snapshot of https://github.com/ory/kratos.git (master, 2026-09-15; blobs > 131072B omitted)

test/e2e/playwright/tests/desktop/identifier_first/code.login.spec.ts

@@ -0,0 +1,636 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { expect } from "@playwright/test"
+import { search } from "../../../actions/mail"
+import { getSession, hasNoSession, hasSession } from "../../../actions/session"
+import { test } from "../../../fixtures"
+import { extractCode, toConfig } from "../../../lib/helper"
+import { LoginPage } from "../../../models/elements/login"
+import { SettingsPage } from "../../../models/elements/settings"
+import { logoutUrl } from "../../../actions/login"
+
+test.describe("account enumeration protection off", () => {
+  test.use({
+    configOverride: toConfig({
+      style: "identifier_first",
+      mitigateEnumeration: false,
+      selfservice: {
+        methods: {
+          code: {
+            passwordless_enabled: true,
+          },
+        },
+      },
+    }),
+  })
+
+  test("login fails because user does not exist", async ({ page, config }) => {
+    const login = new LoginPage(page, config)
+    await login.open()
+
+    await login.submitIdentifierFirst("i@donot.exist")
+
+    await expect(
+      page.locator('[data-testid="ui/message/4000037"]'),
+      "expect account not exist message to be shown",
+    ).toBeVisible()
+  })
+
+  test("login with wrong code fails", async ({
+    page,
+    identity,
+    kratosPublicURL,
+    config,
+  }) => {
+    const login = new LoginPage(page, config)
+    await login.open()
+
+    await login.triggerLoginWithCode(identity.email)
+
+    await login.codeInput.input.fill("123123")
+
+    await login.codeSubmit.getByText("Continue").click()
+
+    await hasNoSession(page.request, kratosPublicURL)
+    await expect(
+      page.locator('[data-testid="ui/message/4010008"]'),
+      "expect to be shown a wrong code error",
+    ).toBeVisible()
+  })
+
+  test("login succeeds", async ({
+    page,
+    identity,
+    config,
+    kratosPublicURL,
+  }) => {
+    const login = new LoginPage(page, config)
+    await login.open()
+
+    await login.triggerLoginWithCode(identity.email)
+
+    const mails = await search({ query: identity.email, kind: "to" })
+    expect(mails).toHaveLength(1)
+
+    const code = extractCode(mails[0])
+
+    await login.codeInput.input.fill(code)
+
+    await login.codeSubmit.getByText("Continue").click()
+
+    await hasSession(page.request, kratosPublicURL)
+  })
+})
+
+test.describe("account enumeration protection on", () => {
+  test.use({
+    configOverride: toConfig({
+      style: "identifier_first",
+      mitigateEnumeration: true,
+      selfservice: {
+        methods: {
+          password: {
+            enabled: false,
+          },
+          code: {
+            passwordless_enabled: true,
+          },
+        },
+      },
+    }),
+  })
+
+  test("login fails because user does not exist", async ({ page, config }) => {
+    const login = new LoginPage(page, config)
+    await login.open()
+
+    await login.submitIdentifierFirst("i@donot.exist")
+
+    await expect(
+      page.locator('button[name="method"][value="code"]'),
+      "expect to show the code form",
+    ).toBeVisible()
+  })
+
+  test("login with wrong code fails", async ({
+    page,
+    identity,
+    kratosPublicURL,
+    config,
+  }) => {
+    const login = new LoginPage(page, config)
+    await login.open()
+
+    await login.triggerLoginWithCode(identity.email)
+
+    await login.codeInput.input.fill("123123")
+
+    await login.codeSubmit.getByText("Continue").click()
+
+    await hasNoSession(page.request, kratosPublicURL)
+    await expect(
+      page.locator('[data-testid="ui/message/4010008"]'),
+      "expect to be shown a wrong code error",
+    ).toBeVisible()
+  })
+
+  test("login succeeds", async ({
+    page,
+    identity,
+    config,
+    kratosPublicURL,
+  }) => {
+    const login = new LoginPage(page, config)
+    await login.open()
+
+    await login.triggerLoginWithCode(identity.email)
+
+    const mails = await search({ query: identity.email, kind: "to" })
+    expect(mails).toHaveLength(1)
+
+    const code = extractCode(mails[0])
+
+    await login.codeInput.input.fill(code)
+
+    await login.codeSubmit.getByText("Continue").click()
+
+    await hasSession(page.request, kratosPublicURL)
+  })
+})
+
+for (const tc of [
+  {
+    name: "do fast login when only code method enabled and configured, mitigation off",
+    methodsEnabled: ["code"],
+    methodsConfigured: "code",
+    mitigation: false,
+    expectFastLogin: true,
+  },
+  {
+    name: "do fast login when only code method enabled and configured, mitigation on",
+    methodsEnabled: ["code"],
+    methodsConfigured: "code",
+    mitigation: true,
+    expectFastLogin: true,
+  },
+  {
+    name: "do not fast login when multiple methods enabled, all configured, mitigation off",
+    methodsEnabled: ["password", "code"],
+    methodsConfigured: "all",
+    mitigation: false,
+    expectFastLogin: false,
+  },
+  {
+    name: "do not fast login when multiple methods enabled, all configured, mitigation on",
+    methodsEnabled: ["password", "code"],
+    methodsConfigured: "all",
+    mitigation: true,
+    expectFastLogin: false,
+  },
+  {
+    name: "do fast login when multiple methods enabled, only code configured, mitigation off",
+    methodsEnabled: ["password", "code"],
+    methodsConfigured: "code",
+    mitigation: false,
+    expectFastLogin: true,
+  },
+  {
+    name: "do not fast login when multiple methods enabled, only code configured, mitigation on",
+    methodsEnabled: ["password", "code"],
+    methodsConfigured: "code",
+    mitigation: true,
+    expectFastLogin: false,
+  },
+]) {
+  test.describe(`account enumeration protection ${
+    tc.mitigation ? "on" : "off"
+  }`, () => {
+    test.use({
+      configOverride: toConfig({
+        style: "identifier_first",
+        mitigateEnumeration: tc.mitigation,
+        selfservice: {
+          methods: {
+            oidc: {
+              enabled: false,
+            },
+            password: {
+              enabled: tc.methodsEnabled.includes("password"),
+            },
+            code: {
+              passwordless_enabled: tc.methodsEnabled.includes("code"),
+            },
+          },
+        },
+      }),
+    })
+
+    test(
+      tc.name,
+      async ({ page, config, identity, identityWithoutPassword }) => {
+        const id =
+          tc.methodsConfigured === "all" ? identity : identityWithoutPassword
+
+        const login = new LoginPage(page, config)
+        await login.open()
+
+        await login.submitIdentifierFirst(id.email)
+
+        if (tc.expectFastLogin) {
+          await expect(login.submitPassword).toBeHidden()
+          await expect(
+            page.locator('[data-testid="ui/message/1010014"]'),
+            "expect code sent message to be shown",
+          ).toBeVisible()
+          await expect(login.codeSubmit).toBeVisible()
+        } else {
+          await expect(login.submitPassword).toBeVisible()
+          await expect(login.codeSubmit).toBeVisible()
+        }
+      },
+    )
+  })
+}
+
+test.describe(() => {
+  test.use({
+    configOverride: toConfig({
+      style: "identifier_first",
+      mitigateEnumeration: false,
+      selfservice: {
+        methods: {
+          password: {
+            enabled: false,
+          },
+          code: {
+            passwordless_enabled: true,
+          },
+        },
+      },
+      featureFlags: {
+        refresh_login_choose_address: true,
+      },
+    }),
+  })
+  test("refresh", async ({ page, identity, config, kratosPublicURL }) => {
+    const login = new LoginPage(page, config)
+
+    const [initialSession, initialCode] =
+      await test.step("initial login", async () => {
+        await login.open()
+        await login.triggerLoginWithCode(identity.email)
+
+        const mails = await search({ query: identity.email, kind: "to" })
+        expect(mails).toHaveLength(1)
+
+        const code = extractCode(mails[0])
+
+        await login.codeInput.input.fill(code)
+
+        await login.codeSubmit.getByText("Continue").click()
+
+        const session = await getSession(page.request, kratosPublicURL)
+        expect(session).toBeDefined()
+        expect(session.active).toBe(true)
+        return [session, code]
+      })
+
+    await login.open({
+      refresh: true,
+    })
+    // On a refresh login the identity is fixed by the session, so the screen
+    // shows a "Send code to <address>" button instead of an identifier field
+    // (ory/kratos#4194).
+    await expect(login.inputField("identifier")).toBeHidden()
+    await login.codeSubmitMfa.click()
+
+    const mails = await search({
+      query: identity.email,
+      kind: "to",
+      filter: (m) => !m.html.includes(initialCode),
+    })
+    expect(mails).toHaveLength(1)
+
+    const code = extractCode(mails[0])
+
+    await login.codeInput.input.fill(code)
+
+    await login.codeSubmit.getByText("Continue").click()
+    await page.waitForURL(
+      new RegExp(config.selfservice.default_browser_return_url),
+    )
+
+    const newSession = await getSession(page.request, kratosPublicURL)
+    expect(newSession).toBeDefined()
+    expect(newSession.active).toBe(true)
+
+    const initDate = Date.parse(initialSession.authenticated_at)
+    const newDate = Date.parse(newSession.authenticated_at)
+    expect(newDate).toBeGreaterThanOrEqual(initDate)
+  })
+})
+
+test.describe("second factor", () => {
+  for (const tc of [
+    {
+      name: "do fast login when only code method enabled and configured",
+      methodsEnabled: ["code"],
+      methodsConfigured: "code",
+      expectFastLogin: true,
+    },
+    {
+      name: "do not fast login when multiple methods enabled, all configured",
+      methodsEnabled: ["totp", "code"],
+      methodsConfigured: "all",
+      expectFastLogin: false,
+    },
+    {
+      name: "do fast login when multiple methods enabled, only code configured",
+      methodsEnabled: ["totp", "code"],
+      methodsConfigured: "code",
+      expectFastLogin: true,
+    },
+  ]) {
+    test.describe(`code mfa ${
+      tc.expectFastLogin ? "with" : "without"
+    } fast login`, () => {
+      test.use({
+        configOverride: toConfig({
+          style: "identifier_first",
+          selfservice: {
+            methods: {
+              oidc: {
+                enabled: false,
+              },
+              password: {
+                enabled: true,
+              },
+              totp: {
+                enabled: tc.methodsEnabled.includes("totp"),
+              },
+              code: {
+                passwordless_enabled: false,
+                mfa_enabled: tc.methodsEnabled.includes("code"),
+              },
+            },
+          },
+        }),
+      })
+
+      test(tc.name, async ({ page, config, identity, kratosPublicURL }) => {
+        const login = new LoginPage(page, config)
+
+        if (tc.methodsConfigured === "all") {
+          await test.step("setup TOTP", async () => {
+            await login.open()
+            await login.loginWithPassword(identity.email, identity.password)
+
+            const mails = await search({ query: identity.email, kind: "to" })
+            expect(mails).toHaveLength(1)
+            const code = extractCode(mails[0])
+            await login.codeInput.input.fill(code)
+            await login.codeSubmit.getByText("Continue").click()
+
+            const settings = new SettingsPage(page, config)
+            await settings.open()
+
+            await settings.setupTotp()
+
+            await page.goto(await logoutUrl(page.request, kratosPublicURL))
+          })
+        }
+
+        test.step("first factor authentication", async () => {
+          await login.open()
+          await login.loginWithPassword(identity.email, identity.password)
+        })
+
+        if (tc.expectFastLogin) {
+          await expect(login.totpInput.input).toBeHidden()
+          await expect(
+            page.locator('[data-testid="ui/message/1010025"]'),
+            "expect code sent message to be shown",
+          ).toBeVisible()
+          await expect(login.codeSubmit).toBeVisible()
+        } else {
+          await expect(login.totpInput.input).toBeVisible()
+          await expect(login.codeSubmitMfa).toBeVisible()
+        }
+      })
+    })
+  }
+})
+
+test.describe("second factor refresh", () => {
+  // TOTP is enabled alongside code so the code method does not fast-login as the
+  // only second factor. That keeps the flow on the regular handler path, which
+  // renders the "Send code to <address>" button this test exercises.
+  test.use({
+    configOverride: toConfig({
+      style: "identifier_first",
+      selfservice: {
+        methods: {
+          oidc: {
+            enabled: false,
+          },
+          password: {
+            enabled: true,
+          },
+          totp: {
+            enabled: true,
+          },
+          code: {
+            passwordless_enabled: false,
+            mfa_enabled: true,
+          },
+        },
+      },
+    }),
+  })
+
+  test("refreshes an aal2 session through the code address button", async ({
+    page,
+    config,
+    identity,
+    kratosPublicURL,
+  }) => {
+    const login = new LoginPage(page, config)
+    const seenCodes: string[] = []
+
+    await test.step("set up TOTP as a second 2FA method", async () => {
+      await login.open()
+      await login.loginWithPassword(identity.email, identity.password)
+
+      // The verified email already works as a code second factor, so with
+      // `highest_available` the flow fast-logs in to aal2 with code. Complete
+      // that before opening settings to set up TOTP.
+      const mails = await search({
+        query: identity.email,
+        kind: "to",
+        filter: (m) => !seenCodes.some((c) => m.html.includes(c)),
+      })
+      const code = extractCode(mails[0])
+      seenCodes.push(code)
+      await login.codeInput.input.fill(code)
+      await login.codeSubmit.getByText("Continue").click()
+
+      const settings = new SettingsPage(page, config)
+      await settings.open()
+      await settings.setupTotp()
+
+      await page.goto(await logoutUrl(page.request, kratosPublicURL))
+    })
+
+    const initialSession =
+      await test.step("log in to aal2 with the code second factor", async () => {
+        await login.open()
+        await login.loginWithPassword(identity.email, identity.password)
+
+        // With TOTP and code both configured, the flow escalates to aal2 and
+        // renders both factors instead of fast-logging in.
+        await expect(login.totpInput.input).toBeVisible()
+        await expect(login.codeSubmitMfa).toBeVisible()
+
+        await login.codeSubmitMfa.click()
+
+        const mails = await search({
+          query: identity.email,
+          kind: "to",
+          filter: (m) => !seenCodes.some((c) => m.html.includes(c)),
+        })
+        const code = extractCode(mails[0])
+        seenCodes.push(code)
+
+        await login.codeInput.input.fill(code)
+        await login.codeSubmit.getByText("Continue").click()
+
+        const session = await getSession(page.request, kratosPublicURL)
+        expect(session.active).toBe(true)
+        expect(session.authenticator_assurance_level).toBe("aal2")
+        return session
+      })
+
+    await test.step("refresh the aal2 session", async () => {
+      await login.open({
+        refresh: true,
+        aal: "aal2",
+      })
+
+      // On a refresh + aal2 flow the second-factor hydrator wins over the
+      // first-factor refresh branch: it renders "Send code to <address>"
+      // buttons and never the hidden first-factor identifier field
+      // (ory/kratos#4194).
+      await expect(login.codeSubmitMfa).toBeVisible()
+      await expect(login.inputField("identifier")).toBeHidden()
+
+      await login.codeSubmitMfa.click()
+
+      const mails = await search({
+        query: identity.email,
+        kind: "to",
+        filter: (m) => !seenCodes.some((c) => m.html.includes(c)),
+      })
+      expect(mails).toHaveLength(1)
+      const code = extractCode(mails[0])
+
+      await login.codeInput.input.fill(code)
+      await login.codeSubmit.getByText("Continue").click()
+      await page.waitForURL(
+        new RegExp(config.selfservice.default_browser_return_url),
+      )
+
+      const refreshedSession = await getSession(page.request, kratosPublicURL)
+      expect(refreshedSession.active).toBe(true)
+      expect(refreshedSession.authenticator_assurance_level).toBe("aal2")
+
+      const initialAuthAt = Date.parse(initialSession.authenticated_at)
+      const refreshedAuthAt = Date.parse(refreshedSession.authenticated_at)
+      expect(refreshedAuthAt).toBeGreaterThanOrEqual(initialAuthAt)
+    })
+  })
+
+  test("rejects a foreign address on an aal2 refresh", async ({
+    page,
+    config,
+    identity,
+    kratosPublicURL,
+  }) => {
+    const login = new LoginPage(page, config)
+    const seenCodes: string[] = []
+
+    await test.step("set up TOTP as a second 2FA method", async () => {
+      await login.open()
+      await login.loginWithPassword(identity.email, identity.password)
+
+      // Complete the code second factor that fast-login auto-sends, then set
+      // up TOTP so later flows render the address button instead of fast-login.
+      const mails = await search({
+        query: identity.email,
+        kind: "to",
+        filter: (m) => !seenCodes.some((c) => m.html.includes(c)),
+      })
+      const code = extractCode(mails[0])
+      seenCodes.push(code)
+      await login.codeInput.input.fill(code)
+      await login.codeSubmit.getByText("Continue").click()
+
+      const settings = new SettingsPage(page, config)
+      await settings.open()
+      await settings.setupTotp()
+
+      await page.goto(await logoutUrl(page.request, kratosPublicURL))
+    })
+
+    const aal2Session =
+      await test.step("log in to aal2 with the code second factor", async () => {
+        await login.open()
+        await login.loginWithPassword(identity.email, identity.password)
+
+        await login.codeSubmitMfa.click()
+
+        const mails = await search({
+          query: identity.email,
+          kind: "to",
+          filter: (m) => !seenCodes.some((c) => m.html.includes(c)),
+        })
+        const code = extractCode(mails[0])
+        seenCodes.push(code)
+        await login.codeInput.input.fill(code)
+        await login.codeSubmit.getByText("Continue").click()
+
+        const session = await getSession(page.request, kratosPublicURL)
+        expect(session.authenticator_assurance_level).toBe("aal2")
+        return session
+      })
+
+    await test.step("tampering the address with a foreign identifier is rejected", async () => {
+      await login.open({
+        refresh: true,
+        aal: "aal2",
+      })
+
+      // Tamper the server-rendered address button so it posts a foreign
+      // identifier. A refresh login must not send a code to it
+      // (ory/kratos#4194).
+      const foreignEmail = "not-" + identity.email
+      await login.codeSubmitMfa.evaluate(
+        (el, value) => el.setAttribute("value", value),
+        foreignEmail,
+      )
+      await login.codeSubmitMfa.click()
+
+      await expect(
+        page.locator('[data-testid="ui/message/4000035"]'),
+        "expect the no-code-credentials error to be shown",
+      ).toBeVisible()
+      await expect(login.codeInput.input).toBeHidden()
+
+      // The active session is untouched: still aal2, same authentication time.
+      const session = await getSession(page.request, kratosPublicURL)
+      expect(session.active).toBe(true)
+      expect(session.authenticator_assurance_level).toBe("aal2")
+      expect(session.authenticated_at).toBe(aal2Session.authenticated_at)
+    })
+  })
+})

test/e2e/playwright/tests/desktop/identifier_first/oidc.login.spec.ts

@@ -0,0 +1,171 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { faker } from "@faker-js/faker"
+import { expect, Page } from "@playwright/test"
+import { getSession, hasSession } from "../../../actions/session"
+import { test } from "../../../fixtures"
+import { toConfig } from "../../../lib/helper"
+import { LoginPage } from "../../../models/elements/login"
+import { OryKratosConfiguration } from "../../../../shared/config"
+
+async function loginHydra(page: Page) {
+  return test.step("login with hydra", async () => {
+    await page
+      .locator("input[name=username]")
+      .fill(faker.internet.email({ provider: "ory.sh" }))
+    await page.locator("button[name=action][value=accept]").click()
+    await page.locator("#offline").check()
+    await page.locator("#openid").check()
+
+    await page.locator("input[name=website]").fill(faker.internet.url())
+
+    await page.locator("button[name=action][value=accept]").click()
+  })
+}
+
+async function registerWithHydra(
+  page: Page,
+  config: OryKratosConfiguration,
+  kratosPublicURL: string,
+) {
+  return await test.step("register", async () => {
+    await page.goto("/registration")
+
+    await page.locator(`button[name=provider][value=hydra]`).click()
+
+    const email = faker.internet.email({ provider: "ory.sh" })
+    await page.locator("input[name=username]").fill(email)
+    await page.locator("#remember").check()
+    await page.locator("button[name=action][value=accept]").click()
+    await page.locator("#offline").check()
+    await page.locator("#openid").check()
+
+    await page.locator("input[name=website]").fill(faker.internet.url())
+
+    await page.locator("button[name=action][value=accept]").click()
+    await page.waitForURL(
+      new RegExp(config.selfservice.default_browser_return_url),
+    )
+    await page.context().clearCookies({
+      domain: new URL(kratosPublicURL).hostname,
+    })
+
+    await expect(
+      getSession(page.request, kratosPublicURL),
+    ).rejects.toThrowError()
+    return email
+  })
+}
+
+for (const mitigateEnumeration of [true, false]) {
+  test.describe(`account enumeration protection ${
+    mitigateEnumeration ? "on" : "off"
+  }`, () => {
+    test.use({
+      configOverride: toConfig({
+        mitigateEnumeration,
+        selfservice: {
+          methods: {
+            password: {
+              enabled: true,
+            },
+          },
+        },
+      }),
+    })
+
+    test("login", async ({ page, config, kratosPublicURL }) => {
+      const login = new LoginPage(page, config)
+      await login.open()
+
+      await page.locator(`button[name=provider][value=hydra]`).click()
+
+      await loginHydra(page)
+
+      await page.waitForURL(
+        new RegExp(config.selfservice.default_browser_return_url),
+      )
+
+      await hasSession(page.request, kratosPublicURL)
+    })
+
+    test("oidc sign in on second step", async ({
+      page,
+      config,
+      kratosPublicURL,
+    }) => {
+      const email = await registerWithHydra(page, config, kratosPublicURL)
+
+      const login = new LoginPage(page, config)
+      await login.open()
+
+      await login.submitIdentifierFirst(email)
+
+      // If account enumeration is mitigated, we should see the password method,
+      // because the identity has not set up a password
+      await expect(
+        page.locator('button[name="method"][value="password"]'),
+        "hide the password method",
+      ).toBeVisible({ visible: mitigateEnumeration })
+
+      await page.locator(`button[name=provider][value=hydra]`).click()
+
+      await loginHydra(page)
+
+      await page.waitForURL(
+        new RegExp(config.selfservice.default_browser_return_url),
+      )
+
+      const session = await getSession(page.request, kratosPublicURL)
+      expect(session).toBeDefined()
+      expect(session.active).toBe(true)
+    })
+  })
+}
+
+test("login with refresh", async ({ page, config, kratosPublicURL }) => {
+  await registerWithHydra(page, config, kratosPublicURL)
+
+  const login = new LoginPage(page, config)
+
+  const initialSession = await test.step("initial login", async () => {
+    await login.open()
+    await page.locator(`button[name=provider][value=hydra]`).click()
+
+    await loginHydra(page)
+
+    await page.waitForURL(
+      new RegExp(config.selfservice.default_browser_return_url),
+    )
+    return await getSession(page.request, kratosPublicURL)
+  })
+
+  // This is required, because OIDC issues a new session on refresh (TODO), and MySQL does not store sub second timestamps, so we need to wait a bit
+  await page.waitForTimeout(1000)
+  await test.step("refresh login", async () => {
+    await login.open({
+      refresh: true,
+    })
+
+    await expect(
+      page.locator('[data-testid="ui/message/1010003"]'),
+      "show the refresh message",
+    ).toBeVisible()
+
+    await page.locator(`button[name=provider][value=hydra]`).click()
+
+    await loginHydra(page)
+
+    await page.waitForURL(
+      new RegExp(config.selfservice.default_browser_return_url),
+    )
+    const newSession = await getSession(page.request, kratosPublicURL)
+    // expect(newSession.authentication_methods).toHaveLength(
+    //   initialSession.authentication_methods.length + 1,
+    // )
+    expect(newSession.authenticated_at).not.toBe(
+      initialSession.authenticated_at,
+    )
+  })
+})

test/e2e/playwright/tests/desktop/identifier_first/passkeys.login.spec.ts

@@ -0,0 +1,238 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { faker } from "@faker-js/faker"
+import { CDPSession, expect, Page } from "@playwright/test"
+import { OryKratosConfiguration } from "../../../../shared/config"
+import { getSession } from "../../../actions/session"
+import { test } from "../../../fixtures"
+import { toConfig } from "../../../lib/helper"
+import { LoginPage } from "../../../models/elements/login"
+
+async function toggleAutomaticPresenceSimulation(
+  cdpSession: CDPSession,
+  authenticatorId: string,
+  enabled: boolean,
+) {
+  await cdpSession.send("WebAuthn.setAutomaticPresenceSimulation", {
+    authenticatorId,
+    enabled,
+  })
+}
+
+async function registerWithPasskey(
+  page: Page,
+  pageCDPSession: CDPSession,
+  config: OryKratosConfiguration,
+  authenticatorId: string,
+  simulatePresence: boolean,
+) {
+  return await test.step("create webauthn identity", async () => {
+    await page.goto("/registration")
+    const identifier = faker.internet.email()
+    await page.locator(`input[name="traits.email"]`).fill(identifier)
+    await page
+      .locator(`input[name="traits.website"]`)
+      .fill(faker.internet.url())
+    await page.locator("button[name=method][value=profile]").click()
+
+    await toggleAutomaticPresenceSimulation(
+      pageCDPSession,
+      authenticatorId,
+      true,
+    )
+    await page.locator("button[name=passkey_register_trigger]").click()
+
+    await toggleAutomaticPresenceSimulation(
+      pageCDPSession,
+      authenticatorId,
+      simulatePresence,
+    )
+
+    await page.waitForURL(
+      new RegExp(config.selfservice.default_browser_return_url),
+    )
+    return identifier
+  })
+}
+
+const passkeyConfig = {
+  methods: {
+    passkey: {
+      enabled: true,
+      config: {
+        rp: {
+          display_name: "ORY",
+          id: "localhost",
+          origins: ["http://localhost:4455"],
+        },
+      },
+    },
+  },
+}
+
+for (const mitigateEnumeration of [true, false]) {
+  test.describe(`account enumeration protection ${
+    mitigateEnumeration ? "on" : "off"
+  }`, () => {
+    test.use({
+      configOverride: toConfig({
+        mitigateEnumeration,
+        style: "identifier_first",
+        selfservice: passkeyConfig,
+      }),
+    })
+
+    for (const simulatePresence of [true, false]) {
+      test.describe(`${
+        simulatePresence ? "with" : "without"
+      } automatic presence proof`, () => {
+        test.use({
+          virtualAuthenticatorOptions: {
+            automaticPresenceSimulation: simulatePresence,
+            // hasResidentKey: simulatePresence,
+          },
+        })
+        test("login", async ({
+          config,
+          page,
+          kratosPublicURL,
+          virtualAuthenticator,
+          pageCDPSession,
+        }) => {
+          const identifier = await registerWithPasskey(
+            page,
+            pageCDPSession,
+            config,
+            virtualAuthenticator.authenticatorId,
+            simulatePresence,
+          )
+          await page.context().clearCookies({})
+
+          const login = new LoginPage(page, config)
+          await login.open()
+
+          if (!simulatePresence) {
+            await login.submitIdentifierFirst(identifier)
+
+            const passkeyLoginTrigger = page.locator(
+              "button[name=passkey_login_trigger]",
+            )
+            await passkeyLoginTrigger.waitFor()
+
+            await page.waitForLoadState("load")
+
+            await toggleAutomaticPresenceSimulation(
+              pageCDPSession,
+              virtualAuthenticator.authenticatorId,
+              true,
+            )
+
+            await passkeyLoginTrigger.click()
+
+            await toggleAutomaticPresenceSimulation(
+              pageCDPSession,
+              virtualAuthenticator.authenticatorId,
+              false,
+            )
+          }
+
+          await page.waitForURL(
+            new RegExp(config.selfservice.default_browser_return_url),
+          )
+
+          await expect(
+            getSession(page.request, kratosPublicURL),
+          ).resolves.toMatchObject({
+            active: true,
+            identity: {
+              traits: {
+                email: identifier,
+              },
+            },
+          })
+        })
+      })
+    }
+  })
+}
+
+test.describe("without automatic presence simulation", () => {
+  test.use({
+    virtualAuthenticatorOptions: {
+      automaticPresenceSimulation: false,
+    },
+    configOverride: toConfig({
+      selfservice: passkeyConfig,
+    }),
+  })
+  test("login with refresh", async ({
+    page,
+    config,
+    kratosPublicURL,
+    pageCDPSession,
+    virtualAuthenticator,
+  }) => {
+    const identifier = await registerWithPasskey(
+      page,
+      pageCDPSession,
+      config,
+      virtualAuthenticator.authenticatorId,
+      true,
+    )
+
+    const login = new LoginPage(page, config)
+    // Due to resetting automatic presence simulating to "true" in the previous step,
+    // opening the login page automatically triggers the passkey login
+    await login.open()
+
+    await page.waitForURL(
+      new RegExp(config.selfservice.default_browser_return_url),
+    )
+
+    await expect(
+      getSession(page.request, kratosPublicURL),
+    ).resolves.toMatchObject({
+      active: true,
+      identity: {
+        traits: {
+          email: identifier,
+        },
+      },
+    })
+
+    await login.open({
+      refresh: true,
+    })
+
+    await expect(
+      page.locator('[data-testid="ui/message/1010003"]'),
+      "show the refresh message",
+    ).toBeVisible()
+
+    const initialSession = await getSession(page.request, kratosPublicURL)
+
+    const passkeyLoginTrigger = page.locator(
+      "button[name=passkey_login_trigger]",
+    )
+    await passkeyLoginTrigger.waitFor()
+
+    await page.waitForLoadState("load")
+
+    await toggleAutomaticPresenceSimulation(
+      pageCDPSession,
+      virtualAuthenticator.authenticatorId,
+      true,
+    )
+
+    await passkeyLoginTrigger.click()
+    await page.waitForURL(
+      new RegExp(config.selfservice.default_browser_return_url),
+    )
+    const newSession = await getSession(page.request, kratosPublicURL)
+
+    expect(newSession.authentication_methods).toHaveLength(
+      initialSession.authentication_methods.length + 1,
+    )
+  })
+})

test/e2e/playwright/tests/desktop/identifier_first/passkeys.options.spec.ts

@@ -0,0 +1,243 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { faker } from "@faker-js/faker"
+import { CDPSession, expect, Page } from "@playwright/test"
+import { OryKratosConfiguration } from "../../../../shared/config"
+import { getSession, hasNoSession } from "../../../actions/session"
+import { test } from "../../../fixtures"
+import { toConfig } from "../../../lib/helper"
+
+async function toggleAutomaticPresenceSimulation(
+  cdpSession: CDPSession,
+  authenticatorId: string,
+  enabled: boolean,
+) {
+  await cdpSession.send("WebAuthn.setAutomaticPresenceSimulation", {
+    authenticatorId,
+    enabled,
+  })
+}
+
+async function startPasskeyRegistration(page: Page) {
+  await page.goto("/registration")
+  const identifier = faker.internet.email()
+  await page.locator(`input[name="traits.email"]`).fill(identifier)
+  await page.locator(`input[name="traits.website"]`).fill(faker.internet.url())
+  await page.locator("button[name=method][value=profile]").click()
+  return identifier
+}
+
+async function registerWithPasskey(
+  page: Page,
+  pageCDPSession: CDPSession,
+  config: OryKratosConfiguration,
+  authenticatorId: string,
+) {
+  return await test.step("create passkey identity", async () => {
+    const identifier = await startPasskeyRegistration(page)
+    await toggleAutomaticPresenceSimulation(
+      pageCDPSession,
+      authenticatorId,
+      true,
+    )
+    await page.locator("button[name=passkey_register_trigger]").click()
+
+    await page.waitForURL(
+      new RegExp(config.selfservice.default_browser_return_url),
+    )
+    return identifier
+  })
+}
+
+test.describe("passkey options - cross-platform attachment", () => {
+  test.use({
+    configOverride: toConfig({
+      style: "identifier_first",
+      selfservice: {
+        methods: {
+          passkey: {
+            enabled: true,
+            config: {
+              rp: {
+                display_name: "ORY",
+                id: "localhost",
+                origins: ["http://localhost:4455"],
+              },
+              authenticator_selection: {
+                attachment: "cross-platform",
+              },
+            },
+          },
+        },
+        flows: {
+          registration: {
+            after: {
+              passkey: {
+                hooks: [{ hook: "session" }],
+              },
+            },
+          },
+        },
+      },
+    }),
+    virtualAuthenticatorOptions: {
+      automaticPresenceSimulation: true,
+      hasResidentKey: true,
+      transport: "usb",
+    },
+  })
+
+  test("registration with cross-platform authenticator succeeds", async ({
+    config,
+    page,
+    pageCDPSession,
+    virtualAuthenticator,
+    kratosPublicURL,
+  }) => {
+    const identifier = await registerWithPasskey(
+      page,
+      pageCDPSession,
+      config,
+      virtualAuthenticator.authenticatorId,
+    )
+
+    await expect(
+      getSession(page.request, kratosPublicURL),
+    ).resolves.toMatchObject({
+      active: true,
+      identity: { traits: { email: identifier } },
+    })
+  })
+})
+
+test.describe("passkey options - user verification required", () => {
+  test.use({
+    configOverride: toConfig({
+      style: "identifier_first",
+      selfservice: {
+        methods: {
+          passkey: {
+            enabled: true,
+            config: {
+              rp: {
+                display_name: "ORY",
+                id: "localhost",
+                origins: ["http://localhost:4455"],
+              },
+              authenticator_selection: {
+                user_verification: "required",
+              },
+            },
+          },
+        },
+        flows: {
+          registration: {
+            after: {
+              passkey: {
+                hooks: [{ hook: "session" }],
+              },
+            },
+          },
+        },
+      },
+    }),
+    virtualAuthenticatorOptions: {
+      automaticPresenceSimulation: true,
+      hasResidentKey: true,
+      hasUserVerification: true,
+      isUserVerified: true,
+    },
+  })
+
+  test("registration with user verification required succeeds", async ({
+    config,
+    page,
+    pageCDPSession,
+    virtualAuthenticator,
+    kratosPublicURL,
+  }) => {
+    const identifier = await registerWithPasskey(
+      page,
+      pageCDPSession,
+      config,
+      virtualAuthenticator.authenticatorId,
+    )
+
+    await expect(
+      getSession(page.request, kratosPublicURL),
+    ).resolves.toMatchObject({
+      active: true,
+      identity: { traits: { email: identifier } },
+    })
+  })
+})
+
+test.describe("passkey options - user verification required, authenticator cannot verify", () => {
+  // Authenticator reports no UV capability, so the browser refuses to
+  // create a credential when the RP sets user_verification=required.
+  test.use({
+    configOverride: toConfig({
+      style: "identifier_first",
+      selfservice: {
+        methods: {
+          passkey: {
+            enabled: true,
+            config: {
+              rp: {
+                display_name: "ORY",
+                id: "localhost",
+                origins: ["http://localhost:4455"],
+              },
+              authenticator_selection: {
+                user_verification: "required",
+              },
+            },
+          },
+        },
+        flows: {
+          registration: {
+            after: {
+              passkey: {
+                hooks: [{ hook: "session" }],
+              },
+            },
+          },
+        },
+      },
+    }),
+    virtualAuthenticatorOptions: {
+      automaticPresenceSimulation: true,
+      hasResidentKey: true,
+      hasUserVerification: false,
+      isUserVerified: false,
+    },
+  })
+
+  test("registration fails and leaves the user on the registration page", async ({
+    page,
+    pageCDPSession,
+    virtualAuthenticator,
+    kratosPublicURL,
+  }) => {
+    await startPasskeyRegistration(page)
+    await toggleAutomaticPresenceSimulation(
+      pageCDPSession,
+      virtualAuthenticator.authenticatorId,
+      true,
+    )
+    await page.locator("button[name=passkey_register_trigger]").click()
+
+    // Credential creation must fail; the flow must not finalize a session.
+    // Give the browser time to reject the ceremony, then assert we stay on
+    // /registration and no session exists.
+    await page.waitForTimeout(1000)
+    await expect(page).toHaveURL(/\/registration/)
+    await hasNoSession(page.request, kratosPublicURL)
+
+    // The passkey trigger must remain visible so the user can retry.
+    await expect(
+      page.locator("button[name=passkey_register_trigger]"),
+    ).toBeVisible()
+  })
+})

test/e2e/playwright/tests/desktop/identifier_first/password.login.spec.ts

@@ -0,0 +1,236 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { expect } from "@playwright/test"
+import { loginWithPassword } from "../../../actions/login"
+import { getSession, hasNoSession, hasSession } from "../../../actions/session"
+import { test } from "../../../fixtures"
+import { toConfig } from "../../../lib/helper"
+import { LoginPage } from "../../../models/elements/login"
+
+// These can run in parallel because they use the same config.
+test.describe("account enumeration protection off", () => {
+  test.use({
+    configOverride: toConfig({
+      style: "identifier_first",
+      mitigateEnumeration: false,
+      selfservice: {
+        methods: {
+          password: {
+            enabled: true,
+          },
+          code: {
+            passwordless_enabled: false,
+          },
+        },
+      },
+    }),
+  })
+
+  test("login fails because user does not exist", async ({ page, config }) => {
+    const login = new LoginPage(page, config)
+    await login.open()
+
+    await login.submitIdentifierFirst("i@donot.exist")
+
+    await expect(
+      page.locator('[data-testid="ui/message/4000037"]'),
+      "expect account not exist message to be shown",
+    ).toBeVisible()
+  })
+
+  test("login with wrong password fails", async ({
+    page,
+    identity,
+    kratosPublicURL,
+    config,
+  }) => {
+    const login = new LoginPage(page, config)
+    await login.open()
+
+    await login.loginWithPassword(identity.email, "wrong-password")
+    await login.isReady()
+
+    await hasNoSession(page.request, kratosPublicURL)
+    await expect(
+      page.locator('[data-testid="ui/message/4000006"]'),
+      "expect to be shown a credentials do not exist error",
+    ).toBeVisible()
+  })
+
+  test("login succeeds", async ({
+    page,
+    identity,
+    config,
+    kratosPublicURL,
+  }) => {
+    const login = new LoginPage(page, config)
+    await login.open()
+
+    await login.inputField("identifier").fill(identity.email)
+    await login.submit("identifier_first", {
+      waitForURL: new RegExp(config.selfservice.flows.login.ui_url),
+    })
+
+    await login.inputField("password").fill(identity.password)
+    await login.submit("password", {
+      waitForURL: new RegExp(config.selfservice.default_browser_return_url),
+    })
+
+    await hasSession(page.request, kratosPublicURL)
+  })
+
+  test("login with refresh", async ({
+    page,
+    config,
+    identity,
+    kratosPublicURL,
+  }) => {
+    await loginWithPassword(
+      {
+        password: identity.password,
+        traits: {
+          email: identity.email,
+        },
+      },
+      page.request,
+      kratosPublicURL,
+    )
+
+    const login = new LoginPage(page, config)
+    await login.open({
+      refresh: true,
+    })
+
+    await expect(
+      page.locator('[data-testid="ui/message/1010003"]'),
+      "show the refresh message",
+    ).toBeVisible()
+
+    const initialSession = await getSession(page.request, kratosPublicURL)
+    await login.inputField("password").fill(identity.password)
+    await login.submit("password", {
+      waitForURL: new RegExp(config.selfservice.default_browser_return_url),
+    })
+
+    const newSession = await getSession(page.request, kratosPublicURL)
+
+    expect(newSession.authentication_methods).toHaveLength(
+      initialSession.authentication_methods.length + 1,
+    )
+  })
+})
+
+test.describe("account enumeration protection on", () => {
+  test.use({
+    configOverride: toConfig({
+      style: "identifier_first",
+      mitigateEnumeration: true,
+      selfservice: {
+        methods: {
+          password: {
+            enabled: true,
+          },
+          code: {
+            passwordless_enabled: false,
+          },
+        },
+      },
+    }),
+  })
+
+  test("login fails because user does not exist", async ({ page, config }) => {
+    const login = new LoginPage(page, config)
+    await login.open()
+
+    await login.submitIdentifierFirst("i@donot.exist")
+
+    await expect(
+      page.locator('button[name="method"][value="password"]'),
+      "expect to show the password form",
+    ).toBeVisible()
+  })
+
+  test("login with wrong password fails", async ({
+    page,
+    identity,
+    kratosPublicURL,
+    config,
+  }) => {
+    const login = new LoginPage(page, config)
+    await login.open()
+
+    await login.loginWithPassword(identity.email, "wrong-password")
+    await login.isReady()
+
+    await hasNoSession(page.request, kratosPublicURL)
+    await expect(
+      page.locator('[data-testid="ui/message/4000006"]'),
+      "expect to be shown a credentials do not exist error",
+    ).toBeVisible()
+  })
+
+  test("login succeeds", async ({
+    page,
+    // projectFrontendClient,
+    identity,
+    config,
+    kratosPublicURL,
+  }) => {
+    const login = new LoginPage(page, config)
+    await login.open()
+
+    await login.inputField("identifier").fill(identity.email)
+    await login.submit("identifier_first", {
+      waitForURL: new RegExp(config.selfservice.flows.login.ui_url),
+    })
+
+    await login.inputField("password").fill(identity.password)
+    await login.submit("password", {
+      waitForURL: new RegExp(config.selfservice.default_browser_return_url),
+    })
+
+    await hasSession(page.request, kratosPublicURL)
+  })
+
+  test("login with refresh", async ({
+    page,
+    config,
+    identity,
+    kratosPublicURL,
+  }) => {
+    await loginWithPassword(
+      {
+        password: identity.password,
+        traits: {
+          email: identity.email,
+        },
+      },
+      page.request,
+      kratosPublicURL,
+    )
+
+    const login = new LoginPage(page, config)
+    await login.open({
+      refresh: true,
+    })
+
+    await expect(
+      page.locator('[data-testid="ui/message/1010003"]'),
+      "show the refresh message",
+    ).toBeVisible()
+
+    const initialSession = await getSession(page.request, kratosPublicURL)
+
+    await login.inputField("password").fill(identity.password)
+    await login.submit("password", {
+      waitForURL: new RegExp(config.selfservice.default_browser_return_url),
+    })
+
+    const newSession = await getSession(page.request, kratosPublicURL)
+
+    expect(newSession.authentication_methods).toHaveLength(
+      initialSession.authentication_methods.length + 1,
+    )
+  })
+})