snapshot of https://github.com/ory/kratos.git (master, 2026-09-15; blobs > 131072B omitted)

test/e2e/cypress/integration/profiles/oidc/login/error.spec.ts

@@ -0,0 +1,96 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { appPrefix, gen, website } from "../../../../helpers"
+import { routes as react } from "../../../../helpers/react"
+import { routes as express } from "../../../../helpers/express"
+
+context("Social Sign In Errors", () => {
+  ;[
+    {
+      login: react.login,
+      app: "react" as "react",
+      profile: "spa",
+    },
+    {
+      login: express.login,
+      app: "express" as "express",
+      profile: "oidc",
+    },
+  ].forEach(({ login, profile, app }) => {
+    describe(`for app ${app}`, () => {
+      before(() => {
+        cy.useConfigProfile(profile)
+        cy.proxy(app)
+      })
+
+      beforeEach(() => {
+        cy.clearAllCookies()
+        cy.visit(login)
+      })
+
+      // playwright:migrated
+      it("should fail when the login request is rejected", () => {
+        cy.triggerOidc(app)
+        cy.get("#reject").click()
+        cy.location("pathname").should("equal", "/login")
+        cy.get(appPrefix(app) + '[data-testid="ui/message/4000001"]').should(
+          "contain.text",
+          "login rejected request",
+        )
+        cy.noSession()
+      })
+
+      // playwright:migrated
+      it("should fail when the consent request is rejected", () => {
+        const email = gen.email()
+        cy.triggerOidc(app)
+        cy.get("#username").type(email)
+        cy.get("#accept").click()
+        cy.get("#reject").click()
+        cy.location("pathname").should("equal", "/login")
+        cy.get('[data-testid="ui/message/4000001"]').should(
+          "contain.text",
+          "consent rejected request",
+        )
+        cy.noSession()
+      })
+
+      it("should fail when the id_token is missing", () => {
+        const email = gen.email()
+        cy.triggerOidc(app)
+        cy.get("#username").type(email)
+        cy.get("#accept").click()
+        cy.get("#website").type(website)
+        cy.get("#accept").click()
+        cy.location("pathname").should("equal", "/login")
+        cy.get('[data-testid="ui/message/4000001"]').should(
+          "contain.text",
+          "no id_token",
+        )
+      })
+
+      it("should fail to convert a sign in flow to a sign up flow when registration is disabled", () => {
+        cy.disableRegistration()
+
+        const email = gen.email()
+        cy.visit(login)
+        cy.triggerOidc(app)
+
+        cy.get("#username").clear().type(email)
+        cy.get("#remember").click()
+        cy.get("#accept").click()
+        cy.get('[name="scope"]').each(($el) => cy.wrap($el).click())
+        cy.get("#remember").click()
+        cy.get("#accept").click()
+
+        cy.get('[data-testid="ui/message/4000001"]').should(
+          "contain.text",
+          "Registration is not allowed because it was disabled",
+        )
+
+        cy.noSession()
+      })
+    })
+  })
+})

test/e2e/cypress/integration/profiles/oidc/login/success.spec.ts

@@ -0,0 +1,128 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+import { appPrefix, gen, website } from "../../../../helpers"
+import { routes as express } from "../../../../helpers/express"
+import { routes as react } from "../../../../helpers/react"
+
+context("Social Sign In Successes", () => {
+  ;[
+    {
+      login: react.login,
+      registration: react.registration,
+      settings: react.settings,
+      app: "react" as "react",
+      profile: "spa",
+    },
+    {
+      login: express.login,
+      registration: express.registration,
+      settings: express.settings,
+      app: "express" as "express",
+      profile: "oidc",
+    },
+  ].forEach(({ login, registration, profile, app, settings }) => {
+    describe(`for app ${app}`, () => {
+      before(() => {
+        cy.useConfigProfile(profile)
+        cy.proxy(app)
+      })
+
+      beforeEach(() => {
+        cy.clearAllCookies()
+      })
+
+      // playwright:migrated
+      it("should be able to sign up, sign out, and then sign in", () => {
+        const email = gen.email()
+        cy.registerOidc({ app, email, website, route: registration })
+        cy.logout()
+        cy.noSession()
+        cy.loginOidc({ app, url: login })
+      })
+
+      it("should be able to sign up and link existing account", () => {
+        const email = gen.email()
+        const password = gen.password()
+
+        // Create a new account
+        cy.registerApi({
+          email,
+          password,
+          fields: { "traits.website": website },
+        })
+
+        // Try to log in with the same identifier through OIDC. This should fail and create a new login flow.
+        cy.registerOidc({
+          app,
+          email,
+          website,
+          expectSession: false,
+        })
+        cy.noSession()
+
+        // Log in with the same identifier through the login flow. This should link the accounts.
+        cy.get('input[name="password"]').type(password)
+        cy.submitPasswordForm()
+        cy.location("pathname").should("not.contain", "/login")
+        cy.getSession()
+
+        // Hydra OIDC should now be linked
+        cy.visit(settings)
+        cy.get('[value="hydra"]')
+          .should("have.attr", "name", "unlink")
+          .should("contain.text", "Unlink Ory")
+      })
+
+      it("should be able to sign up with redirects", () => {
+        const email = gen.email()
+        cy.registerOidc({
+          app,
+          email,
+          website,
+          route: registration + "?return_to=https://www.example.org/",
+        })
+        cy.location("href").should("eq", "https://www.example.org/")
+        cy.logout()
+        cy.noSession()
+        cy.loginOidc({
+          app,
+          url: login + "?return_to=https://www.example.org/",
+        })
+        cy.location("href").should("eq", "https://www.example.org/")
+      })
+
+      it("should be able to log in with upstream parameters", () => {
+        const email = gen.email()
+        cy.registerOidc({
+          app,
+          email,
+          website,
+          route: registration + "?return_to=https://www.example.org/",
+        })
+
+        cy.location("href").should("eq", "https://www.example.org/")
+        cy.logout()
+        cy.noSession()
+        cy.intercept("GET", "**/oauth2/auth*").as("getHydraLogin")
+        cy.loginOidc({
+          app,
+          url: login + "?return_to=https://www.example.org/",
+          preTriggerHook: () => {
+            // Inject hd and login_hint into upstream_parameters. hd is
+            // forwarded; login_hint is never forwarded because a caller-supplied
+            // value cannot be trusted (HackerOne #3239672, ory-corp/cloud#8955).
+            cy.addInputElement("form", "upstream_parameters.hd", "ory.sh")
+            cy.addInputElement("form", "upstream_parameters.login_hint", email)
+          },
+        })
+        // once a request to getHydraLogin responds, 'cy.wait' will resolve
+        cy.wait("@getHydraLogin")
+          .its("request.url")
+          .should("include", "hd=ory.sh")
+          .and("not.include", "login_hint")
+
+        cy.location("href").should("eq", "https://www.example.org/")
+      })
+    })
+  })
+})

test/e2e/cypress/integration/profiles/oidc/logout/success.spec.ts

@@ -0,0 +1,55 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { appPrefix, gen, website } from "../../../../helpers"
+import { routes as react } from "../../../../helpers/react"
+import { routes as express } from "../../../../helpers/express"
+
+context("Social Sign Out Successes", () => {
+  ;[
+    {
+      base: react.base,
+      registration: react.registration,
+      app: "react" as "react",
+      profile: "spa",
+    },
+    {
+      base: express.base,
+      registration: express.registration,
+      app: "express" as "express",
+      profile: "oidc",
+    },
+  ].forEach(({ base, registration, profile, app }) => {
+    describe(`for app ${app}`, () => {
+      before(() => {
+        cy.useConfigProfile(profile)
+        cy.proxy(app)
+      })
+
+      before(() => {
+        cy.clearAllCookies()
+      })
+
+      beforeEach(() => {
+        cy.visit(base)
+        const email = gen.email()
+        cy.registerOidc({ app, email, website, route: registration })
+      })
+
+      // playwright:migrated
+      it("should sign out and be able to sign in again", () => {
+        if (app === "express") {
+          cy.get(
+            `${appPrefix(app)} [data-testid="logout"] a:not(disabled)`,
+          ).click()
+        } else {
+          cy.get(
+            `${appPrefix(app)} [data-testid="logout"]:not(disabled)`,
+          ).click()
+        }
+        cy.noSession()
+        cy.url().should("include", "/login")
+      })
+    })
+  })
+})

test/e2e/cypress/integration/profiles/oidc/registration/error.spec.ts

@@ -0,0 +1,74 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { appPrefix, gen, website } from "../../../../helpers"
+import { routes as express } from "../../../../helpers/express"
+import { routes as react } from "../../../../helpers/react"
+
+context("Social Sign Up Errors", () => {
+  ;[
+    {
+      registration: react.registration,
+      app: "react" as "react",
+      profile: "spa",
+    },
+    {
+      registration: express.registration,
+      app: "express" as "express",
+      profile: "oidc",
+    },
+  ].forEach(({ registration, profile, app }) => {
+    describe(`for app ${app}`, () => {
+      before(() => {
+        cy.useConfigProfile(profile)
+        cy.proxy(app)
+      })
+
+      beforeEach(() => {
+        cy.clearAllCookies()
+        cy.visit(registration)
+      })
+
+      // playwright:migrated
+      it("should fail when the login request is rejected", () => {
+        cy.triggerOidc(app)
+        cy.get("#reject").click()
+        cy.location("pathname").should("equal", "/registration")
+        cy.get(appPrefix(app) + '[data-testid="ui/message/4000001"]').should(
+          "contain.text",
+          "login rejected request",
+        )
+        cy.noSession()
+      })
+
+      // playwright:migrated
+      it("should fail when the consent request is rejected", () => {
+        const email = gen.email()
+        cy.triggerOidc(app)
+        cy.get("#username").type(email)
+        cy.get("#accept").click()
+        cy.get("#reject").click()
+        cy.location("pathname").should("equal", "/registration")
+        cy.get('[data-testid="ui/message/4000001"]').should(
+          "contain.text",
+          "consent rejected request",
+        )
+        cy.noSession()
+      })
+
+      it("should fail when the id_token is missing", () => {
+        const email = gen.email()
+        cy.triggerOidc(app)
+        cy.get("#username").type(email)
+        cy.get("#accept").click()
+        cy.get("#website").type(website)
+        cy.get("#accept").click()
+        cy.location("pathname").should("equal", "/registration")
+        cy.get('[data-testid="ui/message/4000001"]').should(
+          "contain.text",
+          "no id_token",
+        )
+      })
+    })
+  })
+})

test/e2e/cypress/integration/profiles/oidc/registration/success.spec.ts

@@ -0,0 +1,274 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { appPrefix, gen, website } from "../../../../helpers"
+import { routes as express } from "../../../../helpers/express"
+import { routes as react } from "../../../../helpers/react"
+import { testFlowWebhook } from "../../../../helpers/webhook"
+
+context("Social Sign Up Successes", () => {
+  ;[
+    {
+      login: react.login,
+      registration: react.registration,
+      app: "react" as "react",
+      profile: "spa",
+    },
+    {
+      login: express.login,
+      registration: express.registration,
+      app: "express" as "express",
+      profile: "oidc",
+    },
+  ].forEach(({ registration, login, profile, app }) => {
+    describe(`for app ${app}`, () => {
+      before(() => {
+        cy.useConfigProfile(profile)
+        cy.proxy(app)
+      })
+
+      beforeEach(() => {
+        cy.clearAllCookies()
+        cy.visit(registration)
+        cy.setIdentitySchema(
+          "file://test/e2e/profiles/oidc/identity.traits.schema.json",
+        )
+      })
+
+      const shouldSession = (email) => (session) => {
+        const { identity } = session
+        expect(identity.id).to.not.be.empty
+        expect(identity.traits.website).to.equal(website)
+        expect(identity.traits.email).to.equal(email)
+      }
+
+      it("should be able to sign up with incomplete data and finally be signed in", () => {
+        const email = gen.email()
+
+        cy.registerOidc({
+          app,
+          email,
+          expectSession: false,
+          route: registration,
+        })
+
+        cy.get("#registration-password").should("not.exist")
+        cy.get(appPrefix(app) + '[name="traits.email"]').should(
+          "have.value",
+          email,
+        )
+        cy.get('[data-testid="ui/message/4000002"]').should(
+          "contain.text",
+          "Property website is missing",
+        )
+
+        cy.get('[name="traits.consent"][type="checkbox"]')
+          .siblings("label")
+          .click()
+        cy.get('[name="traits.newsletter"][type="checkbox"]')
+          .siblings("label")
+          .click()
+        cy.get('[name="traits.website"]').type("http://s")
+
+        cy.get('[name="provider"]')
+          .should("have.length", 1)
+          .should("have.value", "hydra")
+          .should("contain.text", "Continue")
+          .click()
+
+        cy.get("#registration-password").should("not.exist")
+        cy.get('[name="traits.email"]').should("have.value", email)
+        cy.get('[name="traits.website"]').should("have.value", "http://s")
+        cy.get('[data-testid="ui/message/4000003"]').should(
+          "contain.text",
+          "length must be >= 10",
+        )
+        cy.get('[name="traits.website"]')
+          .should("have.value", "http://s")
+          .clear()
+          .type(website)
+
+        cy.get('[name="traits.consent"]').should("be.checked")
+        cy.get('[name="traits.newsletter"]').should("be.checked")
+
+        cy.triggerOidc(app)
+
+        cy.location("pathname").should((loc) => {
+          expect(loc).to.be.oneOf(["/welcome", "/", "/sessions"])
+        })
+
+        cy.getSession().should((session) => {
+          shouldSession(email)(session)
+          expect(session.identity.traits.consent).to.equal(true)
+        })
+      })
+
+      it("should pass transient_payload to webhook", () => {
+        testFlowWebhook(
+          (hooks) =>
+            cy.setupHooks("registration", "after", "oidc", [
+              ...hooks,
+              { hook: "session" },
+            ]),
+          () => {
+            const email = gen.email()
+            cy.registerOidc({
+              app,
+              email,
+              website,
+              route: registration,
+            })
+            cy.getSession().should(shouldSession(email))
+          },
+        )
+      })
+
+      // playwright:migrated
+      it("should be able to sign up with complete data", () => {
+        const email = gen.email()
+
+        cy.registerOidc({ app, email, website, route: registration })
+        cy.getSession().should(shouldSession(email))
+      })
+
+      it("should be able to convert a sign up flow to a sign in flow", () => {
+        const email = gen.email()
+
+        cy.registerOidc({ app, email, website, route: registration })
+        cy.logout()
+        cy.noSession()
+        cy.visit(registration)
+        cy.triggerOidc(app)
+
+        cy.location("pathname").should((path) => {
+          expect(path).to.oneOf(["/", "/welcome", "/sessions"])
+        })
+
+        cy.getSession().should(shouldSession(email))
+      })
+
+      it("should be able to convert a sign in flow to a sign up flow", () => {
+        cy.setIdentitySchema(
+          "file://test/e2e/profiles/oidc/identity-required.traits.schema.json",
+        )
+
+        const email = gen.email()
+        cy.visit(login)
+        cy.triggerOidc(app)
+
+        cy.get("#username").clear().type(email)
+        cy.get("#remember").click()
+        cy.get("#accept").click()
+        cy.get('[name="scope"]').each(($el) => cy.wrap($el).click())
+        cy.get("#remember").click()
+        cy.get("#accept").click()
+
+        cy.get('[data-testid="ui/message/4000002"]').should(
+          "contain.text",
+          "Property website is missing",
+        )
+        cy.get('[name="traits.website"]').type("http://s")
+
+        cy.triggerOidc(app)
+
+        cy.get('[data-testid="ui/message/4000003"]').should(
+          "contain.text",
+          "length must be >= 10",
+        )
+        cy.get('[name="traits.requirednested"]').should("not.exist")
+        cy.get('[name="traits.requirednested.a"]').siblings("label").click()
+        cy.get('[name="traits.consent"]').siblings("label").click()
+        cy.get('[name="traits.website"]')
+          .should("have.value", "http://s")
+          .clear()
+          .type(website)
+        cy.triggerOidc(app)
+
+        cy.location("pathname").should("not.contain", "/registration")
+
+        cy.getSession().should(shouldSession(email))
+      })
+
+      it("should be able to sign up with redirects", () => {
+        const email = gen.email()
+        cy.registerOidc({
+          app,
+          email,
+          website,
+          route: registration + "?return_to=https://www.example.org/",
+        })
+        cy.location("href").should("eq", "https://www.example.org/")
+        cy.logout()
+      })
+
+      it("should be able to register with upstream parameters", () => {
+        const email = gen.email()
+        cy.intercept("GET", "**/oauth2/auth*").as("getHydraRegistration")
+
+        cy.visit(registration + "?return_to=https://www.example.org/")
+
+        // hd is forwarded; login_hint is never forwarded because a
+        // caller-supplied value cannot be trusted (HackerOne #3239672,
+        // ory-corp/cloud#8955).
+        cy.addInputElement("form", "upstream_parameters.hd", "ory.sh")
+        cy.addInputElement("form", "upstream_parameters.login_hint", email)
+
+        cy.triggerOidc(app)
+
+        // once a request to getHydraRegistration responds, 'cy.wait' will resolve
+        cy.wait("@getHydraRegistration")
+          .its("request.url")
+          .should("include", "hd=ory.sh")
+          .and("not.include", "login_hint")
+      })
+
+      it("oidc registration with duplicate identifier should return new login flow with duplicate error", () => {
+        cy.visit(registration)
+
+        const email = gen.email()
+        const password = gen.password()
+
+        cy.get('input[name="traits.email"]').type(email)
+        cy.get('input[name="password"]').type(password)
+        cy.get('input[name="traits.website"]').type(website)
+        cy.get('[name="traits.consent"]').siblings("label").click()
+        cy.get('[name="traits.newsletter"]').siblings("label").click()
+
+        cy.submitPasswordForm()
+
+        cy.location("pathname").should("not.contain", "/registration")
+
+        cy.getSession().should(shouldSession(email))
+
+        cy.logout()
+        cy.noSession()
+
+        // register the account through the OIDC provider
+        cy.registerOidc({
+          app,
+          acceptConsent: true,
+          acceptLogin: true,
+          expectSession: false,
+          email,
+          website,
+          route: registration,
+        })
+
+        cy.get('[data-testid="ui/message/1010016"]').should("be.visible")
+
+        cy.location("href").should("contain", "/login")
+
+        cy.get("[name='provider'][value='google']").should("be.visible")
+        cy.get("[name='provider'][value='github']").should("be.visible")
+
+        if (app === "express") {
+          cy.get("[data-testid='forgot-password-link']").should("be.visible")
+        }
+
+        cy.get("input[name='password']").type(password)
+        cy.submitPasswordForm()
+        cy.getSession()
+      })
+    })
+  })
+})

test/e2e/cypress/integration/profiles/oidc/settings/error.spec.ts

@@ -0,0 +1,58 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { APP_URL, appPrefix, gen, website } from "../../../../helpers"
+import { routes as react } from "../../../../helpers/react"
+import { routes as express } from "../../../../helpers/express"
+
+context("Social Sign In Settings Errors", () => {
+  ;[
+    {
+      registration: react.registration,
+      settings: react.settings,
+      app: "react" as "react",
+      profile: "spa",
+    },
+    {
+      registration: express.registration,
+      settings: express.settings,
+      app: "express" as "express",
+      profile: "oidc",
+    },
+  ].forEach(({ registration, profile, app, settings }) => {
+    describe(`for app ${app}`, () => {
+      before(() => {
+        cy.useConfigProfile(profile)
+        cy.proxy(app)
+      })
+      let email
+
+      beforeEach(() => {
+        cy.clearAllCookies()
+        email = gen.email()
+
+        cy.registerOidc({
+          app,
+          email,
+          expectSession: true,
+          website,
+          route: registration,
+        })
+        cy.visit(settings)
+      })
+
+      describe("oidc", () => {
+        it("should fail to link google because id token is missing", () => {
+          cy.get(appPrefix(app) + 'button[value="google"]').click()
+          cy.get("#remember").click()
+          cy.get("#accept").click()
+
+          cy.get('[data-testid="ui/message/4000001"]').should(
+            "contain.text",
+            'Authentication failed because no id_token was returned. Please accept the "openid" permission and try again.',
+          )
+        })
+      })
+    })
+  })
+})

test/e2e/cypress/integration/profiles/oidc/settings/success.spec.ts

@@ -0,0 +1,252 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { appPrefix, gen, website } from "../../../../helpers"
+import { routes as express } from "../../../../helpers/express"
+import { routes as react } from "../../../../helpers/react"
+import { util } from "prettier"
+import skip = util.skip
+
+context("Social Sign In Settings Success", () => {
+  ;[
+    {
+      registration: react.registration,
+      settings: react.settings,
+      login: react.login,
+      app: "react" as "react",
+      profile: "spa",
+    },
+    {
+      registration: express.registration,
+      settings: express.settings,
+      login: express.login,
+      app: "express" as "express",
+      profile: "oidc",
+    },
+  ].forEach(({ registration, login, profile, app, settings }) => {
+    describe(`for app ${app}`, () => {
+      before(() => {
+        cy.useConfigProfile(profile)
+        cy.proxy(app)
+      })
+
+      let email
+
+      const hydraReauthFails = () => {
+        cy.clearAllCookies()
+        cy.visit(login)
+        cy.get(appPrefix(app) + '[value="hydra"]').click()
+
+        cy.get("#username").type(email)
+        cy.get("#remember").click()
+        cy.get("#accept").click()
+
+        cy.get('input[name="traits.website"]').clear().type(website)
+        cy.triggerOidc(app, "hydra")
+
+        cy.get('[data-testid="ui/message/1010016"]').should(
+          "contain.text",
+          "as another way to sign in.",
+        )
+
+        cy.noSession()
+      }
+
+      beforeEach(() => {
+        cy.clearAllCookies()
+        email = gen.email()
+
+        cy.registerOidc({
+          app,
+          email,
+          expectSession: true,
+          website,
+          route: registration,
+        })
+        cy.visit(settings)
+      })
+
+      describe("oidc", () => {
+        beforeEach(() => {
+          cy.useConfig((builder) =>
+            builder
+              .longRecoveryLifespan()
+              .longVerificationLifespan()
+              .longPrivilegedSessionTime(),
+          )
+        })
+
+        it("should show the correct options", () => {
+          cy.get('[value="hydra"]').should("not.exist")
+
+          cy.get('[value="google"]')
+            .should("have.attr", "name", "link")
+            .should("contain.text", "Link google")
+
+          cy.get('[value="github"]')
+            .should("have.attr", "name", "link")
+            .should("contain.text", "Link github")
+        })
+
+        it("should show the unlink once password is set", () => {
+          cy.get('[value="hydra"]').should("not.exist")
+
+          cy.get('input[name="password"]').type(gen.password())
+          cy.get('button[value="password"]').click()
+
+          cy.get('[value="hydra"]')
+            .should("have.attr", "name", "unlink")
+            .should("contain.text", "Unlink Ory")
+        })
+
+        it("should link google", () => {
+          cy.get('[value="google"]').click()
+
+          cy.get('input[name="scope"]').each(($el) => cy.wrap($el).click())
+          cy.get("#remember").click()
+          cy.get("#accept").click()
+
+          cy.visit(settings)
+
+          cy.get('[value="google"]')
+            .should("have.attr", "name", "unlink")
+            .should("contain.text", "Unlink google")
+
+          cy.logout()
+
+          cy.visit(login)
+
+          // we create an intercept for login so we make sure the login endpoint is called
+          cy.intercept("GET", "**/oauth2/auth*").as("login")
+
+          cy.get('[value="google"]').click()
+
+          // wait for the login endpoint to be called
+          cy.wait("@login")
+
+          // check the session
+          cy.getSession()
+        })
+
+        it("should link google after re-auth", () => {
+          cy.shortPrivilegedSessionTime()
+          cy.get('[value="google"]').click()
+          cy.location("pathname").should("equal", "/login")
+
+          cy.longPrivilegedSessionTime()
+          cy.get('[value="hydra"]').click()
+
+          // prompt=login means that we need to re-auth!
+          cy.get("#username").type(email)
+          cy.get("#accept").click()
+
+          // we re-authed, now we do the google oauth2 dance
+          cy.get("#username").type(gen.email())
+          cy.get("#accept").click()
+          cy.get('input[name="scope"]').each(($el) => cy.wrap($el).click())
+          cy.get("#accept").click()
+
+          cy.expectSettingsSaved()
+
+          cy.get('[value="google"]')
+            .should("have.attr", "name", "unlink")
+            .should("contain.text", "Unlink google")
+
+          cy.visit(settings)
+
+          cy.get('[value="google"]')
+            .should("have.attr", "name", "unlink")
+            .should("contain.text", "Unlink google")
+        })
+
+        it("should unlink hydra and no longer be able to sign in", () => {
+          if (app === "react") {
+            // This test is flaky on React, so we skip it for now.
+            return
+          }
+          cy.get('[value="hydra"]').should("not.exist")
+          cy.get('input[name="password"]').type(gen.password())
+          cy.get('[value="password"]').click()
+          cy.expectSettingsSaved()
+          cy.visit(settings)
+
+          cy.get('[value="hydra"]').click()
+
+          // It will no longer be possible to sign up with this provider because of a UNIQUE key violation
+          // because of the email verification table.
+          //
+          // Basically what needs to happen is for the user to use the LINK feature to link this account.
+          hydraReauthFails()
+        })
+
+        it("should unlink hydra after reauth", () => {
+          cy.get('[value="hydra"]').should("not.exist")
+
+          cy.get('input[name="password"]').type(gen.password())
+          cy.get('[value="password"]').click()
+          cy.expectSettingsSaved()
+          cy.visit(settings)
+
+          cy.shortPrivilegedSessionTime()
+          cy.get('[value="hydra"]').click()
+
+          cy.longPrivilegedSessionTime()
+          cy.location("pathname").should("equal", "/login")
+          cy.get('[value="hydra"]').click()
+
+          // prompt=login means that we need to re-auth!
+          cy.get("#username").type(email)
+          cy.get("#accept").click()
+          cy.expectSettingsSaved()
+
+          hydraReauthFails()
+        })
+
+        it("should show only linked providers during reauth", () => {
+          cy.shortPrivilegedSessionTime()
+
+          cy.get('input[name="password"]').type(gen.password())
+          cy.get('[value="password"]').click()
+
+          cy.location("pathname").should("equal", "/login")
+
+          cy.get('[value="hydra"]').should("exist")
+          cy.get('[value="google"]').should("not.exist")
+          cy.get('[value="github"]').should("not.exist")
+        })
+
+        it("settings screen stays intact when the original sign up method gets removed", () => {
+          const expectSettingsOk = () => {
+            cy.get('[value="google"]', { timeout: 1000 })
+              .should("have.attr", "name", "link")
+              .should("contain.text", "Link google")
+
+            cy.get('[value="github"]', { timeout: 1000 })
+              .should("have.attr", "name", "link")
+              .should("contain.text", "Link github")
+          }
+
+          cy.visit(settings)
+          expectSettingsOk()
+
+          // set password
+          cy.get('input[name="password"]').type(gen.password())
+          cy.get('button[value="password"]').click()
+
+          // remove the provider used to log in
+          cy.updateConfigFile((config) => {
+            config.selfservice.methods.oidc.config.providers =
+              config.selfservice.methods.oidc.config.providers.filter(
+                ({ id }) => id !== "hydra",
+              )
+            return config
+          })
+
+          // visit settings and everything should still be fine
+          cy.visit(settings)
+          expectSettingsOk()
+        })
+      })
+    })
+  })
+})