snapshot of https://github.com/ory/kratos.git (master, 2026-09-15; blobs > 131072B omitted)

test/e2e/cypress/integration/profiles/email/registration/errors.spec.ts

@@ -0,0 +1,268 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { appPrefix, gen, website } from "../../../../helpers"
+import { routes as express } from "../../../../helpers/express"
+import { routes as react } from "../../../../helpers/react"
+
+describe("Registration failures with email profile", () => {
+  ;[
+    {
+      route: express.registration,
+      app: "express" as "express",
+      profile: "email",
+    },
+    {
+      route: react.registration,
+      app: "react" as "react",
+      profile: "spa",
+    },
+  ].forEach(({ route, profile, app }) => {
+    describe(`for app ${app}`, () => {
+      before(() => {
+        cy.useConfigProfile(profile)
+        cy.proxy(app)
+        cy.updateConfigFile((config) => {
+          config.selfservice.flows.registration.login_hints = true
+          return config
+        })
+      })
+
+      beforeEach(() => {
+        cy.visit(route)
+      })
+
+      const identity = gen.email()
+      const password = gen.password()
+
+      it("fails when CSRF cookies are missing", () => {
+        cy.get(`${appPrefix(app)} input[name="traits.website"]`).type(
+          "https://www.ory.sh",
+        )
+        cy.get('input[name="traits.email"]')
+          .type(identity)
+          .should("have.value", identity)
+        cy.get('input[name="password"]')
+          .type("12345678")
+          .should("have.value", "12345678")
+
+        cy.shouldHaveCsrfError({ app })
+      })
+
+      it("fails when a disallowed return_to url is requested", () => {
+        cy.shouldErrorOnDisallowedReturnTo(
+          route + "?return_to=https://not-allowed",
+          { app },
+        )
+      })
+
+      describe("show errors when invalid signup data is used", () => {
+        // playwright:migrated
+        it("should show an error when the password has leaked before", () => {
+          cy.get('input[name="traits.website"]').type("https://www.ory.sh")
+          cy.get('input[name="traits.email"]')
+            .type(identity)
+            .should("have.value", identity)
+          cy.get('input[name="password"]')
+            .type("12345678")
+            .should("have.value", "12345678")
+
+          cy.submitPasswordForm()
+          cy.get('[data-testid="ui/message/4000034"]').should(
+            "contain.text",
+            "data breaches",
+          )
+        })
+
+        // playwright:migrated
+        it("should show an error when the password is too similar", () => {
+          cy.get('input[name="traits.website"]').type("https://www.ory.sh")
+          cy.get('input[name="traits.email"]').type(identity)
+          cy.get('input[name="password"]').type(identity)
+
+          cy.submitPasswordForm()
+          cy.get('[data-testid="ui/message/4000031"]').should(
+            "contain.text",
+            "too similar",
+          )
+        })
+
+        // playwright:migrated
+        it("should show an error when the password is empty", () => {
+          cy.get('input[name="traits.website"]').type("https://www.ory.sh")
+          cy.get('input[name="traits.email"]').type(identity)
+
+          // the browser will prevent the form from being submitted if the input field is required
+          // we should remove the required attribute to simulate the data not being sent
+          cy.removeAttribute(['input[name="password"]'], "required")
+
+          cy.submitPasswordForm()
+          cy.get('*[data-testid^="ui/message/"]')
+            .invoke("text")
+            .then((text) => {
+              expect(text.trim()).to.be.oneOf([
+                "length must be >= 1, but got 0",
+                "Property password is missing.",
+              ])
+            })
+        })
+
+        // playwright:migrated
+        it("should show an error when the email is empty", () => {
+          cy.get('input[name="traits.website"]').type("https://www.ory.sh")
+          cy.get('input[name="password"]').type(password)
+
+          // the browser will prevent the form from being submitted if the input field is required
+          // we should remove the required attribute to simulate the data not being sent
+          cy.removeAttribute(['input[name="traits.email"]'], "required")
+
+          cy.submitPasswordForm()
+          cy.get('*[data-testid^="ui/message/"]')
+            .invoke("text")
+            .then((text) => {
+              expect(text.trim()).to.be.oneOf([
+                '"" is not valid "email"',
+                "length must be >= 3, but got 0",
+                "Property email is missing.",
+              ])
+            })
+        })
+
+        // playwright:migrated
+        it("should show an error when the email is not an email", () => {
+          cy.get('input[name="traits.website"]').type("https://www.ory.sh")
+          cy.get('input[name="password"]').type(password)
+
+          // the browser will prevent the form from being submitted if the input data doesn't conform to the input field type
+          // in this case an invalid email will prevent the form from being submitted by the browser
+          // we should remove it to ensure kratos is validating the payload
+          cy.get('input[name="traits.email"]').then(($el) =>
+            $el.removeAttr("type"),
+          )
+          cy.get('input[name="traits.email"]').type("not-an-email")
+
+          cy.submitPasswordForm()
+          cy.get(
+            '*[data-testid="ui/message/4000040"], *[data-testid="ui/message/4000002"]',
+          ).should("exist")
+        })
+
+        // playwright:migrated
+        it("should show a missing indicator if no fields are set", () => {
+          // the browser will prevent the form from being submitted if the input field is required
+          // we should remove the required attribute to simulate the data not being sent
+          cy.removeAttribute(
+            [
+              'input[name="traits.email"]',
+              'input[name="traits.website"]',
+              'input[name="password"]',
+            ],
+            "required",
+          )
+
+          cy.submitPasswordForm()
+          cy.get(
+            '*[data-testid="ui/message/4000001"], *[data-testid="ui/message/4000002"]',
+          ).should("exist")
+        })
+
+        it("should show an error when the website is not a valid URI", () => {
+          cy.get('input[name="traits.website"]')
+            .type("1234")
+            .then(($input) => {
+              expect(
+                ($input[0] as HTMLInputElement).validationMessage,
+              ).to.contain("URL")
+            })
+        })
+
+        // playwright:migrated
+        it("should show an error when the website is too short", () => {
+          // the browser will prevent the form from being submitted if the input field is required
+          // we should remove the required attribute to simulate the data not being sent
+          cy.removeAttribute(
+            ['input[name="traits.email"]', 'input[name="password"]'],
+            "required",
+          )
+
+          cy.get('input[name="traits.website"]').type("http://s")
+
+          cy.submitPasswordForm()
+          cy.get('[data-testid="ui/message/4000003"]').should(
+            "contain.text",
+            "length must be >= 10",
+          )
+        })
+
+        // playwright:migrated
+        it("should show an error when required params are missing", () => {
+          // the browser will prevent the form from being submitted if the input field is required
+          // we should remove it from the DOM entirely to simulate the data not being sent
+          cy.get('input[name="traits.website"]').then(($el) => $el.remove())
+          cy.get('input[name="traits.email"]').then(($el) => $el.remove())
+          cy.get('input[name="password"]').then(($el) => $el.remove())
+
+          cy.submitPasswordForm()
+          cy.get('[data-testid="ui/message/4000002"]').should(
+            "contain.text",
+            "Property website is missing.",
+          )
+          cy.get('[data-testid="ui/message/4000002"]').should(
+            "contain.text",
+            "Property email is missing.",
+          )
+          cy.get('[data-testid="ui/message/4000002"]').should(
+            "contain.text",
+            "Property password is missing.",
+          )
+        })
+
+        // playwright:migrated
+        it("should show an error when the age is too high", () => {
+          // the browser will prevent the form from being submitted if the input field is required
+          // we should remove the required attribute to simulate the data not being sent
+          cy.removeAttribute(
+            [
+              'input[name="traits.email"]',
+              'input[name="traits.website"]',
+              'input[name="password"]',
+            ],
+            "required",
+          )
+
+          cy.get('input[name="traits.age"]').type("600")
+
+          cy.submitPasswordForm()
+          cy.get('[data-testid="ui/message/4000020"]').should(
+            "contain.text",
+            "must be <= 300 but found 600",
+          )
+        })
+
+        // playwright:migrated
+        it("should show a hint for existing account", () => {
+          const email = gen.email()
+          const password = gen.password()
+
+          cy.registerApi({
+            email,
+            password,
+            fields: { "traits.website": website },
+          })
+
+          cy.get('input[name="traits.email"]').type(email)
+          cy.get('input[name="password"]').type(password)
+          cy.get('input[name="traits.website').type(website)
+          cy.get('input[name="traits.age"]').type(`30`)
+          cy.submitPasswordForm()
+          cy.get('[data-testid="ui/message/4000028"]').should(
+            "contain.text",
+            "You tried signing in with " +
+              email +
+              " which is already in use by another account. You can sign in using your password.",
+          )
+        })
+      })
+    })
+  })
+})

test/e2e/cypress/integration/profiles/email/registration/success.spec.ts

@@ -0,0 +1,210 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { appPrefix, APP_URL, gen } from "../../../../helpers"
+import { routes as express } from "../../../../helpers/express"
+import { routes as react } from "../../../../helpers/react"
+
+context("Registration success with email profile", () => {
+  ;[
+    {
+      route: express.registration,
+      app: "express" as "express",
+      profile: "email",
+    },
+    {
+      route: react.registration,
+      app: "react" as "react",
+      profile: "spa",
+    },
+  ].forEach(({ route, profile, app }) => {
+    describe(`for app ${app}`, () => {
+      before(() => {
+        cy.useConfigProfile(profile)
+        cy.proxy(app)
+      })
+
+      beforeEach(() => {
+        cy.deleteMail()
+        cy.clearAllCookies()
+        cy.visit(route)
+        cy.enableVerification()
+        if (app === "express") {
+          cy.enableVerificationUIAfterRegistration("password")
+        }
+      })
+
+      // playwright:migrated
+      it("should sign up and be logged in", () => {
+        const email = gen.email()
+        const password = gen.password()
+        const website = "https://www.example.org/"
+        const age = 30
+
+        cy.get(appPrefix(app) + 'input[name="traits"]').should("not.exist")
+        cy.get('input[name="traits.email"]').type(email)
+        cy.get('input[name="password"]').type(password)
+        cy.get('input[name="traits.website').type(website)
+        cy.get('input[name="traits.age"]').type(`${age}`)
+        cy.get('[type="checkbox"][name="traits.tos"]').click({ force: true })
+
+        cy.submitPasswordForm()
+
+        cy.url().should("contain", "verification")
+        cy.getVerificationCodeFromEmail(email).then((code) => {
+          cy.get("input[name=code]").type(code)
+          cy.get("button[name=method][value=code]").click()
+        })
+
+        cy.get('[data-testid="ui/message/1080002"]').should(
+          "have.text",
+          "You successfully verified your email address.",
+        )
+
+        cy.get("[data-testid='node/anchor/continue']").click()
+
+        if (app === "express") {
+          cy.get('a[href*="sessions"').click()
+        }
+        cy.get("pre").should("contain.text", email)
+
+        cy.getSession().should((session) => {
+          const { identity } = session
+          expect(identity.id).to.not.be.empty
+          expect(identity.verifiable_addresses).to.have.length(1)
+          expect(identity.schema_id).to.equal("default")
+          expect(identity.schema_url).to.equal(`${APP_URL}/schemas/ZGVmYXVsdA`)
+          expect(identity.traits.website).to.equal(website)
+          expect(identity.traits.email).to.equal(email)
+          expect(identity.traits.age).to.equal(age)
+          expect(identity.traits.tos).to.equal(true)
+        })
+      })
+
+      // playwright:migrated
+      it("should sign up with advanced form field values be logged in", () => {
+        const email = gen.email()
+        const password = gen.password()
+
+        cy.get('input[name="traits"]').should("not.exist")
+        cy.get('input[name="traits.email"]').type(email)
+        cy.get('input[name="password"]').type(password)
+        const website = "https://www.example.org/"
+        cy.get('input[name="traits.website"]').type(website)
+
+        cy.submitPasswordForm()
+
+        cy.url().should("contain", "verification")
+        cy.getVerificationCodeFromEmail(email).then((code) => {
+          cy.get("input[name=code]").type(code)
+          cy.get("button[name=method][value=code]").click()
+        })
+
+        cy.get('[data-testid="ui/message/1080002"]').should(
+          "have.text",
+          "You successfully verified your email address.",
+        )
+
+        cy.get("[data-testid='node/anchor/continue']").click()
+
+        if (app === "express") {
+          cy.get('a[href*="sessions"').click()
+        }
+        cy.get("pre").should("contain.text", email)
+
+        cy.getSession().should((session) => {
+          const { identity } = session
+          expect(identity.id).to.not.be.empty
+          expect(identity.verifiable_addresses).to.have.length(1)
+          expect(identity.schema_id).to.equal("default")
+          expect(identity.schema_url).to.equal(`${APP_URL}/schemas/ZGVmYXVsdA`)
+          expect(identity.traits.website).to.equal(website)
+          expect(identity.traits.email).to.equal(email)
+          expect(identity.traits.age).to.be.undefined
+          expect(identity.traits.tos).to.be.oneOf([false, undefined])
+        })
+      })
+
+      // playwright:migrated
+      it("should sign up and be redirected", () => {
+        cy.disableVerification()
+        cy.browserReturnUrlOry()
+        cy.visit(route + "?return_to=https://www.example.org/")
+
+        const email = gen.email()
+        const password = gen.password()
+        const website = "https://www.example.org/"
+
+        cy.get('input[name="traits"]').should("not.exist")
+        cy.get('input[name="traits.email"]').type(email)
+        cy.get('input[name="traits.website').type(website)
+        cy.get('input[name="password"]').type(password)
+        cy.submitPasswordForm()
+
+        cy.url().should("eq", "https://www.example.org/")
+      })
+    })
+  })
+
+  describe("redirect for express app", () => {
+    it("should redirect to return_to after flow expires", () => {
+      // Wait for flow to expire
+      cy.useConfigProfile("email")
+      cy.shortRegisterLifespan()
+      cy.browserReturnUrlOry()
+      cy.proxy("express")
+      cy.visit(express.registration + "?return_to=https://www.example.org/")
+      cy.wait(105)
+
+      const email = gen.email()
+      const password = gen.password()
+      const website = "https://www.example.org/"
+
+      cy.get(`${appPrefix("express")} input[name="traits"]`).should("not.exist")
+      cy.get('input[name="traits.email"]').type(email)
+      cy.get('input[name="traits.website').type(website)
+      cy.get('input[name="password"]').type(password)
+
+      cy.longRegisterLifespan()
+      cy.submitPasswordForm()
+
+      cy.get('[data-testid="ui/message/4040001"]').should(
+        "contain.text",
+        "The registration flow expired",
+      )
+
+      // Try again with long lifespan set
+      cy.get('input[name="traits"]').should("not.exist")
+      cy.get('input[name="traits.email"]').type(email)
+      cy.get('input[name="traits.website').type(website)
+      cy.get('input[name="password"]').type(password)
+      cy.submitPasswordForm()
+
+      cy.url().should("eq", "https://www.example.org/")
+    })
+
+    it("should not redirect to verification_flow if not configured", () => {
+      cy.deleteMail()
+      cy.useConfigProfile("email")
+      cy.enableVerification()
+      cy.proxy("express")
+      cy.visit(express.registration + "?return_to=https://www.example.org/")
+
+      const email = gen.email()
+      const password = gen.password()
+      const website = "https://www.example.org/"
+
+      cy.get(`${appPrefix("express")} input[name="traits"]`).should("not.exist")
+      cy.get('input[name="traits.email"]').type(email)
+      cy.get('input[name="traits.website').type(website)
+      cy.get('input[name="password"]').type(password)
+
+      cy.submitPasswordForm()
+
+      // Verify that the verification code is still sent
+      cy.getVerificationCodeFromEmail(email).should("not.be.undefined")
+
+      cy.url().should("eq", "https://www.example.org/")
+    })
+  })
+})

test/e2e/cypress/integration/profiles/email/registration/ui.spec.ts

@@ -0,0 +1,54 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { routes as express } from "../../../../helpers/express"
+import { routes as react } from "../../../../helpers/react"
+import { appPrefix } from "../../../../helpers"
+
+describe("Registration UI for email flows", () => {
+  ;[
+    {
+      route: express.registration,
+      app: "express" as "express",
+      profile: "email",
+    },
+    {
+      route: react.registration,
+      app: "react" as "react",
+      profile: "spa",
+    },
+  ].forEach(({ route, profile, app }) => {
+    describe(`for app ${app}`, () => {
+      before(() => {
+        cy.useConfigProfile(profile)
+        cy.proxy(app)
+      })
+
+      beforeEach(() => {
+        cy.visit(route)
+      })
+
+      describe("use ui elements", () => {
+        // playwright:migrated
+        it("should use the json schema titles", () => {
+          cy.get(appPrefix(app) + 'input[name="traits.email"]')
+            .parent()
+            .should("contain.text", "Your E-Mail")
+          cy.get('input[name="traits.website"]')
+            .parent()
+            .should("contain.text", "Your website")
+          cy.get('button[value="password"]').should("contain.text", "Sign up")
+        })
+
+        // playwright:migrated
+        it("clicks the log in link", () => {
+          cy.get('*[data-testid="cta-link"]').click()
+          cy.location("pathname").should("include", "/login")
+          if (app === "express") {
+            cy.location("search").should("not.be.empty")
+          }
+        })
+      })
+    })
+  })
+})