+          - hook: web_hook
+            config:
+              url: https://test.kratos.ory.sh/after_registration_global_hook
+              method: POST
+              headers: 
+                X-Custom-Header: test
+              body: /path/to/template.jsonnet
+              auth:
+                type: api_key
+                config:
+                  name: My-Key
+                  value: My-Key-Value
+                  in: header
+        oidc:
+          default_browser_return_url: https://self-service/registration/oidc/return_to
+          hooks:
+            - hook: web_hook
+              config:
+                url: https://test.kratos.ory.sh/after_registration_oidc_hook
+                method: GET
+                headers: 
+                  X-Custom-Header: test
+                body: /path/to/template.jsonnet
+            - hook: session

driver/config/stub/.kratos.webauthn.origins.yaml

@@ -0,0 +1,256 @@
+# serve controls the configuration for the http(s) daemon
+serve:
+  admin:
+    base_url: http://admin.kratos.ory.sh
+    port: 1234
+    host: admin.kratos.ory.sh
+  public:
+    base_url: http://public.kratos.ory.sh
+    port: 1235
+    host: public.kratos.ory.sh
+
+dsn: sqlite://foo.db?mode=memory&_fk=true
+
+log:
+  level: debug
+
+courier:
+  smtp:
+    connection_uri: smtp://foo:bar@baz/
+
+identity:
+  default_schema_id: default
+  schemas:
+    - id: default
+      url: base64://ewogICIkaWQiOiAib3J5Oi8vaWRlbnRpdHktdGVzdC1zY2hlbWEiLAogICIkc2NoZW1hIjogImh0dHA6Ly9qc29uLXNjaGVtYS5vcmcvZHJhZnQtMDcvc2NoZW1hIyIsCiAgInRpdGxlIjogIklkZW50aXR5U2NoZW1hIiwKICAidHlwZSI6ICJvYmplY3QiLAogICJwcm9wZXJ0aWVzIjogewogICAgInRyYWl0cyI6IHsKICAgICAgInR5cGUiOiAib2JqZWN0IiwKICAgICAgInByb3BlcnRpZXMiOiB7CiAgICAgICAgIm5hbWUiOiB7CiAgICAgICAgICAidHlwZSI6ICJvYmplY3QiLAogICAgICAgICAgInByb3BlcnRpZXMiOiB7CiAgICAgICAgICAgICJmaXJzdCI6IHsKICAgICAgICAgICAgICAidHlwZSI6ICJzdHJpbmciCiAgICAgICAgICAgIH0sCiAgICAgICAgICAgICJsYXN0IjogewogICAgICAgICAgICAgICJ0eXBlIjogInN0cmluZyIKICAgICAgICAgICAgfQogICAgICAgICAgfQogICAgICAgIH0KICAgICAgfSwKICAgICAgInJlcXVpcmVkIjogWwogICAgICAgICJuYW1lIgogICAgICBdLAogICAgICAiYWRkaXRpb25hbFByb3BlcnRpZXMiOiB0cnVlCiAgICB9CiAgfQp9
+    - id: other
+      url: base64://ewogICIkaWQiOiAib3J5Oi8vaWRlbnRpdHktb3RoZXItc2NoZW1hIiwKICAiJHNjaGVtYSI6ICJodHRwOi8vanNvbi1zY2hlbWEub3JnL2RyYWZ0LTA3L3NjaGVtYSMiLAogICJ0aXRsZSI6ICJJZGVudGl0eU90aGVyU2NoZW1hIiwKICAidHlwZSI6ICJvYmplY3QiLAogICJwcm9wZXJ0aWVzIjogewogICAgInRyYWl0cyI6IHsKICAgICAgInR5cGUiOiAib2JqZWN0IiwKICAgICAgInByb3BlcnRpZXMiOiB7CiAgICAgICAgIm90aGVyIjogewogICAgICAgICAgInR5cGUiOiAic3RyaW5nIgogICAgICAgIH0sCiAgICAgICAgImVtYWlsIjogewogICAgICAgICAgInR5cGUiOiAic3RyaW5nIiwKICAgICAgICAgICJ0aXRsZSI6ICJlbWFpbCIsCiAgICAgICAgICAib3J5LnNoL2tyYXRvcyI6IHsKICAgICAgICAgICAgImNyZWRlbnRpYWxzIjogewogICAgICAgICAgICAgICJwYXNzd29yZCI6IHsKICAgICAgICAgICAgICAgICJpZGVudGlmaWVyIjogdHJ1ZQogICAgICAgICAgICAgIH0KICAgICAgICAgICAgfQogICAgICAgICAgfQogICAgICAgIH0KICAgICAgfSwKICAgICAgInJlcXVpcmVkIjogWwogICAgICAgICJvdGhlciIsCiAgICAgICAgImVtYWlsIgogICAgICBdLAogICAgICAiYWRkaXRpb25hbFByb3BlcnRpZXMiOiB0cnVlCiAgICB9CiAgfQp9
+
+hashers:
+  argon2:
+    memory: 1MB
+    iterations: 2
+    parallelism: 4
+    salt_length: 16
+    key_length: 32
+    dedicated_memory: 1GB
+    expected_duration: 500ms
+    expected_deviation: 500ms
+
+secrets:
+  cookie:
+    - session-key-7f8a9b77-1
+    - session-key-7f8a9b77-2
+  cipher:
+    - secret-thirty-two-character-long
+
+ciphers:
+  algorithm: xchacha20-poly1305
+
+selfservice:
+  default_browser_return_url: http://return-to-3-test.ory.sh/
+  allowed_return_urls:
+    - http://return-to-1-test.ory.sh/
+    - http://return-to-2-test.ory.sh/
+    - http://*.wildcards.ory.sh
+    - http://*.sh
+    - http://*.com
+    - http://*.com.pl
+    - http://*
+    - /return-to-relative-test/
+  methods:
+    totp:
+      enabled: true
+      config:
+        issuer: issuer.ory.sh
+    password:
+      enabled: true
+    oidc:
+      enabled: true
+      config:
+        providers:
+          - id: github
+            provider: github
+            client_id: a
+            client_secret: b
+            mapper_url: http://test.kratos.ory.sh/default-identity.schema.json
+    webauthn:
+      enabled: true
+      config:
+        rp:
+          id: https://example.com/webauthn
+          display_name: Webauthn
+          origins:
+            - https://origin-a.example.com
+            - https://origin-b.example.com
+            - https://origin-c.example.com
+  flows:
+    error:
+      ui_url: http://test.kratos.ory.sh/error
+
+    logout:
+      after:
+        default_browser_return_url: http://test.kratos.ory.sh:4000/
+
+    recovery:
+      enabled: true
+      ui_url: http://test.kratos.ory.sh/recovery
+      lifespan: 98m
+      after:
+        default_browser_return_url: http://test.kratos.ory.sh/dashboard
+        hooks:
+          - hook: web_hook
+            config:
+              url: https://test.kratos.ory.sh/after_recovery_hook
+              method: GET
+              headers: 
+                X-Custom-Header: test
+              body: /path/to/template.jsonnet
+
+    verification:
+      enabled: true
+      lifespan: 97m
+      ui_url: http://test.kratos.ory.sh/verification
+      after:
+        default_browser_return_url: http://test.kratos.ory.sh/dashboard
+        hooks:
+          - hook: web_hook
+            config:
+              url: https://test.kratos.ory.sh/after_verification_hook
+              method: GET
+              headers: 
+                X-Custom-Header: test
+              body: /path/to/template.jsonnet
+
+    settings:
+      ui_url: http://test.kratos.ory.sh/settings
+      lifespan: 99m
+      privileged_session_max_age: 5m
+      after:
+        default_browser_return_url: https://self-service/settings/return_to
+        password:
+          default_browser_return_url: https://self-service/settings/password/return_to
+          hooks:
+            - hook: web_hook
+              config:
+                url: https://test.kratos.ory.sh/after_settings_password_hook
+                method: POST
+                headers: 
+                  X-Custom-Header: test
+                body: /path/to/template.jsonnet
+        profile:
+          hooks:
+            - hook: web_hook
+              config:
+                url: https://test.kratos.ory.sh/after_settings_profile_hook
+                method: POST
+                headers: 
+                  X-Custom-Header: test
+                body: /path/to/template.jsonnet
+        hooks:
+          - hook: web_hook
+            config:
+              url: https://test.kratos.ory.sh/after_settings_global_hook
+              method: POST
+              headers: 
+                X-Custom-Header: test
+              body: /path/to/template.jsonnet
+
+    login:
+      ui_url: http://test.kratos.ory.sh/login
+      lifespan: 99m
+      before:
+        hooks:
+          - hook: web_hook
+            config:
+              url: https://test.kratos.ory.sh/before_login_hook
+              method: POST
+              headers: 
+                X-Custom-Header: test
+      after:
+        default_browser_return_url: https://self-service/login/return_to
+        password:
+          default_browser_return_url: https://self-service/login/password/return_to
+          hooks:
+            - hook: revoke_active_sessions
+            - hook: require_verified_address
+            - hook: web_hook
+              config:
+                url: https://test.kratos.ory.sh/after_login_password_hook
+                method: POST
+                headers: 
+                  X-Custom-Header: test
+                body: /path/to/template.jsonnet
+                auth:
+                  type: basic_auth
+                  config:
+                    user: test-user
+                    password: super-secret
+        oidc:
+          hooks:
+            - hook: web_hook
+              config:
+                url: https://test.kratos.ory.sh/after_login_oidc_hook
+                method: GET
+                headers: 
+                  X-Custom-Header: test
+                body: /path/to/template.jsonnet
+            - hook: revoke_active_sessions
+        hooks:
+          - hook: web_hook
+            config:
+              url: https://test.kratos.ory.sh/after_login_global_hook
+              method: POST
+              headers: 
+                X-Custom-Header: test
+              body: /path/to/template.jsonnet
+
+    registration:
+      enabled: true
+      ui_url: http://test.kratos.ory.sh/register
+      lifespan: 98m
+      before:
+        hooks:
+          - hook: web_hook
+            config:
+              url: https://test.kratos.ory.sh/before_registration_hook
+              method: GET
+              headers: 
+                X-Custom-Header: test
+      after:
+        default_browser_return_url: https://self-service/registration/return_to
+        password:
+          hooks:
+            - hook: session
+            - hook: web_hook
+              config:
+                url: https://test.kratos.ory.sh/after_registration_password_hook
+                method: POST
+                headers: 
+                  X-Custom-Header: test
+                body: /path/to/template.jsonnet
+        hooks:
+          - hook: web_hook
+            config:
+              url: https://test.kratos.ory.sh/after_registration_global_hook
+              method: POST
+              headers: 
+                X-Custom-Header: test
+              body: /path/to/template.jsonnet
+              auth:
+                type: api_key
+                config:
+                  name: My-Key
+                  value: My-Key-Value
+                  in: header
+        oidc:
+          default_browser_return_url: https://self-service/registration/oidc/return_to
+          hooks:
+            - hook: web_hook
+              config:
+                url: https://test.kratos.ory.sh/after_registration_oidc_hook
+                method: GET
+                headers: 
+                  X-Custom-Header: test
+                body: /path/to/template.jsonnet
+            - hook: session

driver/config/stub/.kratos.yaml

@@ -0,0 +1,254 @@
+# serve controls the configuration for the http(s) daemon
+serve:
+  admin:
+    base_url: http://admin.kratos.ory.sh
+    port: 1234
+    host: admin.kratos.ory.sh
+  public:
+    base_url: http://public.kratos.ory.sh
+    port: 1235
+    host: public.kratos.ory.sh
+
+dsn: sqlite://foo.db?mode=memory&_fk=true
+
+log:
+  level: debug
+
+courier:
+  smtp:
+    connection_uri: smtp://foo:bar@baz/
+
+identity:
+  default_schema_id: default
+  schemas:
+    - id: default
+      url: base64://ewogICIkaWQiOiAib3J5Oi8vaWRlbnRpdHktdGVzdC1zY2hlbWEiLAogICIkc2NoZW1hIjogImh0dHA6Ly9qc29uLXNjaGVtYS5vcmcvZHJhZnQtMDcvc2NoZW1hIyIsCiAgInRpdGxlIjogIklkZW50aXR5U2NoZW1hIiwKICAidHlwZSI6ICJvYmplY3QiLAogICJwcm9wZXJ0aWVzIjogewogICAgInRyYWl0cyI6IHsKICAgICAgInR5cGUiOiAib2JqZWN0IiwKICAgICAgInByb3BlcnRpZXMiOiB7CiAgICAgICAgIm5hbWUiOiB7CiAgICAgICAgICAidHlwZSI6ICJvYmplY3QiLAogICAgICAgICAgInByb3BlcnRpZXMiOiB7CiAgICAgICAgICAgICJmaXJzdCI6IHsKICAgICAgICAgICAgICAidHlwZSI6ICJzdHJpbmciCiAgICAgICAgICAgIH0sCiAgICAgICAgICAgICJsYXN0IjogewogICAgICAgICAgICAgICJ0eXBlIjogInN0cmluZyIKICAgICAgICAgICAgfQogICAgICAgICAgfQogICAgICAgIH0KICAgICAgfSwKICAgICAgInJlcXVpcmVkIjogWwogICAgICAgICJuYW1lIgogICAgICBdLAogICAgICAiYWRkaXRpb25hbFByb3BlcnRpZXMiOiB0cnVlCiAgICB9CiAgfQp9
+    - id: other
+      url: base64://ewogICIkaWQiOiAib3J5Oi8vaWRlbnRpdHktb3RoZXItc2NoZW1hIiwKICAiJHNjaGVtYSI6ICJodHRwOi8vanNvbi1zY2hlbWEub3JnL2RyYWZ0LTA3L3NjaGVtYSMiLAogICJ0aXRsZSI6ICJJZGVudGl0eU90aGVyU2NoZW1hIiwKICAidHlwZSI6ICJvYmplY3QiLAogICJwcm9wZXJ0aWVzIjogewogICAgInRyYWl0cyI6IHsKICAgICAgInR5cGUiOiAib2JqZWN0IiwKICAgICAgInByb3BlcnRpZXMiOiB7CiAgICAgICAgIm90aGVyIjogewogICAgICAgICAgInR5cGUiOiAic3RyaW5nIgogICAgICAgIH0sCiAgICAgICAgImVtYWlsIjogewogICAgICAgICAgInR5cGUiOiAic3RyaW5nIiwKICAgICAgICAgICJ0aXRsZSI6ICJlbWFpbCIsCiAgICAgICAgICAib3J5LnNoL2tyYXRvcyI6IHsKICAgICAgICAgICAgImNyZWRlbnRpYWxzIjogewogICAgICAgICAgICAgICJwYXNzd29yZCI6IHsKICAgICAgICAgICAgICAgICJpZGVudGlmaWVyIjogdHJ1ZQogICAgICAgICAgICAgIH0KICAgICAgICAgICAgfQogICAgICAgICAgfQogICAgICAgIH0KICAgICAgfSwKICAgICAgInJlcXVpcmVkIjogWwogICAgICAgICJvdGhlciIsCiAgICAgICAgImVtYWlsIgogICAgICBdLAogICAgICAiYWRkaXRpb25hbFByb3BlcnRpZXMiOiB0cnVlCiAgICB9CiAgfQp9
+
+hashers:
+  argon2:
+    memory: 1MB
+    iterations: 2
+    parallelism: 4
+    salt_length: 16
+    key_length: 32
+    dedicated_memory: 1GB
+    expected_duration: 500ms
+    expected_deviation: 500ms
+  bcrypt:
+    cost: 4
+
+secrets:
+  cookie:
+    - session-key-7f8a9b77-1
+    - session-key-7f8a9b77-2
+  cipher:
+    - secret-thirty-two-character-long
+
+ciphers:
+  algorithm: xchacha20-poly1305
+
+selfservice:
+  default_browser_return_url: http://return-to-3-test.ory.sh/
+  allowed_return_urls:
+    - http://return-to-1-test.ory.sh/
+    - http://return-to-2-test.ory.sh/
+    - http://*.wildcards.ory.sh
+    - http://*.sh
+    - http://*.com
+    - http://*.com.pl
+    - http://*
+    - /return-to-relative-test/
+  methods:
+    totp:
+      enabled: true
+      config:
+        issuer: issuer.ory.sh
+    password:
+      enabled: true
+    oidc:
+      enabled: true
+      config:
+        providers:
+          - id: github
+            provider: github
+            client_id: a
+            client_secret: b
+            mapper_url: http://test.kratos.ory.sh/default-identity.schema.json
+    webauthn:
+      enabled: true
+      config:
+        rp:
+          id: example.com
+          display_name: Webauthn
+  flows:
+    error:
+      ui_url: http://test.kratos.ory.sh/error
+
+    logout:
+      after:
+        default_browser_return_url: http://test.kratos.ory.sh:4000/
+
+    recovery:
+      enabled: true
+      ui_url: http://test.kratos.ory.sh/recovery
+      lifespan: 98m
+      after:
+        default_browser_return_url: http://test.kratos.ory.sh/dashboard
+        hooks:
+          - hook: web_hook
+            config:
+              url: https://test.kratos.ory.sh/after_recovery_hook
+              method: GET
+              headers: 
+                X-Custom-Header: test
+              body: /path/to/template.jsonnet
+
+    verification:
+      enabled: true
+      lifespan: 97m
+      ui_url: http://test.kratos.ory.sh/verification
+      after:
+        default_browser_return_url: http://test.kratos.ory.sh/dashboard
+        hooks:
+          - hook: web_hook
+            config:
+              url: https://test.kratos.ory.sh/after_verification_hook
+              method: GET
+              headers: 
+                X-Custom-Header: test
+              body: /path/to/template.jsonnet
+
+    settings:
+      ui_url: http://test.kratos.ory.sh/settings
+      lifespan: 99m
+      privileged_session_max_age: 5m
+      after:
+        default_browser_return_url: https://self-service/settings/return_to
+        password:
+          default_browser_return_url: https://self-service/settings/password/return_to
+          hooks:
+            - hook: web_hook
+              config:
+                url: https://test.kratos.ory.sh/after_settings_password_hook
+                method: POST
+                headers:
+                  X-Custom-Header: test
+                body: /path/to/template.jsonnet
+        profile:
+          hooks:
+            - hook: web_hook
+              config:
+                url: https://test.kratos.ory.sh/after_settings_profile_hook
+                method: POST
+                headers:
+                  X-Custom-Header: test
+                body: /path/to/template.jsonnet
+        hooks:
+          - hook: web_hook
+            config:
+              url: https://test.kratos.ory.sh/after_settings_global_hook
+              method: POST
+              headers:
+                X-Custom-Header: test
+              body: /path/to/template.jsonnet
+
+    login:
+      ui_url: http://test.kratos.ory.sh/login
+      lifespan: 99m
+      before:
+        hooks:
+          - hook: web_hook
+            config:
+              url: https://test.kratos.ory.sh/before_login_hook
+              method: POST
+              headers:
+                X-Custom-Header: test
+      after:
+        default_browser_return_url: https://self-service/login/return_to
+        password:
+          default_browser_return_url: https://self-service/login/password/return_to
+          hooks:
+            - hook: revoke_active_sessions
+            - hook: require_verified_address
+            - hook: web_hook
+              config:
+                url: https://test.kratos.ory.sh/after_login_password_hook
+                method: POST
+                headers:
+                  X-Custom-Header: test
+                body: /path/to/template.jsonnet
+                auth:
+                  type: basic_auth
+                  config:
+                    user: test-user
+                    password: super-secret
+        oidc:
+          hooks:
+            - hook: web_hook
+              config:
+                url: https://test.kratos.ory.sh/after_login_oidc_hook
+                method: GET
+                headers:
+                  X-Custom-Header: test
+                body: /path/to/template.jsonnet
+            - hook: revoke_active_sessions
+        hooks:
+          - hook: web_hook
+            config:
+              url: https://test.kratos.ory.sh/after_login_global_hook
+              method: POST
+              headers:
+                X-Custom-Header: test
+              body: /path/to/template.jsonnet
+
+    registration:
+      enabled: true
+      ui_url: http://test.kratos.ory.sh/register
+      lifespan: 98m
+      before:
+        hooks:
+          - hook: web_hook
+            config:
+              url: https://test.kratos.ory.sh/before_registration_hook
+              method: GET
+              headers:
+                X-Custom-Header: test
+      after:
+        default_browser_return_url: https://self-service/registration/return_to
+        password:
+          hooks:
+            - hook: session
+            - hook: web_hook
+              config:
+                url: https://test.kratos.ory.sh/after_registration_password_hook
+                method: POST
+                headers:
+                  X-Custom-Header: test
+                body: /path/to/template.jsonnet
+        hooks:
+          - hook: web_hook
+            config:
+              url: https://test.kratos.ory.sh/after_registration_global_hook
+              method: POST
+              headers:
+                  X-Custom-Header: test
+              body: /path/to/template.jsonnet
+              auth:
+                type: api_key
+                config:
+                  name: My-Key
+                  value: My-Key-Value
+                  in: header
+        oidc:
+          default_browser_return_url: https://self-service/registration/oidc/return_to
+          hooks:
+            - hook: web_hook
+              config:
+                url: https://test.kratos.ory.sh/after_registration_oidc_hook
+                method: GET
+                headers:
+                  X-Custom-Header: test
+                body: /path/to/template.jsonnet
+            - hook: session