snapshot of https://github.com/ory/kratos.git (master, 2026-09-15; blobs > 131072B omitted)

test/e2e/cypress/integration/profiles/email/settings/errors.spec.ts

@@ -0,0 +1,314 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { appPrefix, gen, website } from "../../../../helpers"
+import { routes as express } from "../../../../helpers/express"
+import { routes as react } from "../../../../helpers/react"
+
+context("Settings failures with email profile", () => {
+  ;[
+    {
+      route: express.settings,
+      base: express.base,
+      app: "express" as "express",
+      profile: "email",
+    },
+    {
+      route: react.settings,
+      base: react.base,
+      app: "react" as "react",
+      profile: "spa",
+    },
+  ].forEach(({ route, profile, app, base }) => {
+    describe(`for app ${app}`, () => {
+      let email = gen.email()
+      let password = gen.password()
+
+      const emailSecond = `second-${gen.email()}`
+      const passwordSecond = gen.password()
+
+      const up = (value) => `not-${value}`
+
+      before(() => {
+        cy.proxy(app)
+        cy.useConfigProfile(profile)
+        cy.registerApi({
+          email: emailSecond,
+          password: passwordSecond,
+          fields: { "traits.website": "https://github.com/ory/kratos" },
+        })
+        cy.registerApi({
+          email,
+          password,
+          fields: { "traits.website": website },
+        })
+      })
+
+      beforeEach(() => {
+        cy.longPrivilegedSessionTime()
+
+        cy.visit(base)
+        cy.clearAllCookies()
+
+        cy.login({ email, password, cookieUrl: base })
+        cy.visit(route)
+      })
+
+      describe("profile", () => {
+        beforeEach(() => {
+          cy.visit(route)
+        })
+
+        // playwright:migrated
+        it("fails with validation errors", () => {
+          cy.get('input[name="traits.website"]').clear().type("http://s")
+          cy.get('[name="method"][value="profile"]').click()
+          cy.get('[data-testid="ui/message/4000003"]').should(
+            "contain.text",
+            "length must be >= 10",
+          )
+        })
+
+        it("fails because reauth is another person", () => {
+          // Force this because it is hidden
+          cy.get('input[name="traits.email"]').clear().type(up(email))
+          cy.shortPrivilegedSessionTime()
+
+          cy.location().then((loc) => {
+            cy.get('button[value="profile"]').click()
+
+            cy.reauthWithOtherAccount({
+              previousUrl: loc.toString(),
+              expect: { email },
+              type: { email: emailSecond, password: passwordSecond },
+            })
+
+            cy.location("pathname").should("contain", "/settings")
+          })
+
+          // We end up in a new settings flow for the second user
+          cy.get('input[name="traits.email"]').should("have.value", emailSecond)
+
+          // Try to log in with updated credentials -> should fail
+          cy.clearAllCookies()
+          cy.login({
+            email: up(email),
+            password,
+            expectSession: false,
+            cookieUrl: base,
+          })
+        })
+
+        it("does not update data because resumable session was removed", () => {
+          cy.get('input[name="traits.email"]').clear().type(up(email))
+          cy.shortPrivilegedSessionTime()
+          cy.get('button[value="profile"]').click()
+
+          cy.login({ email, password, cookieUrl: base })
+
+          cy.getSession().should((session) => {
+            const { identity } = session
+            expect(identity.traits.email).to.equal(email)
+          })
+        })
+
+        it("does not update without re-auth", () => {
+          cy.get('input[name="traits.email"]').clear().type(up(email))
+          cy.shortPrivilegedSessionTime() // wait for the privileged session to time out
+          cy.get('button[value="profile"]').click()
+
+          cy.visit(base)
+
+          cy.getSession().should((session) => {
+            const { identity } = session
+            expect(identity.traits.email).to.equal(email)
+          })
+        })
+
+        it("does not resume another failed request", () => {
+          // checks here that we're checking settingsRequest.id == cookie.stored.id
+          cy.get('input[name="traits.email"]').clear().type(up(email))
+          cy.shortPrivilegedSessionTime() // wait for the privileged session to time out
+          cy.get('button[value="profile"]').click()
+          cy.location("pathname").should("not.contain", "/settings")
+
+          cy.visit(route)
+          cy.get('input[name="traits.website"]')
+            .clear()
+            .type("http://github.com/aeneasr")
+          cy.get('button[value="profile"]').click()
+          cy.expectSettingsSaved()
+
+          cy.getSession().should((session) => {
+            const { identity } = session
+            expect(identity.traits.email).to.equal(email) // this is NOT up(email)
+            expect(identity.traits.website).to.equal(
+              "http://github.com/aeneasr",
+            ) // this is NOT up(email)
+          })
+        })
+      })
+
+      describe("password", () => {
+        beforeEach(() => {
+          cy.longPrivilegedSessionTime()
+        })
+
+        afterEach(() => {
+          cy.longPrivilegedSessionTime()
+        })
+
+        // playwright:migrated
+        it("fails if password policy is violated", () => {
+          cy.get('input[name="password"]').clear().type("12345678")
+          cy.get('button[value="password"]').click()
+          cy.get('[data-testid="ui/message/4000034"]').should(
+            "contain.text",
+            "data breaches",
+          )
+        })
+
+        it("fails because reauth is another person", () => {
+          cy.shortPrivilegedSessionTime() // wait for the privileged session to time out
+          cy.get('input[name="password"]').clear().type(up(password))
+
+          let firstSession
+          cy.getSession().then((session) => {
+            firstSession = session
+          })
+
+          cy.location().then((loc) => {
+            cy.get('button[value="password"]').click()
+
+            cy.reauthWithOtherAccount({
+              previousUrl: loc.toString(),
+              expect: { email },
+              type: { email: emailSecond, password: passwordSecond },
+            })
+
+            cy.location("pathname").should("contain", "/settings")
+          })
+
+          // We want to ensure that the reauth session is completely different from the one we had in the first place.
+          cy.getSession().then((session) => {
+            expect(session.authentication_methods).to.have.length(1)
+            expect(session.identity.traits.email).to.eq(emailSecond)
+            expect(session.id).to.not.eq(firstSession.id)
+            expect(session.identity.id).to.not.eq(firstSession.identity.id)
+            expect(session.authenticated_at).to.not.eq(
+              firstSession.authenticated_at,
+            )
+          })
+
+          // We end up in a new settings flow for the second user
+          cy.get('input[name="traits.email"]').should("have.value", emailSecond)
+
+          // Try to log in with updated credentials -> should fail
+          cy.clearAllCookies()
+          cy.login({
+            email,
+            password: up(password),
+            expectSession: false,
+            cookieUrl: base,
+          })
+        })
+
+        it("does not update without re-auth", () => {
+          cy.get('input[name="password"]').clear().type(up(password))
+          cy.shortPrivilegedSessionTime() // wait for the privileged session to time out
+          cy.get('button[value="password"]').click()
+
+          cy.visit(base)
+          cy.clearAllCookies()
+          cy.login({
+            email,
+            password: up(password),
+            expectSession: false,
+            cookieUrl: base,
+          })
+        })
+
+        it("does not update data because resumable session was removed", () => {
+          cy.get('input[name="password"]').clear().type(up(password))
+          cy.shortPrivilegedSessionTime() // wait for the privileged session to time out
+          cy.get('button[value="password"]').click()
+
+          cy.clearAllCookies()
+          cy.login({ email, password, cookieUrl: base })
+          cy.clearAllCookies()
+          cy.login({
+            email,
+            password: up(password),
+            expectSession: false,
+            cookieUrl: base,
+          })
+        })
+
+        it("does not resume another queued request", () => {
+          const email = gen.email()
+          const password = gen.password()
+          cy.clearAllCookies()
+          cy.register({
+            email,
+            password,
+            fields: { "traits.website": website },
+          })
+          cy.visit(route)
+
+          // checks here that we're checking settingsRequest.id == cookie.stored.id
+          const invalidPassword = "invalid-" + gen.password()
+          cy.get('input[name="password"]').clear().type(invalidPassword)
+          cy.shortPrivilegedSessionTime() // wait for the privileged session to time out
+          cy.get('button[value="password"]').click()
+          cy.location("pathname").should("include", "/login")
+
+          const validPassword = "valid-" + gen.password()
+          cy.visit(route)
+          cy.get('input[name="password"]').clear().type(validPassword)
+          cy.get('button[value="password"]').click()
+
+          cy.location("pathname").should("include", "/login")
+          cy.reauth({ expect: { email }, type: { password: password } })
+
+          cy.location("pathname").should("include", "/settings")
+          cy.get('input[name="password"]').should("exist")
+
+          // This should pass because it is the correct password
+          cy.clearAllCookies()
+          cy.login({ email, password: validPassword, cookieUrl: base })
+
+          // This should fail because it is the wrong password
+          cy.clearAllCookies()
+          cy.login({
+            email,
+            password: invalidPassword,
+            expectSession: false,
+            cookieUrl: base,
+          })
+
+          cy.clearAllCookies()
+          cy.login({
+            email,
+            password: password,
+            expectSession: false,
+            cookieUrl: base,
+          })
+        })
+      })
+
+      describe("global errors", () => {
+        it("fails when CSRF is incorrect", () => {
+          cy.get(appPrefix(app) + 'input[name="password"]').type("12345678")
+          cy.shouldHaveCsrfError({ app })
+        })
+
+        it("fails when a disallowed return_to url is requested", () => {
+          cy.shouldErrorOnDisallowedReturnTo(
+            route + "?return_to=https://not-allowed",
+            { app },
+          )
+        })
+      })
+    })
+  })
+})

test/e2e/cypress/integration/profiles/email/settings/success.spec.ts

@@ -0,0 +1,194 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { appPrefix, gen, website } from "../../../../helpers"
+import { routes as express } from "../../../../helpers/express"
+import { routes as react } from "../../../../helpers/react"
+
+context("Settings success with email profile", () => {
+  ;[
+    {
+      route: express.settings,
+      base: express.base,
+      app: "express" as "express",
+      profile: "email",
+      login: express.login,
+    },
+    {
+      route: react.settings,
+      base: react.base,
+      app: "react" as "react",
+      profile: "spa",
+      login: react.login,
+    },
+  ].forEach(({ route, profile, app, base, login }) => {
+    describe(`for app ${app}`, () => {
+      let email = gen.email()
+      const firstPassword = gen.password()
+      const secondPassword = gen.password()
+      const thirdPassword = gen.password()
+      let password = firstPassword
+
+      const up = (value: string) => `not-${value}`
+      const down = (value: string) => value.replace(/not-/, "")
+
+      before(() => {
+        cy.useConfigProfile(profile)
+        cy.registerApi({
+          email,
+          password,
+          fields: { "traits.website": website },
+        })
+        cy.proxy(app)
+      })
+
+      beforeEach(() => {
+        cy.deleteMail()
+        cy.login({ email, password, cookieUrl: base })
+        cy.visit(route)
+      })
+
+      // playwright:migrated
+      it("shows all settings forms", () => {
+        cy.get(appPrefix(app) + "h3").should("contain.text", "Profile")
+        cy.get('input[name="traits.email"]').should("contain.value", email)
+        cy.get('input[name="traits.website"]').should("contain.value", website)
+
+        cy.get("h3").should("contain.text", "Password")
+        cy.get('input[name="password"]').should("be.empty")
+      })
+
+      describe("password", () => {
+        // playwright:migrated
+        it("modifies the password with privileged session", () => {
+          // Once input weak password to test which error message is cleared after updating successfully
+          cy.get('input[name="password"]').clear().type("123")
+          cy.get('button[value="password"]').click()
+          cy.get('[data-testid="ui/message/1050001"]').should("not.exist")
+          cy.get('[data-testid="ui/message/4000032"]').should("exist")
+          cy.get('input[name="password"]').should("be.empty")
+
+          password = secondPassword
+          cy.get('input[name="password"]').clear().type(secondPassword)
+          cy.get('button[value="password"]').click()
+          cy.expectSettingsSaved()
+          cy.get('[data-testid="ui/message/4000032"]').should("not.exist")
+          cy.get('[data-testid="ui/message/1050001"]').should("exist")
+          cy.get('input[name="password"]').should("be.empty")
+        })
+
+        // playwright:migrated
+        it("is unable to log in with the old password", () => {
+          cy.login({
+            email: email,
+            password: firstPassword,
+            expectSession: false,
+            cookieUrl: base,
+          })
+        })
+
+        it("modifies the password with an unprivileged session", () => {
+          password = thirdPassword
+          cy.get('input[name="password"]').clear().type(password)
+          cy.shortPrivilegedSessionTime() // wait for the privileged session to time out
+          cy.get('button[value="password"]').click()
+
+          cy.reauth({ expect: { email }, type: { password: secondPassword } })
+
+          cy.url().should("include", "/settings")
+          cy.expectSettingsSaved()
+          cy.get('input[name="password"]').should("be.empty")
+        })
+      })
+
+      describe("profile", () => {
+        // playwright:migrated
+        it("modifies an unprotected traits", () => {
+          cy.get('input[name="traits.website"]')
+            .clear()
+            .type("https://github.com/ory")
+          cy.get('input[name="traits.age"]').clear().type("30")
+          cy.get('input[type="checkbox"][name="traits.tos"]').click({
+            force: true,
+          })
+          cy.submitProfileForm()
+          cy.expectSettingsSaved()
+
+          cy.get('input[name="traits.website"]').should(
+            "contain.value",
+            "https://github.com/ory",
+          )
+          cy.get('input[type="checkbox"][name="traits.tos"]')
+            .should("be.checked")
+            .click({ force: true })
+          cy.get('input[name="traits.age"]')
+            .should("have.value", "30")
+            .clear()
+            .type("90")
+
+          cy.submitProfileForm()
+          cy.expectSettingsSaved()
+
+          cy.get('input[type="checkbox"][name="traits.tos"]').should(
+            "not.be.checked",
+          )
+          cy.get('input[name="traits.age"]').should("have.value", "90")
+        })
+
+        // playwright:migrated
+        it("modifies a protected trait with privileged session", () => {
+          email = up(email)
+          cy.disableVerification()
+          cy.get('input[name="traits.email"]').clear().type(email)
+          cy.get('button[value="profile"]').click()
+          cy.expectSettingsSaved()
+          cy.get('input[name="traits.email"]').should("contain.value", email)
+        })
+
+        // playwright:migrated
+        it("is unable to log in with the old email", () => {
+          cy.login({
+            email: down(email),
+            password,
+            expectSession: false,
+            cookieUrl: base,
+          })
+        })
+
+        it("modifies a protected trait with unprivileged session", () => {
+          email = up(email)
+          cy.get('input[name="traits.email"]').clear().type(email)
+          cy.shortPrivilegedSessionTime() // wait for the privileged session to time out
+          cy.get('button[value="profile"]').click()
+
+          cy.reauth({ expect: { email: down(email) }, type: { password } })
+
+          cy.url().should("include", "/settings")
+          cy.expectSettingsSaved()
+          cy.get('input[name="traits.email"]').should("contain.value", email)
+        })
+
+        if (app === "react") {
+          it("shows verification screen after email update", () => {
+            cy.deleteMail()
+            cy.enableVerification()
+            email = up(email)
+            cy.get('input[name="traits.email"]').clear().type(email)
+            cy.get('button[value="profile"]').click()
+
+            cy.url().should("contain", "verification")
+            cy.getVerificationCodeFromEmail(email).then((code) => {
+              cy.get("input[name=code]").type(code)
+              cy.get("button[name=method][value=code]").click()
+            })
+
+            cy.get('[data-testid="ui/message/1080002"]').should(
+              "have.text",
+              "You successfully verified your email address.",
+            )
+          })
+        }
+      })
+    })
+  })
+})

test/e2e/cypress/integration/profiles/email/settings/ui.spec.ts

@@ -0,0 +1,75 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { appPrefix, gen } from "../../../../helpers"
+import { routes as express } from "../../../../helpers/express"
+import { routes as react } from "../../../../helpers/react"
+
+context("Settings errors with email profile", () => {
+  ;[
+    {
+      base: express.base,
+      app: "express" as "express",
+      profile: "email",
+    },
+    {
+      base: react.base,
+      app: "react" as "react",
+      profile: "spa",
+    },
+  ].forEach(({ profile, app, base }) => {
+    describe(`for app ${app}`, () => {
+      const identity = gen.identity()
+
+      before(() => {
+        cy.useConfigProfile(profile)
+        cy.registerApi({
+          ...identity,
+          fields: { "traits.website": "https://www.ory.sh/" },
+        })
+        cy.proxy(app)
+      })
+
+      beforeEach(() => {
+        cy.login({ ...identity, cookieUrl: base })
+        cy.visit(base)
+      })
+
+      describe("use ui elements", () => {
+        // playwright:migrated
+        it("should use the json schema titles", () => {
+          const settingsLink = appPrefix(app) + 'a[href*="settings"]'
+          if (app === "express") {
+            cy.get(settingsLink).should("have.attr", "target", "_blank")
+            cy.removeAttribute([settingsLink], "target")
+          }
+          cy.get(settingsLink).click()
+          cy.get('input[name="traits.email"]')
+            .parent()
+            .should("contain.text", "Your E-Mail")
+          cy.get('input[name="traits.website"]')
+            .parent()
+            .should("contain.text", "Your website")
+
+          cy.get('input[name="password"]')
+            .parentsUntil("label")
+            .should("contain.text", "Password")
+
+          cy.get('button[value="profile"]').should("contain.text", "Save")
+          cy.get('button[value="password"]').should("contain.text", "Save")
+        })
+
+        // playwright:migrated
+        it("clicks the settings link", () => {
+          const settingsLink = 'a[href*="settings"]'
+          if (app === "express") {
+            cy.get(settingsLink).should("have.attr", "target", "_blank")
+            cy.removeAttribute([settingsLink], "target")
+          }
+          cy.get(settingsLink).click()
+          cy.location("pathname").should("include", "settings")
+        })
+      })
+    })
+  })
+})