snapshot of https://github.com/ory/kratos.git (master, 2026-09-15; blobs > 131072B omitted)

test/e2e/playwright/actions/db.ts

@@ -0,0 +1,62 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { execSync } from "child_process"
+
+/**
+ * Extracts the SQLite file path from the TEST_DATABASE_SQLITE env var.
+ *
+ * Expected format: sqlite:///path/to/db.sqlite?_fk=true
+ */
+export function getSqliteDbPath(): string {
+  const dsn = process.env["TEST_DATABASE_SQLITE"]
+  if (!dsn) {
+    throw new Error(
+      "TEST_DATABASE_SQLITE is not set — cannot manipulate legacy data",
+    )
+  }
+
+  // Strip the sqlite:// prefix and any query parameters
+  const withoutScheme = dsn.replace(/^sqlite:\/\//, "")
+  const pathOnly = withoutScheme.split("?")[0]
+  return pathOnly
+}
+
+/**
+ * Downgrades an identity created via admin API to simulate a legacy (pre-normalization)
+ * record in the database. This reverts the E.164 normalization that the admin API applies
+ * on creation, making the DB state match what an old Kratos version would have stored.
+ *
+ * Updates:
+ * - identity_credential_identifiers: replaces normalized identifier with legacy format
+ * - identity_credentials: sets version to 0 (pre-normalization)
+ * - identity_verifiable_addresses: replaces normalized value with legacy format
+ * - identity_recovery_addresses: replaces normalized value with legacy format
+ */
+export function downgradeLegacyIdentity(
+  identityId: string,
+  legacyPhone: string,
+  normalizedPhone: string,
+) {
+  const dbPath = getSqliteDbPath()
+  const escapedLegacy = legacyPhone.replace(/'/g, "''")
+  const escapedNormalized = normalizedPhone.replace(/'/g, "''")
+
+  const queries = [
+    // Revert credential identifiers to legacy format
+    `UPDATE identity_credential_identifiers SET identifier = '${escapedLegacy}' WHERE identifier = '${escapedNormalized}' AND identity_credential_id IN (SELECT id FROM identity_credentials WHERE identity_id = '${identityId}');`,
+    // Set credential version to 0 (pre-normalization)
+    `UPDATE identity_credentials SET version = 0 WHERE identity_id = '${identityId}';`,
+    // Revert verifiable addresses
+    `UPDATE identity_verifiable_addresses SET value = '${escapedLegacy}' WHERE value = '${escapedNormalized}' AND identity_id = '${identityId}';`,
+    // Revert recovery addresses
+    `UPDATE identity_recovery_addresses SET value = '${escapedLegacy}' WHERE value = '${escapedNormalized}' AND identity_id = '${identityId}';`,
+  ]
+
+  for (const query of queries) {
+    execSync(`sqlite3 "${dbPath}" "${query}"`, {
+      encoding: "utf-8",
+      timeout: 5000,
+    })
+  }
+}

test/e2e/playwright/actions/identity.ts

@@ -0,0 +1,100 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { faker } from "@faker-js/faker"
+import { APIRequestContext } from "@playwright/test"
+import { CreateIdentityBody } from "@ory/kratos-client"
+import { generatePhoneNumber, CountryNames } from "phone-number-generator-js"
+import { expect } from "../fixtures"
+
+export async function createIdentity(
+  request: APIRequestContext,
+  data: Partial<CreateIdentityBody>,
+) {
+  const resp = await request.post("http://localhost:4434/admin/identities", {
+    data,
+  })
+  expect(resp.status()).toBe(201)
+  return await resp.json()
+}
+
+export async function createIdentityWithPhoneNumber(
+  request: APIRequestContext,
+) {
+  const phone = generatePhoneNumber({
+    countryName: CountryNames.Germany,
+    withoutCountryCode: false,
+  })
+  return {
+    identity: await createIdentity(request, {
+      schema_id: "sms",
+      traits: {
+        phone,
+      },
+    }),
+    phone,
+  }
+}
+
+export async function createIdentityWithEmail(request: APIRequestContext) {
+  const email = faker.internet.email({ provider: "ory.sh" })
+  return {
+    identity: await createIdentity(request, {
+      schema_id: "email",
+      traits: {
+        email,
+        website: faker.internet.url(),
+      },
+    }),
+    email,
+  }
+}
+
+export async function createIdentityWithPhoneAndPassword(
+  request: APIRequestContext,
+  phone: string,
+  password: string,
+  schemaId = "sms-password",
+) {
+  return {
+    identity: await createIdentity(request, {
+      schema_id: schemaId,
+      traits: {
+        phone,
+      },
+      credentials: {
+        password: {
+          config: {
+            password,
+          },
+        },
+      },
+    }),
+    phone,
+    password,
+  }
+}
+
+export async function createIdentityWithPassword(request: APIRequestContext) {
+  const email = faker.internet.email({ provider: "ory.sh" })
+  const password = faker.internet.password()
+  return {
+    identity: await createIdentity(request, {
+      schema_id: "email",
+      traits: {
+        email,
+        website: faker.internet.url(),
+      },
+
+      credentials: {
+        password: {
+          config: {
+            password,
+          },
+        },
+      },
+    }),
+    email,
+    password,
+  }
+}

test/e2e/playwright/actions/login.ts

@@ -0,0 +1,61 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { APIRequestContext } from "@playwright/test"
+import { findCsrfToken } from "../lib/helper"
+import { LoginFlow, LogoutFlow, Session } from "@ory/kratos-client"
+import { expectJSONResponse } from "../lib/request"
+import { expect } from "../fixtures"
+
+export async function loginWithPassword(
+  user: { password: string; traits: { email: string } },
+  r: APIRequestContext,
+  baseUrl: string,
+): Promise<void> {
+  const { ui } = await expectJSONResponse<LoginFlow>(
+    await r.get(baseUrl + "/self-service/login/browser", {
+      headers: {
+        Accept: "application/json",
+      },
+    }),
+    {
+      message: "Initializing login flow failed",
+    },
+  )
+
+  const res = await r.post(ui.action, {
+    headers: {
+      Accept: "application/json",
+    },
+    data: {
+      identifier: user.traits.email,
+      password: user.password,
+      method: "password",
+      csrf_token: findCsrfToken(ui),
+    },
+  })
+  const { session } = await expectJSONResponse<{ session: Session }>(res)
+  expect(session?.identity?.traits.email).toEqual(user.traits.email)
+  expect(
+    res.headersArray().find(
+      ({ name, value }) =>
+        name.toLowerCase() === "set-cookie" &&
+        (value.indexOf("ory_session_") > -1 || // Ory Network
+          value.indexOf("ory_kratos_session") > -1), // Locally hosted
+    ),
+  ).toBeDefined()
+}
+
+export async function logoutUrl(r: APIRequestContext, baseUrl: string) {
+  const { logout_url } = await expectJSONResponse<LogoutFlow>(
+    await r.get(baseUrl + "/self-service/logout/browser", {
+      headers: {
+        Accept: "application/json",
+      },
+    }),
+    {
+      message: "Logout failed",
+    },
+  )
+  return logout_url
+}

test/e2e/playwright/actions/mail.ts

@@ -0,0 +1,39 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import mailhog from "mailhog"
+import retry from "async-retry"
+
+const mh = mailhog({
+  basePath: "http://localhost:8025/api",
+})
+
+type searchProps = {
+  query: string
+  kind: "to" | "from" | "containing"
+  /**
+   *
+   * @param message an email message
+   * @returns decide whether to include the message in the result
+   */
+  filter?: (message: mailhog.Message) => boolean
+}
+
+export function search({ query, kind, filter }: searchProps) {
+  return retry(
+    async () => {
+      const res = await mh.search(query, kind)
+      if (res.total === 0) {
+        throw new Error("no emails found")
+      }
+      const result = filter ? res.items.filter(filter) : res.items
+      if (result.length === 0) {
+        throw new Error("no emails found")
+      }
+      return result
+    },
+    {
+      retries: 3,
+    },
+  )
+}

test/e2e/playwright/actions/session.ts

@@ -0,0 +1,38 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { APIRequestContext, expect } from "@playwright/test"
+import { Session } from "@ory/kratos-client"
+
+export async function hasSession(
+  r: APIRequestContext,
+  kratosPublicURL: string,
+): Promise<void> {
+  const resp = await r.get(kratosPublicURL + "/sessions/whoami", {
+    failOnStatusCode: true,
+  })
+  const session = await resp.json()
+  expect(session).toBeDefined()
+  expect(session.active).toBe(true)
+}
+
+export async function getSession(
+  r: APIRequestContext,
+  kratosPublicURL: string,
+): Promise<Session> {
+  const resp = await r.get(kratosPublicURL + "/sessions/whoami", {
+    failOnStatusCode: true,
+  })
+  return resp.json()
+}
+
+export async function hasNoSession(
+  r: APIRequestContext,
+  kratosPublicURL: string,
+): Promise<void> {
+  const resp = await r.get(kratosPublicURL + "/sessions/whoami", {
+    failOnStatusCode: false,
+  })
+  expect(resp.status()).toBe(401)
+  return resp.json()
+}

test/e2e/playwright/actions/webhook.ts

@@ -0,0 +1,57 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { request } from "@playwright/test"
+import retry from "promise-retry"
+import { retryOptions } from "../lib/config"
+
+export const WEBHOOK_TARGET = "http://127.0.0.1:4471"
+
+const baseUrl = WEBHOOK_TARGET
+
+/**
+ * Fetches a documented (hopefully) created by web hook
+ *
+ * @param key
+ */
+export async function fetchDocument(key: string) {
+  const r = await request.newContext()
+
+  return retry(async (retry) => {
+    const res = await r.get(documentUrl(key))
+    if (res.status() !== 200) {
+      const body = await res.text()
+      const message = `Expected response code 200 but received ${res.status()}: ${body}`
+      return retry(message)
+    }
+    return await res.json()
+  }, retryOptions)
+}
+
+/**
+ * Fetches a documented (hopefully) created by web hook
+ *
+ * @param key
+ */
+export async function deleteDocument(key: string) {
+  const r = await request.newContext()
+
+  return retry(async (retry) => {
+    const res = await r.delete(documentUrl(key))
+    if (res.status() !== 204) {
+      const body = await res.text()
+      const message = `Expected response code 204 but received ${res.status()}: ${body}`
+      return retry(message)
+    }
+    return
+  }, retryOptions)
+}
+
+/**
+ * Returns the URL for a specific document
+ *
+ * @param key
+ */
+export function documentUrl(key: string) {
+  return `${baseUrl}/documents/${key}`
+}

test/e2e/playwright/fixtures/index.ts

@@ -0,0 +1,241 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { Identity } from "@ory/kratos-client"
+import {
+  APIRequestContext,
+  CDPSession,
+  expect as baseExpect,
+  Page,
+  test as base,
+} from "@playwright/test"
+import { writeFile } from "fs/promises"
+import { merge } from "lodash"
+import { OryKratosConfiguration } from "../../shared/config"
+import { default_config } from "../setup/default_config"
+import { APIResponse } from "playwright-core"
+import { SessionWithResponse } from "../types"
+import { retryOptions } from "../lib/request"
+import promiseRetry from "promise-retry"
+import { Protocol } from "playwright-core/types/protocol"
+import {
+  createIdentityWithEmail,
+  createIdentityWithPassword,
+} from "../actions/identity"
+import { randomBytes } from "crypto"
+
+// from https://stackoverflow.com/questions/61132262/typescript-deep-partial
+type DeepPartial<T> = T extends object
+  ? {
+      [P in keyof T]?: DeepPartial<T[P]>
+    }
+  : T
+
+type TestFixtures = {
+  identity: { oryIdentity: Identity; email: string; password: string }
+  identityWithoutPassword: { oryIdentity: Identity; email: string }
+  configOverride: DeepPartial<OryKratosConfiguration>
+  config: OryKratosConfiguration
+  virtualAuthenticatorOptions: Partial<Protocol.WebAuthn.VirtualAuthenticatorOptions>
+  pageCDPSession: CDPSession
+  virtualAuthenticator: Protocol.WebAuthn.addVirtualAuthenticatorReturnValue
+}
+
+type WorkerFixtures = {
+  kratosAdminURL: string
+  kratosPublicURL: string
+  mode:
+    | "reconfigure_kratos"
+    | "reconfigure_ory_network_project"
+    | "existing_kratos"
+    | "existing_ory_network_project"
+}
+
+export const test = base.extend<TestFixtures, WorkerFixtures>({
+  configOverride: {},
+  config: [
+    async ({ request, configOverride }, use) => {
+      const configToWrite = merge(default_config, configOverride)
+
+      const revision = randomBytes(16).toString("hex")
+      const fileDirectory = __dirname + "/../.."
+      await writeFile(
+        fileDirectory + "/playwright/kratos.config.json",
+        JSON.stringify(
+          {
+            ...configToWrite,
+            // Forces a new hash, even if the config was not changed.
+            revision,
+          },
+          null,
+          2,
+        ),
+      )
+
+      await expect(async () => {
+        const resp = await request.get(
+          "http://localhost:4434/admin/health/config",
+        )
+        const updatedRevision = (await resp.body()).toString()
+        expect(updatedRevision).toBe(revision)
+      }).toPass()
+
+      await use(configToWrite)
+    },
+    { auto: true },
+  ],
+  virtualAuthenticatorOptions: undefined,
+  pageCDPSession: async ({ page }, use) => {
+    const cdpSession = await page.context().newCDPSession(page)
+    await use(cdpSession)
+    await cdpSession.detach()
+  },
+  virtualAuthenticator: async (
+    { pageCDPSession, virtualAuthenticatorOptions },
+    use,
+  ) => {
+    await pageCDPSession.send("WebAuthn.enable")
+    const { authenticatorId } = await pageCDPSession.send(
+      "WebAuthn.addVirtualAuthenticator",
+      {
+        options: {
+          protocol: "ctap2",
+          transport: "internal",
+          hasResidentKey: true,
+          hasUserVerification: true,
+          isUserVerified: true,
+          ...virtualAuthenticatorOptions,
+        },
+      },
+    )
+    await use({ authenticatorId })
+    await pageCDPSession.send("WebAuthn.removeVirtualAuthenticator", {
+      authenticatorId,
+    })
+
+    await pageCDPSession.send("WebAuthn.disable")
+  },
+  identity: async ({ request }, use, i) => {
+    const {
+      identity: oryIdentity,
+      password,
+      email,
+    } = await createIdentityWithPassword(request)
+    i.attach("identity", {
+      body: JSON.stringify(oryIdentity, null, 2),
+      contentType: "application/json",
+    })
+    await use({
+      oryIdentity,
+      email,
+      password,
+    })
+  },
+  identityWithoutPassword: async ({ request }, use, i) => {
+    const { identity: oryIdentity, email } =
+      await createIdentityWithEmail(request)
+    i.attach("identity", {
+      body: JSON.stringify(oryIdentity, null, 2),
+      contentType: "application/json",
+    })
+    await use({
+      oryIdentity,
+      email,
+    })
+  },
+  kratosAdminURL: ["http://localhost:4434", { option: true, scope: "worker" }],
+  kratosPublicURL: ["http://localhost:4433", { option: true, scope: "worker" }],
+})
+
+export const expect = baseExpect.extend({
+  toHaveSession,
+  toMatchResponseData,
+})
+
+async function toHaveSession(
+  requestOrPage: APIRequestContext | Page,
+  baseUrl: string,
+) {
+  let r: APIRequestContext
+  if ("request" in requestOrPage) {
+    r = requestOrPage.request
+  } else {
+    r = requestOrPage
+  }
+  let pass = true
+
+  let responseData: string
+  let response: APIResponse = null
+  try {
+    const result = await promiseRetry(
+      () =>
+        r
+          .get(baseUrl + "/sessions/whoami", {
+            failOnStatusCode: false,
+          })
+          .then<SessionWithResponse>(
+            async (res: APIResponse): Promise<SessionWithResponse> => {
+              return {
+                session: await res.json(),
+                response: res,
+              }
+            },
+          ),
+      retryOptions,
+    )
+    pass = !!result.session.active
+    responseData = await result.response.text()
+    response = result.response
+  } catch (e) {
+    pass = false
+    responseData = JSON.stringify(e.message, undefined, 2)
+  }
+
+  const message = () =>
+    this.utils.matcherHint("toHaveSession", undefined, undefined, {
+      isNot: this.isNot,
+    }) +
+    `\n
+    \n
+    Expected: ${this.isNot ? "not" : ""} to have session\n
+    Session data received: ${responseData}\n
+    Headers: ${JSON.stringify(response?.headers(), null, 2)}\n
+    `
+
+  return {
+    message,
+    pass,
+    name: "toHaveSession",
+  }
+}
+
+async function toMatchResponseData(
+  res: APIResponse,
+  options: {
+    statusCode?: number
+    failureHint?: string
+  },
+) {
+  const body = await res.text()
+  const statusCode = options.statusCode ?? 200
+  const failureHint = options.failureHint ?? ""
+  const message = () =>
+    this.utils.matcherHint("toMatch", undefined, undefined, {
+      isNot: this.isNot,
+    }) +
+    `\n
+    ${failureHint}
+    \n
+    Expected: ${this.isNot ? "not" : ""} to match\n
+    Status Code: ${statusCode}\n
+    Body: ${body}\n
+    Headers: ${JSON.stringify(res.headers(), null, 2)}\n
+    URL: ${JSON.stringify(res.url(), null, 2)}\n
+    `
+
+  return {
+    message,
+    pass: res.status() === statusCode,
+    name: "toMatch",
+  }
+}

test/e2e/playwright/fixtures/mappers/hydra-phone.jsonnet

@@ -0,0 +1,12 @@
+local claims = std.extVar('claims');
+
+if std.length(claims.sub) == 0 then
+  error 'claim sub not set'
+else
+  {
+    identity: {
+      traits: {
+        phone: claims.sub,
+      },
+    },
+  }

test/e2e/playwright/fixtures/schemas/sms-oidc.ts

@@ -0,0 +1,35 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+export default {
+  $id: "https://schemas.ory.sh/presets/kratos/test/sms-oidc/identity.schema.json",
+  $schema: "http://json-schema.org/draft-07/schema#",
+  title: "Person",
+  type: "object",
+  properties: {
+    traits: {
+      type: "object",
+      properties: {
+        phone: {
+          type: "string",
+          format: "tel",
+          title: "Your Phone Number",
+          minLength: 3,
+          "ory.sh/kratos": {
+            credentials: {
+              code: {
+                identifier: true,
+                via: "sms",
+              },
+            },
+            verification: {
+              via: "sms",
+            },
+          },
+        },
+      },
+      required: ["phone"],
+      additionalProperties: false,
+    },
+  },
+}

test/e2e/playwright/fixtures/schemas/sms-password.ts

@@ -0,0 +1,41 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+export default {
+  $id: "https://schemas.ory.sh/presets/kratos/test/sms-password/identity.schema.json",
+  $schema: "http://json-schema.org/draft-07/schema#",
+  title: "Person",
+  type: "object",
+  properties: {
+    traits: {
+      type: "object",
+      properties: {
+        phone: {
+          type: "string",
+          format: "tel",
+          title: "Your Phone Number",
+          minLength: 3,
+          "ory.sh/kratos": {
+            credentials: {
+              password: {
+                identifier: true,
+              },
+              code: {
+                identifier: true,
+                via: "sms",
+              },
+            },
+            verification: {
+              via: "sms",
+            },
+            recovery: {
+              via: "sms",
+            },
+          },
+        },
+      },
+      required: ["phone"],
+      additionalProperties: false,
+    },
+  },
+}

test/e2e/playwright/fixtures/schemas/sms.ts

@@ -0,0 +1,35 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+export default {
+  $id: "https://schemas.ory.sh/presets/kratos/quickstart/email-password/identity.schema.json",
+  $schema: "http://json-schema.org/draft-07/schema#",
+  title: "Person",
+  type: "object",
+  properties: {
+    traits: {
+      type: "object",
+      properties: {
+        phone: {
+          type: "string",
+          format: "tel",
+          title: "Your Phone Number",
+          minLength: 3,
+          "ory.sh/kratos": {
+            credentials: {
+              code: {
+                identifier: true,
+                via: "sms",
+              },
+            },
+            verification: {
+              via: "sms",
+            },
+          },
+        },
+      },
+      required: ["phone"],
+      additionalProperties: false,
+    },
+  },
+}

test/e2e/playwright/kratos.base-config.json

@@ -0,0 +1,120 @@
+{
+  "identity": {
+    "schemas": [
+      {
+        "id": "default",
+        "url": "file://test/e2e/profiles/oidc/identity.traits.schema.json"
+      },
+      {
+        "id": "email",
+        "url": "file://test/e2e/profiles/email/identity.traits.schema.json"
+      }
+    ]
+  },
+  "serve": {
+    "public": {
+      "base_url": "http://localhost:4455/",
+      "cors": {
+        "enabled": true,
+        "allowed_origins": ["http://localhost:3000", "http://localhost:19006"],
+        "allowed_headers": ["Authorization", "Content-Type", "X-Session-Token"]
+      }
+    }
+  },
+  "log": {
+    "level": "trace",
+    "leak_sensitive_values": true
+  },
+  "secrets": {
+    "cookie": ["PLEASE-CHANGE-ME-I-AM-VERY-INSECURE"],
+    "cipher": ["secret-thirty-two-character-long"]
+  },
+  "selfservice": {
+    "default_browser_return_url": "http://localhost:4455/",
+    "allowed_return_urls": [
+      "http://localhost:4455",
+      "http://localhost:19006",
+      "https://www.ory.sh/",
+      "https://example.org/",
+      "https://www.example.org/",
+      "exp://example.com/my-app",
+      "https://example.com/my-app"
+    ],
+    "methods": {
+      "link": {
+        "config": {
+          "lifespan": "1h"
+        }
+      },
+      "code": {
+        "config": {
+          "lifespan": "1h"
+        }
+      },
+      "oidc": {
+        "enabled": true,
+        "config": {
+          "providers": [
+            {
+              "id": "hydra",
+              "label": "Ory",
+              "provider": "generic",
+              "client_id": "client_id",
+              "client_secret": "client_secret",
+              "issuer_url": "http://localhost:4444/",
+              "scope": ["offline"],
+              "mapper_url": "file://test/e2e/profiles/oidc/hydra.jsonnet"
+            }
+          ]
+        }
+      }
+    },
+    "flows": {
+      "settings": {
+        "privileged_session_max_age": "5m",
+        "ui_url": "http://localhost:4455/settings"
+      },
+      "logout": {
+        "after": {
+          "default_browser_return_url": "http://localhost:4455/login"
+        }
+      },
+      "registration": {
+        "ui_url": "http://localhost:4455/registration",
+        "after": {
+          "password": {
+            "hooks": [
+              {
+                "hook": "session"
+              }
+            ]
+          },
+          "oidc": {
+            "hooks": [
+              {
+                "hook": "session"
+              }
+            ]
+          }
+        }
+      },
+      "login": {
+        "ui_url": "http://localhost:4455/login"
+      },
+      "error": {
+        "ui_url": "http://localhost:4455/error"
+      },
+      "verification": {
+        "ui_url": "http://localhost:4455/verify"
+      },
+      "recovery": {
+        "ui_url": "http://localhost:4455/recovery"
+      }
+    }
+  },
+  "courier": {
+    "smtp": {
+      "connection_uri": "smtps://test:test@localhost:8026/?skip_ssl_verify=true"
+    }
+  }
+}

test/e2e/playwright/lib/config.ts

@@ -0,0 +1,14 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import type { OperationOptions } from "retry"
+
+export type RetryOptions = OperationOptions
+
+export const retryOptions: RetryOptions = {
+  retries: 20,
+  factor: 1,
+  maxTimeout: 500,
+  minTimeout: 250,
+  randomize: false,
+}

test/e2e/playwright/lib/helper.ts

@@ -0,0 +1,77 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { Message } from "mailhog"
+import {
+  UiContainer,
+  UiNodeAttributes,
+  UiNodeInputAttributes,
+} from "@ory/kratos-client"
+import { expect } from "../fixtures"
+import { LoginFlowStyle, OryKratosConfiguration } from "../../shared/config"
+
+export const codeRegex = /(\d{6})/
+
+/**
+ * Extracts the recovery or verification code from a mail
+ *
+ * @param mail the mail to extract the code from
+ * @returns the code or null if no code was found
+ */
+export function extractCode(mail: Message) {
+  const result = codeRegex.exec(mail.html || mail.text)
+  if (result != null && result.length > 0) {
+    return result[0]
+  }
+  return null
+}
+
+export function findCsrfToken(ui: UiContainer) {
+  const csrf = ui.nodes
+    .filter((node) => isUiNodeInputAttributes(node.attributes))
+    // Since we filter all non-input attributes, the following as is ok:
+    .map(
+      (node): UiNodeInputAttributes => node.attributes as UiNodeInputAttributes,
+    )
+    .find(({ name }) => name === "csrf_token")?.value
+  expect(csrf).toBeDefined()
+  return csrf
+}
+
+export function isUiNodeInputAttributes(
+  attrs: UiNodeAttributes,
+): attrs is UiNodeInputAttributes & {
+  node_type: "input"
+} {
+  return attrs.node_type === "input"
+}
+
+export const toConfig = ({
+  style = "identifier_first",
+  mitigateEnumeration = false,
+  selfservice,
+  featureFlags,
+}: {
+  style?: LoginFlowStyle
+  mitigateEnumeration?: boolean
+  selfservice?: Partial<OryKratosConfiguration["selfservice"]>
+  featureFlags?: OryKratosConfiguration["feature_flags"]
+}) => ({
+  selfservice: {
+    default_browser_return_url: "http://localhost:4455/welcome",
+    ...selfservice,
+    flows: {
+      login: {
+        ...selfservice?.flows?.login,
+        style,
+      },
+      ...selfservice?.flows,
+    },
+  },
+  security: {
+    account_enumeration: {
+      mitigate: mitigateEnumeration,
+    },
+  },
+  ...(featureFlags ? { feature_flags: featureFlags } : {}),
+})

test/e2e/playwright/lib/request.ts

@@ -0,0 +1,34 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { APIResponse } from "playwright-core"
+import { expect } from "../fixtures"
+import { OperationOptions } from "retry"
+
+export type RetryOptions = OperationOptions
+
+export const retryOptions: RetryOptions = {
+  retries: 20,
+  factor: 1,
+  maxTimeout: 500,
+  minTimeout: 250,
+  randomize: false,
+}
+
+export async function expectJSONResponse<T>(
+  res: APIResponse,
+  { statusCode = 200, message }: { statusCode?: number; message?: string } = {},
+): Promise<T> {
+  await expect(res).toMatchResponseData({
+    statusCode,
+    failureHint: message,
+  })
+  try {
+    return (await res.json()) as T
+  } catch (e) {
+    const body = await res.text()
+    throw Error(
+      `Expected to be able to parse body as json: ${e} (body: ${body})`,
+    )
+  }
+}

test/e2e/playwright/models/elements/login.ts

@@ -0,0 +1,269 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { expect, Locator, Page } from "@playwright/test"
+import { createInputLocator, InputLocator } from "../../selectors/input"
+import { URLSearchParams } from "node:url"
+import { OryKratosConfiguration } from "../../../shared/config"
+
+enum LoginStyle {
+  IdentifierFirst = "identifier_first",
+  Unified = "unified",
+}
+
+type SubmitOptions = {
+  submitWithKeyboard?: boolean
+  waitForURL?: string | RegExp
+}
+
+export class LoginPage {
+  public submitPassword: Locator
+  public github: Locator
+  public google: Locator
+  public signup: Locator
+
+  public identifier: InputLocator
+  public password: InputLocator
+  public totpInput: InputLocator
+  public totpSubmit: Locator
+  public lookupInput: InputLocator
+  public lookupSubmit: Locator
+  public codeSubmit = this.page.locator(
+    'button[type="submit"][name="method"][value="code"]',
+  )
+  public codeSubmitMfa = this.page.locator(
+    'button[type="submit"][name="address"]',
+  )
+  public codeInput = createInputLocator(this.page, "code")
+
+  public alert: Locator
+
+  constructor(
+    readonly page: Page,
+    readonly config: OryKratosConfiguration,
+  ) {
+    this.identifier = createInputLocator(page, "identifier")
+    this.password = createInputLocator(page, "password")
+    this.totpInput = createInputLocator(page, "totp_code")
+    this.lookupInput = createInputLocator(page, "lookup_secret")
+
+    this.submitPassword = page.locator(
+      '[type="submit"][name="method"][value="password"]',
+    )
+
+    this.github = page.locator('[name="provider"][value="github"]')
+    this.google = page.locator('[name="provider"][value="google"]')
+
+    this.totpSubmit = page.locator('[name="method"][value="totp"]')
+    this.lookupSubmit = page.locator('[name="method"][value="lookup_secret"]')
+
+    this.signup = page.locator('[data-testid="signup-link"]')
+
+    // this.submitHydra = page.locator('[name="provider"][value="hydra"]')
+    // this.forgotPasswordLink = page.locator(
+    //   "[data-testid='forgot-password-link']",
+    // )
+    // this.logoutLink = page.locator("[data-testid='logout-link']")
+  }
+
+  async submitIdentifierFirst(identifier: string) {
+    await this.inputField("identifier").fill(identifier)
+    await this.submit("identifier_first", {
+      waitForURL: new RegExp(this.config.selfservice.flows.login.ui_url),
+    })
+  }
+
+  async loginWithPassword(
+    identifier: string,
+    password: string,
+    opts?: SubmitOptions,
+  ) {
+    switch (this.config.selfservice.flows.login.style) {
+      case LoginStyle.IdentifierFirst:
+        await this.submitIdentifierFirst(identifier)
+        break
+      case LoginStyle.Unified:
+        await this.inputField("identifier").fill(identifier)
+        break
+    }
+
+    await this.inputField("password").fill(password)
+    await this.submit("password", opts)
+  }
+
+  async triggerLoginWithCode(identifier: string, opts?: SubmitOptions) {
+    switch (this.config.selfservice.flows.login.style) {
+      case LoginStyle.IdentifierFirst:
+        await this.submitIdentifierFirst(identifier)
+        const enabled = [
+          this.config.selfservice.methods.passkey?.enabled,
+          this.config.selfservice.methods.password?.enabled,
+          this.config.selfservice.methods.code?.passwordless_enabled,
+          this.config.selfservice.methods.webauthn?.enabled &&
+            this.config.selfservice.methods.webauthn?.config?.passwordless,
+          this.config.selfservice.methods.oidc?.enabled &&
+            this.config.selfservice.methods.oidc.config.providers.length > 0,
+        ].filter((e) => e)
+
+        if (enabled.length > 1) {
+          await this.codeSubmit.click()
+        }
+        break
+      case LoginStyle.Unified:
+        await this.inputField("identifier").fill(identifier)
+        await this.codeSubmit.click()
+        break
+    }
+  }
+
+  async open({
+    aal,
+    refresh,
+  }: {
+    aal?: string
+    refresh?: boolean
+  } = {}) {
+    const p = new URLSearchParams()
+    if (refresh) {
+      p.append("refresh", "true")
+    }
+
+    if (aal) {
+      p.append("aal", aal)
+    }
+
+    await Promise.all([
+      this.page.goto(
+        this.config.selfservice.flows.login.ui_url + "?" + p.toString(),
+      ),
+      this.isReady(),
+      this.page.waitForURL((url) =>
+        url.toString().includes(this.config.selfservice.flows.login.ui_url),
+      ),
+    ])
+    await this.isReady()
+  }
+
+  async isReady() {
+    await expect(this.inputField("csrf_token").nth(0)).toBeHidden()
+  }
+
+  submitMethod(method: string) {
+    switch (method) {
+      case "google":
+      case "github":
+      case "hydra":
+        return this.page.locator(`[name="provider"][value="${method}"]`)
+    }
+    return this.page.locator(`[name="method"][value="${method}"]`)
+  }
+
+  inputField(name: string) {
+    return this.page.locator(`input[name=${name}]`)
+  }
+
+  async submit(method: string, opts?: SubmitOptions) {
+    const waitFor = [
+      opts?.waitForURL
+        ? this.page.waitForURL(opts.waitForURL)
+        : Promise.resolve(),
+    ]
+
+    if (opts?.submitWithKeyboard) {
+      waitFor.push(this.page.keyboard.press("Enter"))
+    } else {
+      waitFor.push(this.submitMethod(method).click())
+    }
+
+    await Promise.all(waitFor)
+  }
+
+  //
+  // async submitPasswordForm(
+  //   id: string,
+  //   password: string,
+  //   expectURL: string | RegExp,
+  //   options: {
+  //     submitWithKeyboard?: boolean
+  //     style?: LoginStyle
+  //   } = {
+  //     submitWithKeyboard: false,
+  //     style: LoginStyle.OneStep,
+  //   },
+  // ) {
+  //   await this.isReady()
+  //   await this.inputField("identifier").fill(id)
+  //
+  //   if (options.style === LoginStyle.IdentifierFirst) {
+  //     await this.submitMethod("identifier_first").click()
+  //     await this.inputField("password").fill(password)
+  //   } else {
+  //     await this.inputField("password").fill(password)
+  //   }
+  //
+  //   const nav = this.page.waitForURL(expectURL)
+  //
+  //   if (submitWithKeyboard) {
+  //     await this.page.keyboard.press("Enter")
+  //   } else {
+  //     await this.submitPassword.click()
+  //   }
+  //
+  //   await nav
+  // }
+  //
+  // readonly baseURL: string
+  // readonly submitHydra: Locator
+  // readonly forgotPasswordLink: Locator
+  // readonly logoutLink: Locator
+  //
+  // async goto(returnTo?: string, refresh?: boolean) {
+  //   const u = new URL(routes.hosted.login(this.baseURL))
+  //   if (returnTo) {
+  //     u.searchParams.append("return_to", returnTo)
+  //   }
+  //   if (refresh) {
+  //     u.searchParams.append("refresh", refresh.toString())
+  //   }
+  //   await this.page.goto(u.toString())
+  //   await this.isReady()
+  // }
+  //
+  // async loginWithHydra(email: string, password: string) {
+  //   await this.submitHydra.click()
+  //   await this.page.waitForURL(new RegExp(OIDC_PROVIDER))
+  //
+  //   await this.page.locator("input[name=email]").fill(email)
+  //   await this.page.locator("input[name=password]").fill(password)
+  //
+  //   await this.page.locator("input[name=submit][id=accept]").click()
+  // }
+  //
+  // async loginWithOIDC(email = generateEmail(), password = generatePassword()) {
+  //   await this.page.fill('[name="email"]', email)
+  //   await this.page.fill('[name="password"]', password)
+  //   await this.page.click("#accept")
+  // }
+  //
+  // async loginAndAcceptConsent(
+  //   email = generateEmail(),
+  //   password = generatePassword(),
+  //   {rememberConsent = true, rememberLogin = false} = {},
+  // ) {
+  //   await this.page.fill('[name="email"]', email)
+  //   await this.page.fill('[name="password"]', password)
+  //   rememberLogin && (await this.page.check('[name="remember"]'))
+  //   await this.page.click("#accept")
+  //
+  //   await this.page.click("#offline")
+  //   await this.page.click("#openid")
+  //   rememberConsent && (await this.page.check("[name=remember]"))
+  //   await this.page.click("#accept")
+  //
+  //   return email
+  // }
+  //
+  // async expectAlert(id: string) {
+  //   await this.page.getByTestId(`ui/message/${id}`).waitFor()
+  // }
+}

test/e2e/playwright/models/elements/registration.ts

@@ -0,0 +1,48 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { expect, Page } from "@playwright/test"
+import { createInputLocator, InputLocator } from "../../selectors/input"
+import { OryKratosConfiguration } from "../../../shared/config"
+
+export class RegistrationPage {
+  public identifier: InputLocator
+
+  constructor(
+    readonly page: Page,
+    readonly config: OryKratosConfiguration,
+  ) {
+    this.identifier = createInputLocator(page, "identifier")
+  }
+
+  async open() {
+    await Promise.all([
+      this.page.goto(this.config.selfservice.flows.registration.ui_url),
+      this.isReady(),
+      this.page.waitForURL((url) =>
+        url
+          .toString()
+          .includes(this.config.selfservice.flows.registration.ui_url),
+      ),
+    ])
+    await this.isReady()
+  }
+
+  inputField(name: string) {
+    return this.page.locator(`input[name="${name}"]`)
+  }
+
+  submitField(name: string) {
+    return this.page.locator(`[type="submit"][name="method"][value="${name}"]`)
+  }
+
+  async isReady() {
+    await expect(this.inputField("csrf_token").nth(0)).toBeHidden()
+  }
+
+  async triggerRegistrationWithCode(identifier: string) {
+    await this.inputField("traits.phone").fill(identifier)
+    await this.submitField("profile").click()
+    await this.submitField("code").click()
+  }
+}

test/e2e/playwright/models/elements/settings.ts

@@ -0,0 +1,41 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { expect, Page } from "@playwright/test"
+import { TOTP } from "otpauth"
+import { OryKratosConfiguration } from "../../../shared/config"
+
+export class SettingsPage {
+  constructor(
+    readonly page: Page,
+    readonly config: OryKratosConfiguration,
+  ) {}
+
+  async isReady() {
+    for (const csrfInput of await this.page
+      .locator(`input[name="csrf_token"]`)
+      .all()) {
+      await expect(csrfInput).toHaveValue(/.+/)
+    }
+  }
+
+  async open() {
+    await this.page.goto(this.config.selfservice.flows.settings.ui_url)
+    await this.isReady()
+  }
+
+  async setupTotp() {
+    const totpSecret = await this.page
+      .getByTestId("node/text/totp_secret_key/text")
+      .locator("code")
+      .textContent()
+    await expect(totpSecret).toMatch(/^[A-Z2-7]{32}$/)
+    const totpCode = () => {
+      return new TOTP({ secret: totpSecret }).generate()
+    }
+    await this.page.fill("input[name=totp_code]", totpCode())
+    await this.page.locator("button[name=method][value=totp]").click()
+
+    return { totpCode }
+  }
+}

test/e2e/playwright/selectors/input.ts

@@ -0,0 +1,19 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { Locator, Page } from "@playwright/test"
+
+export interface InputLocator {
+  input: Locator
+  message: Locator
+  label: Locator
+}
+
+export const createInputLocator = (page: Page, field: string): InputLocator => {
+  const prefix = `[data-testid="node/input/${field}"]`
+  return {
+    input: page.locator(`${prefix} input`),
+    label: page.locator(`${prefix} label`),
+    message: page.locator(`${prefix} p`),
+  }
+}

test/e2e/playwright/setup/default_config.ts

@@ -0,0 +1,137 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { OryKratosConfiguration } from "../../shared/config"
+
+export const default_config: OryKratosConfiguration = {
+  dsn: "",
+  identity: {
+    schemas: [
+      {
+        id: "default",
+        url: "file://test/e2e/profiles/oidc/identity.traits.schema.json",
+      },
+      {
+        id: "email",
+        url: "file://test/e2e/profiles/email/identity.traits.schema.json",
+      },
+    ],
+  },
+  serve: {
+    public: {
+      base_url: "http://localhost:4455/",
+      cors: {
+        enabled: true,
+        allowed_origins: ["http://localhost:3000", "http://localhost:19006"],
+        allowed_headers: [
+          "Authorization",
+          "Content-Type",
+          "Max-Age",
+          "X-Session-Token",
+          "X-XSRF-TOKEN",
+          "X-CSRF-TOKEN",
+        ],
+      },
+    },
+  },
+
+  log: {
+    level: "trace",
+    leak_sensitive_values: true,
+  },
+  secrets: {
+    cookie: ["PLEASE-CHANGE-ME-I-AM-VERY-INSECURE"],
+    cipher: ["secret-thirty-two-character-long"],
+  },
+  selfservice: {
+    default_browser_return_url: "http://localhost:4455/welcome",
+    allowed_return_urls: [
+      "http://localhost:4455",
+      "http://localhost:19006",
+      "https://www.ory.sh/",
+      "https://example.org/",
+      "https://www.example.org/",
+      "exp://example.com/my-app",
+      "https://example.com/my-app",
+    ],
+    methods: {
+      link: {
+        config: {
+          lifespan: "1h",
+        },
+      },
+      code: {
+        config: {
+          lifespan: "1h",
+        },
+      },
+      oidc: {
+        enabled: true,
+        config: {
+          providers: [
+            {
+              id: "hydra",
+              label: "Ory",
+              provider: "generic",
+              client_id: process.env["OIDC_HYDRA_CLIENT_ID"],
+              client_secret: process.env["OIDC_HYDRA_CLIENT_SECRET"],
+              issuer_url: "http://localhost:4444/",
+              scope: ["offline"],
+              mapper_url: "file://test/e2e/profiles/oidc/hydra.jsonnet",
+            },
+          ],
+        },
+      },
+    },
+
+    flows: {
+      settings: {
+        privileged_session_max_age: "5m",
+        ui_url: "http://localhost:4455/settings",
+      },
+      logout: {
+        after: {
+          default_browser_return_url: "http://localhost:4455/login",
+        },
+      },
+      registration: {
+        ui_url: "http://localhost:4455/registration",
+        after: {
+          password: {
+            hooks: [
+              {
+                hook: "session",
+              },
+            ],
+          },
+          oidc: {
+            hooks: [
+              {
+                hook: "session",
+              },
+            ],
+          },
+        },
+      },
+      login: {
+        ui_url: "http://localhost:4455/login",
+      },
+      error: {
+        ui_url: "http://localhost:4455/error",
+      },
+      verification: {
+        ui_url: "http://localhost:4455/verify",
+      },
+      recovery: {
+        enabled: true,
+        ui_url: "http://localhost:4455/recovery",
+      },
+    },
+  },
+
+  courier: {
+    smtp: {
+      connection_uri: "smtp://localhost:8026/?disable_starttls=true",
+    },
+  },
+}

test/e2e/playwright/setup/hydra-global-setup.ts

@@ -0,0 +1,40 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { request } from "@playwright/test"
+
+/**
+ * Creates a Hydra OAuth2 client and exposes its credentials via process.env so
+ * that test workers see the generated client_id / client_secret when they load
+ * the oidcConfig constants.  Playwright propagates process.env mutations from
+ * globalSetup to all worker processes.
+ */
+async function globalSetup() {
+  const context = await request.newContext()
+  try {
+    const resp = await context.post("http://localhost:4445/admin/clients", {
+      data: {
+        grant_types: ["authorization_code", "refresh_token"],
+        response_types: ["code", "id_token"],
+        scope: "openid offline",
+        redirect_uris: [
+          "http://localhost:4455/self-service/methods/oidc/callback/hydra",
+        ],
+      },
+    })
+
+    if (resp.status() !== 201) {
+      throw new Error(
+        `Failed to create Hydra OAuth2 client: ${resp.status()} ${await resp.text()}`,
+      )
+    }
+
+    const client = await resp.json()
+    process.env["OIDC_HYDRA_CLIENT_ID"] = client.client_id
+    process.env["OIDC_HYDRA_CLIENT_SECRET"] = client.client_secret
+  } finally {
+    await context.dispose()
+  }
+}
+
+export default globalSetup

test/e2e/playwright/tests/desktop/code/sms.spec.ts

@@ -0,0 +1,116 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { test } from "../../../fixtures"
+import { toConfig } from "../../../lib/helper"
+import smsSchema from "../../../fixtures/schemas/sms"
+import { LoginPage } from "../../../models/elements/login"
+import { hasSession } from "../../../actions/session"
+import { createIdentityWithPhoneNumber } from "../../../actions/identity"
+import {
+  deleteDocument,
+  documentUrl,
+  fetchDocument,
+} from "../../../actions/webhook"
+import { RegistrationPage } from "../../../models/elements/registration"
+import { CountryNames, generatePhoneNumber } from "phone-number-generator-js"
+
+const documentId = "doc-" + Math.random().toString(36).substring(7)
+
+test.describe("account enumeration protection off", () => {
+  test.use({
+    configOverride: {
+      security: {
+        account_enumeration: {
+          enabled: false,
+        },
+      },
+      selfservice: {
+        flows: {
+          login: {
+            style: "unified",
+          },
+          registration: {
+            after: {
+              code: {
+                hooks: [
+                  {
+                    hook: "session",
+                  },
+                ],
+              },
+            },
+          },
+        },
+        methods: {
+          code: {
+            passwordless_enabled: true,
+          },
+          password: {
+            enabled: false,
+          },
+        },
+      },
+      courier: {
+        channels: [
+          {
+            id: "sms",
+            type: "http",
+            request_config: {
+              body: "base64://ZnVuY3Rpb24oY3R4KSB7DQpjdHg6IGN0eCwNCn0=",
+              method: "PUT",
+              url: documentUrl(documentId),
+            },
+          },
+        ],
+      },
+      identity: {
+        default_schema_id: "sms",
+        schemas: [
+          {
+            id: "sms",
+            url:
+              "base64://" +
+              Buffer.from(JSON.stringify(smsSchema), "ascii").toString(
+                "base64",
+              ),
+          },
+        ],
+      },
+    },
+  })
+
+  test.afterEach(async () => {
+    await deleteDocument(documentId)
+  })
+
+  test("login succeeds", async ({ page, config, kratosPublicURL }) => {
+    const identity = await createIdentityWithPhoneNumber(page.request)
+
+    const login = new LoginPage(page, config)
+    await login.open()
+    await login.triggerLoginWithCode(identity.phone)
+
+    const result = await fetchDocument(documentId)
+    await login.codeInput.input.fill(result.ctx.template_data.login_code)
+    await login.codeSubmit.getByText("Continue").click()
+    await hasSession(page.request, kratosPublicURL)
+  })
+
+  test("registration succeeds", async ({ page, config, kratosPublicURL }) => {
+    const phone = generatePhoneNumber({
+      countryName: CountryNames.Germany,
+      withoutCountryCode: false,
+    })
+
+    const registration = new RegistrationPage(page, config)
+    await registration.open()
+    await registration.triggerRegistrationWithCode(phone)
+
+    const result = await fetchDocument(documentId)
+    const code = result.ctx.template_data.registration_code
+    await registration.inputField("code").fill(code)
+    await registration.submitField("code").getByText("Continue").click()
+    await hasSession(page.request, kratosPublicURL)
+  })
+})

test/e2e/playwright/tests/desktop/identifier_first/code.login.spec.ts

@@ -0,0 +1,636 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { expect } from "@playwright/test"
+import { search } from "../../../actions/mail"
+import { getSession, hasNoSession, hasSession } from "../../../actions/session"
+import { test } from "../../../fixtures"
+import { extractCode, toConfig } from "../../../lib/helper"
+import { LoginPage } from "../../../models/elements/login"
+import { SettingsPage } from "../../../models/elements/settings"
+import { logoutUrl } from "../../../actions/login"
+
+test.describe("account enumeration protection off", () => {
+  test.use({
+    configOverride: toConfig({
+      style: "identifier_first",
+      mitigateEnumeration: false,
+      selfservice: {
+        methods: {
+          code: {
+            passwordless_enabled: true,
+          },
+        },
+      },
+    }),
+  })
+
+  test("login fails because user does not exist", async ({ page, config }) => {
+    const login = new LoginPage(page, config)
+    await login.open()
+
+    await login.submitIdentifierFirst("i@donot.exist")
+
+    await expect(
+      page.locator('[data-testid="ui/message/4000037"]'),
+      "expect account not exist message to be shown",
+    ).toBeVisible()
+  })
+
+  test("login with wrong code fails", async ({
+    page,
+    identity,
+    kratosPublicURL,
+    config,
+  }) => {
+    const login = new LoginPage(page, config)
+    await login.open()
+
+    await login.triggerLoginWithCode(identity.email)
+
+    await login.codeInput.input.fill("123123")
+
+    await login.codeSubmit.getByText("Continue").click()
+
+    await hasNoSession(page.request, kratosPublicURL)
+    await expect(
+      page.locator('[data-testid="ui/message/4010008"]'),
+      "expect to be shown a wrong code error",
+    ).toBeVisible()
+  })
+
+  test("login succeeds", async ({
+    page,
+    identity,
+    config,
+    kratosPublicURL,
+  }) => {
+    const login = new LoginPage(page, config)
+    await login.open()
+
+    await login.triggerLoginWithCode(identity.email)
+
+    const mails = await search({ query: identity.email, kind: "to" })
+    expect(mails).toHaveLength(1)
+
+    const code = extractCode(mails[0])
+
+    await login.codeInput.input.fill(code)
+
+    await login.codeSubmit.getByText("Continue").click()
+
+    await hasSession(page.request, kratosPublicURL)
+  })
+})
+
+test.describe("account enumeration protection on", () => {
+  test.use({
+    configOverride: toConfig({
+      style: "identifier_first",
+      mitigateEnumeration: true,
+      selfservice: {
+        methods: {
+          password: {
+            enabled: false,
+          },
+          code: {
+            passwordless_enabled: true,
+          },
+        },
+      },
+    }),
+  })
+
+  test("login fails because user does not exist", async ({ page, config }) => {
+    const login = new LoginPage(page, config)
+    await login.open()
+
+    await login.submitIdentifierFirst("i@donot.exist")
+
+    await expect(
+      page.locator('button[name="method"][value="code"]'),
+      "expect to show the code form",
+    ).toBeVisible()
+  })
+
+  test("login with wrong code fails", async ({
+    page,
+    identity,
+    kratosPublicURL,
+    config,
+  }) => {
+    const login = new LoginPage(page, config)
+    await login.open()
+
+    await login.triggerLoginWithCode(identity.email)
+
+    await login.codeInput.input.fill("123123")
+
+    await login.codeSubmit.getByText("Continue").click()
+
+    await hasNoSession(page.request, kratosPublicURL)
+    await expect(
+      page.locator('[data-testid="ui/message/4010008"]'),
+      "expect to be shown a wrong code error",
+    ).toBeVisible()
+  })
+
+  test("login succeeds", async ({
+    page,
+    identity,
+    config,
+    kratosPublicURL,
+  }) => {
+    const login = new LoginPage(page, config)
+    await login.open()
+
+    await login.triggerLoginWithCode(identity.email)
+
+    const mails = await search({ query: identity.email, kind: "to" })
+    expect(mails).toHaveLength(1)
+
+    const code = extractCode(mails[0])
+
+    await login.codeInput.input.fill(code)
+
+    await login.codeSubmit.getByText("Continue").click()
+
+    await hasSession(page.request, kratosPublicURL)
+  })
+})
+
+for (const tc of [
+  {
+    name: "do fast login when only code method enabled and configured, mitigation off",
+    methodsEnabled: ["code"],
+    methodsConfigured: "code",
+    mitigation: false,
+    expectFastLogin: true,
+  },
+  {
+    name: "do fast login when only code method enabled and configured, mitigation on",
+    methodsEnabled: ["code"],
+    methodsConfigured: "code",
+    mitigation: true,
+    expectFastLogin: true,
+  },
+  {
+    name: "do not fast login when multiple methods enabled, all configured, mitigation off",
+    methodsEnabled: ["password", "code"],
+    methodsConfigured: "all",
+    mitigation: false,
+    expectFastLogin: false,
+  },
+  {
+    name: "do not fast login when multiple methods enabled, all configured, mitigation on",
+    methodsEnabled: ["password", "code"],
+    methodsConfigured: "all",
+    mitigation: true,
+    expectFastLogin: false,
+  },
+  {
+    name: "do fast login when multiple methods enabled, only code configured, mitigation off",
+    methodsEnabled: ["password", "code"],
+    methodsConfigured: "code",
+    mitigation: false,
+    expectFastLogin: true,
+  },
+  {
+    name: "do not fast login when multiple methods enabled, only code configured, mitigation on",
+    methodsEnabled: ["password", "code"],
+    methodsConfigured: "code",
+    mitigation: true,
+    expectFastLogin: false,
+  },
+]) {
+  test.describe(`account enumeration protection ${
+    tc.mitigation ? "on" : "off"
+  }`, () => {
+    test.use({
+      configOverride: toConfig({
+        style: "identifier_first",
+        mitigateEnumeration: tc.mitigation,
+        selfservice: {
+          methods: {
+            oidc: {
+              enabled: false,
+            },
+            password: {
+              enabled: tc.methodsEnabled.includes("password"),
+            },
+            code: {
+              passwordless_enabled: tc.methodsEnabled.includes("code"),
+            },
+          },
+        },
+      }),
+    })
+
+    test(
+      tc.name,
+      async ({ page, config, identity, identityWithoutPassword }) => {
+        const id =
+          tc.methodsConfigured === "all" ? identity : identityWithoutPassword
+
+        const login = new LoginPage(page, config)
+        await login.open()
+
+        await login.submitIdentifierFirst(id.email)
+
+        if (tc.expectFastLogin) {
+          await expect(login.submitPassword).toBeHidden()
+          await expect(
+            page.locator('[data-testid="ui/message/1010014"]'),
+            "expect code sent message to be shown",
+          ).toBeVisible()
+          await expect(login.codeSubmit).toBeVisible()
+        } else {
+          await expect(login.submitPassword).toBeVisible()
+          await expect(login.codeSubmit).toBeVisible()
+        }
+      },
+    )
+  })
+}
+
+test.describe(() => {
+  test.use({
+    configOverride: toConfig({
+      style: "identifier_first",
+      mitigateEnumeration: false,
+      selfservice: {
+        methods: {
+          password: {
+            enabled: false,
+          },
+          code: {
+            passwordless_enabled: true,
+          },
+        },
+      },
+      featureFlags: {
+        refresh_login_choose_address: true,
+      },
+    }),
+  })
+  test("refresh", async ({ page, identity, config, kratosPublicURL }) => {
+    const login = new LoginPage(page, config)
+
+    const [initialSession, initialCode] =
+      await test.step("initial login", async () => {
+        await login.open()
+        await login.triggerLoginWithCode(identity.email)
+
+        const mails = await search({ query: identity.email, kind: "to" })
+        expect(mails).toHaveLength(1)
+
+        const code = extractCode(mails[0])
+
+        await login.codeInput.input.fill(code)
+
+        await login.codeSubmit.getByText("Continue").click()
+
+        const session = await getSession(page.request, kratosPublicURL)
+        expect(session).toBeDefined()
+        expect(session.active).toBe(true)
+        return [session, code]
+      })
+
+    await login.open({
+      refresh: true,
+    })
+    // On a refresh login the identity is fixed by the session, so the screen
+    // shows a "Send code to <address>" button instead of an identifier field
+    // (ory/kratos#4194).
+    await expect(login.inputField("identifier")).toBeHidden()
+    await login.codeSubmitMfa.click()
+
+    const mails = await search({
+      query: identity.email,
+      kind: "to",
+      filter: (m) => !m.html.includes(initialCode),
+    })
+    expect(mails).toHaveLength(1)
+
+    const code = extractCode(mails[0])
+
+    await login.codeInput.input.fill(code)
+
+    await login.codeSubmit.getByText("Continue").click()
+    await page.waitForURL(
+      new RegExp(config.selfservice.default_browser_return_url),
+    )
+
+    const newSession = await getSession(page.request, kratosPublicURL)
+    expect(newSession).toBeDefined()
+    expect(newSession.active).toBe(true)
+
+    const initDate = Date.parse(initialSession.authenticated_at)
+    const newDate = Date.parse(newSession.authenticated_at)
+    expect(newDate).toBeGreaterThanOrEqual(initDate)
+  })
+})
+
+test.describe("second factor", () => {
+  for (const tc of [
+    {
+      name: "do fast login when only code method enabled and configured",
+      methodsEnabled: ["code"],
+      methodsConfigured: "code",
+      expectFastLogin: true,
+    },
+    {
+      name: "do not fast login when multiple methods enabled, all configured",
+      methodsEnabled: ["totp", "code"],
+      methodsConfigured: "all",
+      expectFastLogin: false,
+    },
+    {
+      name: "do fast login when multiple methods enabled, only code configured",
+      methodsEnabled: ["totp", "code"],
+      methodsConfigured: "code",
+      expectFastLogin: true,
+    },
+  ]) {
+    test.describe(`code mfa ${
+      tc.expectFastLogin ? "with" : "without"
+    } fast login`, () => {
+      test.use({
+        configOverride: toConfig({
+          style: "identifier_first",
+          selfservice: {
+            methods: {
+              oidc: {
+                enabled: false,
+              },
+              password: {
+                enabled: true,
+              },
+              totp: {
+                enabled: tc.methodsEnabled.includes("totp"),
+              },
+              code: {
+                passwordless_enabled: false,
+                mfa_enabled: tc.methodsEnabled.includes("code"),
+              },
+            },
+          },
+        }),
+      })
+
+      test(tc.name, async ({ page, config, identity, kratosPublicURL }) => {
+        const login = new LoginPage(page, config)
+
+        if (tc.methodsConfigured === "all") {
+          await test.step("setup TOTP", async () => {
+            await login.open()
+            await login.loginWithPassword(identity.email, identity.password)
+
+            const mails = await search({ query: identity.email, kind: "to" })
+            expect(mails).toHaveLength(1)
+            const code = extractCode(mails[0])
+            await login.codeInput.input.fill(code)
+            await login.codeSubmit.getByText("Continue").click()
+
+            const settings = new SettingsPage(page, config)
+            await settings.open()
+
+            await settings.setupTotp()
+
+            await page.goto(await logoutUrl(page.request, kratosPublicURL))
+          })
+        }
+
+        test.step("first factor authentication", async () => {
+          await login.open()
+          await login.loginWithPassword(identity.email, identity.password)
+        })
+
+        if (tc.expectFastLogin) {
+          await expect(login.totpInput.input).toBeHidden()
+          await expect(
+            page.locator('[data-testid="ui/message/1010025"]'),
+            "expect code sent message to be shown",
+          ).toBeVisible()
+          await expect(login.codeSubmit).toBeVisible()
+        } else {
+          await expect(login.totpInput.input).toBeVisible()
+          await expect(login.codeSubmitMfa).toBeVisible()
+        }
+      })
+    })
+  }
+})
+
+test.describe("second factor refresh", () => {
+  // TOTP is enabled alongside code so the code method does not fast-login as the
+  // only second factor. That keeps the flow on the regular handler path, which
+  // renders the "Send code to <address>" button this test exercises.
+  test.use({
+    configOverride: toConfig({
+      style: "identifier_first",
+      selfservice: {
+        methods: {
+          oidc: {
+            enabled: false,
+          },
+          password: {
+            enabled: true,
+          },
+          totp: {
+            enabled: true,
+          },
+          code: {
+            passwordless_enabled: false,
+            mfa_enabled: true,
+          },
+        },
+      },
+    }),
+  })
+
+  test("refreshes an aal2 session through the code address button", async ({
+    page,
+    config,
+    identity,
+    kratosPublicURL,
+  }) => {
+    const login = new LoginPage(page, config)
+    const seenCodes: string[] = []
+
+    await test.step("set up TOTP as a second 2FA method", async () => {
+      await login.open()
+      await login.loginWithPassword(identity.email, identity.password)
+
+      // The verified email already works as a code second factor, so with
+      // `highest_available` the flow fast-logs in to aal2 with code. Complete
+      // that before opening settings to set up TOTP.
+      const mails = await search({
+        query: identity.email,
+        kind: "to",
+        filter: (m) => !seenCodes.some((c) => m.html.includes(c)),
+      })
+      const code = extractCode(mails[0])
+      seenCodes.push(code)
+      await login.codeInput.input.fill(code)
+      await login.codeSubmit.getByText("Continue").click()
+
+      const settings = new SettingsPage(page, config)
+      await settings.open()
+      await settings.setupTotp()
+
+      await page.goto(await logoutUrl(page.request, kratosPublicURL))
+    })
+
+    const initialSession =
+      await test.step("log in to aal2 with the code second factor", async () => {
+        await login.open()
+        await login.loginWithPassword(identity.email, identity.password)
+
+        // With TOTP and code both configured, the flow escalates to aal2 and
+        // renders both factors instead of fast-logging in.
+        await expect(login.totpInput.input).toBeVisible()
+        await expect(login.codeSubmitMfa).toBeVisible()
+
+        await login.codeSubmitMfa.click()
+
+        const mails = await search({
+          query: identity.email,
+          kind: "to",
+          filter: (m) => !seenCodes.some((c) => m.html.includes(c)),
+        })
+        const code = extractCode(mails[0])
+        seenCodes.push(code)
+
+        await login.codeInput.input.fill(code)
+        await login.codeSubmit.getByText("Continue").click()
+
+        const session = await getSession(page.request, kratosPublicURL)
+        expect(session.active).toBe(true)
+        expect(session.authenticator_assurance_level).toBe("aal2")
+        return session
+      })
+
+    await test.step("refresh the aal2 session", async () => {
+      await login.open({
+        refresh: true,
+        aal: "aal2",
+      })
+
+      // On a refresh + aal2 flow the second-factor hydrator wins over the
+      // first-factor refresh branch: it renders "Send code to <address>"
+      // buttons and never the hidden first-factor identifier field
+      // (ory/kratos#4194).
+      await expect(login.codeSubmitMfa).toBeVisible()
+      await expect(login.inputField("identifier")).toBeHidden()
+
+      await login.codeSubmitMfa.click()
+
+      const mails = await search({
+        query: identity.email,
+        kind: "to",
+        filter: (m) => !seenCodes.some((c) => m.html.includes(c)),
+      })
+      expect(mails).toHaveLength(1)
+      const code = extractCode(mails[0])
+
+      await login.codeInput.input.fill(code)
+      await login.codeSubmit.getByText("Continue").click()
+      await page.waitForURL(
+        new RegExp(config.selfservice.default_browser_return_url),
+      )
+
+      const refreshedSession = await getSession(page.request, kratosPublicURL)
+      expect(refreshedSession.active).toBe(true)
+      expect(refreshedSession.authenticator_assurance_level).toBe("aal2")
+
+      const initialAuthAt = Date.parse(initialSession.authenticated_at)
+      const refreshedAuthAt = Date.parse(refreshedSession.authenticated_at)
+      expect(refreshedAuthAt).toBeGreaterThanOrEqual(initialAuthAt)
+    })
+  })
+
+  test("rejects a foreign address on an aal2 refresh", async ({
+    page,
+    config,
+    identity,
+    kratosPublicURL,
+  }) => {
+    const login = new LoginPage(page, config)
+    const seenCodes: string[] = []
+
+    await test.step("set up TOTP as a second 2FA method", async () => {
+      await login.open()
+      await login.loginWithPassword(identity.email, identity.password)
+
+      // Complete the code second factor that fast-login auto-sends, then set
+      // up TOTP so later flows render the address button instead of fast-login.
+      const mails = await search({
+        query: identity.email,
+        kind: "to",
+        filter: (m) => !seenCodes.some((c) => m.html.includes(c)),
+      })
+      const code = extractCode(mails[0])
+      seenCodes.push(code)
+      await login.codeInput.input.fill(code)
+      await login.codeSubmit.getByText("Continue").click()
+
+      const settings = new SettingsPage(page, config)
+      await settings.open()
+      await settings.setupTotp()
+
+      await page.goto(await logoutUrl(page.request, kratosPublicURL))
+    })
+
+    const aal2Session =
+      await test.step("log in to aal2 with the code second factor", async () => {
+        await login.open()
+        await login.loginWithPassword(identity.email, identity.password)
+
+        await login.codeSubmitMfa.click()
+
+        const mails = await search({
+          query: identity.email,
+          kind: "to",
+          filter: (m) => !seenCodes.some((c) => m.html.includes(c)),
+        })
+        const code = extractCode(mails[0])
+        seenCodes.push(code)
+        await login.codeInput.input.fill(code)
+        await login.codeSubmit.getByText("Continue").click()
+
+        const session = await getSession(page.request, kratosPublicURL)
+        expect(session.authenticator_assurance_level).toBe("aal2")
+        return session
+      })
+
+    await test.step("tampering the address with a foreign identifier is rejected", async () => {
+      await login.open({
+        refresh: true,
+        aal: "aal2",
+      })
+
+      // Tamper the server-rendered address button so it posts a foreign
+      // identifier. A refresh login must not send a code to it
+      // (ory/kratos#4194).
+      const foreignEmail = "not-" + identity.email
+      await login.codeSubmitMfa.evaluate(
+        (el, value) => el.setAttribute("value", value),
+        foreignEmail,
+      )
+      await login.codeSubmitMfa.click()
+
+      await expect(
+        page.locator('[data-testid="ui/message/4000035"]'),
+        "expect the no-code-credentials error to be shown",
+      ).toBeVisible()
+      await expect(login.codeInput.input).toBeHidden()
+
+      // The active session is untouched: still aal2, same authentication time.
+      const session = await getSession(page.request, kratosPublicURL)
+      expect(session.active).toBe(true)
+      expect(session.authenticator_assurance_level).toBe("aal2")
+      expect(session.authenticated_at).toBe(aal2Session.authenticated_at)
+    })
+  })
+})

test/e2e/playwright/tests/desktop/identifier_first/oidc.login.spec.ts

@@ -0,0 +1,171 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { faker } from "@faker-js/faker"
+import { expect, Page } from "@playwright/test"
+import { getSession, hasSession } from "../../../actions/session"
+import { test } from "../../../fixtures"
+import { toConfig } from "../../../lib/helper"
+import { LoginPage } from "../../../models/elements/login"
+import { OryKratosConfiguration } from "../../../../shared/config"
+
+async function loginHydra(page: Page) {
+  return test.step("login with hydra", async () => {
+    await page
+      .locator("input[name=username]")
+      .fill(faker.internet.email({ provider: "ory.sh" }))
+    await page.locator("button[name=action][value=accept]").click()
+    await page.locator("#offline").check()
+    await page.locator("#openid").check()
+
+    await page.locator("input[name=website]").fill(faker.internet.url())
+
+    await page.locator("button[name=action][value=accept]").click()
+  })
+}
+
+async function registerWithHydra(
+  page: Page,
+  config: OryKratosConfiguration,
+  kratosPublicURL: string,
+) {
+  return await test.step("register", async () => {
+    await page.goto("/registration")
+
+    await page.locator(`button[name=provider][value=hydra]`).click()
+
+    const email = faker.internet.email({ provider: "ory.sh" })
+    await page.locator("input[name=username]").fill(email)
+    await page.locator("#remember").check()
+    await page.locator("button[name=action][value=accept]").click()
+    await page.locator("#offline").check()
+    await page.locator("#openid").check()
+
+    await page.locator("input[name=website]").fill(faker.internet.url())
+
+    await page.locator("button[name=action][value=accept]").click()
+    await page.waitForURL(
+      new RegExp(config.selfservice.default_browser_return_url),
+    )
+    await page.context().clearCookies({
+      domain: new URL(kratosPublicURL).hostname,
+    })
+
+    await expect(
+      getSession(page.request, kratosPublicURL),
+    ).rejects.toThrowError()
+    return email
+  })
+}
+
+for (const mitigateEnumeration of [true, false]) {
+  test.describe(`account enumeration protection ${
+    mitigateEnumeration ? "on" : "off"
+  }`, () => {
+    test.use({
+      configOverride: toConfig({
+        mitigateEnumeration,
+        selfservice: {
+          methods: {
+            password: {
+              enabled: true,
+            },
+          },
+        },
+      }),
+    })
+
+    test("login", async ({ page, config, kratosPublicURL }) => {
+      const login = new LoginPage(page, config)
+      await login.open()
+
+      await page.locator(`button[name=provider][value=hydra]`).click()
+
+      await loginHydra(page)
+
+      await page.waitForURL(
+        new RegExp(config.selfservice.default_browser_return_url),
+      )
+
+      await hasSession(page.request, kratosPublicURL)
+    })
+
+    test("oidc sign in on second step", async ({
+      page,
+      config,
+      kratosPublicURL,
+    }) => {
+      const email = await registerWithHydra(page, config, kratosPublicURL)
+
+      const login = new LoginPage(page, config)
+      await login.open()
+
+      await login.submitIdentifierFirst(email)
+
+      // If account enumeration is mitigated, we should see the password method,
+      // because the identity has not set up a password
+      await expect(
+        page.locator('button[name="method"][value="password"]'),
+        "hide the password method",
+      ).toBeVisible({ visible: mitigateEnumeration })
+
+      await page.locator(`button[name=provider][value=hydra]`).click()
+
+      await loginHydra(page)
+
+      await page.waitForURL(
+        new RegExp(config.selfservice.default_browser_return_url),
+      )
+
+      const session = await getSession(page.request, kratosPublicURL)
+      expect(session).toBeDefined()
+      expect(session.active).toBe(true)
+    })
+  })
+}
+
+test("login with refresh", async ({ page, config, kratosPublicURL }) => {
+  await registerWithHydra(page, config, kratosPublicURL)
+
+  const login = new LoginPage(page, config)
+
+  const initialSession = await test.step("initial login", async () => {
+    await login.open()
+    await page.locator(`button[name=provider][value=hydra]`).click()
+
+    await loginHydra(page)
+
+    await page.waitForURL(
+      new RegExp(config.selfservice.default_browser_return_url),
+    )
+    return await getSession(page.request, kratosPublicURL)
+  })
+
+  // This is required, because OIDC issues a new session on refresh (TODO), and MySQL does not store sub second timestamps, so we need to wait a bit
+  await page.waitForTimeout(1000)
+  await test.step("refresh login", async () => {
+    await login.open({
+      refresh: true,
+    })
+
+    await expect(
+      page.locator('[data-testid="ui/message/1010003"]'),
+      "show the refresh message",
+    ).toBeVisible()
+
+    await page.locator(`button[name=provider][value=hydra]`).click()
+
+    await loginHydra(page)
+
+    await page.waitForURL(
+      new RegExp(config.selfservice.default_browser_return_url),
+    )
+    const newSession = await getSession(page.request, kratosPublicURL)
+    // expect(newSession.authentication_methods).toHaveLength(
+    //   initialSession.authentication_methods.length + 1,
+    // )
+    expect(newSession.authenticated_at).not.toBe(
+      initialSession.authenticated_at,
+    )
+  })
+})

test/e2e/playwright/tests/desktop/identifier_first/passkeys.login.spec.ts

@@ -0,0 +1,238 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { faker } from "@faker-js/faker"
+import { CDPSession, expect, Page } from "@playwright/test"
+import { OryKratosConfiguration } from "../../../../shared/config"
+import { getSession } from "../../../actions/session"
+import { test } from "../../../fixtures"
+import { toConfig } from "../../../lib/helper"
+import { LoginPage } from "../../../models/elements/login"
+
+async function toggleAutomaticPresenceSimulation(
+  cdpSession: CDPSession,
+  authenticatorId: string,
+  enabled: boolean,
+) {
+  await cdpSession.send("WebAuthn.setAutomaticPresenceSimulation", {
+    authenticatorId,
+    enabled,
+  })
+}
+
+async function registerWithPasskey(
+  page: Page,
+  pageCDPSession: CDPSession,
+  config: OryKratosConfiguration,
+  authenticatorId: string,
+  simulatePresence: boolean,
+) {
+  return await test.step("create webauthn identity", async () => {
+    await page.goto("/registration")
+    const identifier = faker.internet.email()
+    await page.locator(`input[name="traits.email"]`).fill(identifier)
+    await page
+      .locator(`input[name="traits.website"]`)
+      .fill(faker.internet.url())
+    await page.locator("button[name=method][value=profile]").click()
+
+    await toggleAutomaticPresenceSimulation(
+      pageCDPSession,
+      authenticatorId,
+      true,
+    )
+    await page.locator("button[name=passkey_register_trigger]").click()
+
+    await toggleAutomaticPresenceSimulation(
+      pageCDPSession,
+      authenticatorId,
+      simulatePresence,
+    )
+
+    await page.waitForURL(
+      new RegExp(config.selfservice.default_browser_return_url),
+    )
+    return identifier
+  })
+}
+
+const passkeyConfig = {
+  methods: {
+    passkey: {
+      enabled: true,
+      config: {
+        rp: {
+          display_name: "ORY",
+          id: "localhost",
+          origins: ["http://localhost:4455"],
+        },
+      },
+    },
+  },
+}
+
+for (const mitigateEnumeration of [true, false]) {
+  test.describe(`account enumeration protection ${
+    mitigateEnumeration ? "on" : "off"
+  }`, () => {
+    test.use({
+      configOverride: toConfig({
+        mitigateEnumeration,
+        style: "identifier_first",
+        selfservice: passkeyConfig,
+      }),
+    })
+
+    for (const simulatePresence of [true, false]) {
+      test.describe(`${
+        simulatePresence ? "with" : "without"
+      } automatic presence proof`, () => {
+        test.use({
+          virtualAuthenticatorOptions: {
+            automaticPresenceSimulation: simulatePresence,
+            // hasResidentKey: simulatePresence,
+          },
+        })
+        test("login", async ({
+          config,
+          page,
+          kratosPublicURL,
+          virtualAuthenticator,
+          pageCDPSession,
+        }) => {
+          const identifier = await registerWithPasskey(
+            page,
+            pageCDPSession,
+            config,
+            virtualAuthenticator.authenticatorId,
+            simulatePresence,
+          )
+          await page.context().clearCookies({})
+
+          const login = new LoginPage(page, config)
+          await login.open()
+
+          if (!simulatePresence) {
+            await login.submitIdentifierFirst(identifier)
+
+            const passkeyLoginTrigger = page.locator(
+              "button[name=passkey_login_trigger]",
+            )
+            await passkeyLoginTrigger.waitFor()
+
+            await page.waitForLoadState("load")
+
+            await toggleAutomaticPresenceSimulation(
+              pageCDPSession,
+              virtualAuthenticator.authenticatorId,
+              true,
+            )
+
+            await passkeyLoginTrigger.click()
+
+            await toggleAutomaticPresenceSimulation(
+              pageCDPSession,
+              virtualAuthenticator.authenticatorId,
+              false,
+            )
+          }
+
+          await page.waitForURL(
+            new RegExp(config.selfservice.default_browser_return_url),
+          )
+
+          await expect(
+            getSession(page.request, kratosPublicURL),
+          ).resolves.toMatchObject({
+            active: true,
+            identity: {
+              traits: {
+                email: identifier,
+              },
+            },
+          })
+        })
+      })
+    }
+  })
+}
+
+test.describe("without automatic presence simulation", () => {
+  test.use({
+    virtualAuthenticatorOptions: {
+      automaticPresenceSimulation: false,
+    },
+    configOverride: toConfig({
+      selfservice: passkeyConfig,
+    }),
+  })
+  test("login with refresh", async ({
+    page,
+    config,
+    kratosPublicURL,
+    pageCDPSession,
+    virtualAuthenticator,
+  }) => {
+    const identifier = await registerWithPasskey(
+      page,
+      pageCDPSession,
+      config,
+      virtualAuthenticator.authenticatorId,
+      true,
+    )
+
+    const login = new LoginPage(page, config)
+    // Due to resetting automatic presence simulating to "true" in the previous step,
+    // opening the login page automatically triggers the passkey login
+    await login.open()
+
+    await page.waitForURL(
+      new RegExp(config.selfservice.default_browser_return_url),
+    )
+
+    await expect(
+      getSession(page.request, kratosPublicURL),
+    ).resolves.toMatchObject({
+      active: true,
+      identity: {
+        traits: {
+          email: identifier,
+        },
+      },
+    })
+
+    await login.open({
+      refresh: true,
+    })
+
+    await expect(
+      page.locator('[data-testid="ui/message/1010003"]'),
+      "show the refresh message",
+    ).toBeVisible()
+
+    const initialSession = await getSession(page.request, kratosPublicURL)
+
+    const passkeyLoginTrigger = page.locator(
+      "button[name=passkey_login_trigger]",
+    )
+    await passkeyLoginTrigger.waitFor()
+
+    await page.waitForLoadState("load")
+
+    await toggleAutomaticPresenceSimulation(
+      pageCDPSession,
+      virtualAuthenticator.authenticatorId,
+      true,
+    )
+
+    await passkeyLoginTrigger.click()
+    await page.waitForURL(
+      new RegExp(config.selfservice.default_browser_return_url),
+    )
+    const newSession = await getSession(page.request, kratosPublicURL)
+
+    expect(newSession.authentication_methods).toHaveLength(
+      initialSession.authentication_methods.length + 1,
+    )
+  })
+})

test/e2e/playwright/tests/desktop/identifier_first/passkeys.options.spec.ts

@@ -0,0 +1,243 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { faker } from "@faker-js/faker"
+import { CDPSession, expect, Page } from "@playwright/test"
+import { OryKratosConfiguration } from "../../../../shared/config"
+import { getSession, hasNoSession } from "../../../actions/session"
+import { test } from "../../../fixtures"
+import { toConfig } from "../../../lib/helper"
+
+async function toggleAutomaticPresenceSimulation(
+  cdpSession: CDPSession,
+  authenticatorId: string,
+  enabled: boolean,
+) {
+  await cdpSession.send("WebAuthn.setAutomaticPresenceSimulation", {
+    authenticatorId,
+    enabled,
+  })
+}
+
+async function startPasskeyRegistration(page: Page) {
+  await page.goto("/registration")
+  const identifier = faker.internet.email()
+  await page.locator(`input[name="traits.email"]`).fill(identifier)
+  await page.locator(`input[name="traits.website"]`).fill(faker.internet.url())
+  await page.locator("button[name=method][value=profile]").click()
+  return identifier
+}
+
+async function registerWithPasskey(
+  page: Page,
+  pageCDPSession: CDPSession,
+  config: OryKratosConfiguration,
+  authenticatorId: string,
+) {
+  return await test.step("create passkey identity", async () => {
+    const identifier = await startPasskeyRegistration(page)
+    await toggleAutomaticPresenceSimulation(
+      pageCDPSession,
+      authenticatorId,
+      true,
+    )
+    await page.locator("button[name=passkey_register_trigger]").click()
+
+    await page.waitForURL(
+      new RegExp(config.selfservice.default_browser_return_url),
+    )
+    return identifier
+  })
+}
+
+test.describe("passkey options - cross-platform attachment", () => {
+  test.use({
+    configOverride: toConfig({
+      style: "identifier_first",
+      selfservice: {
+        methods: {
+          passkey: {
+            enabled: true,
+            config: {
+              rp: {
+                display_name: "ORY",
+                id: "localhost",
+                origins: ["http://localhost:4455"],
+              },
+              authenticator_selection: {
+                attachment: "cross-platform",
+              },
+            },
+          },
+        },
+        flows: {
+          registration: {
+            after: {
+              passkey: {
+                hooks: [{ hook: "session" }],
+              },
+            },
+          },
+        },
+      },
+    }),
+    virtualAuthenticatorOptions: {
+      automaticPresenceSimulation: true,
+      hasResidentKey: true,
+      transport: "usb",
+    },
+  })
+
+  test("registration with cross-platform authenticator succeeds", async ({
+    config,
+    page,
+    pageCDPSession,
+    virtualAuthenticator,
+    kratosPublicURL,
+  }) => {
+    const identifier = await registerWithPasskey(
+      page,
+      pageCDPSession,
+      config,
+      virtualAuthenticator.authenticatorId,
+    )
+
+    await expect(
+      getSession(page.request, kratosPublicURL),
+    ).resolves.toMatchObject({
+      active: true,
+      identity: { traits: { email: identifier } },
+    })
+  })
+})
+
+test.describe("passkey options - user verification required", () => {
+  test.use({
+    configOverride: toConfig({
+      style: "identifier_first",
+      selfservice: {
+        methods: {
+          passkey: {
+            enabled: true,
+            config: {
+              rp: {
+                display_name: "ORY",
+                id: "localhost",
+                origins: ["http://localhost:4455"],
+              },
+              authenticator_selection: {
+                user_verification: "required",
+              },
+            },
+          },
+        },
+        flows: {
+          registration: {
+            after: {
+              passkey: {
+                hooks: [{ hook: "session" }],
+              },
+            },
+          },
+        },
+      },
+    }),
+    virtualAuthenticatorOptions: {
+      automaticPresenceSimulation: true,
+      hasResidentKey: true,
+      hasUserVerification: true,
+      isUserVerified: true,
+    },
+  })
+
+  test("registration with user verification required succeeds", async ({
+    config,
+    page,
+    pageCDPSession,
+    virtualAuthenticator,
+    kratosPublicURL,
+  }) => {
+    const identifier = await registerWithPasskey(
+      page,
+      pageCDPSession,
+      config,
+      virtualAuthenticator.authenticatorId,
+    )
+
+    await expect(
+      getSession(page.request, kratosPublicURL),
+    ).resolves.toMatchObject({
+      active: true,
+      identity: { traits: { email: identifier } },
+    })
+  })
+})
+
+test.describe("passkey options - user verification required, authenticator cannot verify", () => {
+  // Authenticator reports no UV capability, so the browser refuses to
+  // create a credential when the RP sets user_verification=required.
+  test.use({
+    configOverride: toConfig({
+      style: "identifier_first",
+      selfservice: {
+        methods: {
+          passkey: {
+            enabled: true,
+            config: {
+              rp: {
+                display_name: "ORY",
+                id: "localhost",
+                origins: ["http://localhost:4455"],
+              },
+              authenticator_selection: {
+                user_verification: "required",
+              },
+            },
+          },
+        },
+        flows: {
+          registration: {
+            after: {
+              passkey: {
+                hooks: [{ hook: "session" }],
+              },
+            },
+          },
+        },
+      },
+    }),
+    virtualAuthenticatorOptions: {
+      automaticPresenceSimulation: true,
+      hasResidentKey: true,
+      hasUserVerification: false,
+      isUserVerified: false,
+    },
+  })
+
+  test("registration fails and leaves the user on the registration page", async ({
+    page,
+    pageCDPSession,
+    virtualAuthenticator,
+    kratosPublicURL,
+  }) => {
+    await startPasskeyRegistration(page)
+    await toggleAutomaticPresenceSimulation(
+      pageCDPSession,
+      virtualAuthenticator.authenticatorId,
+      true,
+    )
+    await page.locator("button[name=passkey_register_trigger]").click()
+
+    // Credential creation must fail; the flow must not finalize a session.
+    // Give the browser time to reject the ceremony, then assert we stay on
+    // /registration and no session exists.
+    await page.waitForTimeout(1000)
+    await expect(page).toHaveURL(/\/registration/)
+    await hasNoSession(page.request, kratosPublicURL)
+
+    // The passkey trigger must remain visible so the user can retry.
+    await expect(
+      page.locator("button[name=passkey_register_trigger]"),
+    ).toBeVisible()
+  })
+})

test/e2e/playwright/tests/desktop/identifier_first/password.login.spec.ts

@@ -0,0 +1,236 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { expect } from "@playwright/test"
+import { loginWithPassword } from "../../../actions/login"
+import { getSession, hasNoSession, hasSession } from "../../../actions/session"
+import { test } from "../../../fixtures"
+import { toConfig } from "../../../lib/helper"
+import { LoginPage } from "../../../models/elements/login"
+
+// These can run in parallel because they use the same config.
+test.describe("account enumeration protection off", () => {
+  test.use({
+    configOverride: toConfig({
+      style: "identifier_first",
+      mitigateEnumeration: false,
+      selfservice: {
+        methods: {
+          password: {
+            enabled: true,
+          },
+          code: {
+            passwordless_enabled: false,
+          },
+        },
+      },
+    }),
+  })
+
+  test("login fails because user does not exist", async ({ page, config }) => {
+    const login = new LoginPage(page, config)
+    await login.open()
+
+    await login.submitIdentifierFirst("i@donot.exist")
+
+    await expect(
+      page.locator('[data-testid="ui/message/4000037"]'),
+      "expect account not exist message to be shown",
+    ).toBeVisible()
+  })
+
+  test("login with wrong password fails", async ({
+    page,
+    identity,
+    kratosPublicURL,
+    config,
+  }) => {
+    const login = new LoginPage(page, config)
+    await login.open()
+
+    await login.loginWithPassword(identity.email, "wrong-password")
+    await login.isReady()
+
+    await hasNoSession(page.request, kratosPublicURL)
+    await expect(
+      page.locator('[data-testid="ui/message/4000006"]'),
+      "expect to be shown a credentials do not exist error",
+    ).toBeVisible()
+  })
+
+  test("login succeeds", async ({
+    page,
+    identity,
+    config,
+    kratosPublicURL,
+  }) => {
+    const login = new LoginPage(page, config)
+    await login.open()
+
+    await login.inputField("identifier").fill(identity.email)
+    await login.submit("identifier_first", {
+      waitForURL: new RegExp(config.selfservice.flows.login.ui_url),
+    })
+
+    await login.inputField("password").fill(identity.password)
+    await login.submit("password", {
+      waitForURL: new RegExp(config.selfservice.default_browser_return_url),
+    })
+
+    await hasSession(page.request, kratosPublicURL)
+  })
+
+  test("login with refresh", async ({
+    page,
+    config,
+    identity,
+    kratosPublicURL,
+  }) => {
+    await loginWithPassword(
+      {
+        password: identity.password,
+        traits: {
+          email: identity.email,
+        },
+      },
+      page.request,
+      kratosPublicURL,
+    )
+
+    const login = new LoginPage(page, config)
+    await login.open({
+      refresh: true,
+    })
+
+    await expect(
+      page.locator('[data-testid="ui/message/1010003"]'),
+      "show the refresh message",
+    ).toBeVisible()
+
+    const initialSession = await getSession(page.request, kratosPublicURL)
+    await login.inputField("password").fill(identity.password)
+    await login.submit("password", {
+      waitForURL: new RegExp(config.selfservice.default_browser_return_url),
+    })
+
+    const newSession = await getSession(page.request, kratosPublicURL)
+
+    expect(newSession.authentication_methods).toHaveLength(
+      initialSession.authentication_methods.length + 1,
+    )
+  })
+})
+
+test.describe("account enumeration protection on", () => {
+  test.use({
+    configOverride: toConfig({
+      style: "identifier_first",
+      mitigateEnumeration: true,
+      selfservice: {
+        methods: {
+          password: {
+            enabled: true,
+          },
+          code: {
+            passwordless_enabled: false,
+          },
+        },
+      },
+    }),
+  })
+
+  test("login fails because user does not exist", async ({ page, config }) => {
+    const login = new LoginPage(page, config)
+    await login.open()
+
+    await login.submitIdentifierFirst("i@donot.exist")
+
+    await expect(
+      page.locator('button[name="method"][value="password"]'),
+      "expect to show the password form",
+    ).toBeVisible()
+  })
+
+  test("login with wrong password fails", async ({
+    page,
+    identity,
+    kratosPublicURL,
+    config,
+  }) => {
+    const login = new LoginPage(page, config)
+    await login.open()
+
+    await login.loginWithPassword(identity.email, "wrong-password")
+    await login.isReady()
+
+    await hasNoSession(page.request, kratosPublicURL)
+    await expect(
+      page.locator('[data-testid="ui/message/4000006"]'),
+      "expect to be shown a credentials do not exist error",
+    ).toBeVisible()
+  })
+
+  test("login succeeds", async ({
+    page,
+    // projectFrontendClient,
+    identity,
+    config,
+    kratosPublicURL,
+  }) => {
+    const login = new LoginPage(page, config)
+    await login.open()
+
+    await login.inputField("identifier").fill(identity.email)
+    await login.submit("identifier_first", {
+      waitForURL: new RegExp(config.selfservice.flows.login.ui_url),
+    })
+
+    await login.inputField("password").fill(identity.password)
+    await login.submit("password", {
+      waitForURL: new RegExp(config.selfservice.default_browser_return_url),
+    })
+
+    await hasSession(page.request, kratosPublicURL)
+  })
+
+  test("login with refresh", async ({
+    page,
+    config,
+    identity,
+    kratosPublicURL,
+  }) => {
+    await loginWithPassword(
+      {
+        password: identity.password,
+        traits: {
+          email: identity.email,
+        },
+      },
+      page.request,
+      kratosPublicURL,
+    )
+
+    const login = new LoginPage(page, config)
+    await login.open({
+      refresh: true,
+    })
+
+    await expect(
+      page.locator('[data-testid="ui/message/1010003"]'),
+      "show the refresh message",
+    ).toBeVisible()
+
+    const initialSession = await getSession(page.request, kratosPublicURL)
+
+    await login.inputField("password").fill(identity.password)
+    await login.submit("password", {
+      waitForURL: new RegExp(config.selfservice.default_browser_return_url),
+    })
+
+    const newSession = await getSession(page.request, kratosPublicURL)
+
+    expect(newSession.authentication_methods).toHaveLength(
+      initialSession.authentication_methods.length + 1,
+    )
+  })
+})

test/e2e/playwright/tests/desktop/profile_first/everything.registration.spec.ts

@@ -0,0 +1,147 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { expect } from "@playwright/test"
+import { test } from "../../../fixtures"
+import { toConfig } from "../../../lib/helper"
+import { RegistrationPage } from "../../../models/elements/registration"
+import {
+  OryKratosConfiguration,
+  RegistrationFlowStyle,
+  RegistrationNodeGroup,
+} from "../../../../shared/config"
+
+const selfservice: Partial<OryKratosConfiguration["selfservice"]> = {
+  methods: {
+    code: {
+      passwordless_enabled: true,
+    },
+    password: {
+      enabled: true,
+    },
+    webauthn: {
+      enabled: true,
+      config: {
+        passwordless: true,
+        rp: { id: "localhost", display_name: "Ory Kratos" },
+      },
+    },
+    passkey: {
+      enabled: true,
+      config: {
+        rp: { id: "localhost", display_name: "Ory Kratos" },
+      },
+    },
+    totp: {
+      enabled: true,
+    },
+    lookup_secret: {
+      enabled: true,
+    },
+    oidc: {
+      enabled: true,
+      config: {
+        providers: [
+          {
+            id: "github",
+            provider: "github",
+            label: "GitHub",
+            client_id: "1",
+            client_secret: "1",
+            mapper_url: "base64://",
+          },
+          {
+            id: "google",
+            provider: "google",
+            label: "Google",
+            client_id: "1",
+            client_secret: "1",
+            mapper_url: "base64://e30=",
+          },
+        ],
+      },
+    },
+  },
+}
+
+test.describe("profile_first strategy with all methods enabled", () => {
+  ;["default", "password"].forEach((group: RegistrationNodeGroup) => {
+    test.describe(`password group behavior is ${group}`, () => {
+      ;["profile_first", "unified"].forEach((style: RegistrationFlowStyle) => {
+        test.describe(`registration with ${style} enabled`, () => {
+          ;[
+            ["password"],
+            ["password", "webauthn"],
+            ["password", "code"],
+            ["password", "code", "webauthn"],
+            ["password", "code", "passkey"],
+            ["password", "code", "passkey", "webauthn"],
+          ].forEach((methods) => {
+            test.describe(`methods ${methods.join(", ")} enabled`, () => {
+              test.use({
+                configOverride: {
+                  ...toConfig({
+                    style: "identifier_first",
+                    mitigateEnumeration: false,
+                    selfservice: {
+                      ...selfservice,
+                      methods: {
+                        password: {
+                          enabled: methods.includes("password"),
+                        },
+                        webauthn: {
+                          enabled: methods.includes("webauthn"),
+                          config: {
+                            passwordless: true,
+                            rp: { id: "localhost", display_name: "Ory Kratos" },
+                          },
+                        },
+                        passkey: {
+                          enabled: methods.includes("passkey"),
+                          config: {
+                            rp: { id: "localhost", display_name: "Ory Kratos" },
+                          },
+                        },
+                        code: {
+                          enabled: methods.includes("code"),
+                          passwordless_enabled: methods.includes("code"),
+                        },
+                        totp: {
+                          enabled: false,
+                        },
+                        lookup_secret: {
+                          enabled: false,
+                        },
+                        oidc: {
+                          enabled: false,
+                        },
+                      },
+                      flows: {
+                        registration: { style },
+                      },
+                    },
+                  }),
+                  feature_flags: {
+                    password_profile_registration_node_group: group,
+                  },
+                },
+              })
+              test("registration does not have any duplicated fields when using profile first", async ({
+                page,
+                config,
+              }) => {
+                const registration = new RegistrationPage(page, config)
+                await registration.open()
+
+                await expect(
+                  page.locator('[name="traits.email"]'),
+                  "expect the profile form fields to not be duplicated",
+                ).toHaveCount(style === "profile_first" ? 1 : methods.length)
+              })
+            })
+          })
+        })
+      })
+    })
+  })
+})

test/e2e/playwright/tests/desktop/regression/phone-normalization.spec.ts

@@ -0,0 +1,769 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { APIRequestContext } from "@playwright/test"
+import type { OryKratosConfiguration } from "../../../../shared/config"
+import { downgradeLegacyIdentity } from "../../../actions/db"
+import {
+  createIdentity,
+  createIdentityWithPhoneAndPassword,
+} from "../../../actions/identity"
+import { hasNoSession, hasSession } from "../../../actions/session"
+import {
+  deleteDocument,
+  documentUrl,
+  fetchDocument,
+} from "../../../actions/webhook"
+import { expect, test } from "../../../fixtures"
+import smsSchema from "../../../fixtures/schemas/sms"
+import smsOidcSchema from "../../../fixtures/schemas/sms-oidc"
+import smsPasswordSchema from "../../../fixtures/schemas/sms-password"
+import { LoginPage } from "../../../models/elements/login"
+import { RegistrationPage } from "../../../models/elements/registration"
+
+test.skip(
+  process.env.DB !== "sqlite",
+  "These tests rely on a SQL downgrade that only works with SQLite.",
+)
+
+type DeepPartial<T> = T extends object
+  ? { [P in keyof T]?: DeepPartial<T[P]> }
+  : T
+
+// Test phone numbers — deterministic so the SQL downgrade can target the known E.164 form
+const DE_LEGACY = "+49 176 671 11 638"
+const DE_E164 = "+4917667111638"
+const DE_DASHED = "+49-176-671-11-638"
+
+const US_LEGACY = "+1 (415) 555-2671"
+const US_E164 = "+14155552671"
+
+const smsDocumentId = "doc-sms-" + Math.random().toString(36).substring(7)
+
+function smsSchemaBase64(schema: object) {
+  return (
+    "base64://" +
+    Buffer.from(JSON.stringify(schema), "ascii").toString("base64")
+  )
+}
+
+// Always register all three SMS schemas so identities from any test group
+// can be listed and deleted via the admin API regardless of which schema
+// is "active". Without this, cleanIdentities() silently fails when the
+// current config doesn't know the schema of an existing identity.
+function allSmsSchemas() {
+  return [
+    { id: "sms" as const, url: smsSchemaBase64(smsSchema) },
+    { id: "sms-password" as const, url: smsSchemaBase64(smsPasswordSchema) },
+    { id: "sms-oidc" as const, url: smsSchemaBase64(smsOidcSchema) },
+    // Include default and email schemas so cleanIdentities can list identities
+    // left over from other test specs that use these schemas.
+    {
+      id: "default" as const,
+      url: "file://test/e2e/profiles/oidc/identity.traits.schema.json",
+    },
+    {
+      id: "email" as const,
+      url: "file://test/e2e/profiles/email/identity.traits.schema.json",
+    },
+  ]
+}
+
+function smsCourierChannels() {
+  return [
+    {
+      id: "sms" as const,
+      type: "http" as const,
+      request_config: {
+        body: "base64://ZnVuY3Rpb24oY3R4KSB7DQpjdHg6IGN0eCwNCn0=",
+        method: "PUT",
+        url: documentUrl(smsDocumentId),
+      },
+    },
+  ]
+}
+
+/**
+ * Config for code-only login flows (A, B, F tests).
+ * Password is disabled so the unified login page renders a single identifier
+ * input, avoiding the strict-mode violation caused by two `input[name=identifier]`
+ * elements when both code and password methods are active.
+ */
+function smsCodeConfig(schemaId: string): DeepPartial<OryKratosConfiguration> {
+  return {
+    security: { account_enumeration: { enabled: false } },
+    selfservice: {
+      flows: {
+        login: { style: "unified" },
+        registration: {
+          after: { code: { hooks: [{ hook: "session" }] } },
+        },
+        recovery: { enabled: true, use: "code" },
+      },
+      methods: {
+        code: { passwordless_enabled: true },
+        password: { enabled: false },
+      },
+    },
+    courier: { channels: smsCourierChannels() },
+    identity: { default_schema_id: schemaId, schemas: allSmsSchemas() },
+  }
+}
+
+/**
+ * Config for password+recovery flows (C, D, E tests).
+ * Code is enabled (for recovery) but passwordless_enabled is false so the
+ * login page shows only the password form (single identifier input).
+ * Recovery V2 (choose_recovery_address) is enabled so that SMS phone addresses
+ * are supported — Recovery V1 hardcodes AddressTypeEmail and never sends SMS.
+ */
+function smsPasswordConfig(
+  schemaId: string,
+): DeepPartial<OryKratosConfiguration> {
+  return {
+    security: { account_enumeration: { enabled: false } },
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    feature_flags: {
+      // choose_recovery_address enables Recovery V2 which supports SMS phone
+      // addresses — Recovery V1 hardcodes AddressTypeEmail and never sends SMS.
+      choose_recovery_address: true,
+      use_continue_with_transitions: true,
+    } as any,
+    selfservice: {
+      flows: {
+        login: { style: "unified" },
+        registration: {
+          after: { password: { hooks: [{ hook: "session" }] } },
+        },
+        recovery: { enabled: true, use: "code" },
+      },
+      methods: {
+        code: { enabled: true, passwordless_enabled: false },
+        password: { enabled: true },
+      },
+    },
+    courier: { channels: smsCourierChannels() },
+    identity: { default_schema_id: schemaId, schemas: allSmsSchemas() },
+  }
+}
+
+/**
+ * Deletes all identities via the admin API.
+ * Called in beforeEach to ensure a clean DB state for every test,
+ * preventing UNIQUE constraint violations from previous test runs or retries.
+ */
+async function cleanIdentities(request: APIRequestContext) {
+  const resp = await request.get(
+    "http://localhost:4434/admin/identities?per_page=250",
+  )
+  if (!resp.ok()) {
+    console.error(
+      `cleanIdentities: list failed with status ${resp.status()}: ${await resp.text()}`,
+    )
+    return
+  }
+  const identities: Array<{ id: string }> = await resp.json()
+  for (const identity of identities) {
+    const del = await request.delete(
+      `http://localhost:4434/admin/identities/${identity.id}`,
+    )
+    if (!del.ok()) {
+      console.error(
+        `cleanIdentities: delete ${identity.id} failed with status ${del.status()}`,
+      )
+    }
+  }
+}
+
+// ────────────────────────────────────────────────────────────────────
+// A. Code login (SMS) — legacy data
+// ────────────────────────────────────────────────────────────────────
+test.describe("A: code login with legacy phone data", () => {
+  test.use({
+    configOverride: smsCodeConfig("sms"),
+  })
+
+  test.beforeEach(async ({ page }) => {
+    await cleanIdentities(page.request)
+  })
+
+  test.afterEach(async () => {
+    await deleteDocument(smsDocumentId)
+  })
+
+  test("A1: login succeeds with exact legacy format", async ({
+    page,
+    config,
+    kratosPublicURL,
+  }) => {
+    // Create identity with DE_LEGACY via admin API — Kratos normalizes and stores DE_E164
+    const identity = await createIdentity(page.request, {
+      schema_id: "sms",
+      traits: { phone: DE_LEGACY },
+    })
+    // Revert DE_E164 → DE_LEGACY to simulate a pre-normalization DB record
+    downgradeLegacyIdentity(identity.id, DE_LEGACY, DE_E164)
+
+    const login = new LoginPage(page, config)
+    await login.open()
+    await login.triggerLoginWithCode(DE_LEGACY)
+
+    const result = await fetchDocument(smsDocumentId)
+    await login.codeInput.input.fill(result.ctx.template_data.login_code)
+    await Promise.all([
+      page.waitForURL(
+        new RegExp(config.selfservice.default_browser_return_url),
+      ),
+      login.codeSubmit.getByText("Continue").click(),
+    ])
+    await hasSession(page.request, kratosPublicURL)
+  })
+
+  test("A2: login fails with E.164 when DB has legacy format (known limitation)", async ({
+    page,
+    config,
+    kratosPublicURL,
+  }) => {
+    // Create with legacy, store as DE_E164, then downgrade to legacy
+    const identity = await createIdentity(page.request, {
+      schema_id: "sms",
+      traits: { phone: DE_LEGACY },
+    })
+    downgradeLegacyIdentity(identity.id, DE_LEGACY, DE_E164)
+
+    const login = new LoginPage(page, config)
+    await login.open()
+    // Enter E.164 format — IN query becomes IN(DE_E164, DE_E164), no match on legacy DB row
+    await login.inputField("identifier").fill(DE_E164)
+    await Promise.all([
+      page.waitForLoadState("networkidle"),
+      login.codeSubmit.click(),
+    ])
+
+    // No SMS code is sent because no identity was found
+    await hasNoSession(page.request, kratosPublicURL)
+  })
+
+  test("A3: login fails with dashed format when DB has legacy format", async ({
+    page,
+    config,
+    kratosPublicURL,
+  }) => {
+    const identity = await createIdentity(page.request, {
+      schema_id: "sms",
+      traits: { phone: DE_LEGACY },
+    })
+    downgradeLegacyIdentity(identity.id, DE_LEGACY, DE_E164)
+
+    const login = new LoginPage(page, config)
+    await login.open()
+    await login.inputField("identifier").fill(DE_DASHED)
+    await Promise.all([
+      page.waitForLoadState("networkidle"),
+      login.codeSubmit.click(),
+    ])
+
+    await hasNoSession(page.request, kratosPublicURL)
+  })
+})
+
+// ────────────────────────────────────────────────────────────────────
+// B. Code login (SMS) — new data (control group)
+// ────────────────────────────────────────────────────────────────────
+test.describe("B: code login with newly registered phone data", () => {
+  test.use({
+    configOverride: smsCodeConfig("sms"),
+  })
+
+  test.beforeEach(async ({ page }) => {
+    await cleanIdentities(page.request)
+  })
+
+  test.afterEach(async () => {
+    await deleteDocument(smsDocumentId)
+  })
+
+  test("B1: register with spaces, login with E.164", async ({
+    page,
+    config,
+    kratosPublicURL,
+  }) => {
+    // Register with non-normalized phone — new Kratos normalizes and stores DE_E164
+    const registration = new RegistrationPage(page, config)
+    await registration.open()
+    await registration.triggerRegistrationWithCode(DE_LEGACY)
+
+    let result = await fetchDocument(smsDocumentId)
+    const regCode = result.ctx.template_data.registration_code
+    await registration.inputField("code").fill(regCode)
+    await Promise.all([
+      page.waitForURL(
+        new RegExp(config.selfservice.default_browser_return_url),
+      ),
+      registration.submitField("code").getByText("Continue").click(),
+    ])
+    await hasSession(page.request, kratosPublicURL)
+
+    // Clear session for login test
+    await page.context().clearCookies()
+    await deleteDocument(smsDocumentId)
+
+    // Login with E.164 — should succeed because DB now stores E.164 (new normalization)
+    const login = new LoginPage(page, config)
+    await login.open()
+    await login.triggerLoginWithCode(DE_E164)
+
+    result = await fetchDocument(smsDocumentId)
+    await login.codeInput.input.fill(result.ctx.template_data.login_code)
+    await login.codeSubmit.getByText("Continue").click()
+    await hasSession(page.request, kratosPublicURL)
+  })
+
+  test("B2: register with spaces, login with same spaces", async ({
+    page,
+    config,
+    kratosPublicURL,
+  }) => {
+    const registration = new RegistrationPage(page, config)
+    await registration.open()
+    await registration.triggerRegistrationWithCode(DE_LEGACY)
+
+    let result = await fetchDocument(smsDocumentId)
+    const regCode = result.ctx.template_data.registration_code
+    await registration.inputField("code").fill(regCode)
+    await Promise.all([
+      page.waitForURL(
+        new RegExp(config.selfservice.default_browser_return_url),
+      ),
+      registration.submitField("code").getByText("Continue").click(),
+    ])
+    await hasSession(page.request, kratosPublicURL)
+
+    await page.context().clearCookies()
+    await deleteDocument(smsDocumentId)
+
+    // Login with same spaced format — IN query's 2nd value (raw input) matches
+    const login = new LoginPage(page, config)
+    await login.open()
+    await login.triggerLoginWithCode(DE_LEGACY)
+
+    result = await fetchDocument(smsDocumentId)
+    await login.codeInput.input.fill(result.ctx.template_data.login_code)
+    await login.codeSubmit.getByText("Continue").click()
+    await hasSession(page.request, kratosPublicURL)
+  })
+})
+
+// ────────────────────────────────────────────────────────────────────
+// C. Password login with phone — legacy data
+// ────────────────────────────────────────────────────────────────────
+test.describe("C: password login with legacy phone data", () => {
+  const password = "vErY-s3cur3-p@ss!"
+
+  test.use({
+    configOverride: smsPasswordConfig("sms-password"),
+  })
+
+  test.beforeEach(async ({ page }) => {
+    await cleanIdentities(page.request)
+  })
+
+  test.afterEach(async () => {
+    await deleteDocument(smsDocumentId)
+  })
+
+  test("C1: password login succeeds with exact legacy phone format", async ({
+    page,
+    config,
+    kratosPublicURL,
+  }) => {
+    // Create via admin API — Kratos stores DE_E164, then downgrade to legacy
+    const { identity } = await createIdentityWithPhoneAndPassword(
+      page.request,
+      DE_LEGACY,
+      password,
+      "sms-password",
+    )
+    downgradeLegacyIdentity(identity.id, DE_LEGACY, DE_E164)
+
+    const login = new LoginPage(page, config)
+    await login.open()
+    await login.loginWithPassword(DE_LEGACY, password)
+    await hasSession(page.request, kratosPublicURL)
+  })
+
+  test("C2: password login fails with E.164 when DB has legacy format (known limitation)", async ({
+    page,
+    config,
+    kratosPublicURL,
+  }) => {
+    const { identity } = await createIdentityWithPhoneAndPassword(
+      page.request,
+      DE_LEGACY,
+      password,
+      "sms-password",
+    )
+    downgradeLegacyIdentity(identity.id, DE_LEGACY, DE_E164)
+
+    const login = new LoginPage(page, config)
+    await login.open()
+    // E.164 input — IN query produces IN(DE_E164, DE_E164) — no match on legacy value
+    await login.loginWithPassword(DE_E164, password)
+    await page.waitForLoadState("networkidle")
+    await hasNoSession(page.request, kratosPublicURL)
+  })
+})
+
+// ────────────────────────────────────────────────────────────────────
+// D. Recovery via SMS — legacy data
+// ────────────────────────────────────────────────────────────────────
+test.describe("D: SMS recovery with legacy phone data", () => {
+  const password = "vErY-s3cur3-p@ss!"
+
+  test.use({
+    configOverride: smsPasswordConfig("sms-password"),
+  })
+
+  test.beforeEach(async ({ page }) => {
+    await cleanIdentities(page.request)
+  })
+
+  test.afterEach(async () => {
+    await deleteDocument(smsDocumentId)
+  })
+
+  test("D1: recovery succeeds with exact legacy phone format", async ({
+    page,
+    config,
+  }) => {
+    const { identity } = await createIdentityWithPhoneAndPassword(
+      page.request,
+      US_LEGACY,
+      password,
+      "sms-password",
+    )
+    downgradeLegacyIdentity(identity.id, US_LEGACY, US_E164)
+
+    await page.goto(config.selfservice.flows!.recovery!.ui_url!)
+    await page.locator('input[name="recovery_address"]').fill(US_LEGACY)
+    await page.locator('button[name="method"][value="code"]').click()
+
+    // Recovery code should be sent via SMS webhook
+    // RecoveryCodeValidModel.RecoveryCode is marshalled as "verification_code"
+    const result = await fetchDocument(smsDocumentId)
+    expect(result.ctx.template_data).toBeDefined()
+    expect(result.ctx.template_data.verification_code).toBeDefined()
+  })
+
+  test("D2: recovery fails with E.164 when DB has legacy format (known limitation)", async ({
+    page,
+    config,
+  }) => {
+    const { identity } = await createIdentityWithPhoneAndPassword(
+      page.request,
+      US_LEGACY,
+      password,
+      "sms-password",
+    )
+    downgradeLegacyIdentity(identity.id, US_LEGACY, US_E164)
+
+    await page.goto(config.selfservice.flows!.recovery!.ui_url!)
+    await page.locator('input[name="recovery_address"]').fill(US_E164)
+    await page.locator('button[name="method"][value="code"]').click()
+
+    // Wait for Kratos to process, then verify no SMS was sent
+    await page.waitForTimeout(2000)
+    try {
+      const result = await fetchDocument(smsDocumentId)
+      // If a document exists, recovery was triggered — unexpected for this known-limitation case
+      expect(result.ctx?.template_data?.verification_code).toBeUndefined()
+    } catch {
+      // fetchDocument retries and throws on 404 — no document means no SMS, which is expected
+    }
+  })
+})
+
+// ────────────────────────────────────────────────────────────────────
+// E. Verification — legacy data
+// ────────────────────────────────────────────────────────────────────
+test.describe("E: verification address integrity with legacy data", () => {
+  test.use({
+    configOverride: smsPasswordConfig("sms-password"),
+  })
+
+  test.beforeEach(async ({ page }) => {
+    await cleanIdentities(page.request)
+  })
+
+  test("E1: legacy identity retains verification address", async ({ page }) => {
+    const { identity } = await createIdentityWithPhoneAndPassword(
+      page.request,
+      DE_LEGACY,
+      "some-password-123!",
+      "sms-password",
+    )
+    downgradeLegacyIdentity(identity.id, DE_LEGACY, DE_E164)
+
+    // Fetch the identity via admin API and verify the address is still present
+    const resp = await page.request.get(
+      `http://localhost:4434/admin/identities/${identity.id}?include_credential=password`,
+    )
+    expect(resp.status()).toBe(200)
+    const fetched = await resp.json()
+
+    // The verifiable address should still exist (even if value was reverted to legacy)
+    expect(fetched.verifiable_addresses).toBeDefined()
+    expect(fetched.verifiable_addresses.length).toBeGreaterThan(0)
+  })
+})
+
+// ────────────────────────────────────────────────────────────────────
+// F. Duplicate identity detection (ConflictingIdentity)
+// ────────────────────────────────────────────────────────────────────
+test.describe("F: duplicate identity detection with phone normalization", () => {
+  test.use({
+    configOverride: smsCodeConfig("sms"),
+  })
+
+  test.beforeEach(async ({ page }) => {
+    await cleanIdentities(page.request)
+  })
+
+  test.afterEach(async () => {
+    await deleteDocument(smsDocumentId)
+  })
+
+  test("F1: legacy phone in DB, register with E.164 creates duplicate (known gap)", async ({
+    page,
+    config,
+    kratosPublicURL,
+  }) => {
+    // Create identity with DE_LEGACY → stored as DE_E164 → then downgrade to DE_LEGACY
+    const legacyIdentity = await createIdentity(page.request, {
+      schema_id: "sms",
+      traits: { phone: DE_LEGACY },
+    })
+    downgradeLegacyIdentity(legacyIdentity.id, DE_LEGACY, DE_E164)
+
+    // Register a new identity with DE_E164 (the E.164 form of the same number)
+    const registration = new RegistrationPage(page, config)
+    await registration.open()
+    await registration.triggerRegistrationWithCode(DE_E164)
+
+    // The IN query becomes IN(DE_E164, DE_E164) which does NOT match legacy "+49 176 671 11 638"
+    // So no conflict is detected and a registration code is sent
+    const result = await fetchDocument(smsDocumentId)
+    expect(result.ctx.template_data.registration_code).toBeDefined()
+
+    // Complete registration — this proves the system allowed a duplicate
+    await registration
+      .inputField("code")
+      .fill(result.ctx.template_data.registration_code)
+    await Promise.all([
+      page.waitForURL(
+        new RegExp(config.selfservice.default_browser_return_url),
+      ),
+      registration.submitField("code").getByText("Continue").click(),
+    ])
+    await hasSession(page.request, kratosPublicURL)
+
+    // Verify two distinct identities exist for the same logical phone number — BUG
+    const listResp = await page.request.get(
+      "http://localhost:4434/admin/identities?per_page=250",
+    )
+    const identities = await listResp.json()
+    const matching = identities.filter(
+      (i: { traits: { phone: string } }) =>
+        i.traits.phone === DE_E164 || i.traits.phone === DE_LEGACY,
+    )
+    // BUG: Two identities exist for the same phone number
+    expect(matching.length).toBe(2)
+  })
+
+  test("F2: new E.164 in DB, register with spaced format detects conflict", async ({
+    page,
+    config,
+  }) => {
+    // Create identity with E.164 directly (modern Kratos stores this as-is)
+    await createIdentity(page.request, {
+      schema_id: "sms",
+      traits: { phone: DE_E164 },
+    })
+
+    // Attempt to register with the spaced variant of the same number.
+    // The IN query becomes IN(DE_E164, DE_LEGACY) — DE_E164 matches the DB record.
+    const registration = new RegistrationPage(page, config)
+    await registration.open()
+    await registration.triggerRegistrationWithCode(DE_LEGACY)
+
+    const result = await fetchDocument(smsDocumentId)
+    expect(result.ctx.template_data.registration_code).toBeDefined()
+
+    await registration
+      .inputField("code")
+      .fill(result.ctx.template_data.registration_code)
+    await registration.submitField("code").getByText("Continue").click()
+
+    // Conflict is detected: only one identity should exist
+    const listResp = await page.request.get(
+      "http://localhost:4434/admin/identities?per_page=250",
+    )
+    const identities = await listResp.json()
+    const matching = identities.filter(
+      (i: { traits: { phone: string } }) =>
+        i.traits.phone === DE_E164 || i.traits.phone === DE_LEGACY,
+    )
+    expect(matching.length).toBe(1)
+  })
+})
+
+// ────────────────────────────────────────────────────────────────────
+// G. OIDC account linking — legacy data
+// ────────────────────────────────────────────────────────────────────
+const oidcConfig: DeepPartial<OryKratosConfiguration> = {
+  security: {
+    account_enumeration: {
+      enabled: false,
+    },
+  },
+  selfservice: {
+    flows: {
+      login: {
+        style: "unified",
+      },
+      registration: {
+        after: {
+          oidc: {
+            hooks: [{ hook: "session" }],
+          },
+          code: {
+            hooks: [{ hook: "session" }],
+          },
+        },
+      },
+    },
+    methods: {
+      code: {
+        passwordless_enabled: true,
+      },
+      password: {
+        enabled: false,
+      },
+      oidc: {
+        enabled: true,
+        config: {
+          providers: [
+            {
+              id: "hydra",
+              label: "Ory",
+              provider: "generic",
+              client_id: process.env["OIDC_HYDRA_CLIENT_ID"],
+              client_secret: process.env["OIDC_HYDRA_CLIENT_SECRET"],
+              issuer_url: "http://localhost:4444/",
+              scope: ["offline"],
+              mapper_url:
+                "file://test/e2e/playwright/fixtures/mappers/hydra-phone.jsonnet",
+            },
+          ],
+        },
+      },
+    },
+  },
+  courier: { channels: smsCourierChannels() },
+  identity: { default_schema_id: "sms-oidc", schemas: allSmsSchemas() },
+}
+
+test.describe("G: OIDC account linking with legacy phone data", () => {
+  test.use({
+    configOverride: oidcConfig,
+  })
+
+  test.beforeEach(async ({ page }) => {
+    await cleanIdentities(page.request)
+  })
+
+  test.afterEach(async () => {
+    await deleteDocument(smsDocumentId)
+  })
+
+  test("G1: legacy phone in DB, OIDC returns E.164 creates duplicate (known gap)", async ({
+    page,
+    config,
+    kratosPublicURL,
+  }) => {
+    // Create identity with legacy phone via admin API, then downgrade to legacy format
+    const legacyIdentity = await createIdentity(page.request, {
+      schema_id: "sms-oidc",
+      traits: { phone: DE_LEGACY },
+    })
+    downgradeLegacyIdentity(legacyIdentity.id, DE_LEGACY, DE_E164)
+
+    // Initiate OIDC registration — Hydra returns DE_E164 as sub claim
+    await page.goto(config.selfservice.flows!.registration!.ui_url!)
+    await page.locator('button[name="provider"][value="hydra"]').click()
+
+    // Hydra login: use E.164 phone as the username (sub claim)
+    await page.locator("input[name=username]").fill(DE_E164)
+    await page.locator("button[name=action][value=accept]").click()
+
+    // Consent screen
+    await page.locator("#offline").check()
+    await page.locator("#openid").check()
+    await page.locator("button[name=action][value=accept]").click()
+
+    // ConflictingIdentity uses IN(DE_E164, DE_E164) which does NOT match legacy record
+    // BUG: A second identity is created instead of linking to the existing one
+    await page.waitForURL(
+      new RegExp(config.selfservice.default_browser_return_url),
+    )
+    await hasSession(page.request, kratosPublicURL)
+
+    const listResp = await page.request.get(
+      "http://localhost:4434/admin/identities?per_page=250",
+    )
+    const identities = await listResp.json()
+    const matching = identities.filter(
+      (i: { traits: { phone: string } }) =>
+        i.traits.phone === DE_E164 || i.traits.phone === DE_LEGACY,
+    )
+    // BUG: Two identities exist for the same phone number
+    expect(matching.length).toBe(2)
+  })
+
+  test("G2: new E.164 in DB, OIDC registration detects conflict (no duplicate)", async ({
+    page,
+    config,
+  }) => {
+    // Create identity with E.164 phone (modern format — no downgrade needed)
+    await createIdentity(page.request, {
+      schema_id: "sms-oidc",
+      traits: { phone: DE_E164 },
+    })
+
+    // Initiate OIDC registration — Hydra returns DE_E164 as sub claim
+    await page.goto(config.selfservice.flows!.registration!.ui_url!)
+    await page.locator('button[name="provider"][value="hydra"]').click()
+
+    await page.locator("input[name=username]").fill(DE_E164)
+    await page.locator("button[name=action][value=accept]").click()
+
+    await page.locator("#offline").check()
+    await page.locator("#openid").check()
+    await page.locator("button[name=action][value=accept]").click()
+
+    // ConflictingIdentity uses IN(DE_E164, DE_E164) which DOES match DE_E164 in DB.
+    // Conflict is detected → Kratos shows duplicate-credentials / account-linking
+    // page instead of completing registration. No session is created.
+    await page.waitForLoadState("networkidle")
+
+    // Key assertion: conflict was detected, so NO duplicate identity was created.
+    const listResp = await page.request.get(
+      "http://localhost:4434/admin/identities?per_page=250",
+    )
+    const identities = await listResp.json()
+    const matching = identities.filter(
+      (i: { traits: { phone: string } }) => i.traits.phone === DE_E164,
+    )
+    expect(matching.length).toBe(1)
+  })
+})

test/e2e/playwright/tests/mobile/app_login.spec.ts

@@ -0,0 +1,117 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { expect, Page } from "@playwright/test"
+import { test } from "../../fixtures"
+
+async function performOidcLogin(popup: Page, username: string) {
+  await popup.waitForLoadState()
+
+  await popup.locator("#username").fill(username)
+  await popup.getByRole("button", { name: "login" }).click()
+
+  await popup.locator("#offline").click()
+  await popup.locator("#openid").click()
+  await popup.locator("#website").fill("https://example.com")
+  await popup.getByRole("button", { name: "login" }).click()
+}
+
+async function rejectOidcLogin(popup: Page) {
+  await popup.waitForLoadState()
+  await popup.getByRole("button", { name: "reject" }).click()
+  await popup.close()
+}
+
+async function testRegistrationOrLogin(page: Page, username: string) {
+  const popupPromise = page.waitForEvent("popup")
+  await page.getByText(/sign (up|in) with ory/i).click()
+  const popup = await popupPromise
+
+  await performOidcLogin(popup, username)
+
+  await page.waitForURL("Home")
+  expect(popup.isClosed()).toBeTruthy()
+  await expect(page.getByText("Welcome back")).toBeVisible()
+}
+
+async function logout(page: Page) {
+  return page.getByTestId("logout").click()
+}
+
+async function testRegistration(page: Page, username: string) {
+  await page.goto("Registration")
+  return testRegistrationOrLogin(page, username)
+}
+
+async function testLogin(page: Page, username: string) {
+  await page.goto("Login")
+  return testRegistrationOrLogin(page, username)
+}
+
+test.describe("Registration", () => {
+  test("register twice", async ({ page }) => {
+    await testRegistration(page, "registration@example.com")
+    await logout(page)
+    await testRegistration(page, "registration@example.com")
+  })
+
+  test("register, then login", async ({ page }) => {
+    await testRegistration(page, "registration-login@example.com")
+    await logout(page)
+    await testLogin(page, "registration-login@example.com")
+  })
+
+  test("register, cancel, register", async ({ page }) => {
+    await page.goto("Registration")
+
+    let popupPromise = page.waitForEvent("popup")
+    await page.getByText(/sign (up|in) with ory/i).click()
+    let popup = await popupPromise
+
+    await rejectOidcLogin(popup)
+
+    await expect(page.getByText("login rejected request")).toBeVisible()
+    popupPromise = page.waitForEvent("popup")
+    await page.getByText(/continue/i).click()
+    popup = await popupPromise
+    await performOidcLogin(popup, "register-reject-then-accept@example.com")
+
+    await page.waitForURL("Home")
+    expect(popup.isClosed()).toBeTruthy()
+    await expect(page.getByText("Welcome back")).toBeVisible()
+  })
+})
+
+test.describe("Login", () => {
+  test("login twice", async ({ page }) => {
+    await testLogin(page, "login@example.com")
+    await logout(page)
+    await testLogin(page, "login@example.com")
+  })
+
+  test("login, then register", async ({ page }) => {
+    await testLogin(page, "login-registration@example.com")
+    await logout(page)
+    await testRegistration(page, "login-registration@example.com")
+  })
+
+  test("login, cancel, login", async ({ page }) => {
+    await page.goto("Login")
+
+    let popupPromise = page.waitForEvent("popup")
+    await page.getByText(/sign (up|in) with ory/i).click()
+    let popup = await popupPromise
+
+    await rejectOidcLogin(popup)
+
+    await expect(page.getByText("login rejected request")).toBeVisible()
+    popupPromise = page.waitForEvent("popup")
+    await page.getByText(/sign in with ory/i).click()
+    popup = await popupPromise
+    await performOidcLogin(popup, "login-reject-then-accept@example.com")
+
+    await page.waitForURL("Home")
+    expect(popup.isClosed()).toBeTruthy()
+    await expect(page.getByText("Welcome back")).toBeVisible()
+  })
+})

test/e2e/playwright/tests/mobile/app_recovery.spec.ts

@@ -0,0 +1,140 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { expect } from "@playwright/test"
+import { test } from "../../fixtures"
+import { search } from "../../actions/mail"
+import { extractCode } from "../../lib/helper"
+
+const schemaConfig = {
+  default_schema_id: "email",
+  schemas: [
+    {
+      id: "email",
+      url: "file://test/e2e/profiles/email/identity.traits.schema.json",
+    },
+  ],
+}
+
+test.describe("Recovery", () => {
+  test.use({
+    configOverride: {
+      identity: {
+        ...schemaConfig,
+      },
+      feature_flags: {
+        use_continue_with_transitions: true,
+      },
+    },
+  })
+
+  test("succeeds with a valid email address", async ({ page, identity }) => {
+    await page.goto("/Recovery")
+
+    await page.getByTestId("email").fill(identity.email)
+    await page.getByTestId("submit-form").click()
+    await expect(page.getByTestId("ui/message/1060003")).toBeVisible()
+
+    const mails = await search({ query: identity.email, kind: "to" })
+    expect(mails).toHaveLength(1)
+
+    const code = extractCode(mails[0])
+    const wrongCode = "0" + code
+
+    await test.step("enter wrong code", async () => {
+      await page.getByTestId("code").fill(wrongCode)
+      await page.getByText("Continue").click()
+      await expect(page.getByTestId("ui/message/4060006")).toBeVisible()
+    })
+
+    await test.step("enter correct code", async () => {
+      await page.getByTestId("code").fill(code)
+      await page.getByText("Continue").click()
+      await page.waitForURL(/Settings/)
+      await expect(page.getByTestId("ui/message/1060001").first()).toBeVisible()
+    })
+  })
+
+  test("wrong email address does not get sent", async ({ page, identity }) => {
+    await page.goto("/Recovery")
+
+    const wrongEmailAddress = "wrong-" + identity.email
+    await page.getByTestId("email").fill(wrongEmailAddress)
+    await page.getByTestId("submit-form").click()
+    await expect(page.getByTestId("ui/message/1060003")).toBeVisible()
+
+    try {
+      await search({ query: identity.email, kind: "to" })
+      expect(false).toBeTruthy()
+    } catch (e) {
+      // this is expected
+    }
+  })
+
+  test("fails with an invalid code", async ({ page, identity }) => {
+    await page.goto("/Recovery")
+
+    await page.getByTestId("email").fill(identity.email)
+    await page.getByTestId("submit-form").click()
+    await page.getByTestId("ui/message/1060003").isVisible()
+
+    const mails = await search({ query: identity.email, kind: "to" })
+    expect(mails).toHaveLength(1)
+
+    const code = extractCode(mails[0])
+    const wrongCode = "0" + code
+
+    await test.step("enter wrong repeatedly", async () => {
+      for (let i = 0; i < 10; i++) {
+        await page.getByTestId("code").fill(wrongCode)
+        await page.getByText("Continue", { exact: true }).click()
+        await expect(page.getByTestId("ui/message/4060006")).toBeVisible()
+      }
+    })
+
+    await test.step("enter correct code fails", async () => {
+      await page.getByTestId("code").fill(code)
+      await page.getByText("Continue", { exact: true }).click()
+      await expect(page.getByTestId("ui/message/4060006")).toBeVisible()
+    })
+  })
+
+  test.describe("with short code expiration", () => {
+    test.use({
+      configOverride: {
+        identity: {
+          ...schemaConfig,
+        },
+        selfservice: {
+          methods: {
+            code: {
+              config: {
+                lifespan: "1ms",
+              },
+            },
+          },
+        },
+        feature_flags: {
+          use_continue_with_transitions: true,
+        },
+      },
+    })
+
+    test("fails with an expired code", async ({ page, identity }) => {
+      await page.goto("/Recovery")
+
+      await page.getByTestId("email").fill(identity.email)
+      await page.getByTestId("submit-form").click()
+      await page.getByTestId("ui/message/1060003").isVisible()
+
+      const mails = await search({ query: identity.email, kind: "to" })
+      expect(mails).toHaveLength(1)
+
+      const code = extractCode(mails[0])
+
+      await page.getByTestId("code").fill(code)
+      await page.getByText("Continue", { exact: true }).click()
+      await expect(page.getByTestId("ui/message/4060006")).toBeVisible()
+    })
+  })
+})

test/e2e/playwright/types/index.ts

@@ -0,0 +1,10 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { APIResponse } from "playwright-core"
+import { Session } from "@ory/kratos-client"
+
+export type SessionWithResponse = {
+  session: Session
+  response: APIResponse
+}