Repository: ory/kratos
Pull request #1657 (2021-08-17 16:24:34)

fix:add session in spa registration if session cook is configured
<!--
Describe the big picture of your changes here to communicate to the maintainers why we should accept this pull request.

This text will be included in the changelog. If applicable, include links to documentation or pieces of code.
If your change includes breaking changes please add a codeblock documenting the breaking change:

```
BREAKING CHANGES: This patch changes the behavior of configuration item `foo` to do bar. To keep the existing
behavior please do baz.
```
-->

## Related issue(s)

<!--
Please link the GitHub issue this pull request resolves in the format of `#1234`. If you discussed this change
with a maintainer, please mention her/him using the `@` syntax (e.g. `@aeneasr`).

If this change neither resolves an existing issue nor has sign-off from one of the maintainers, there is a
chance substantial changes will be requested or that the changes will be rejected.

You can discuss changes with maintainers either in the Github Discusssions in this repository or
join the [Ory Chat](https://www.ory.sh/chat).
-->

## Checklist

<!--
Put an `x` in the boxes that apply. You can also fill these out after creating the PR.

Please be aware that pull requests must have all boxes ticked in order to be merged.

If you're unsure about any of them, don't hesitate to ask. We're here to help!
-->

- [x] I have read the [contributing guidelines](../blob/master/CONTRIBUTING.md).
- [x] I am following the
      [contributing code guidelines](../blob/master/CONTRIBUTING.md#contributing-code).
- [x] I have read the [security policy](../security/policy).
- [x] I confirm that this pull request does not address a security
      vulnerability. If this pull request addresses a security. vulnerability, I
      confirm that I got green light (please contact
      [security@ory.sh](mailto:security@ory.sh)) from the maintainers to push
      the changes.
- [x] I have added tests that prove my fix is effective or that my feature
      works.
- [x] I have added or changed [the documentation](docs/docs).

## Further Comments

<!--
If this is a relatively large or complex change, kick off the discussion by explaining why you chose the solution
you did and what alternatives you considered, etc...
-->


codecov[bot]: # [Codecov](https://codecov.io/gh/ory/kratos/pull/1657?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=ory) Report
> Merging [#1657](https://codecov.io/gh/ory/kratos/pull/1657?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=ory) (2109284) into [master](https://codecov.io/gh/ory/kratos/commit/4ce03f25ddd70fe8a1024a7b0da6559ce508c6ee?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=ory) (4ce03f2) will **decrease** coverage by `0.05%`.
> The diff coverage is `100.00%`.

[![Impacted file tree graph](https://codecov.io/gh/ory/kratos/pull/1657/graphs/tree.svg?width=650&height=150&src=pr&token=6t0QqOdurR&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=ory)](https://codecov.io/gh/ory/kratos/pull/1657?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=ory)

```diff
@@            Coverage Diff             @@
##           master    #1657      +/-   ##
==========================================
- Coverage   74.31%   74.25%   -0.06%     
==========================================
  Files         259      259              
  Lines       12618    12618              
==========================================
- Hits         9377     9370       -7     
- Misses       2622     2627       +5     
- Partials      619      621       +2     
```


| [Impacted Files](https://codecov.io/gh/ory/kratos/pull/1657?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=ory) | Coverage Δ | |
|---|---|---|
| [selfservice/flow/registration/hook.go](https://codecov.io/gh/ory/kratos/pull/1657/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=ory#diff-c2VsZnNlcnZpY2UvZmxvdy9yZWdpc3RyYXRpb24vaG9vay5nbw==) | `84.78% <100.00%> (ø)` | |
| [courier/courier.go](https://codecov.io/gh/ory/kratos/pull/1657/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=ory#diff-Y291cmllci9jb3VyaWVyLmdv) | `67.64% <0.00%> (-3.68%)` | :arrow_down: |
| [persistence/sql/persister\_courier.go](https://codecov.io/gh/ory/kratos/pull/1657/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=ory#diff-cGVyc2lzdGVuY2Uvc3FsL3BlcnNpc3Rlcl9jb3VyaWVyLmdv) | `85.00% <0.00%> (-3.34%)` | :arrow_down: |

------

[Continue to review full report at Codecov](https://codecov.io/gh/ory/kratos/pull/1657?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=ory).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=ory)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/ory/kratos/pull/1657?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=ory). Last update [4ce03f2...2109284](https://codecov.io/gh/ory/kratos/pull/1657?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=ory). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=ory).


Patch:
diff --git a/docs/docs/milestones.md b/docs/docs/milestones.md
index f5dbad1d1..08f2398e3 100644
--- a/docs/docs/milestones.md
+++ b/docs/docs/milestones.md
@@ -3,71 +3,10 @@ id: milestones
 title: Milestones and Roadmap
 ---
 
-## [v0.10.0-alpha.1](https://github.com/ory/kratos/milestone/13)
-
-_This milestone does not have a description._
-
-### [Feat](https://github.com/ory/kratos/labels/feat)
-
-New feature or request.
-
-#### Issues
-
-- [ ] Require second factor only if device is unknown
-      ([kratos#1643](https://github.com/ory/kratos/issues/1643))
-- [ ] Potentially encrypt settings InternalContext
-      ([kratos#1647](https://github.com/ory/kratos/issues/1647))
-- [ ] Regenerate lookup secrets as part of login when last secret was used
-      ([kratos#1649](https://github.com/ory/kratos/issues/1649))
-
-### [Rfc](https://github.com/ory/kratos/labels/rfc)
-
-A request for comments to discuss and share ideas.
-
-#### Issues
-
-- [ ] Potentially encrypt settings InternalContext
-      ([kratos#1647](https://github.com/ory/kratos/issues/1647))
-
-## [v0.7.x](https://github.com/ory/kratos/milestone/12)
-
-_This milestone does not have a description._
-
-### [Bug](https://github.com/ory/kratos/labels/bug)
-
-Something is not working.
-
-#### Issues
-
-- [x] Submitting successful link verification again ends up with JSON response
-      ([kratos#1546](https://github.com/ory/kratos/issues/1546)) -
-      [@hackerman](https://github.com/aeneasr)
-- [x] Opening verification link in another browser causes GET request to fail
-      due to CSRF issue
-      ([kratos#1547](https://github.com/ory/kratos/issues/1547)) -
-      [@hackerman](https://github.com/aeneasr)
-
-#### Pull Requests
-
-- [x] fix(sdk): use proper annotation for genericError
-      ([kratos#1611](https://github.com/ory/kratos/pull/1611)) -
-      [@hackerman](https://github.com/aeneasr)
-
-### [Docs](https://github.com/ory/kratos/labels/docs)
+## [Incubating Release](https://github.com/ory/kratos/milestone/14)
 
-Affects documentation.
-
-#### Issues
-
-- [x] Update CSRF pitfall section for admin endpoints
-      ([kratos#1557](https://github.com/ory/kratos/issues/1557)) -
-      [@hackerman](https://github.com/aeneasr)
-- [x] Different payload for stub:500
-      ([kratos#1568](https://github.com/ory/kratos/issues/1568))
-
-## [v0.9.0-alpha.1](https://github.com/ory/kratos/milestone/11)
-
-_This milestone does not have a description._
+This milestone tracks all issues we want to resolve before Ory Kratos goes into
+incubating phase.
 
 ### [Bug](https://github.com/ory/kratos/labels/bug)
 
@@ -89,10 +28,6 @@ Something is not working.
 - [ ] panic: a handle is already registered for path
       '/self-service/recovery/methods/link'
       ([kratos#1068](https://github.com/ory/kratos/issues/1068))
-- [ ] Recovery link doesn't log out existing users
-      ([kratos#1077](https://github.com/ory/kratos/issues/1077))
-- [ ] Email verification link is automatically opened by mail provider
-      ([kratos#1202](https://github.com/ory/kratos/issues/1202))
 - [ ] Relative path in ui_url or default_browser_return_url cause runtime crash
       ([kratos#1446](https://github.com/ory/kratos/issues/1446))
 - [ ] /schemas/default does not work with base64 identity schemas
@@ -100,8 +35,6 @@ Something is not working.
 - [ ] Auto-Login on Registration flow does not return `session`, only `identity`
       for SPA requests
       ([kratos#1604](https://github.com/ory/kratos/issues/1604))
-- [x] recovery link is open by email app
-      ([kratos#1142](https://github.com/ory/kratos/issues/1142))
 
 ### [Feat](https://github.com/ory/kratos/labels/feat)
 
@@ -116,25 +49,12 @@ New feature or request.
       ([kratos#117](https://github.com/ory/kratos/issues/117))
 - [ ] Implement Hydra integration
       ([kratos#273](https://github.com/ory/kratos/issues/273))
-- [ ] Support email verification paswordless login
-      ([kratos#286](https://github.com/ory/kratos/issues/286))
-- [ ] Prevent account enumeration for profile updates
-      ([kratos#292](https://github.com/ory/kratos/issues/292)) -
-      [@hackerman](https://github.com/aeneasr)
 - [ ] SMTP Error spams the server logs
       ([kratos#402](https://github.com/ory/kratos/issues/402))
 - [ ] How to sign in with Twitter
       ([kratos#517](https://github.com/ory/kratos/issues/517))
-- [ ] Selfservice account deletion
-      ([kratos#596](https://github.com/ory/kratos/issues/596))
-- [ ] Add ability to import user credentials
-      ([kratos#605](https://github.com/ory/kratos/issues/605)) -
-      [@hackerman](https://github.com/aeneasr)
 - [ ] Throttling repeated login requests
       ([kratos#654](https://github.com/ory/kratos/issues/654))
-- [ ] Admin/Selfservice session management
-      ([kratos#655](https://github.com/ory/kratos/issues/655)) -
-      [@Alano Terblanche](https://github.com/Benehiko)
 - [ ] Require identity deactivation before administrative deletion
       ([kratos#657](https://github.com/ory/kratos/issues/657))
 - [ ] Self-service GDPR identity export
@@ -162,14 +82,21 @@ New feature or request.
       ([kratos#1055](https://github.com/ory/kratos/issues/1055))
 - [ ] Allow account recovery for identities without email address
       ([kratos#1419](https://github.com/ory/kratos/issues/1419))
-- [ ] Write new recovery and verification strategy that does not rely on links
-      ([kratos#1451](https://github.com/ory/kratos/issues/1451))
 - [ ] Field validation answer status code 422 instead of 400
       ([kratos#1559](https://github.com/ory/kratos/issues/1559))
 - [ ] [Feature] LOG_LEVEL to allow stacktrace in error for /api endpoint
       ([kratos#1589](https://github.com/ory/kratos/issues/1589))
+- [ ] Deprecate webhook loader without URI scheme
+      ([kratos#1610](https://github.com/ory/kratos/issues/1610)) -
+      [@Patrik](https://github.com/zepatrik)
 - [ ] EMail on registration with existing identifier
       ([kratos#1625](https://github.com/ory/kratos/issues/1625))
+- [ ] Require second factor only if device is unknown
+      ([kratos#1643](https://github.com/ory/kratos/issues/1643))
+- [ ] Regenerate lookup secrets as part of login when last secret was used
+      ([kratos#1649](https://github.com/ory/kratos/issues/1649))
+- [x] Potentially encrypt settings InternalContext
+      ([kratos#1647](https://github.com/ory/kratos/issues/1647))
 
 ### [Docs](https://github.com/ory/kratos/labels/docs)
 
@@ -180,10 +107,6 @@ Affects documentation.
 - [ ] Config JSON Schema needs example values
       ([kratos#179](https://github.com/ory/kratos/issues/179)) -
       [@hackerman](https://github.com/aeneasr)
-- [x] Document that identity information (traits, etc) are available to token
-      holders and backend systems
-      ([kratos#43](https://github.com/ory/kratos/issues/43)) -
-      [@hackerman](https://github.com/aeneasr)
 
 ### [Rfc](https://github.com/ory/kratos/labels/rfc)
 
@@ -198,6 +121,8 @@ A request for comments to discuss and share ideas.
       ([kratos#765](https://github.com/ory/kratos/issues/765))
 - [ ] Field validation answer status code 422 instead of 400
       ([kratos#1559](https://github.com/ory/kratos/issues/1559))
+- [x] Potentially encrypt settings InternalContext
+      ([kratos#1647](https://github.com/ory/kratos/issues/1647))
 
 ### [Blocking](https://github.com/ory/kratos/labels/blocking)
 
@@ -208,9 +133,107 @@ Blocks milestones or other issues or pulls.
 - [ ] Implement Hydra integration
       ([kratos#273](https://github.com/ory/kratos/issues/273))
 
+## [v0.10.0-alpha.1](https://github.com/ory/kratos/milestone/13)
+
+_This milestone does not have a description._
+
+### [Feat](https://github.com/ory/kratos/labels/feat)
+
+New feature or request.
+
+#### Issues
+
+- [ ] Selfservice account deletion
+      ([kratos#596](https://github.com/ory/kratos/issues/596))
+- [ ] Add ability to import user credentials
+      ([kratos#605](https://github.com/ory/kratos/issues/605)) -
+      [@hackerman](https://github.com/aeneasr)
+
+## [v0.7.x](https://github.com/ory/kratos/milestone/12)
+
+_This milestone does not have a description._
+
+### [Bug](https://github.com/ory/kratos/labels/bug)
+
+Something is not working.
+
+#### Issues
+
+- [x] Submitting successful link verification again ends up with JSON response
+      ([kratos#1546](https://github.com/ory/kratos/issues/1546)) -
+      [@hackerman](https://github.com/aeneasr)
+- [x] Opening verification link in another browser causes GET request to fail
+      due to CSRF issue
+      ([kratos#1547](https://github.com/ory/kratos/issues/1547)) -
+      [@hackerman](https://github.com/aeneasr)
+
+#### Pull Requests
+
+- [x] fix(sdk): use proper annotation for genericError
+      ([kratos#1611](https://github.com/ory/kratos/pull/1611)) -
+      [@hackerman](https://github.com/aeneasr)
+
+### [Docs](https://github.com/ory/kratos/labels/docs)
+
+Affects documentation.
+
+#### Issues
+
+- [x] Update CSRF pitfall section for admin endpoints
+      ([kratos#1557](https://github.com/ory/kratos/issues/1557)) -
+      [@hackerman](https://github.com/aeneasr)
+- [x] Different payload for stub:500
+      ([kratos#1568](https://github.com/ory/kratos/issues/1568))
+
+## [v0.9.0-alpha.1](https://github.com/ory/kratos/milestone/11)
+
+This milestone focuses on passwordless authentication and improved recovery and
+verification flows.
+
+### [Bug](https://github.com/ory/kratos/labels/bug)
+
+Something is not working.
+
+#### Issues
+
+- [ ] Recovery link doesn't log out existing users
+      ([kratos#1077](https://github.com/ory/kratos/issues/1077))
+- [ ] Email verification link is automatically opened by mail provider
+      ([kratos#1202](https://github.com/ory/kratos/issues/1202))
+- [x] recovery link is open by email app
+      ([kratos#1142](https://github.com/ory/kratos/issues/1142))
+
+### [Feat](https://github.com/ory/kratos/labels/feat)
+
+New feature or request.
+
+#### Issues
+
+- [ ] Support email verification paswordless login
+      ([kratos#286](https://github.com/ory/kratos/issues/286))
+- [ ] Prevent account enumeration for profile updates
+      ([kratos#292](https://github.com/ory/kratos/issues/292)) -
+      [@hackerman](https://github.com/aeneasr)
+- [ ] Admin/Selfservice session management
+      ([kratos#655](https://github.com/ory/kratos/issues/655)) -
+      [@Alano Terblanche](https://github.com/Benehiko)
+- [ ] Write new recovery and verification strategy that does not rely on links
+      ([kratos#1451](https://github.com/ory/kratos/issues/1451))
+
+### [Docs](https://github.com/ory/kratos/labels/docs)
+
+Affects documentation.
+
+#### Issues
+
+- [x] Document that identity information (traits, etc) are available to token
+      holders and backend systems
+      ([kratos#43](https://github.com/ory/kratos/issues/43)) -
+      [@hackerman](https://github.com/aeneasr)
+
 ## [v0.8.0-alpha.1](https://github.com/ory/kratos/milestone/10)
 
-This milestone focuses on MFA with TOTP.
+This milestone focuses on MFA with TOTP, WebAuthn, and Recovery Codes.
 
 ### [Bug](https://github.com/ory/kratos/labels/bug)
 
@@ -232,9 +255,6 @@ New feature or request.
 - [ ] Add `return_to` to self-service SDK methods including logout
       ([kratos#1605](https://github.com/ory/kratos/issues/1605)) -
       [@hackerman](https://github.com/aeneasr)
-- [ ] Deprecate webhook loader without URI scheme
-      ([kratos#1610](https://github.com/ory/kratos/issues/1610)) -
-      [@Patrik](https://github.com/zepatrik)
 - [x] Implement identity state and administrative deactivation, deletion of
       identities ([kratos#598](https://github.com/ory/kratos/issues/598)) -
       [@hackerman](https://github.com/aeneasr)
diff --git a/selfservice/flow/registration/hook.go b/selfservice/flow/registration/hook.go
index 1ec0cb9ec..0a63193d6 100644
--- a/selfservice/flow/registration/hook.go
+++ b/selfservice/flow/registration/hook.go
@@ -171,7 +171,7 @@ func (e *HookExecutor) PostRegistrationHook(w http.ResponseWriter, r *http.Reque
 		Debug("Post registration execution hooks completed successfully.")
 
 	if a.Type == flow.TypeAPI || x.IsJSONRequest(r) {
-		e.d.Writer().Write(w, r, &APIFlowResponse{Identity: i})
+		e.d.Writer().Write(w, r, &APIFlowResponse{Identity: i, Session: s})
 		return nil
 	}
 


Test patch:
diff --git a/selfservice/strategy/password/registration_test.go b/selfservice/strategy/password/registration_test.go
index 39dc5e646..461696d65 100644
--- a/selfservice/strategy/password/registration_test.go
+++ b/selfservice/strategy/password/registration_test.go
@@ -515,7 +515,7 @@ func TestRegistration(t *testing.T) {
 				})
 				assert.Equal(t, `registration-identifier-8-spa`, gjson.Get(body, "identity.traits.username").String(), "%s", body)
 				assert.Empty(t, gjson.Get(body, "session_token").String(), "%s", body)
-				assert.Empty(t, gjson.Get(body, "session.id").String(), "%s", body)
+				assert.NotEmpty(t, gjson.Get(body, "session.id").String(), "%s", body)
 			})
 
 			t.Run("type=browser", func(t *testing.T) {