snapshot of https://github.com/ory/kratos.git (master, 2026-09-15; blobs > 131072B omitted)

selfservice/flowhelpers/login.go

@@ -0,0 +1,36 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package flowhelpers
+
+import (
+	"net/http"
+
+	"github.com/ory/kratos/identity"
+	"github.com/ory/kratos/session"
+)
+
+// GuessForcedLoginIdentifier returns the identifier for login flows where the identity needs to refresh the session.
+func GuessForcedLoginIdentifier(r *http.Request, d interface {
+	session.ManagementProvider
+	identity.PrivilegedPoolProvider
+}, f interface {
+	IsRefresh() bool
+}, ct identity.CredentialsType) (identifier string, id *identity.Identity, creds *identity.Credentials) {
+	var ok bool
+	// This block adds the identifier to the method when the request is forced - as a hint for the user.
+	if !f.IsRefresh() {
+		// do nothing
+	} else if sess, err := d.SessionManager().FetchFromRequest(r.Context(), r, session.ExpandNothing, identity.ExpandNothing); err != nil {
+		// do nothing
+	} else if id, err = d.PrivilegedIdentityPool().GetIdentityConfidential(r.Context(), sess.IdentityID); err != nil {
+		// do nothing
+	} else if creds, ok = id.GetCredentials(ct); !ok {
+		// do nothing
+	} else if len(creds.Identifiers) == 0 {
+		// do nothing
+	} else {
+		identifier = creds.Identifiers[0]
+	}
+	return
+}

selfservice/flowhelpers/login_test.go

@@ -0,0 +1,51 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package flowhelpers_test
+
+import (
+	"context"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/ory/kratos/identity"
+	"github.com/ory/kratos/pkg"
+	"github.com/ory/kratos/pkg/testhelpers"
+	"github.com/ory/kratos/selfservice/flow/login"
+	"github.com/ory/kratos/selfservice/flowhelpers"
+)
+
+func TestGuessForcedLoginIdentifier(t *testing.T) {
+	conf, reg := pkg.NewFastRegistryWithMocks(t)
+	testhelpers.SetDefaultIdentitySchema(conf, "file://./stub/login.schema.json")
+
+	i := identity.NewIdentity("")
+	ic := identity.Credentials{
+		Type:        identity.CredentialsTypePassword,
+		Identifiers: []string{"foobar"},
+	}
+	i.Credentials[identity.CredentialsTypePassword] = ic
+	require.NoError(t, reg.IdentityManager().Create(context.Background(), i))
+
+	req := httptest.NewRequest("GET", "/sessions/whoami", nil)
+
+	sess, err := testhelpers.NewActiveSession(req, reg, i, time.Now(), identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
+	require.NoError(t, err)
+	require.NoError(t, reg.SessionPersister().UpsertSession(context.Background(), sess))
+
+	r := httptest.NewRequest("GET", "/login", nil)
+	r.Header.Set("Authorization", "Bearer "+sess.Token)
+
+	var f login.Flow
+	f.Refresh = true
+
+	identifier, id, creds := flowhelpers.GuessForcedLoginIdentifier(r, reg, &f, identity.CredentialsTypePassword)
+	assert.Equal(t, "foobar", identifier)
+	assert.EqualValues(t, ic.Type, creds.Type)
+	assert.EqualValues(t, ic.Identifiers, creds.Identifiers)
+	assert.EqualValues(t, id.ID, id.ID)
+}

selfservice/flowhelpers/stub/login.schema.json

@@ -0,0 +1,11 @@
+{
+  "$id": "https://example.com/person.schema.json",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Person",
+  "type": "object",
+  "properties": {
+    "traits": {
+      "type": "object"
+    }
+  }
+}