snapshot of https://github.com/ory/kratos.git (master, 2026-09-15; blobs > 131072B omitted)

test/e2e/cypress/integration/profiles/mobile/login/errors.spec.ts

@@ -0,0 +1,65 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { gen, MOBILE_URL } from "../../../../helpers"
+
+context("Mobile Profile", () => {
+  describe("Login Flow Errors", () => {
+    before(() => {
+      cy.clearAllCookies()
+      cy.useConfigProfile("mobile")
+    })
+
+    beforeEach(() => {
+      cy.visit(MOBILE_URL + "/Login")
+    })
+
+    describe("shows validation errors when invalid signup data is used", () => {
+      it("should show an error when the identifier is missing", () => {
+        cy.get('input[data-testid="password"]').type(gen.password())
+
+        cy.get(
+          'div[data-testid="field/method/password"] div[data-testid="submit-form"]',
+        ).click()
+
+        cy.get('*[data-testid="field/identifier"]').should(
+          "contain.text",
+          "Property identifier is missing.",
+        )
+
+        cy.get('*[data-testid="field/password"]').should(
+          "not.contain.text",
+          "Property password is missing.",
+        )
+      })
+
+      it("should show an error when the password is missing", () => {
+        const email = gen.email()
+        cy.get('input[data-testid="identifier"]')
+          .type(email)
+          .should("have.value", email)
+
+        cy.get(
+          'div[data-testid="field/method/password"] div[data-testid="submit-form"]',
+        ).click()
+
+        cy.get('*[data-testid="field/password"]').should(
+          "contain.text",
+          "Property password is missing.",
+        )
+      })
+
+      it("should show fail to sign in", () => {
+        cy.get('input[data-testid="identifier"]').type(gen.email())
+        cy.get('input[data-testid="password"]').type(gen.password())
+        cy.get(
+          '*[data-testid="field/method/password"] *[data-testid="submit-form"]',
+        ).click()
+        cy.get('*[data-testid="form-messages"]').should(
+          "contain.text",
+          "credentials are invalid",
+        )
+      })
+    })
+  })
+})

test/e2e/cypress/integration/profiles/mobile/login/success.spec.ts

@@ -0,0 +1,35 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { gen, MOBILE_URL, website } from "../../../../helpers"
+
+context("Mobile Profile", () => {
+  describe("Login Flow Success", () => {
+    before(() => {
+      cy.useConfigProfile("mobile")
+    })
+
+    const email = gen.email()
+    const password = gen.password()
+
+    before(() => {
+      cy.registerApi({ email, password, fields: { "traits.website": website } })
+    })
+
+    beforeEach(() => {
+      cy.clearAllCookies()
+      cy.visit(MOBILE_URL + "/Login")
+    })
+
+    it("should sign up and be logged in", () => {
+      cy.get('input[data-testid="identifier"]').type(email)
+      cy.get('input[data-testid="password"]').type(password)
+      cy.get(
+        'div[data-testid="field/method/password"] div[data-testid="submit-form"]',
+      ).click()
+
+      cy.get('[data-testid="session-content"]').should("contain", email)
+      cy.get('[data-testid="session-token"]').should("not.be.empty")
+    })
+  })
+})

test/e2e/cypress/integration/profiles/mobile/mfa/backup.spec.ts

@@ -0,0 +1,123 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { gen, MOBILE_URL, website } from "../../../../helpers"
+
+context("Mobile Profile", () => {
+  describe("TOTP 2FA Flow", () => {
+    before(() => {
+      cy.useConfigProfile("mobile")
+    })
+
+    describe("password", () => {
+      let email = gen.email()
+      let password = gen.password()
+
+      before(() => {
+        cy.clearAllCookies()
+      })
+
+      beforeEach(() => {
+        email = gen.email()
+        password = gen.password()
+
+        cy.registerApi({
+          email,
+          password,
+          fields: { "traits.website": website },
+        })
+
+        cy.loginMobile({ email, password })
+        cy.visit(MOBILE_URL + "/Settings")
+      })
+
+      it("should be able to lifecycle through lookup_secret flows", () => {
+        cy.get('[data-testid="field/lookup_secret_codes"]').should("not.exist")
+        cy.get('[data-testid="field/lookup_secret_confirm/true"]').should(
+          "not.exist",
+        )
+        cy.get('[data-testid="field/lookup_secret_reveal/true"]').should(
+          "not.exist",
+        )
+        cy.get('[data-testid="field/lookup_secret_regenerate/true"]').click()
+
+        cy.get('[data-testid="field/lookup_secret_reveal/true"]').should(
+          "not.exist",
+        )
+        cy.get('[data-testid="field/lookup_secret_codes"]').should("exist")
+        let codes
+        cy.get('[data-testid="field/lookup_secret_codes/text"]').then(($e) => {
+          codes = $e.text().trim().split(", ")
+        })
+        cy.get('[data-testid="field/lookup_secret_confirm/true"]').click()
+        cy.expectSettingsSaved()
+
+        cy.get('[data-testid="field/lookup_secret_confirm/true"]').should(
+          "not.exist",
+        )
+        cy.get('[data-testid="field/lookup_secret_regenerate/true"]').should(
+          "not.exist",
+        )
+        cy.get('[data-testid="field/lookup_secret_codes/true"]').should(
+          "not.exist",
+        )
+
+        cy.get('[data-testid="field/lookup_secret_reveal/true"]').click()
+        cy.get('[data-testid="field/lookup_secret_regenerate/true"]').should(
+          "exist",
+        )
+        cy.get('[data-testid="field/lookup_secret_codes/text"]').then(($e) => {
+          const actualCodes = $e.text().trim().split(", ")
+          expect(actualCodes.join(", ")).to.eq(codes.join(", "))
+        })
+
+        let newCodes
+        cy.get('[data-testid="field/lookup_secret_regenerate/true"]').click()
+        cy.get(
+          '[data-testid="field/lookup_secret_regenerate/true"]:disabled',
+        ).should("not.exist")
+
+        cy.get('[data-testid="field/lookup_secret_codes/text"]')
+          .and(($e) => {
+            expect($e.text().trim().split(", ").join(", ")).to.not.eq(
+              codes.join(", "),
+            )
+          })
+          .then(($e) => {
+            newCodes = $e.text().trim().split(", ")
+          })
+
+        cy.get('[data-testid="field/lookup_secret_confirm/true"]').click()
+        cy.expectSettingsSaved()
+
+        cy.get('[data-testid="field/lookup_secret_reveal/true"]').click()
+        cy.get('[data-testid="field/lookup_secret_codes/text"]').and(($e) => {
+          const actualCodes = $e.text().trim().split(", ")
+          expect(actualCodes.join(", ")).to.eq(newCodes.join(", "))
+        })
+
+        cy.visit(MOBILE_URL + "/Login?aal=aal2&refresh=true")
+
+        // First use a wrong code
+        cy.get("[data-testid=lookup_secret]").then(($e) => {
+          console.log(codes)
+          cy.wrap($e).type("1234")
+        })
+        cy.get('[data-testid="field/method/lookup_secret"]').click()
+        cy.get('[data-testid="form-messages"]').should(
+          "contain.text",
+          "The backup recovery code is not valid.",
+        )
+        cy.get("[data-testid=lookup_secret]").then(($e) => {
+          cy.wrap($e).type(newCodes[0])
+        })
+        cy.get('[data-testid="field/method/lookup_secret"]').click()
+        cy.get('[data-testid="session-content"]').should("contain", "aal2")
+        cy.get('[data-testid="session-content"]').should(
+          "contain",
+          "lookup_secret",
+        )
+      })
+    })
+  })
+})

test/e2e/cypress/integration/profiles/mobile/mfa/mix.spec.ts

@@ -0,0 +1,91 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { gen, MOBILE_URL, website } from "../../../../helpers"
+import { TOTP } from "otpauth"
+
+context("Mobile Profile", () => {
+  describe("TOTP 2FA Flow", () => {
+    before(() => {
+      cy.useConfigProfile("mobile")
+    })
+
+    describe("password", () => {
+      let email = gen.email()
+      let password = gen.password()
+
+      before(() => {
+        cy.clearAllCookies()
+      })
+
+      beforeEach(() => {
+        email = gen.email()
+        password = gen.password()
+
+        cy.registerApi({
+          email,
+          password,
+          fields: { "traits.website": website },
+        })
+        cy.loginMobile({ email, password })
+        cy.visit(MOBILE_URL + "/Settings")
+      })
+
+      it("should be able to use both TOTP and lookup", () => {
+        // set up totp
+        let totpSecret
+        cy.get('*[data-testid="field/totp_secret_key/text"]').then(($e) => {
+          totpSecret = $e.text().trim()
+        })
+        cy.get('*[data-testid="field/totp_code"]').then(($e) => {
+          cy.wrap($e).type(
+            new TOTP({
+              secret: totpSecret,
+            }).generate(),
+          )
+        })
+        cy.get('*[data-testid="field/method/totp"]').click()
+        cy.expectSettingsSaved()
+
+        // Set up backup code
+        cy.get('*[data-testid="field/lookup_secret_regenerate/true"]').click()
+        let recoveryCodes
+        cy.get('*[data-testid="field/lookup_secret_codes/text"]').then(($e) => {
+          recoveryCodes = $e.text().trim().split(", ")
+        })
+        cy.get('*[data-testid="field/lookup_secret_confirm/true"]').click()
+        cy.expectSettingsSaved()
+
+        // Lets sign in with TOTP
+        cy.visit(MOBILE_URL + "/Login?aal=aal2&refresh=true")
+        cy.get('*[data-testid="field/totp_code"]').then(($e) => {
+          cy.wrap($e).type(
+            new TOTP({
+              secret: totpSecret,
+            }).generate(),
+          )
+        })
+        cy.get('*[data-testid="field/method/totp"]').click()
+
+        // We have AAL now
+        cy.get('[data-testid="session-content"]').should("contain", "aal2")
+        cy.get('[data-testid="session-content"]').should("contain", "totp")
+
+        // Lets sign in with lookup secret
+        cy.visit(MOBILE_URL + "/Login?aal=aal2&refresh=true")
+        cy.get('*[data-testid="field/lookup_secret"]').then(($e) => {
+          cy.wrap($e).type(recoveryCodes[0])
+        })
+        cy.get('*[data-testid="field/method/lookup_secret"]').click()
+
+        // We have AAL now
+        cy.get('[data-testid="session-content"]').should("contain", "aal2")
+        cy.get('[data-testid="session-content"]').should("contain", "totp")
+        cy.get('[data-testid="session-content"]').should(
+          "contain",
+          "lookup_secret",
+        )
+      })
+    })
+  })
+})

test/e2e/cypress/integration/profiles/mobile/mfa/totp.spec.ts

@@ -0,0 +1,103 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { gen, MOBILE_URL, website } from "../../../../helpers"
+import { TOTP } from "otpauth"
+
+context("Mobile Profile", () => {
+  describe("TOTP 2FA Flow", () => {
+    before(() => {
+      cy.useConfigProfile("mobile")
+    })
+
+    describe("password", () => {
+      let email = gen.email()
+      let password = gen.password()
+
+      before(() => {
+        cy.clearAllCookies()
+      })
+
+      beforeEach(() => {
+        email = gen.email()
+        password = gen.password()
+
+        cy.registerApi({
+          email,
+          password,
+          fields: { "traits.website": website },
+        })
+        cy.loginMobile({ email, password })
+        cy.visit(MOBILE_URL + "/Settings")
+      })
+
+      it("should be able to lifecycle through TOTP flows", () => {
+        cy.get('*[data-testid="field/totp_qr"]').should("exist")
+        cy.get('*[data-testid="field/totp_code"]').should("exist")
+
+        // Set up TOTP with invalid key
+        cy.get('*[data-testid="field/totp_code"]').type("111111")
+        cy.get('*[data-testid="field/method/totp"]').click()
+        cy.get('*[data-testid="field/totp_code"]').should(
+          "contain.text",
+          "The provided authentication code is invalid, please try again.",
+        )
+
+        // Set up TOTP with valid key
+        let secret
+        cy.get('*[data-testid="field/totp_secret_key/text"]').then(($e) => {
+          secret = $e.text().trim()
+        })
+        cy.get('*[data-testid="field/totp_code"]').then(($e) => {
+          cy.wrap($e).type(
+            new TOTP({
+              secret,
+            }).generate(),
+          )
+        })
+        cy.get('*[data-testid="field/method/totp"]').click()
+        cy.expectSettingsSaved()
+
+        // Form should look different now
+        cy.get('*[data-testid="field/totp_secret_key/text"]').should(
+          "not.exist",
+        )
+        cy.get('*[data-testid="field/totp_code"]').should("not.exist")
+        cy.get('*[data-testid="field/totp_qr"]').should("not.exist")
+        cy.get('*[data-testid="field/totp_unlink/true"]').should("exist")
+
+        // Lets sign in
+        cy.visit(MOBILE_URL + "/Login?aal=aal2&refresh=true")
+
+        // First use a wrong code
+        cy.get('*[data-testid="field/totp_code"]').type("111111")
+        cy.get('*[data-testid="field/method/totp"]').click()
+        cy.get('*[data-testid="form-messages"]').should(
+          "contain.text",
+          "The provided authentication code is invalid, please try again.",
+        )
+
+        // Use the correct code
+        cy.get('*[data-testid="field/totp_code"]').then(($e) => {
+          cy.wrap($e).type(
+            new TOTP({
+              secret,
+            }).generate(),
+          )
+        })
+        cy.get('*[data-testid="field/method/totp"]').click()
+
+        // We have AAL now
+        cy.get('[data-testid="session-content"]').should("contain", "aal2")
+        cy.get('[data-testid="session-content"]').should("contain", "totp")
+
+        // Go back to settings and unlink
+        cy.visit(MOBILE_URL + "/Settings")
+        cy.get('*[data-testid="field/totp_unlink/true"]').click()
+        cy.get('*[data-testid="field/totp_unlink/true"]').should("not.exist")
+        cy.get('*[data-testid="field/totp_qr"]').should("exist")
+        cy.get('*[data-testid="field/totp_code"]').should("exist")
+      })
+    })
+  })
+})

test/e2e/cypress/integration/profiles/mobile/passkey/flows.spec.ts

@@ -0,0 +1,172 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { gen, MOBILE_URL, website } from "../../../../helpers"
+
+const signupMobilePasskey = (email = gen.email()) => {
+  cy.visit(MOBILE_URL + "/Registration")
+  cy.get('input[data-testid="traits.email"]').type(email)
+  cy.get('input[data-testid="traits.website"]').type(website)
+  cy.get('[data-testid="passkey-button"]').click()
+
+  cy.wait(1000)
+
+  cy.get('[data-testid="session-content"]').should("contain", email)
+  cy.get('[data-testid="session-token"]').should("not.be.empty")
+  return cy.wrap(email)
+}
+
+// The RN app stores the session token in localStorage (AsyncStorage on web).
+// cy.clearAllCookies() alone does not clear it, so login flows fail with a
+// stale token. This helper clears both cookies and localStorage.
+const clearMobileSession = () => {
+  cy.clearAllCookies()
+  cy.window().then((win) => win.localStorage.clear())
+}
+
+// Logout via the RN app's logout button which clears the stored session.
+const logoutMobile = () => {
+  cy.get('*[data-testid="logout"]').click()
+  cy.get('input[data-testid="identifier"]').should("exist")
+}
+
+context("Mobile Profile", () => {
+  describe("Passkey Flows", () => {
+    let authenticator: any
+
+    before(() => {
+      cy.task("resetCRI", {})
+      cy.useConfigProfile("passkey")
+
+      cy.task("sendCRI", {
+        query: "WebAuthn.enable",
+        opts: {},
+      })
+        .then(() => {
+          cy.task("sendCRI", {
+            query: "WebAuthn.addVirtualAuthenticator",
+            opts: {
+              options: {
+                protocol: "ctap2",
+                transport: "internal",
+                hasResidentKey: true,
+                hasUserVerification: true,
+                isUserVerified: true,
+              },
+            },
+          })
+        })
+        .then((result) => {
+          authenticator = result
+          cy.log("authenticator ID:", authenticator)
+        })
+
+      cy.longPrivilegedSessionTime()
+    })
+
+    beforeEach(() => {
+      clearMobileSession()
+      cy.task("sendCRI", {
+        query: "WebAuthn.clearCredentials",
+        opts: authenticator,
+      })
+    })
+
+    after(() => {
+      cy.task("sendCRI", {
+        query: "WebAuthn.removeVirtualAuthenticator",
+        opts: authenticator,
+      }).then(() => {
+        cy.task("resetCRI", {})
+      })
+    })
+
+    it("should register with passkey", () => {
+      const email = gen.email()
+      signupMobilePasskey(email)
+    })
+
+    it("should login with passkey after registration", () => {
+      const email = gen.email()
+      signupMobilePasskey(email).then((registeredEmail) => {
+        logoutMobile()
+        cy.visit(MOBILE_URL + "/Login")
+
+        cy.get('[data-testid="passkey-button"]').click()
+        cy.wait(1000)
+
+        cy.get('[data-testid="session-content"]').should(
+          "contain",
+          registeredEmail,
+        )
+        cy.get('[data-testid="session-token"]').should("not.be.empty")
+      })
+    })
+
+    it("should add passkey in settings after password registration", () => {
+      const email = gen.email()
+      const password = gen.password()
+
+      cy.registerApi({
+        email,
+        password,
+        fields: { "traits.website": website },
+      })
+      cy.loginMobile({ email, password })
+      cy.visit(MOBILE_URL + "/Settings")
+
+      cy.get(
+        '*[data-testid="settings-passkey"] [data-testid="passkey-button"]',
+      ).click()
+      cy.wait(1000)
+      cy.expectSettingsSaved()
+    })
+
+    it("should not be able to unlink last passkey", () => {
+      signupMobilePasskey().then(() => {
+        cy.visit(MOBILE_URL + "/Settings")
+        // React Native Web renders disabled as aria-disabled on TouchableOpacity
+        cy.get('[data-testid^="passkey-remove-"]').should(
+          "have.attr",
+          "aria-disabled",
+          "true",
+        )
+      })
+    })
+
+    it("should be able to link password then remove passkey", () => {
+      const email = gen.email()
+      const password = gen.password()
+
+      signupMobilePasskey(email).then(() => {
+        cy.visit(MOBILE_URL + "/Settings")
+
+        // Add a password
+        cy.get(
+          '*[data-testid="settings-password"] input[data-testid="password"]',
+        )
+          .clear()
+          .type(password)
+        cy.get(
+          '*[data-testid="settings-password"] div[data-testid="submit-form"]',
+        ).click()
+        cy.expectSettingsSaved()
+
+        // Now passkey remove should be enabled
+        cy.get('[data-testid^="passkey-remove-"]').should(
+          "not.have.attr",
+          "aria-disabled",
+          "true",
+        )
+        cy.get('[data-testid^="passkey-remove-"]').click()
+        cy.expectSettingsSaved()
+
+        // Logout and login with password
+        logoutMobile()
+        cy.loginMobile({ email, password })
+        cy.get('[data-testid="session-content"]').should("contain", email)
+        cy.get('[data-testid="session-token"]').should("not.be.empty")
+      })
+    })
+  })
+})

test/e2e/cypress/integration/profiles/mobile/registration/errors.spec.ts

@@ -0,0 +1,112 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { gen, MOBILE_URL, website } from "../../../../helpers"
+
+context("Mobile Profile", () => {
+  describe("Registration Flow Errors", () => {
+    before(() => {
+      cy.useConfigProfile("mobile")
+    })
+
+    beforeEach(() => {
+      cy.visit(MOBILE_URL + "/Registration")
+    })
+
+    const email = gen.email()
+    const password = gen.password()
+
+    describe("show errors when invalid signup data is used", () => {
+      it("should show an error when the password has leaked before", () => {
+        cy.get('input[data-testid="traits.email"]').type(email)
+        cy.get('input[data-testid="password"]').type("12345678")
+        cy.get('input[data-testid="traits.website"]').type(website)
+        cy.get(
+          'div[data-testid="field/method/password"] div[data-testid="submit-form"]',
+        ).click()
+
+        cy.get('*[data-testid="field/password"]').should(
+          "contain.text",
+          "data breaches",
+        )
+      })
+
+      it("should show an error when the password is too similar", () => {
+        cy.get('input[data-testid="traits.email"]').type(email)
+        cy.get('input[data-testid="password"]').type(email)
+        cy.get('input[data-testid="traits.website"]').type(website)
+        cy.get(
+          'div[data-testid="field/method/password"] div[data-testid="submit-form"]',
+        ).click()
+
+        cy.get('*[data-testid="field/password"]').should(
+          "contain.text",
+          "too similar",
+        )
+      })
+
+      it("should show an error when the password is empty", () => {
+        cy.get('input[data-testid="traits.website"]').type(website)
+        cy.get('input[data-testid="traits.email"]').type(email)
+
+        cy.get(
+          'div[data-testid="field/method/password"] div[data-testid="submit-form"]',
+        ).click()
+        cy.get('*[data-testid="field/password"]').should(
+          "contain.text",
+          "Property password is missing",
+        )
+      })
+
+      it("should show an error when the email is empty", () => {
+        cy.get('input[data-testid="traits.website"]').type("https://www.ory.sh")
+        cy.get('input[data-testid="password"]').type(password)
+
+        cy.get(
+          'div[data-testid="field/method/password"] div[data-testid="submit-form"]',
+        ).click()
+        cy.get('*[data-testid="field/traits.email"]').should(
+          "contain.text",
+          "Property email is missing",
+        )
+      })
+
+      it("should show an error when the email is not an email", () => {
+        cy.get('input[data-testid="traits.website"]').type("https://www.ory.sh")
+        cy.get('input[data-testid="traits.email"]').type("not-an-email")
+        cy.get('input[data-testid="password"]').type(password)
+
+        cy.get(
+          'div[data-testid="field/method/password"] div[data-testid="submit-form"]',
+        ).click()
+        cy.get('*[data-testid="field/traits.email"]').should(
+          "contain.text",
+          "Enter a valid email address",
+        )
+      })
+
+      it("should show a missing indicator if no fields are set", () => {
+        cy.get(
+          'div[data-testid="field/method/password"] div[data-testid="submit-form"]',
+        ).click()
+        cy.get('*[data-testid="field/password"]').should(
+          "contain.text",
+          "Property password is missing",
+        )
+      })
+
+      it("should show an error when the website is too short", () => {
+        cy.get('input[data-testid="traits.website"]').type("http://s")
+        cy.get('input[data-testid="traits.email"]').type(email)
+
+        cy.get(
+          'div[data-testid="field/method/password"] div[data-testid="submit-form"]',
+        ).click()
+        cy.get('*[data-testid="field/traits.website"]').should(
+          "contain.text",
+          "length must be >= 10",
+        )
+      })
+    })
+  })
+})

test/e2e/cypress/integration/profiles/mobile/registration/success.spec.ts

@@ -0,0 +1,89 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { gen, MOBILE_URL, website } from "../../../../helpers"
+import { testFlowWebhook } from "../../../../helpers/webhook"
+
+context("Mobile Profile", () => {
+  describe("Login Flow Success", () => {
+    before(() => {
+      cy.useConfigProfile("mobile")
+    })
+
+    beforeEach(() => {
+      cy.deleteMail()
+      cy.visit(MOBILE_URL + "/Registration")
+    })
+
+    it("should sign up and be logged in", () => {
+      const email = gen.email()
+      const password = gen.password()
+
+      cy.get('input[data-testid="traits.email"]').type(email)
+      cy.get('input[data-testid="password"]').type(password)
+      cy.get('input[data-testid="traits.website"]').type(website)
+      cy.get(
+        'div[data-testid="field/method/password"] div[data-testid="submit-form"]',
+      ).click()
+
+      cy.get('[data-testid="session-content"]').should("contain", email)
+      cy.get('[data-testid="session-token"]').should("not.be.empty")
+    })
+
+    it("should pass transient_payload to webhook", () => {
+      testFlowWebhook(
+        (hooks) =>
+          cy.setupHooks("registration", "after", "password", [
+            ...hooks,
+            { hook: "session" },
+          ]),
+        () => {
+          const email = gen.email()
+          const password = gen.password()
+
+          cy.get('input[data-testid="traits.email"]').type(email)
+          cy.get('input[data-testid="password"]').type(password)
+          cy.get('input[data-testid="traits.website"]').type(website)
+          cy.get(
+            'div[data-testid="field/method/password"] div[data-testid="submit-form"]',
+          ).click()
+
+          cy.get('[data-testid="session-content"]').should("contain", email)
+          cy.get('[data-testid="session-token"]').should("not.be.empty")
+        },
+      )
+    })
+
+    it("should sign up and show verification form", () => {
+      cy.enableVerification()
+      const email = gen.email()
+      const password = gen.password()
+
+      cy.get('input[data-testid="traits.email"]').type(email)
+      cy.get('input[data-testid="password"]').type(password)
+      cy.get('input[data-testid="traits.website"]').type(website)
+      cy.get(
+        'div[data-testid="field/method/password"] div[data-testid="submit-form"]',
+      ).click()
+
+      cy.get('div[data-testid="field/code"] input').should("be.visible")
+
+      cy.getVerificationCodeFromEmail(email).then((code) => {
+        cy.get('div[data-testid="field/code"] input').type(code)
+        cy.get(
+          'div[data-testid="field/method/code"] div[data-testid=submit-form]',
+        ).click()
+      })
+
+      cy.get('[data-testid="ui/message/1080002"]').should(
+        "have.text",
+        "You successfully verified your email address.",
+      )
+
+      cy.get("div[data-testid=continue-button]").click()
+
+      cy.get('[data-testid="session-content"]').should("contain", email)
+      cy.get('[data-testid="session-token"]').should("not.be.empty")
+    })
+  })
+})

test/e2e/cypress/integration/profiles/mobile/settings/errors.spec.ts

@@ -0,0 +1,49 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { gen, MOBILE_URL, website } from "../../../../helpers"
+
+context("Mobile Profile", () => {
+  describe("Settings Flow Errors", () => {
+    before(() => {
+      cy.useConfigProfile("mobile")
+    })
+
+    let email, password
+
+    before(() => {
+      email = gen.email()
+      password = gen.password()
+      cy.registerApi({ email, password, fields: { "traits.website": website } })
+    })
+
+    beforeEach(() => {
+      cy.loginMobile({ email, password })
+      cy.visit(MOBILE_URL + "/Settings")
+    })
+
+    describe("profile", () => {
+      it("fails with validation errors", () => {
+        cy.get(
+          '*[data-testid="settings-profile"] input[data-testid="traits.website"]',
+        )
+          .clear()
+          .type("http://s")
+        cy.get(
+          '*[data-testid="settings-profile"] div[data-testid="submit-form"]',
+        ).click()
+
+        cy.get(
+          '*[data-testid="settings-profile"] div[data-testid="submit-form"]',
+        ).should("not.have.attr", "data-focusable", "false")
+
+        cy.get('*[data-testid="field/traits.website"]').should(
+          "contain.text",
+          "length must be >= 10",
+        )
+
+        cy.get('*[data-testid="settings-password"]').should("exist")
+      })
+    })
+  })
+})

test/e2e/cypress/integration/profiles/mobile/settings/oidc.spec.ts

@@ -0,0 +1,99 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { gen, KRATOS_ADMIN, MOBILE_URL, website } from "../../../../helpers"
+
+context("Mobile OIDC Settings", () => {
+  before(() => {
+    cy.useConfigProfile("mobile")
+  })
+
+  describe("link buttons", () => {
+    const email = gen.email()
+    const password = gen.password()
+
+    before(() => {
+      cy.registerApi({
+        email,
+        password,
+        fields: { "traits.website": website },
+      })
+    })
+
+    beforeEach(() => {
+      cy.clearAllCookies()
+      cy.loginMobile({ email, password })
+      cy.visit(MOBILE_URL + "/Settings")
+    })
+
+    it("should show link buttons for unlinked providers", () => {
+      cy.get('[data-testid="settings-oidc"]').should("exist")
+      cy.get('[data-testid="settings-oidc"]').within(() => {
+        cy.get('[data-testid="field/link/hydra"]').should("exist")
+        cy.get('[data-testid="field/link/google"]').should("exist")
+        cy.get('[data-testid="field/link/github"]').should("exist")
+      })
+    })
+  })
+
+  describe("unlink", () => {
+    let email: string
+    let password: string
+
+    beforeEach(() => {
+      email = gen.email()
+      password = gen.password()
+
+      // Create an identity with both password and OIDC credentials via Admin API
+      cy.request({
+        method: "POST",
+        url: KRATOS_ADMIN + "/admin/identities",
+        body: {
+          schema_id: "default",
+          traits: { email, website },
+          credentials: {
+            password: { config: { password } },
+            oidc: {
+              config: {
+                providers: [
+                  {
+                    provider: "hydra",
+                    subject: email,
+                  },
+                ],
+              },
+            },
+          },
+        },
+      })
+
+      cy.clearAllCookies()
+      cy.loginMobile({ email, password })
+      cy.visit(MOBILE_URL + "/Settings")
+    })
+
+    it("should show unlink button for linked provider", () => {
+      cy.get('[data-testid="settings-oidc"]').should("exist")
+      cy.get('[data-testid="settings-oidc"]').within(() => {
+        cy.get('[data-testid="field/unlink/hydra"]').should("exist")
+        cy.get('[data-testid="field/link/google"]').should("exist")
+        cy.get('[data-testid="field/link/github"]').should("exist")
+      })
+    })
+
+    it("should unlink a provider", () => {
+      cy.get('[data-testid="settings-oidc"]').within(() => {
+        cy.get('[data-testid="field/unlink/hydra"]').should("exist")
+        cy.get('[data-testid="field/unlink/hydra"]').click()
+      })
+
+      cy.expectSettingsSaved()
+
+      // After unlinking, the button should change to link
+      cy.get('[data-testid="settings-oidc"]').within(() => {
+        cy.get('[data-testid="field/link/hydra"]').should("exist")
+        cy.get('[data-testid="field/unlink/hydra"]').should("not.exist")
+      })
+    })
+  })
+})

test/e2e/cypress/integration/profiles/mobile/settings/success.spec.ts

@@ -0,0 +1,144 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { gen, MOBILE_URL, website } from "../../../../helpers"
+
+context("Mobile Profile", () => {
+  describe("Login Flow Success", () => {
+    before(() => {
+      cy.useConfigProfile("mobile")
+    })
+
+    const up = (value) => `not-${value}`
+
+    describe("password", () => {
+      const email = gen.email()
+      const password = gen.password()
+
+      before(() => {
+        cy.registerApi({
+          email,
+          password,
+          fields: { "traits.website": website },
+        })
+      })
+
+      beforeEach(() => {
+        cy.clearAllCookies()
+        cy.loginMobile({ email, password })
+        cy.visit(MOBILE_URL + "/Settings")
+      })
+
+      it("modifies the password", () => {
+        const newPassword = up(password)
+        cy.get(
+          '*[data-testid="settings-password"] input[data-testid="password"]',
+        )
+          .clear()
+          .type(newPassword)
+        cy.get(
+          '*[data-testid="settings-password"] div[data-testid="submit-form"]',
+        ).click()
+        cy.expectSettingsSaved()
+
+        cy.get(
+          '*[data-testid="settings-password"] div[data-testid="submit-form"]',
+        ).should("not.have.attr", "data-focusable", "false")
+        cy.get('*[data-testid="logout"]').click()
+        cy.get('input[data-testid="identifier"]').should("exist")
+
+        cy.loginMobile({ email, password })
+        cy.get('[data-testid="session-token"]').should("not.exist")
+        cy.loginMobile({ email, password: newPassword })
+        cy.get('[data-testid="session-token"]').should("not.be.empty")
+      })
+    })
+
+    describe("profile", () => {
+      let email: string
+      let password: string
+
+      beforeEach(() => {
+        cy.deleteMail()
+        email = gen.email()
+        password = gen.password()
+        cy.registerApi({
+          email,
+          password,
+          fields: { "traits.website": website },
+        })
+        cy.loginMobile({ email, password })
+        cy.location("pathname").should("not.contain", "/Login")
+        cy.visit(MOBILE_URL + "/Settings")
+      })
+
+      it("modifies an unprotected trait", () => {
+        cy.get(
+          '*[data-testid="settings-profile"] input[data-testid="traits.website"]',
+        )
+          .clear()
+          .type("https://github.com/ory")
+        cy.get(
+          '*[data-testid="settings-profile"] div[data-testid="submit-form"]',
+        ).click()
+        cy.get(
+          '*[data-testid="settings-profile"] div[data-testid="submit-form"]',
+        ).should("not.have.attr", "data-focusable", "false")
+
+        cy.visit(MOBILE_URL + "/Home")
+        cy.get('[data-testid="session-content"]').should(
+          "contain",
+          "https://github.com/ory",
+        )
+      })
+
+      it("modifies a protected trait", () => {
+        const newEmail = up(email)
+        cy.get(
+          '*[data-testid="settings-profile"] input[data-testid="traits.email"]',
+        )
+          .clear()
+          .type(newEmail)
+        cy.get(
+          '*[data-testid="settings-profile"] div[data-testid="submit-form"]',
+        ).click()
+        cy.get(
+          '*[data-testid="settings-profile"] div[data-testid="submit-form"]',
+        ).should("not.have.attr", "data-focusable", "false")
+
+        cy.visit(MOBILE_URL + "/Home")
+        cy.get('[data-testid="session-content"]').should("contain", newEmail)
+      })
+
+      it("shows verification screen after email update", () => {
+        cy.enableVerification()
+        const newEmail = up(email)
+        cy.get(
+          '*[data-testid="settings-profile"] input[data-testid="traits.email"]',
+        )
+          .clear()
+          .type(newEmail)
+        cy.get(
+          '*[data-testid="settings-profile"] div[data-testid="submit-form"]',
+        ).click()
+        cy.get(
+          '*[data-testid="settings-profile"] div[data-testid="submit-form"]',
+        ).should("not.have.attr", "data-focusable", "false")
+
+        cy.get('div[data-testid="field/code"] input').should("be.visible")
+
+        cy.getVerificationCodeFromEmail(newEmail).then((code) => {
+          cy.get('div[data-testid="field/code"] input').type(code)
+          cy.get(
+            'div[data-testid="field/method/code"] div[data-testid=submit-form]',
+          ).click()
+        })
+
+        cy.get('[data-testid="ui/message/1080002"]').should(
+          "have.text",
+          "You successfully verified your email address.",
+        )
+      })
+    })
+  })
+})