snapshot of https://github.com/ory/kratos.git (master, 2026-09-15; blobs > 131072B omitted)

test/e2e/cypress/integration/profiles/email/error/ui.spec.ts

@@ -0,0 +1,48 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { routes as express } from "../../../../helpers/express"
+import { routes as react } from "../../../../helpers/react"
+import { appPrefix } from "../../../../helpers"
+
+// playwright:migrated
+describe("Handling self-service error flows", () => {
+  ;[
+    {
+      route: express.base,
+      app: "express" as "express",
+      profile: "email",
+    },
+    {
+      route: react.base,
+      app: "react" as "react",
+      profile: "spa",
+    },
+  ].forEach(({ route, app, profile }) => {
+    describe(`for app ${app}`, () => {
+      before(() => {
+        cy.useConfigProfile(profile)
+        cy.proxy(app)
+      })
+
+      // playwright:migrated
+      it("should show the error", () => {
+        cy.visit(`${route}/error?id=stub:500`, {
+          failOnStatusCode: false,
+        })
+
+        if (app === "express") {
+          cy.get(`${appPrefix(app)} [data-testid="ui/error/message"]`).should(
+            "contain.text",
+            "This is a stub error.",
+          )
+        } else {
+          cy.get(`${appPrefix(app)}code`).should(
+            "contain.text",
+            "This is a stub error.",
+          )
+        }
+      })
+    })
+  })
+})

test/e2e/cypress/integration/profiles/email/login/error.spec.ts

@@ -0,0 +1,108 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { appPrefix, gen } from "../../../../helpers"
+import { routes as express } from "../../../../helpers/express"
+import { routes as react } from "../../../../helpers/react"
+
+// playwright:migrated
+describe("Basic email profile with failing login flows", () => {
+  ;[
+    {
+      route: express.login,
+      app: "express" as "express",
+      profile: "email",
+    },
+    {
+      route: react.login,
+      app: "react" as "react",
+      profile: "spa",
+    },
+  ].forEach(({ route, profile, app }) => {
+    describe(`for app ${app}`, () => {
+      before(() => {
+        cy.useConfigProfile(profile)
+        cy.proxy(app)
+      })
+
+      beforeEach(() => {
+        cy.clearAllCookies()
+        cy.visit(route)
+      })
+
+      // playwright:migrated
+      it("fails when CSRF cookies are missing", () => {
+        cy.get(`${appPrefix(app)}input[name="identifier"]`).type(
+          "i-do-not-exist",
+        )
+        cy.get('input[name="password"]').type("invalid-password")
+
+        cy.shouldHaveCsrfError({ app })
+      })
+
+      // playwright:migrated
+      it("fails when a disallowed return_to url is requested", () => {
+        cy.shouldErrorOnDisallowedReturnTo(
+          route + "?return_to=https://not-allowed",
+          { app },
+        )
+      })
+
+      // playwright:migrated - partially
+      describe("shows validation errors when invalid signup data is used", () => {
+        // playwright:migrated
+        it("should show an error when the identifier is missing", () => {
+          // the browser will prevent the form from submitting if the fields are empty since they are required
+          // here we just remove the required attribute to make the form submit
+          cy.removeAttribute(
+            ['input[name="identifier"]', 'input[name="password"]'],
+            "required",
+          )
+          cy.submitPasswordForm()
+          cy.get('*[data-testid="ui/message/4000002"]').should(
+            "contain.text",
+            "Property identifier is missing",
+          )
+          cy.get('*[data-testid="ui/message/4000002"]').should(
+            "contain.text",
+            "Property password is missing",
+          )
+        })
+
+        // playwright:migrated
+        it("should show an error when the password is missing", () => {
+          const identity = gen.email()
+          cy.get('input[name="identifier"]')
+            .type(identity)
+            .should("have.value", identity)
+
+          // the browser will prevent the form from submitting if the fields are empty since they are required
+          // here we just remove the required attribute to make the form submit
+          cy.removeAttribute(['input[name="password"]'], "required")
+
+          cy.submitPasswordForm()
+          cy.get('*[data-testid^="ui/message/"]')
+            .invoke("text")
+            .then((text) => {
+              expect(text.trim()).to.be.oneOf([
+                "length must be >= 1, but got 0",
+                "Property password is missing.",
+              ])
+            })
+        })
+
+        // playwright:migrated
+        it("should show fail to sign in", () => {
+          cy.get('input[name="identifier"]').type("i-do-not-exist")
+          cy.get('input[name="password"]').type("invalid-password")
+
+          cy.submitPasswordForm()
+          cy.get('*[data-testid="ui/message/4000006"]').should(
+            "contain.text",
+            "credentials are invalid",
+          )
+        })
+      })
+    })
+  })
+})

test/e2e/cypress/integration/profiles/email/login/success.spec.ts

@@ -0,0 +1,131 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { APP_URL, appPrefix, gen, website } from "../../../../helpers"
+import { routes as express } from "../../../../helpers/express"
+import { routes as react } from "../../../../helpers/react"
+
+// playwright:migrated
+describe("Basic email profile with succeeding login flows", () => {
+  const email = gen.email()
+  const password = gen.password()
+
+  before(() => {
+    cy.registerApi({ email, password, fields: { "traits.website": website } })
+  })
+  ;[
+    {
+      route: express.login,
+      app: "express" as "express",
+      profile: "email",
+    },
+    {
+      route: react.login,
+      app: "react" as "react",
+      profile: "spa",
+    },
+  ].forEach(({ route, profile, app }) => {
+    describe(`for app ${app}`, () => {
+      before(() => {
+        cy.proxy(app)
+      })
+
+      beforeEach(() => {
+        cy.useConfigProfile(profile)
+        cy.clearAllCookies()
+        cy.visit(route)
+      })
+
+      // playwright:migrated
+      it("should sign in and be logged in", () => {
+        cy.get(`${appPrefix(app)}input[name="identifier"]`).type(email)
+        cy.get('input[name="password"]').type(password)
+        cy.submitPasswordForm()
+        cy.location("pathname").should("not.contain", "/login")
+
+        cy.getSession().should((session) => {
+          const { identity } = session
+          expect(identity.id).to.not.be.empty
+          expect(identity.schema_id).to.equal("default")
+          expect(identity.schema_url).to.equal(`${APP_URL}/schemas/ZGVmYXVsdA`)
+          expect(identity.traits.website).to.equal(website)
+          expect(identity.traits.email).to.equal(email)
+        })
+      })
+
+      // playwright:migrated
+      it("should sign in with case insensitive identifier surrounded by whitespace", () => {
+        cy.get('input[name="identifier"]').type(
+          "  " + email.toUpperCase() + "  ",
+        )
+        cy.get('input[name="password"]').type(password)
+        cy.submitPasswordForm()
+        cy.location("pathname").should("not.contain", "/login")
+
+        cy.getSession().should((session) => {
+          const { identity } = session
+          expect(identity.id).to.not.be.empty
+          expect(identity.schema_id).to.equal("default")
+          expect(identity.schema_url).to.equal(`${APP_URL}/schemas/ZGVmYXVsdA`)
+          expect(identity.traits.website).to.equal(website)
+          expect(identity.traits.email).to.equal(email)
+        })
+      })
+
+      // playwright:migrated
+      it("should sign in and be redirected", () => {
+        cy.browserReturnUrlOry()
+        cy.visit(route + "?return_to=https://www.example.org/")
+
+        cy.get('input[name="identifier"]').type(email.toUpperCase())
+        cy.get('input[name="password"]').type(password)
+        cy.submitPasswordForm()
+
+        cy.url().should("eq", "https://www.example.org/")
+      })
+    })
+  })
+
+  // playwright:migrated
+  describe("for app express handle return_to correctly for expired flows", () => {
+    before(() => {
+      cy.proxy("express")
+      cy.useConfigProfile("email")
+
+      cy.browserReturnUrlOry()
+    })
+
+    beforeEach(() => {
+      cy.clearAllCookies()
+    })
+
+    // playwright:migrated
+    it("should redirect to return_to when retrying expired flow", () => {
+      cy.shortLoginLifespan()
+      cy.wait(500)
+
+      cy.visit(express.login + "?return_to=https://www.example.org/")
+
+      cy.longLoginLifespan()
+
+      cy.get(appPrefix("express") + 'input[name="identifier"]').type(
+        email.toUpperCase(),
+      )
+      cy.get('input[name="password"]').type(password)
+
+      cy.submitPasswordForm()
+      cy.get('[data-testid="ui/message/4010001"]').should(
+        "contain.text",
+        "The login flow expired",
+      )
+
+      // try again with long lifespan set
+      cy.get('input[name="identifier"]').type(email.toUpperCase())
+      cy.get('input[name="password"]').type(password)
+      cy.submitPasswordForm()
+
+      // check that redirection has happened
+      cy.url().should("eq", "https://www.example.org/")
+    })
+  })
+})

test/e2e/cypress/integration/profiles/email/login/ui.spec.ts

@@ -0,0 +1,55 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { routes as express } from "../../../../helpers/express"
+import { routes as react } from "../../../../helpers/react"
+import { appPrefix } from "../../../../helpers"
+
+// playwright:migrated
+context("UI tests using the email profile", () => {
+  ;[
+    {
+      route: express.login,
+      app: "express" as "express",
+      profile: "email",
+    },
+    {
+      route: react.login,
+      app: "react" as "react",
+      profile: "spa",
+    },
+  ].forEach(({ route, profile, app }) => {
+    describe(`for app ${app}`, () => {
+      before(() => {
+        cy.useConfigProfile(profile)
+        cy.proxy(app)
+      })
+
+      beforeEach(() => {
+        cy.visit(route)
+      })
+
+      // playwright:migrated
+      it("should use the json schema titles", () => {
+        cy.get(`${appPrefix(app)}input[name="identifier"]`)
+          .parent()
+          .should("contain.text", "Your E-Mail")
+
+        cy.get('input[name="password"]')
+          .parentsUntil("label")
+          .should("contain.text", "Password")
+        cy.get('button[value="password"]').should("contain.text", "Sign in")
+      })
+
+      // playwright:migrated
+      it("clicks the log in link", () => {
+        cy.get('a[href*="registration"]').click()
+        cy.location("pathname").should("include", "registration")
+
+        if (app === "express") {
+          cy.location("search").should("not.be.empty")
+        }
+      })
+    })
+  })
+})

test/e2e/cypress/integration/profiles/email/logout/success.spec.ts

@@ -0,0 +1,146 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { appPrefix, gen, website } from "../../../../helpers"
+import { routes as express } from "../../../../helpers/express"
+import { routes as react } from "../../../../helpers/react"
+
+context("Testing logout flows", () => {
+  ;[
+    {
+      route: express.login,
+      app: "express" as "express",
+      profile: "email",
+      settings: express.settings,
+      welcome: express.welcome,
+    },
+    {
+      route: react.login,
+      app: "react" as "react",
+      profile: "spa",
+      settings: react.settings,
+      welcome: "",
+    },
+  ].forEach(({ route, profile, app, settings, welcome }) => {
+    describe(`for app ${app}`, () => {
+      let email: string
+      let password: string
+
+      before(() => {
+        cy.proxy(app)
+
+        email = gen.email()
+        password = gen.password()
+
+        cy.useConfigProfile(profile)
+        cy.registerApi({
+          email,
+          password,
+          fields: { "traits.website": website },
+        })
+      })
+
+      beforeEach(() => {
+        cy.clearAllCookies()
+        cy.login({ email, password, cookieUrl: route })
+        cy.visit(route)
+      })
+
+      // playwright:migrated
+      it("should sign out and be able to sign in again", () => {
+        cy.getSession()
+        cy.getCookie("ory_kratos_session").should("not.be.null")
+        if (app === "express") {
+          cy.get(
+            `${appPrefix(app)} [data-testid="logout"] a:not(.disabled)`,
+          ).click()
+        } else {
+          cy.get(
+            `${appPrefix(app)} [data-testid="logout"]:not(.disabled)`,
+          ).click()
+        }
+        cy.getCookie("ory_kratos_session").should("be.null")
+        cy.noSession()
+        cy.url().should("include", "/login")
+      })
+
+      // playwright:migrated
+      it("should be able to sign out on settings page", () => {
+        if (app === "react") {
+          return
+        }
+        cy.sessionRequiresNo2fa()
+        cy.useLaxAal()
+
+        cy.getSession({ expectAal: "aal1" })
+        cy.getCookie("ory_kratos_session").should("not.be.null")
+
+        cy.visit(settings, {
+          qs: {
+            return_to: "https://www.example.org",
+          },
+        })
+
+        cy.get("a[href*='logout']").click()
+        cy.location("host").should("eq", "www.example.org")
+      })
+
+      // playwright:migrated
+      it("should be able to sign out on welcome page", () => {
+        if (app === "react") {
+          return
+        }
+        cy.sessionRequiresNo2fa()
+        cy.useLaxAal()
+
+        cy.getSession({ expectAal: "aal1" })
+
+        cy.visit(welcome, {
+          qs: {
+            return_to: "https://www.example.org",
+          },
+        })
+
+        cy.get("a[href*='logout']").click()
+        cy.location("host").should("eq", "www.example.org")
+      })
+
+      it("should be able to sign out at 2fa page", () => {
+        if (app === "react") {
+          return
+        }
+        cy.useLookupSecrets(true)
+        cy.sessionRequires2fa()
+        cy.getSession({ expectAal: "aal1" })
+        cy.getCookie("ory_kratos_session").should("not.be.null")
+
+        // add 2fa to account
+        cy.visit(settings)
+        cy.get(
+          appPrefix(app) + 'button[name="lookup_secret_regenerate"]',
+        ).click()
+        cy.get('button[name="lookup_secret_confirm"]').click()
+        cy.expectSettingsSaved()
+
+        cy.logout()
+        cy.visit(route, {
+          qs: {
+            return_to: "https://www.example.org",
+          },
+        })
+
+        cy.get('[name="identifier"]').clear().type(email)
+
+        cy.reauth({
+          expect: { email, success: false },
+          type: { password: password },
+        })
+
+        cy.get("a[href*='logout']").click()
+
+        cy.location("host").should("eq", "www.example.org")
+        cy.useLookupSecrets(false)
+      })
+    })
+  })
+})

test/e2e/cypress/integration/profiles/email/registration/errors.spec.ts

@@ -0,0 +1,268 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { appPrefix, gen, website } from "../../../../helpers"
+import { routes as express } from "../../../../helpers/express"
+import { routes as react } from "../../../../helpers/react"
+
+describe("Registration failures with email profile", () => {
+  ;[
+    {
+      route: express.registration,
+      app: "express" as "express",
+      profile: "email",
+    },
+    {
+      route: react.registration,
+      app: "react" as "react",
+      profile: "spa",
+    },
+  ].forEach(({ route, profile, app }) => {
+    describe(`for app ${app}`, () => {
+      before(() => {
+        cy.useConfigProfile(profile)
+        cy.proxy(app)
+        cy.updateConfigFile((config) => {
+          config.selfservice.flows.registration.login_hints = true
+          return config
+        })
+      })
+
+      beforeEach(() => {
+        cy.visit(route)
+      })
+
+      const identity = gen.email()
+      const password = gen.password()
+
+      it("fails when CSRF cookies are missing", () => {
+        cy.get(`${appPrefix(app)} input[name="traits.website"]`).type(
+          "https://www.ory.sh",
+        )
+        cy.get('input[name="traits.email"]')
+          .type(identity)
+          .should("have.value", identity)
+        cy.get('input[name="password"]')
+          .type("12345678")
+          .should("have.value", "12345678")
+
+        cy.shouldHaveCsrfError({ app })
+      })
+
+      it("fails when a disallowed return_to url is requested", () => {
+        cy.shouldErrorOnDisallowedReturnTo(
+          route + "?return_to=https://not-allowed",
+          { app },
+        )
+      })
+
+      describe("show errors when invalid signup data is used", () => {
+        // playwright:migrated
+        it("should show an error when the password has leaked before", () => {
+          cy.get('input[name="traits.website"]').type("https://www.ory.sh")
+          cy.get('input[name="traits.email"]')
+            .type(identity)
+            .should("have.value", identity)
+          cy.get('input[name="password"]')
+            .type("12345678")
+            .should("have.value", "12345678")
+
+          cy.submitPasswordForm()
+          cy.get('[data-testid="ui/message/4000034"]').should(
+            "contain.text",
+            "data breaches",
+          )
+        })
+
+        // playwright:migrated
+        it("should show an error when the password is too similar", () => {
+          cy.get('input[name="traits.website"]').type("https://www.ory.sh")
+          cy.get('input[name="traits.email"]').type(identity)
+          cy.get('input[name="password"]').type(identity)
+
+          cy.submitPasswordForm()
+          cy.get('[data-testid="ui/message/4000031"]').should(
+            "contain.text",
+            "too similar",
+          )
+        })
+
+        // playwright:migrated
+        it("should show an error when the password is empty", () => {
+          cy.get('input[name="traits.website"]').type("https://www.ory.sh")
+          cy.get('input[name="traits.email"]').type(identity)
+
+          // the browser will prevent the form from being submitted if the input field is required
+          // we should remove the required attribute to simulate the data not being sent
+          cy.removeAttribute(['input[name="password"]'], "required")
+
+          cy.submitPasswordForm()
+          cy.get('*[data-testid^="ui/message/"]')
+            .invoke("text")
+            .then((text) => {
+              expect(text.trim()).to.be.oneOf([
+                "length must be >= 1, but got 0",
+                "Property password is missing.",
+              ])
+            })
+        })
+
+        // playwright:migrated
+        it("should show an error when the email is empty", () => {
+          cy.get('input[name="traits.website"]').type("https://www.ory.sh")
+          cy.get('input[name="password"]').type(password)
+
+          // the browser will prevent the form from being submitted if the input field is required
+          // we should remove the required attribute to simulate the data not being sent
+          cy.removeAttribute(['input[name="traits.email"]'], "required")
+
+          cy.submitPasswordForm()
+          cy.get('*[data-testid^="ui/message/"]')
+            .invoke("text")
+            .then((text) => {
+              expect(text.trim()).to.be.oneOf([
+                '"" is not valid "email"',
+                "length must be >= 3, but got 0",
+                "Property email is missing.",
+              ])
+            })
+        })
+
+        // playwright:migrated
+        it("should show an error when the email is not an email", () => {
+          cy.get('input[name="traits.website"]').type("https://www.ory.sh")
+          cy.get('input[name="password"]').type(password)
+
+          // the browser will prevent the form from being submitted if the input data doesn't conform to the input field type
+          // in this case an invalid email will prevent the form from being submitted by the browser
+          // we should remove it to ensure kratos is validating the payload
+          cy.get('input[name="traits.email"]').then(($el) =>
+            $el.removeAttr("type"),
+          )
+          cy.get('input[name="traits.email"]').type("not-an-email")
+
+          cy.submitPasswordForm()
+          cy.get(
+            '*[data-testid="ui/message/4000040"], *[data-testid="ui/message/4000002"]',
+          ).should("exist")
+        })
+
+        // playwright:migrated
+        it("should show a missing indicator if no fields are set", () => {
+          // the browser will prevent the form from being submitted if the input field is required
+          // we should remove the required attribute to simulate the data not being sent
+          cy.removeAttribute(
+            [
+              'input[name="traits.email"]',
+              'input[name="traits.website"]',
+              'input[name="password"]',
+            ],
+            "required",
+          )
+
+          cy.submitPasswordForm()
+          cy.get(
+            '*[data-testid="ui/message/4000001"], *[data-testid="ui/message/4000002"]',
+          ).should("exist")
+        })
+
+        it("should show an error when the website is not a valid URI", () => {
+          cy.get('input[name="traits.website"]')
+            .type("1234")
+            .then(($input) => {
+              expect(
+                ($input[0] as HTMLInputElement).validationMessage,
+              ).to.contain("URL")
+            })
+        })
+
+        // playwright:migrated
+        it("should show an error when the website is too short", () => {
+          // the browser will prevent the form from being submitted if the input field is required
+          // we should remove the required attribute to simulate the data not being sent
+          cy.removeAttribute(
+            ['input[name="traits.email"]', 'input[name="password"]'],
+            "required",
+          )
+
+          cy.get('input[name="traits.website"]').type("http://s")
+
+          cy.submitPasswordForm()
+          cy.get('[data-testid="ui/message/4000003"]').should(
+            "contain.text",
+            "length must be >= 10",
+          )
+        })
+
+        // playwright:migrated
+        it("should show an error when required params are missing", () => {
+          // the browser will prevent the form from being submitted if the input field is required
+          // we should remove it from the DOM entirely to simulate the data not being sent
+          cy.get('input[name="traits.website"]').then(($el) => $el.remove())
+          cy.get('input[name="traits.email"]').then(($el) => $el.remove())
+          cy.get('input[name="password"]').then(($el) => $el.remove())
+
+          cy.submitPasswordForm()
+          cy.get('[data-testid="ui/message/4000002"]').should(
+            "contain.text",
+            "Property website is missing.",
+          )
+          cy.get('[data-testid="ui/message/4000002"]').should(
+            "contain.text",
+            "Property email is missing.",
+          )
+          cy.get('[data-testid="ui/message/4000002"]').should(
+            "contain.text",
+            "Property password is missing.",
+          )
+        })
+
+        // playwright:migrated
+        it("should show an error when the age is too high", () => {
+          // the browser will prevent the form from being submitted if the input field is required
+          // we should remove the required attribute to simulate the data not being sent
+          cy.removeAttribute(
+            [
+              'input[name="traits.email"]',
+              'input[name="traits.website"]',
+              'input[name="password"]',
+            ],
+            "required",
+          )
+
+          cy.get('input[name="traits.age"]').type("600")
+
+          cy.submitPasswordForm()
+          cy.get('[data-testid="ui/message/4000020"]').should(
+            "contain.text",
+            "must be <= 300 but found 600",
+          )
+        })
+
+        // playwright:migrated
+        it("should show a hint for existing account", () => {
+          const email = gen.email()
+          const password = gen.password()
+
+          cy.registerApi({
+            email,
+            password,
+            fields: { "traits.website": website },
+          })
+
+          cy.get('input[name="traits.email"]').type(email)
+          cy.get('input[name="password"]').type(password)
+          cy.get('input[name="traits.website').type(website)
+          cy.get('input[name="traits.age"]').type(`30`)
+          cy.submitPasswordForm()
+          cy.get('[data-testid="ui/message/4000028"]').should(
+            "contain.text",
+            "You tried signing in with " +
+              email +
+              " which is already in use by another account. You can sign in using your password.",
+          )
+        })
+      })
+    })
+  })
+})

test/e2e/cypress/integration/profiles/email/registration/success.spec.ts

@@ -0,0 +1,210 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { appPrefix, APP_URL, gen } from "../../../../helpers"
+import { routes as express } from "../../../../helpers/express"
+import { routes as react } from "../../../../helpers/react"
+
+context("Registration success with email profile", () => {
+  ;[
+    {
+      route: express.registration,
+      app: "express" as "express",
+      profile: "email",
+    },
+    {
+      route: react.registration,
+      app: "react" as "react",
+      profile: "spa",
+    },
+  ].forEach(({ route, profile, app }) => {
+    describe(`for app ${app}`, () => {
+      before(() => {
+        cy.useConfigProfile(profile)
+        cy.proxy(app)
+      })
+
+      beforeEach(() => {
+        cy.deleteMail()
+        cy.clearAllCookies()
+        cy.visit(route)
+        cy.enableVerification()
+        if (app === "express") {
+          cy.enableVerificationUIAfterRegistration("password")
+        }
+      })
+
+      // playwright:migrated
+      it("should sign up and be logged in", () => {
+        const email = gen.email()
+        const password = gen.password()
+        const website = "https://www.example.org/"
+        const age = 30
+
+        cy.get(appPrefix(app) + 'input[name="traits"]').should("not.exist")
+        cy.get('input[name="traits.email"]').type(email)
+        cy.get('input[name="password"]').type(password)
+        cy.get('input[name="traits.website').type(website)
+        cy.get('input[name="traits.age"]').type(`${age}`)
+        cy.get('[type="checkbox"][name="traits.tos"]').click({ force: true })
+
+        cy.submitPasswordForm()
+
+        cy.url().should("contain", "verification")
+        cy.getVerificationCodeFromEmail(email).then((code) => {
+          cy.get("input[name=code]").type(code)
+          cy.get("button[name=method][value=code]").click()
+        })
+
+        cy.get('[data-testid="ui/message/1080002"]').should(
+          "have.text",
+          "You successfully verified your email address.",
+        )
+
+        cy.get("[data-testid='node/anchor/continue']").click()
+
+        if (app === "express") {
+          cy.get('a[href*="sessions"').click()
+        }
+        cy.get("pre").should("contain.text", email)
+
+        cy.getSession().should((session) => {
+          const { identity } = session
+          expect(identity.id).to.not.be.empty
+          expect(identity.verifiable_addresses).to.have.length(1)
+          expect(identity.schema_id).to.equal("default")
+          expect(identity.schema_url).to.equal(`${APP_URL}/schemas/ZGVmYXVsdA`)
+          expect(identity.traits.website).to.equal(website)
+          expect(identity.traits.email).to.equal(email)
+          expect(identity.traits.age).to.equal(age)
+          expect(identity.traits.tos).to.equal(true)
+        })
+      })
+
+      // playwright:migrated
+      it("should sign up with advanced form field values be logged in", () => {
+        const email = gen.email()
+        const password = gen.password()
+
+        cy.get('input[name="traits"]').should("not.exist")
+        cy.get('input[name="traits.email"]').type(email)
+        cy.get('input[name="password"]').type(password)
+        const website = "https://www.example.org/"
+        cy.get('input[name="traits.website"]').type(website)
+
+        cy.submitPasswordForm()
+
+        cy.url().should("contain", "verification")
+        cy.getVerificationCodeFromEmail(email).then((code) => {
+          cy.get("input[name=code]").type(code)
+          cy.get("button[name=method][value=code]").click()
+        })
+
+        cy.get('[data-testid="ui/message/1080002"]').should(
+          "have.text",
+          "You successfully verified your email address.",
+        )
+
+        cy.get("[data-testid='node/anchor/continue']").click()
+
+        if (app === "express") {
+          cy.get('a[href*="sessions"').click()
+        }
+        cy.get("pre").should("contain.text", email)
+
+        cy.getSession().should((session) => {
+          const { identity } = session
+          expect(identity.id).to.not.be.empty
+          expect(identity.verifiable_addresses).to.have.length(1)
+          expect(identity.schema_id).to.equal("default")
+          expect(identity.schema_url).to.equal(`${APP_URL}/schemas/ZGVmYXVsdA`)
+          expect(identity.traits.website).to.equal(website)
+          expect(identity.traits.email).to.equal(email)
+          expect(identity.traits.age).to.be.undefined
+          expect(identity.traits.tos).to.be.oneOf([false, undefined])
+        })
+      })
+
+      // playwright:migrated
+      it("should sign up and be redirected", () => {
+        cy.disableVerification()
+        cy.browserReturnUrlOry()
+        cy.visit(route + "?return_to=https://www.example.org/")
+
+        const email = gen.email()
+        const password = gen.password()
+        const website = "https://www.example.org/"
+
+        cy.get('input[name="traits"]').should("not.exist")
+        cy.get('input[name="traits.email"]').type(email)
+        cy.get('input[name="traits.website').type(website)
+        cy.get('input[name="password"]').type(password)
+        cy.submitPasswordForm()
+
+        cy.url().should("eq", "https://www.example.org/")
+      })
+    })
+  })
+
+  describe("redirect for express app", () => {
+    it("should redirect to return_to after flow expires", () => {
+      // Wait for flow to expire
+      cy.useConfigProfile("email")
+      cy.shortRegisterLifespan()
+      cy.browserReturnUrlOry()
+      cy.proxy("express")
+      cy.visit(express.registration + "?return_to=https://www.example.org/")
+      cy.wait(105)
+
+      const email = gen.email()
+      const password = gen.password()
+      const website = "https://www.example.org/"
+
+      cy.get(`${appPrefix("express")} input[name="traits"]`).should("not.exist")
+      cy.get('input[name="traits.email"]').type(email)
+      cy.get('input[name="traits.website').type(website)
+      cy.get('input[name="password"]').type(password)
+
+      cy.longRegisterLifespan()
+      cy.submitPasswordForm()
+
+      cy.get('[data-testid="ui/message/4040001"]').should(
+        "contain.text",
+        "The registration flow expired",
+      )
+
+      // Try again with long lifespan set
+      cy.get('input[name="traits"]').should("not.exist")
+      cy.get('input[name="traits.email"]').type(email)
+      cy.get('input[name="traits.website').type(website)
+      cy.get('input[name="password"]').type(password)
+      cy.submitPasswordForm()
+
+      cy.url().should("eq", "https://www.example.org/")
+    })
+
+    it("should not redirect to verification_flow if not configured", () => {
+      cy.deleteMail()
+      cy.useConfigProfile("email")
+      cy.enableVerification()
+      cy.proxy("express")
+      cy.visit(express.registration + "?return_to=https://www.example.org/")
+
+      const email = gen.email()
+      const password = gen.password()
+      const website = "https://www.example.org/"
+
+      cy.get(`${appPrefix("express")} input[name="traits"]`).should("not.exist")
+      cy.get('input[name="traits.email"]').type(email)
+      cy.get('input[name="traits.website').type(website)
+      cy.get('input[name="password"]').type(password)
+
+      cy.submitPasswordForm()
+
+      // Verify that the verification code is still sent
+      cy.getVerificationCodeFromEmail(email).should("not.be.undefined")
+
+      cy.url().should("eq", "https://www.example.org/")
+    })
+  })
+})

test/e2e/cypress/integration/profiles/email/registration/ui.spec.ts

@@ -0,0 +1,54 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { routes as express } from "../../../../helpers/express"
+import { routes as react } from "../../../../helpers/react"
+import { appPrefix } from "../../../../helpers"
+
+describe("Registration UI for email flows", () => {
+  ;[
+    {
+      route: express.registration,
+      app: "express" as "express",
+      profile: "email",
+    },
+    {
+      route: react.registration,
+      app: "react" as "react",
+      profile: "spa",
+    },
+  ].forEach(({ route, profile, app }) => {
+    describe(`for app ${app}`, () => {
+      before(() => {
+        cy.useConfigProfile(profile)
+        cy.proxy(app)
+      })
+
+      beforeEach(() => {
+        cy.visit(route)
+      })
+
+      describe("use ui elements", () => {
+        // playwright:migrated
+        it("should use the json schema titles", () => {
+          cy.get(appPrefix(app) + 'input[name="traits.email"]')
+            .parent()
+            .should("contain.text", "Your E-Mail")
+          cy.get('input[name="traits.website"]')
+            .parent()
+            .should("contain.text", "Your website")
+          cy.get('button[value="password"]').should("contain.text", "Sign up")
+        })
+
+        // playwright:migrated
+        it("clicks the log in link", () => {
+          cy.get('*[data-testid="cta-link"]').click()
+          cy.location("pathname").should("include", "/login")
+          if (app === "express") {
+            cy.location("search").should("not.be.empty")
+          }
+        })
+      })
+    })
+  })
+})

test/e2e/cypress/integration/profiles/email/settings/errors.spec.ts

@@ -0,0 +1,314 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { appPrefix, gen, website } from "../../../../helpers"
+import { routes as express } from "../../../../helpers/express"
+import { routes as react } from "../../../../helpers/react"
+
+context("Settings failures with email profile", () => {
+  ;[
+    {
+      route: express.settings,
+      base: express.base,
+      app: "express" as "express",
+      profile: "email",
+    },
+    {
+      route: react.settings,
+      base: react.base,
+      app: "react" as "react",
+      profile: "spa",
+    },
+  ].forEach(({ route, profile, app, base }) => {
+    describe(`for app ${app}`, () => {
+      let email = gen.email()
+      let password = gen.password()
+
+      const emailSecond = `second-${gen.email()}`
+      const passwordSecond = gen.password()
+
+      const up = (value) => `not-${value}`
+
+      before(() => {
+        cy.proxy(app)
+        cy.useConfigProfile(profile)
+        cy.registerApi({
+          email: emailSecond,
+          password: passwordSecond,
+          fields: { "traits.website": "https://github.com/ory/kratos" },
+        })
+        cy.registerApi({
+          email,
+          password,
+          fields: { "traits.website": website },
+        })
+      })
+
+      beforeEach(() => {
+        cy.longPrivilegedSessionTime()
+
+        cy.visit(base)
+        cy.clearAllCookies()
+
+        cy.login({ email, password, cookieUrl: base })
+        cy.visit(route)
+      })
+
+      describe("profile", () => {
+        beforeEach(() => {
+          cy.visit(route)
+        })
+
+        // playwright:migrated
+        it("fails with validation errors", () => {
+          cy.get('input[name="traits.website"]').clear().type("http://s")
+          cy.get('[name="method"][value="profile"]').click()
+          cy.get('[data-testid="ui/message/4000003"]').should(
+            "contain.text",
+            "length must be >= 10",
+          )
+        })
+
+        it("fails because reauth is another person", () => {
+          // Force this because it is hidden
+          cy.get('input[name="traits.email"]').clear().type(up(email))
+          cy.shortPrivilegedSessionTime()
+
+          cy.location().then((loc) => {
+            cy.get('button[value="profile"]').click()
+
+            cy.reauthWithOtherAccount({
+              previousUrl: loc.toString(),
+              expect: { email },
+              type: { email: emailSecond, password: passwordSecond },
+            })
+
+            cy.location("pathname").should("contain", "/settings")
+          })
+
+          // We end up in a new settings flow for the second user
+          cy.get('input[name="traits.email"]').should("have.value", emailSecond)
+
+          // Try to log in with updated credentials -> should fail
+          cy.clearAllCookies()
+          cy.login({
+            email: up(email),
+            password,
+            expectSession: false,
+            cookieUrl: base,
+          })
+        })
+
+        it("does not update data because resumable session was removed", () => {
+          cy.get('input[name="traits.email"]').clear().type(up(email))
+          cy.shortPrivilegedSessionTime()
+          cy.get('button[value="profile"]').click()
+
+          cy.login({ email, password, cookieUrl: base })
+
+          cy.getSession().should((session) => {
+            const { identity } = session
+            expect(identity.traits.email).to.equal(email)
+          })
+        })
+
+        it("does not update without re-auth", () => {
+          cy.get('input[name="traits.email"]').clear().type(up(email))
+          cy.shortPrivilegedSessionTime() // wait for the privileged session to time out
+          cy.get('button[value="profile"]').click()
+
+          cy.visit(base)
+
+          cy.getSession().should((session) => {
+            const { identity } = session
+            expect(identity.traits.email).to.equal(email)
+          })
+        })
+
+        it("does not resume another failed request", () => {
+          // checks here that we're checking settingsRequest.id == cookie.stored.id
+          cy.get('input[name="traits.email"]').clear().type(up(email))
+          cy.shortPrivilegedSessionTime() // wait for the privileged session to time out
+          cy.get('button[value="profile"]').click()
+          cy.location("pathname").should("not.contain", "/settings")
+
+          cy.visit(route)
+          cy.get('input[name="traits.website"]')
+            .clear()
+            .type("http://github.com/aeneasr")
+          cy.get('button[value="profile"]').click()
+          cy.expectSettingsSaved()
+
+          cy.getSession().should((session) => {
+            const { identity } = session
+            expect(identity.traits.email).to.equal(email) // this is NOT up(email)
+            expect(identity.traits.website).to.equal(
+              "http://github.com/aeneasr",
+            ) // this is NOT up(email)
+          })
+        })
+      })
+
+      describe("password", () => {
+        beforeEach(() => {
+          cy.longPrivilegedSessionTime()
+        })
+
+        afterEach(() => {
+          cy.longPrivilegedSessionTime()
+        })
+
+        // playwright:migrated
+        it("fails if password policy is violated", () => {
+          cy.get('input[name="password"]').clear().type("12345678")
+          cy.get('button[value="password"]').click()
+          cy.get('[data-testid="ui/message/4000034"]').should(
+            "contain.text",
+            "data breaches",
+          )
+        })
+
+        it("fails because reauth is another person", () => {
+          cy.shortPrivilegedSessionTime() // wait for the privileged session to time out
+          cy.get('input[name="password"]').clear().type(up(password))
+
+          let firstSession
+          cy.getSession().then((session) => {
+            firstSession = session
+          })
+
+          cy.location().then((loc) => {
+            cy.get('button[value="password"]').click()
+
+            cy.reauthWithOtherAccount({
+              previousUrl: loc.toString(),
+              expect: { email },
+              type: { email: emailSecond, password: passwordSecond },
+            })
+
+            cy.location("pathname").should("contain", "/settings")
+          })
+
+          // We want to ensure that the reauth session is completely different from the one we had in the first place.
+          cy.getSession().then((session) => {
+            expect(session.authentication_methods).to.have.length(1)
+            expect(session.identity.traits.email).to.eq(emailSecond)
+            expect(session.id).to.not.eq(firstSession.id)
+            expect(session.identity.id).to.not.eq(firstSession.identity.id)
+            expect(session.authenticated_at).to.not.eq(
+              firstSession.authenticated_at,
+            )
+          })
+
+          // We end up in a new settings flow for the second user
+          cy.get('input[name="traits.email"]').should("have.value", emailSecond)
+
+          // Try to log in with updated credentials -> should fail
+          cy.clearAllCookies()
+          cy.login({
+            email,
+            password: up(password),
+            expectSession: false,
+            cookieUrl: base,
+          })
+        })
+
+        it("does not update without re-auth", () => {
+          cy.get('input[name="password"]').clear().type(up(password))
+          cy.shortPrivilegedSessionTime() // wait for the privileged session to time out
+          cy.get('button[value="password"]').click()
+
+          cy.visit(base)
+          cy.clearAllCookies()
+          cy.login({
+            email,
+            password: up(password),
+            expectSession: false,
+            cookieUrl: base,
+          })
+        })
+
+        it("does not update data because resumable session was removed", () => {
+          cy.get('input[name="password"]').clear().type(up(password))
+          cy.shortPrivilegedSessionTime() // wait for the privileged session to time out
+          cy.get('button[value="password"]').click()
+
+          cy.clearAllCookies()
+          cy.login({ email, password, cookieUrl: base })
+          cy.clearAllCookies()
+          cy.login({
+            email,
+            password: up(password),
+            expectSession: false,
+            cookieUrl: base,
+          })
+        })
+
+        it("does not resume another queued request", () => {
+          const email = gen.email()
+          const password = gen.password()
+          cy.clearAllCookies()
+          cy.register({
+            email,
+            password,
+            fields: { "traits.website": website },
+          })
+          cy.visit(route)
+
+          // checks here that we're checking settingsRequest.id == cookie.stored.id
+          const invalidPassword = "invalid-" + gen.password()
+          cy.get('input[name="password"]').clear().type(invalidPassword)
+          cy.shortPrivilegedSessionTime() // wait for the privileged session to time out
+          cy.get('button[value="password"]').click()
+          cy.location("pathname").should("include", "/login")
+
+          const validPassword = "valid-" + gen.password()
+          cy.visit(route)
+          cy.get('input[name="password"]').clear().type(validPassword)
+          cy.get('button[value="password"]').click()
+
+          cy.location("pathname").should("include", "/login")
+          cy.reauth({ expect: { email }, type: { password: password } })
+
+          cy.location("pathname").should("include", "/settings")
+          cy.get('input[name="password"]').should("exist")
+
+          // This should pass because it is the correct password
+          cy.clearAllCookies()
+          cy.login({ email, password: validPassword, cookieUrl: base })
+
+          // This should fail because it is the wrong password
+          cy.clearAllCookies()
+          cy.login({
+            email,
+            password: invalidPassword,
+            expectSession: false,
+            cookieUrl: base,
+          })
+
+          cy.clearAllCookies()
+          cy.login({
+            email,
+            password: password,
+            expectSession: false,
+            cookieUrl: base,
+          })
+        })
+      })
+
+      describe("global errors", () => {
+        it("fails when CSRF is incorrect", () => {
+          cy.get(appPrefix(app) + 'input[name="password"]').type("12345678")
+          cy.shouldHaveCsrfError({ app })
+        })
+
+        it("fails when a disallowed return_to url is requested", () => {
+          cy.shouldErrorOnDisallowedReturnTo(
+            route + "?return_to=https://not-allowed",
+            { app },
+          )
+        })
+      })
+    })
+  })
+})

test/e2e/cypress/integration/profiles/email/settings/success.spec.ts

@@ -0,0 +1,194 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { appPrefix, gen, website } from "../../../../helpers"
+import { routes as express } from "../../../../helpers/express"
+import { routes as react } from "../../../../helpers/react"
+
+context("Settings success with email profile", () => {
+  ;[
+    {
+      route: express.settings,
+      base: express.base,
+      app: "express" as "express",
+      profile: "email",
+      login: express.login,
+    },
+    {
+      route: react.settings,
+      base: react.base,
+      app: "react" as "react",
+      profile: "spa",
+      login: react.login,
+    },
+  ].forEach(({ route, profile, app, base, login }) => {
+    describe(`for app ${app}`, () => {
+      let email = gen.email()
+      const firstPassword = gen.password()
+      const secondPassword = gen.password()
+      const thirdPassword = gen.password()
+      let password = firstPassword
+
+      const up = (value: string) => `not-${value}`
+      const down = (value: string) => value.replace(/not-/, "")
+
+      before(() => {
+        cy.useConfigProfile(profile)
+        cy.registerApi({
+          email,
+          password,
+          fields: { "traits.website": website },
+        })
+        cy.proxy(app)
+      })
+
+      beforeEach(() => {
+        cy.deleteMail()
+        cy.login({ email, password, cookieUrl: base })
+        cy.visit(route)
+      })
+
+      // playwright:migrated
+      it("shows all settings forms", () => {
+        cy.get(appPrefix(app) + "h3").should("contain.text", "Profile")
+        cy.get('input[name="traits.email"]').should("contain.value", email)
+        cy.get('input[name="traits.website"]').should("contain.value", website)
+
+        cy.get("h3").should("contain.text", "Password")
+        cy.get('input[name="password"]').should("be.empty")
+      })
+
+      describe("password", () => {
+        // playwright:migrated
+        it("modifies the password with privileged session", () => {
+          // Once input weak password to test which error message is cleared after updating successfully
+          cy.get('input[name="password"]').clear().type("123")
+          cy.get('button[value="password"]').click()
+          cy.get('[data-testid="ui/message/1050001"]').should("not.exist")
+          cy.get('[data-testid="ui/message/4000032"]').should("exist")
+          cy.get('input[name="password"]').should("be.empty")
+
+          password = secondPassword
+          cy.get('input[name="password"]').clear().type(secondPassword)
+          cy.get('button[value="password"]').click()
+          cy.expectSettingsSaved()
+          cy.get('[data-testid="ui/message/4000032"]').should("not.exist")
+          cy.get('[data-testid="ui/message/1050001"]').should("exist")
+          cy.get('input[name="password"]').should("be.empty")
+        })
+
+        // playwright:migrated
+        it("is unable to log in with the old password", () => {
+          cy.login({
+            email: email,
+            password: firstPassword,
+            expectSession: false,
+            cookieUrl: base,
+          })
+        })
+
+        it("modifies the password with an unprivileged session", () => {
+          password = thirdPassword
+          cy.get('input[name="password"]').clear().type(password)
+          cy.shortPrivilegedSessionTime() // wait for the privileged session to time out
+          cy.get('button[value="password"]').click()
+
+          cy.reauth({ expect: { email }, type: { password: secondPassword } })
+
+          cy.url().should("include", "/settings")
+          cy.expectSettingsSaved()
+          cy.get('input[name="password"]').should("be.empty")
+        })
+      })
+
+      describe("profile", () => {
+        // playwright:migrated
+        it("modifies an unprotected traits", () => {
+          cy.get('input[name="traits.website"]')
+            .clear()
+            .type("https://github.com/ory")
+          cy.get('input[name="traits.age"]').clear().type("30")
+          cy.get('input[type="checkbox"][name="traits.tos"]').click({
+            force: true,
+          })
+          cy.submitProfileForm()
+          cy.expectSettingsSaved()
+
+          cy.get('input[name="traits.website"]').should(
+            "contain.value",
+            "https://github.com/ory",
+          )
+          cy.get('input[type="checkbox"][name="traits.tos"]')
+            .should("be.checked")
+            .click({ force: true })
+          cy.get('input[name="traits.age"]')
+            .should("have.value", "30")
+            .clear()
+            .type("90")
+
+          cy.submitProfileForm()
+          cy.expectSettingsSaved()
+
+          cy.get('input[type="checkbox"][name="traits.tos"]').should(
+            "not.be.checked",
+          )
+          cy.get('input[name="traits.age"]').should("have.value", "90")
+        })
+
+        // playwright:migrated
+        it("modifies a protected trait with privileged session", () => {
+          email = up(email)
+          cy.disableVerification()
+          cy.get('input[name="traits.email"]').clear().type(email)
+          cy.get('button[value="profile"]').click()
+          cy.expectSettingsSaved()
+          cy.get('input[name="traits.email"]').should("contain.value", email)
+        })
+
+        // playwright:migrated
+        it("is unable to log in with the old email", () => {
+          cy.login({
+            email: down(email),
+            password,
+            expectSession: false,
+            cookieUrl: base,
+          })
+        })
+
+        it("modifies a protected trait with unprivileged session", () => {
+          email = up(email)
+          cy.get('input[name="traits.email"]').clear().type(email)
+          cy.shortPrivilegedSessionTime() // wait for the privileged session to time out
+          cy.get('button[value="profile"]').click()
+
+          cy.reauth({ expect: { email: down(email) }, type: { password } })
+
+          cy.url().should("include", "/settings")
+          cy.expectSettingsSaved()
+          cy.get('input[name="traits.email"]').should("contain.value", email)
+        })
+
+        if (app === "react") {
+          it("shows verification screen after email update", () => {
+            cy.deleteMail()
+            cy.enableVerification()
+            email = up(email)
+            cy.get('input[name="traits.email"]').clear().type(email)
+            cy.get('button[value="profile"]').click()
+
+            cy.url().should("contain", "verification")
+            cy.getVerificationCodeFromEmail(email).then((code) => {
+              cy.get("input[name=code]").type(code)
+              cy.get("button[name=method][value=code]").click()
+            })
+
+            cy.get('[data-testid="ui/message/1080002"]').should(
+              "have.text",
+              "You successfully verified your email address.",
+            )
+          })
+        }
+      })
+    })
+  })
+})

test/e2e/cypress/integration/profiles/email/settings/ui.spec.ts

@@ -0,0 +1,75 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { appPrefix, gen } from "../../../../helpers"
+import { routes as express } from "../../../../helpers/express"
+import { routes as react } from "../../../../helpers/react"
+
+context("Settings errors with email profile", () => {
+  ;[
+    {
+      base: express.base,
+      app: "express" as "express",
+      profile: "email",
+    },
+    {
+      base: react.base,
+      app: "react" as "react",
+      profile: "spa",
+    },
+  ].forEach(({ profile, app, base }) => {
+    describe(`for app ${app}`, () => {
+      const identity = gen.identity()
+
+      before(() => {
+        cy.useConfigProfile(profile)
+        cy.registerApi({
+          ...identity,
+          fields: { "traits.website": "https://www.ory.sh/" },
+        })
+        cy.proxy(app)
+      })
+
+      beforeEach(() => {
+        cy.login({ ...identity, cookieUrl: base })
+        cy.visit(base)
+      })
+
+      describe("use ui elements", () => {
+        // playwright:migrated
+        it("should use the json schema titles", () => {
+          const settingsLink = appPrefix(app) + 'a[href*="settings"]'
+          if (app === "express") {
+            cy.get(settingsLink).should("have.attr", "target", "_blank")
+            cy.removeAttribute([settingsLink], "target")
+          }
+          cy.get(settingsLink).click()
+          cy.get('input[name="traits.email"]')
+            .parent()
+            .should("contain.text", "Your E-Mail")
+          cy.get('input[name="traits.website"]')
+            .parent()
+            .should("contain.text", "Your website")
+
+          cy.get('input[name="password"]')
+            .parentsUntil("label")
+            .should("contain.text", "Password")
+
+          cy.get('button[value="profile"]').should("contain.text", "Save")
+          cy.get('button[value="password"]').should("contain.text", "Save")
+        })
+
+        // playwright:migrated
+        it("clicks the settings link", () => {
+          const settingsLink = 'a[href*="settings"]'
+          if (app === "express") {
+            cy.get(settingsLink).should("have.attr", "target", "_blank")
+            cy.removeAttribute([settingsLink], "target")
+          }
+          cy.get(settingsLink).click()
+          cy.location("pathname").should("include", "settings")
+        })
+      })
+    })
+  })
+})