snapshot of https://github.com/ory/kratos.git (master, 2026-09-15; blobs > 131072B omitted)

test/e2e/cypress/integration/profiles/oidc/settings/error.spec.ts

@@ -0,0 +1,58 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { APP_URL, appPrefix, gen, website } from "../../../../helpers"
+import { routes as react } from "../../../../helpers/react"
+import { routes as express } from "../../../../helpers/express"
+
+context("Social Sign In Settings Errors", () => {
+  ;[
+    {
+      registration: react.registration,
+      settings: react.settings,
+      app: "react" as "react",
+      profile: "spa",
+    },
+    {
+      registration: express.registration,
+      settings: express.settings,
+      app: "express" as "express",
+      profile: "oidc",
+    },
+  ].forEach(({ registration, profile, app, settings }) => {
+    describe(`for app ${app}`, () => {
+      before(() => {
+        cy.useConfigProfile(profile)
+        cy.proxy(app)
+      })
+      let email
+
+      beforeEach(() => {
+        cy.clearAllCookies()
+        email = gen.email()
+
+        cy.registerOidc({
+          app,
+          email,
+          expectSession: true,
+          website,
+          route: registration,
+        })
+        cy.visit(settings)
+      })
+
+      describe("oidc", () => {
+        it("should fail to link google because id token is missing", () => {
+          cy.get(appPrefix(app) + 'button[value="google"]').click()
+          cy.get("#remember").click()
+          cy.get("#accept").click()
+
+          cy.get('[data-testid="ui/message/4000001"]').should(
+            "contain.text",
+            'Authentication failed because no id_token was returned. Please accept the "openid" permission and try again.',
+          )
+        })
+      })
+    })
+  })
+})

test/e2e/cypress/integration/profiles/oidc/settings/success.spec.ts

@@ -0,0 +1,252 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { appPrefix, gen, website } from "../../../../helpers"
+import { routes as express } from "../../../../helpers/express"
+import { routes as react } from "../../../../helpers/react"
+import { util } from "prettier"
+import skip = util.skip
+
+context("Social Sign In Settings Success", () => {
+  ;[
+    {
+      registration: react.registration,
+      settings: react.settings,
+      login: react.login,
+      app: "react" as "react",
+      profile: "spa",
+    },
+    {
+      registration: express.registration,
+      settings: express.settings,
+      login: express.login,
+      app: "express" as "express",
+      profile: "oidc",
+    },
+  ].forEach(({ registration, login, profile, app, settings }) => {
+    describe(`for app ${app}`, () => {
+      before(() => {
+        cy.useConfigProfile(profile)
+        cy.proxy(app)
+      })
+
+      let email
+
+      const hydraReauthFails = () => {
+        cy.clearAllCookies()
+        cy.visit(login)
+        cy.get(appPrefix(app) + '[value="hydra"]').click()
+
+        cy.get("#username").type(email)
+        cy.get("#remember").click()
+        cy.get("#accept").click()
+
+        cy.get('input[name="traits.website"]').clear().type(website)
+        cy.triggerOidc(app, "hydra")
+
+        cy.get('[data-testid="ui/message/1010016"]').should(
+          "contain.text",
+          "as another way to sign in.",
+        )
+
+        cy.noSession()
+      }
+
+      beforeEach(() => {
+        cy.clearAllCookies()
+        email = gen.email()
+
+        cy.registerOidc({
+          app,
+          email,
+          expectSession: true,
+          website,
+          route: registration,
+        })
+        cy.visit(settings)
+      })
+
+      describe("oidc", () => {
+        beforeEach(() => {
+          cy.useConfig((builder) =>
+            builder
+              .longRecoveryLifespan()
+              .longVerificationLifespan()
+              .longPrivilegedSessionTime(),
+          )
+        })
+
+        it("should show the correct options", () => {
+          cy.get('[value="hydra"]').should("not.exist")
+
+          cy.get('[value="google"]')
+            .should("have.attr", "name", "link")
+            .should("contain.text", "Link google")
+
+          cy.get('[value="github"]')
+            .should("have.attr", "name", "link")
+            .should("contain.text", "Link github")
+        })
+
+        it("should show the unlink once password is set", () => {
+          cy.get('[value="hydra"]').should("not.exist")
+
+          cy.get('input[name="password"]').type(gen.password())
+          cy.get('button[value="password"]').click()
+
+          cy.get('[value="hydra"]')
+            .should("have.attr", "name", "unlink")
+            .should("contain.text", "Unlink Ory")
+        })
+
+        it("should link google", () => {
+          cy.get('[value="google"]').click()
+
+          cy.get('input[name="scope"]').each(($el) => cy.wrap($el).click())
+          cy.get("#remember").click()
+          cy.get("#accept").click()
+
+          cy.visit(settings)
+
+          cy.get('[value="google"]')
+            .should("have.attr", "name", "unlink")
+            .should("contain.text", "Unlink google")
+
+          cy.logout()
+
+          cy.visit(login)
+
+          // we create an intercept for login so we make sure the login endpoint is called
+          cy.intercept("GET", "**/oauth2/auth*").as("login")
+
+          cy.get('[value="google"]').click()
+
+          // wait for the login endpoint to be called
+          cy.wait("@login")
+
+          // check the session
+          cy.getSession()
+        })
+
+        it("should link google after re-auth", () => {
+          cy.shortPrivilegedSessionTime()
+          cy.get('[value="google"]').click()
+          cy.location("pathname").should("equal", "/login")
+
+          cy.longPrivilegedSessionTime()
+          cy.get('[value="hydra"]').click()
+
+          // prompt=login means that we need to re-auth!
+          cy.get("#username").type(email)
+          cy.get("#accept").click()
+
+          // we re-authed, now we do the google oauth2 dance
+          cy.get("#username").type(gen.email())
+          cy.get("#accept").click()
+          cy.get('input[name="scope"]').each(($el) => cy.wrap($el).click())
+          cy.get("#accept").click()
+
+          cy.expectSettingsSaved()
+
+          cy.get('[value="google"]')
+            .should("have.attr", "name", "unlink")
+            .should("contain.text", "Unlink google")
+
+          cy.visit(settings)
+
+          cy.get('[value="google"]')
+            .should("have.attr", "name", "unlink")
+            .should("contain.text", "Unlink google")
+        })
+
+        it("should unlink hydra and no longer be able to sign in", () => {
+          if (app === "react") {
+            // This test is flaky on React, so we skip it for now.
+            return
+          }
+          cy.get('[value="hydra"]').should("not.exist")
+          cy.get('input[name="password"]').type(gen.password())
+          cy.get('[value="password"]').click()
+          cy.expectSettingsSaved()
+          cy.visit(settings)
+
+          cy.get('[value="hydra"]').click()
+
+          // It will no longer be possible to sign up with this provider because of a UNIQUE key violation
+          // because of the email verification table.
+          //
+          // Basically what needs to happen is for the user to use the LINK feature to link this account.
+          hydraReauthFails()
+        })
+
+        it("should unlink hydra after reauth", () => {
+          cy.get('[value="hydra"]').should("not.exist")
+
+          cy.get('input[name="password"]').type(gen.password())
+          cy.get('[value="password"]').click()
+          cy.expectSettingsSaved()
+          cy.visit(settings)
+
+          cy.shortPrivilegedSessionTime()
+          cy.get('[value="hydra"]').click()
+
+          cy.longPrivilegedSessionTime()
+          cy.location("pathname").should("equal", "/login")
+          cy.get('[value="hydra"]').click()
+
+          // prompt=login means that we need to re-auth!
+          cy.get("#username").type(email)
+          cy.get("#accept").click()
+          cy.expectSettingsSaved()
+
+          hydraReauthFails()
+        })
+
+        it("should show only linked providers during reauth", () => {
+          cy.shortPrivilegedSessionTime()
+
+          cy.get('input[name="password"]').type(gen.password())
+          cy.get('[value="password"]').click()
+
+          cy.location("pathname").should("equal", "/login")
+
+          cy.get('[value="hydra"]').should("exist")
+          cy.get('[value="google"]').should("not.exist")
+          cy.get('[value="github"]').should("not.exist")
+        })
+
+        it("settings screen stays intact when the original sign up method gets removed", () => {
+          const expectSettingsOk = () => {
+            cy.get('[value="google"]', { timeout: 1000 })
+              .should("have.attr", "name", "link")
+              .should("contain.text", "Link google")
+
+            cy.get('[value="github"]', { timeout: 1000 })
+              .should("have.attr", "name", "link")
+              .should("contain.text", "Link github")
+          }
+
+          cy.visit(settings)
+          expectSettingsOk()
+
+          // set password
+          cy.get('input[name="password"]').type(gen.password())
+          cy.get('button[value="password"]').click()
+
+          // remove the provider used to log in
+          cy.updateConfigFile((config) => {
+            config.selfservice.methods.oidc.config.providers =
+              config.selfservice.methods.oidc.config.providers.filter(
+                ({ id }) => id !== "hydra",
+              )
+            return config
+          })
+
+          // visit settings and everything should still be fine
+          cy.visit(settings)
+          expectSettingsOk()
+        })
+      })
+    })
+  })
+})