Repository: ory/kratos
Pull request #187 (2020-01-27 21:44:29)

Improve Docker Compose Quickstart


Patch:
diff --git a/Makefile b/Makefile
index d05e4557d..6190eddf8 100644
--- a/Makefile
+++ b/Makefile
@@ -81,3 +81,12 @@ sdk:
 		mkdir -p internal/httpclient
 		$$(go env GOPATH)/bin/swagger generate client -f ./docs/api.swagger.json -t internal/httpclient -A Ory_Hydra
 		make format
+
+quickstart:
+		docker pull oryd/kratos:latest
+		docker-compose -f quickstart.yml up --build --force-recreate
+
+quickstart-dev:
+		docker build -f Dockerfile-build -t oryd/kratos:latest .
+		docker pull oryd/kratos-selfservice-ui-node:latest
+		docker-compose -f quickstart.yml up --build --force-recreate
diff --git a/contrib/quickstart/kratos/email-password/.kratos.yml b/contrib/quickstart/kratos/email-password/.kratos.yml
index 9a7bd573d..de09a467d 100644
--- a/contrib/quickstart/kratos/email-password/.kratos.yml
+++ b/contrib/quickstart/kratos/email-password/.kratos.yml
@@ -11,9 +11,9 @@ selfservice:
     after:
       password:
         -
-          run: session
+          job: session
         -
-          run: redirect
+          job: redirect
           config:
             default_redirect_url: http://127.0.0.1:4455/
             allow_user_defined_redirect: true
@@ -23,9 +23,9 @@ selfservice:
     after:
       password:
         -
-          run: session
+          job: session
         -
-          run: redirect
+          job: redirect
           config:
             default_redirect_url: http://127.0.0.1:4455/
             allow_user_defined_redirect: true
@@ -48,7 +48,8 @@ urls:
     public: http://127.0.0.1:4455/.ory/kratos/public/
     admin: http://kratos:4434/
   default_return_to: http://127.0.0.1:4455/
-  whitelisted_return_to_domains: http://127.0.0.1:4455/
+  whitelisted_return_to_domains:
+    - http://127.0.0.1:4455
 
 hashers:
   argon2:
diff --git a/contrib/quickstart/oathkeeper/access-rules.yml b/contrib/quickstart/oathkeeper/access-rules.yml
index ac992a8b5..a35510059 100644
--- a/contrib/quickstart/oathkeeper/access-rules.yml
+++ b/contrib/quickstart/oathkeeper/access-rules.yml
@@ -26,7 +26,7 @@
     preserve_host: true
     url: "http://kratos-selfservice-ui-node:4435"
   match:
-    url: "http://127.0.0.1:4455/<(error|auth/login|auth/registration|index.css)(|/)>"
+    url: "http://127.0.0.1:4455/<(error|auth/login|auth/registration|(.+\\.css))(|/)>"
     methods:
       - GET
   authenticators:
@@ -44,7 +44,7 @@
     preserve_host: true
     url: "http://kratos-selfservice-ui-node:4435"
   match:
-    url: "http://127.0.0.1:4455<(/debug|/|)(|/)>"
+    url: "http://127.0.0.1:4455<(/debug|/|/dashboard|)(|/)>"
     methods:
       - GET
   authenticators:
@@ -58,4 +58,3 @@
     - handler: redirect
       config:
         to: http://127.0.0.1:4455/.ory/kratos/public/auth/browser/login
-
diff --git a/docs/.kratos.yaml b/docs/.kratos.yaml
index 3b8d8731d..b81a5ed87 100644
--- a/docs/.kratos.yaml
+++ b/docs/.kratos.yaml
@@ -68,47 +68,53 @@ selfservice:
   login:
     request_lifespan: 99m
     before:
-      - run: redirect
+      - job: redirect
         config:
           default_redirect_url: http://test.kratos.ory.sh:4000/
           allow_user_defined_redirect: false
     after:
       password:
-        - run: revoke_active_sessions
-        - run: session
-        - run: redirect
+        -
+          job: revoke_active_sessions
+        - job: session
+        - job: redirect
           config:
             default_redirect_url: http://test.kratos.ory.sh:4000/
             allow_user_defined_redirect: true
       oidc:
-        - run: revoke_active_sessions
-        - run: session
-        - run: redirect
+        -
+          job: revoke_active_sessions
+        - job: session
+        - job: redirect
           config:
             default_redirect_url: http://test.kratos.ory.sh:4000/
             allow_user_defined_redirect: true
   registration:
     request_lifespan: 98m
     before:
-      - run: redirect
+      - job: redirect
         config:
           default_redirect_url: http://test.kratos.ory.sh:4000/
           allow_user_defined_redirect: false
     after:
       password:
-        - run: session
-        - run: redirect
+        -
+          job: session
+        -
+          job: redirect
           config:
             default_redirect_url: http://test.kratos.ory.sh:4000/
             allow_user_defined_redirect: true
       oidc:
-        - run: session
-        - run: redirect
+        -
+          job: session
+        -
+          job: redirect
           config:
             default_redirect_url: http://test.kratos.ory.sh:4000/
             allow_user_defined_redirect: true
 
-#      - run: account_activation
+#      - job: account_activation
 #        config:
 #          redirect:
 #            pending:
diff --git a/docs/api.swagger.json b/docs/api.swagger.json
index b343a3760..052e463cf 100755
--- a/docs/api.swagger.json
+++ b/docs/api.swagger.json
@@ -320,10 +320,9 @@
     "CredentialsType": {
       "description": "and so on.",
       "type": "string",
-      "title": "CredentialsType CredentialsType  represents several different credential types, like password credentials, passwordless credentials,"
+      "title": "CredentialsType  represents several different credential types, like password credentials, passwordless credentials,"
     },
     "Error": {
-      "description": "Error error",
       "type": "object",
       "properties": {
         "message": {
@@ -333,7 +332,6 @@
       }
     },
     "Identity": {
-      "description": "Identity identity",
       "type": "object",
       "required": [
         "id",
@@ -347,17 +345,16 @@
           "$ref": "#/definitions/Traits"
         },
         "traits_schema_id": {
-          "description": "TraitsSchemaID is the JSON Schema to be used for validating the identity's traits.",
+          "description": "TraitsSchemaID is the ID of the JSON Schema to be used for validating the identity's traits.",
           "type": "string"
         },
         "traits_schema_url": {
-          "description": "TraitsSchemaURL is the kratos public endpoint where the identity's traits schema can be fetched.",
+          "description": "TraitsSchemaURL is the URL of the endpoint where the identity's traits schema can be fetched from.\n\nformat: url",
           "type": "string"
         }
       }
     },
     "Traits": {
-      "description": "Traits traits",
       "type": "object"
     },
     "UUID": {
@@ -401,25 +398,24 @@
         },
         "name": {
           "description": "Name is the equivalent of \u003cinput name=\"{{.Name}}\"\u003e",
-          "type": "string",
-          "x-go-asdffasd": "Asdffsdafsad"
+          "type": "string"
         },
         "required": {
-          "description": "Name is the equivalent of \u003cinput required=\"{{.Required}}\"\u003e",
+          "description": "Required is the equivalent of \u003cinput required=\"{{.Required}}\"\u003e",
           "type": "boolean"
         },
         "type": {
-          "description": "Name is the equivalent of \u003cinput type=\"{{.Type}}\"\u003e",
+          "description": "Type is the equivalent of \u003cinput type=\"{{.Type}}\"\u003e",
           "type": "string"
         },
         "value": {
-          "description": "Name is the equivalent of \u003cinput value=\"{{.Value}}\"\u003e",
+          "description": "Value is the equivalent of \u003cinput value=\"{{.Value}}\"\u003e",
           "type": "object"
         }
       }
     },
     "formFields": {
-      "description": "FormFields Fields contains multiple fields asdfasdf",
+      "description": "Fields contains multiple fields",
       "type": "object",
       "additionalProperties": {
         "$ref": "#/definitions/formField"
@@ -478,14 +474,13 @@
       }
     },
     "loginRequest": {
-      "description": "LoginRequest login request",
       "type": "object",
       "properties": {
         "active": {
           "$ref": "#/definitions/CredentialsType"
         },
         "expires_at": {
-          "description": "ExpiresAt is the time (UTC) when the request expires. If the user still wishes to log in,\na new request has to be initiated.\nFormat: date-time",
+          "description": "ExpiresAt is the time (UTC) when the request expires. If the user still wishes to log in,\na new request has to be initiated.",
           "type": "string",
           "format": "date-time"
         },
@@ -493,7 +488,7 @@
           "$ref": "#/definitions/UUID"
         },
         "issued_at": {
-          "description": "IssuedAt is the time (UTC) when the request occurred.\nFormat: date-time",
+          "description": "IssuedAt is the time (UTC) when the request occurred.",
           "type": "string",
           "format": "date-time"
         },
@@ -522,7 +517,6 @@
       }
     },
     "loginRequestMethodConfig": {
-      "description": "LoginRequestMethodConfig login request method config",
       "type": "object",
       "allOf": [
         {
@@ -542,10 +536,10 @@
     "profileManagementRequest": {
       "description": "This request is used when an identity wants to update profile information\n(especially traits) in a selfservice manner.\n\nFor more information head over to: https://www.ory.sh/docs/kratos/selfservice/profile",
       "type": "object",
-      "title": "ProfileManagementRequest Request presents a profile management request",
+      "title": "Request presents a profile management request",
       "properties": {
         "expires_at": {
-          "description": "ExpiresAt is the time (UTC) when the request expires. If the user still wishes to update the profile,\na new request has to be initiated.\nFormat: date-time",
+          "description": "ExpiresAt is the time (UTC) when the request expires. If the user still wishes to update the profile,\na new request has to be initiated.",
           "type": "string",
           "format": "date-time"
         },
@@ -559,7 +553,7 @@
           "$ref": "#/definitions/Identity"
         },
         "issued_at": {
-          "description": "IssuedAt is the time (UTC) when the request occurred.\nFormat: date-time",
+          "description": "IssuedAt is the time (UTC) when the request occurred.",
           "type": "string",
           "format": "date-time"
         },
@@ -574,14 +568,13 @@
       }
     },
     "registrationRequest": {
-      "description": "RegistrationRequest registration request",
       "type": "object",
       "properties": {
         "active": {
           "$ref": "#/definitions/CredentialsType"
         },
         "expires_at": {
-          "description": "ExpiresAt is the time (UTC) when the request expires. If the user still wishes to log in,\na new request has to be initiated.\nFormat: date-time",
+          "description": "ExpiresAt is the time (UTC) when the request expires. If the user still wishes to log in,\na new request has to be initiated.",
           "type": "string",
           "format": "date-time"
         },
@@ -589,7 +582,7 @@
           "$ref": "#/definitions/UUID"
         },
         "issued_at": {
-          "description": "IssuedAt is the time (UTC) when the request occurred.\nFormat: date-time",
+          "description": "IssuedAt is the time (UTC) when the request occurred.",
           "type": "string",
           "format": "date-time"
         },
@@ -607,7 +600,6 @@
       }
     },
     "registrationRequestMethod": {
-      "description": "RegistrationRequestMethod registration request method",
       "type": "object",
       "properties": {
         "config": {
diff --git a/docs/config.schema.json b/docs/config.schema.json
index 76032ec7e..fe859b355 100644
--- a/docs/config.schema.json
+++ b/docs/config.schema.json
@@ -7,7 +7,7 @@
     "selfServiceRedirectHook": {
       "type": "object",
       "properties": {
-        "run": {
+        "job": {
           "const": "redirect"
         },
         "config": {
@@ -29,32 +29,32 @@
       },
       "additionalItems": false,
       "required": [
-        "run",
+        "job",
         "config"
       ]
     },
     "selfServiceSessionRevokerHook": {
       "type": "object",
       "properties": {
-        "run": {
+        "job": {
           "const": "revoke_active_sessions"
         }
       },
       "additionalItems": false,
       "required": [
-        "run"
+        "job"
       ]
     },
     "selfServiceSessionIssuerHook": {
       "type": "object",
       "properties": {
-        "run": {
+        "job": {
           "const": "session"
         }
       },
       "additionalItems": false,
       "required": [
-        "run"
+        "job"
       ]
     },
     "selfServiceOIDCProvider": {
diff --git a/driver/configuration/provider.go b/driver/configuration/provider.go
index 1991542c5..9ce4a77ff 100644
--- a/driver/configuration/provider.go
+++ b/driver/configuration/provider.go
@@ -17,7 +17,7 @@ type HasherArgon2Config struct {
 }
 
 type SelfServiceHook struct {
-	Run    string          `json:"run"`
+	Job    string          `json:"job"`
 	Config json.RawMessage `json:"config"`
 }
 
diff --git a/driver/registry_default_hooks.go b/driver/registry_default_hooks.go
index 01fa45ef4..efe53e601 100644
--- a/driver/registry_default_hooks.go
+++ b/driver/registry_default_hooks.go
@@ -15,7 +15,7 @@ func (m *RegistryDefault) getHooks(credentialsType identity.CredentialsType, con
 	var i []interface{}
 
 	for _, h := range configs {
-		switch h.Run {
+		switch h.Job {
 		case hook.KeySessionIssuer:
 			i = append(
 				i,
@@ -35,7 +35,7 @@ func (m *RegistryDefault) getHooks(credentialsType identity.CredentialsType, con
 			if err := json.NewDecoder(bytes.NewBuffer(h.Config)).Decode(&rc); err != nil {
 				m.l.WithError(err).
 					WithField("type", credentialsType).
-					WithField("hook", h.Run).
+					WithField("hook", h.Job).
 					WithField("config", fmt.Sprintf("%s", h.Config)).
 					Errorf("The after hook is misconfigured.")
 				continue
@@ -45,7 +45,7 @@ func (m *RegistryDefault) getHooks(credentialsType identity.CredentialsType, con
 			if err != nil {
 				m.l.WithError(err).
 					WithField("type", credentialsType).
-					WithField("hook", h.Run).
+					WithField("hook", h.Job).
 					WithField("config", fmt.Sprintf("%s", h.Config)).
 					Errorf("The after hook is misconfigured.")
 				continue
@@ -66,7 +66,7 @@ func (m *RegistryDefault) getHooks(credentialsType identity.CredentialsType, con
 		default:
 			m.l.
 				WithField("type", credentialsType).
-				WithField("hook", h.Run).
+				WithField("hook", h.Job).
 				Errorf("A unknown hook was requested and can therefore not be used")
 		}
 	}
diff --git a/internal/httpclient/models/credentials_type.go b/internal/httpclient/models/credentials_type.go
index 6cfba2b66..0d3419209 100644
--- a/internal/httpclient/models/credentials_type.go
+++ b/internal/httpclient/models/credentials_type.go
@@ -9,7 +9,7 @@ import (
 	strfmt "github.com/go-openapi/strfmt"
 )
 
-// CredentialsType CredentialsType CredentialsType  represents several different credential types, like password credentials, passwordless credentials,
+// CredentialsType CredentialsType  represents several different credential types, like password credentials, passwordless credentials,
 //
 // and so on.
 // swagger:model CredentialsType
diff --git a/internal/httpclient/models/error.go b/internal/httpclient/models/error.go
index 3e97c334e..2422e508a 100644
--- a/internal/httpclient/models/error.go
+++ b/internal/httpclient/models/error.go
@@ -11,7 +11,7 @@ import (
 	"github.com/go-openapi/swag"
 )
 
-// Error Error error
+// Error error
 // swagger:model Error
 type Error struct {
 
diff --git a/internal/httpclient/models/form_field.go b/internal/httpclient/models/form_field.go
index 548fa33f2..f0bf69079 100644
--- a/internal/httpclient/models/form_field.go
+++ b/internal/httpclient/models/form_field.go
@@ -24,13 +24,13 @@ type FormField struct {
 	// Name is the equivalent of <input name="{{.Name}}">
 	Name string `json:"name,omitempty"`
 
-	// Name is the equivalent of <input required="{{.Required}}">
+	// Required is the equivalent of <input required="{{.Required}}">
 	Required bool `json:"required,omitempty"`
 
-	// Name is the equivalent of <input type="{{.Type}}">
+	// Type is the equivalent of <input type="{{.Type}}">
 	Type string `json:"type,omitempty"`
 
-	// Name is the equivalent of <input value="{{.Value}}">
+	// Value is the equivalent of <input value="{{.Value}}">
 	Value interface{} `json:"value,omitempty"`
 }
 
diff --git a/internal/httpclient/models/form_fields.go b/internal/httpclient/models/form_fields.go
index f0fa7036e..215b0c8f9 100644
--- a/internal/httpclient/models/form_fields.go
+++ b/internal/httpclient/models/form_fields.go
@@ -12,7 +12,7 @@ import (
 	"github.com/go-openapi/validate"
 )
 
-// FormFields FormFields Fields contains multiple fields asdfasdf
+// FormFields Fields contains multiple fields
 // swagger:model formFields
 type FormFields map[string]FormField
 
diff --git a/internal/httpclient/models/identity.go b/internal/httpclient/models/identity.go
index f351b2c7d..491b9e1a0 100644
--- a/internal/httpclient/models/identity.go
+++ b/internal/httpclient/models/identity.go
@@ -13,7 +13,7 @@ import (
 	"github.com/go-openapi/validate"
 )
 
-// Identity Identity identity
+// Identity identity
 // swagger:model Identity
 type Identity struct {
 
@@ -26,10 +26,12 @@ type Identity struct {
 	// Required: true
 	Traits Traits `json:"traits"`
 
-	// TraitsSchemaID is the JSON Schema to be used for validating the identity's traits.
+	// TraitsSchemaID is the ID of the JSON Schema to be used for validating the identity's traits.
 	TraitsSchemaID string `json:"traits_schema_id,omitempty"`
 
-	// TraitsSchemaURL is the kratos public endpoint where the identity's traits schema can be fetched.
+	// TraitsSchemaURL is the URL of the endpoint where the identity's traits schema can be fetched from.
+	//
+	// format: url
 	TraitsSchemaURL string `json:"traits_schema_url,omitempty"`
 }
 
diff --git a/internal/httpclient/models/login_request.go b/internal/httpclient/models/login_request.go
index f254821f4..70de61bff 100644
--- a/internal/httpclient/models/login_request.go
+++ b/internal/httpclient/models/login_request.go
@@ -13,7 +13,7 @@ import (
 	"github.com/go-openapi/validate"
 )
 
-// LoginRequest LoginRequest login request
+// LoginRequest login request
 // swagger:model loginRequest
 type LoginRequest struct {
 
@@ -23,7 +23,6 @@ type LoginRequest struct {
 	// ExpiresAt is the time (UTC) when the request expires. If the user still wishes to log in,
 	// a new request has to be initiated.
 	// Format: date-time
-	// Format: date-time
 	ExpiresAt strfmt.DateTime `json:"expires_at,omitempty"`
 
 	// id
@@ -32,7 +31,6 @@ type LoginRequest struct {
 
 	// IssuedAt is the time (UTC) when the request occurred.
 	// Format: date-time
-	// Format: date-time
 	IssuedAt strfmt.DateTime `json:"issued_at,omitempty"`
 
 	// Methods contains context for all enabled login methods. If a login request has been
diff --git a/internal/httpclient/models/login_request_method_config.go b/internal/httpclient/models/login_request_method_config.go
index 16737d5c4..6127fe038 100644
--- a/internal/httpclient/models/login_request_method_config.go
+++ b/internal/httpclient/models/login_request_method_config.go
@@ -11,7 +11,7 @@ import (
 	"github.com/go-openapi/swag"
 )
 
-// LoginRequestMethodConfig LoginRequestMethodConfig login request method config
+// LoginRequestMethodConfig login request method config
 // swagger:model loginRequestMethodConfig
 type LoginRequestMethodConfig struct {
 	LoginRequestMethodConfigAllOf0
diff --git a/internal/httpclient/models/profile_management_request.go b/internal/httpclient/models/profile_management_request.go
index 3012598ba..816c8afb9 100644
--- a/internal/httpclient/models/profile_management_request.go
+++ b/internal/httpclient/models/profile_management_request.go
@@ -13,7 +13,7 @@ import (
 	"github.com/go-openapi/validate"
 )
 
-// ProfileManagementRequest ProfileManagementRequest Request presents a profile management request
+// ProfileManagementRequest Request presents a profile management request
 //
 // This request is used when an identity wants to update profile information
 // (especially traits) in a selfservice manner.
@@ -25,7 +25,6 @@ type ProfileManagementRequest struct {
 	// ExpiresAt is the time (UTC) when the request expires. If the user still wishes to update the profile,
 	// a new request has to be initiated.
 	// Format: date-time
-	// Format: date-time
 	ExpiresAt strfmt.DateTime `json:"expires_at,omitempty"`
 
 	// form
@@ -40,7 +39,6 @@ type ProfileManagementRequest struct {
 
 	// IssuedAt is the time (UTC) when the request occurred.
 	// Format: date-time
-	// Format: date-time
 	IssuedAt strfmt.DateTime `json:"issued_at,omitempty"`
 
 	// RequestURL is the initial URL that was requested from ORY Kratos. It can be used
diff --git a/internal/httpclient/models/registration_request.go b/internal/httpclient/models/registration_request.go
index 098374dc4..c360d5ec1 100644
--- a/internal/httpclient/models/registration_request.go
+++ b/internal/httpclient/models/registration_request.go
@@ -13,7 +13,7 @@ import (
 	"github.com/go-openapi/validate"
 )
 
-// RegistrationRequest RegistrationRequest registration request
+// RegistrationRequest registration request
 // swagger:model registrationRequest
 type RegistrationRequest struct {
 
@@ -23,7 +23,6 @@ type RegistrationRequest struct {
 	// ExpiresAt is the time (UTC) when the request expires. If the user still wishes to log in,
 	// a new request has to be initiated.
 	// Format: date-time
-	// Format: date-time
 	ExpiresAt strfmt.DateTime `json:"expires_at,omitempty"`
 
 	// id
@@ -32,7 +31,6 @@ type RegistrationRequest struct {
 
 	// IssuedAt is the time (UTC) when the request occurred.
 	// Format: date-time
-	// Format: date-time
 	IssuedAt strfmt.DateTime `json:"issued_at,omitempty"`
 
 	// Methods contains context for all enabled registration methods. If a registration request has been
diff --git a/internal/httpclient/models/registration_request_method.go b/internal/httpclient/models/registration_request_method.go
index 94fe18f31..f4c89c6ff 100644
--- a/internal/httpclient/models/registration_request_method.go
+++ b/internal/httpclient/models/registration_request_method.go
@@ -12,7 +12,7 @@ import (
 	"github.com/go-openapi/swag"
 )
 
-// RegistrationRequestMethod RegistrationRequestMethod registration request method
+// RegistrationRequestMethod registration request method
 // swagger:model registrationRequestMethod
 type RegistrationRequestMethod struct {
 
@@ -27,6 +27,10 @@ type RegistrationRequestMethod struct {
 func (m *RegistrationRequestMethod) Validate(formats strfmt.Registry) error {
 	var res []error
 
+	if err := m.validateConfig(formats); err != nil {
+		res = append(res, err)
+	}
+
 	if err := m.validateMethod(formats); err != nil {
 		res = append(res, err)
 	}
@@ -37,6 +41,24 @@ func (m *RegistrationRequestMethod) Validate(formats strfmt.Registry) error {
 	return nil
 }
 
+func (m *RegistrationRequestMethod) validateConfig(formats strfmt.Registry) error {
+
+	if swag.IsZero(m.Config) { // not required
+		return nil
+	}
+
+	if m.Config != nil {
+		if err := m.Config.Validate(formats); err != nil {
+			if ve, ok := err.(*errors.Validation); ok {
+				return ve.ValidateName("config")
+			}
+			return err
+		}
+	}
+
+	return nil
+}
+
 func (m *RegistrationRequestMethod) validateMethod(formats strfmt.Registry) error {
 
 	if swag.IsZero(m.Method) { // not required
diff --git a/internal/httpclient/models/traits.go b/internal/httpclient/models/traits.go
index 2e61ece25..e39059ab6 100644
--- a/internal/httpclient/models/traits.go
+++ b/internal/httpclient/models/traits.go
@@ -5,6 +5,6 @@ package models
 // This file was generated by the swagger tool.
 // Editing this file might prove futile when you re-run the swagger generate command
 
-// Traits Traits traits
+// Traits traits
 // swagger:model Traits
 type Traits interface{}
diff --git a/quickstart.yml b/quickstart.yml
index 65060b8f8..77dd52e63 100644
--- a/quickstart.yml
+++ b/quickstart.yml
@@ -7,9 +7,7 @@ version: '3.7'
 services:
 
   kratos-migrate:
-    build:
-      context: .
-      dockerfile: Dockerfile-build
+    image: oryd/kratos:latest
     environment:
       - DSN=sqlite:///var/lib/sqlite/db.sqlite?_fk=true
     volumes:
@@ -30,7 +28,7 @@ services:
       - intranet
 
   kratos-selfservice-ui-node:
-    image: oryd/kratos-selfservice-ui-node:v0.0.25-alpha.1
+    image: oryd/kratos-selfservice-ui-node:latest
     ports:
       - "4435:4435"
     environment:
@@ -40,9 +38,12 @@ services:
       - JWKS_URL=http://oathkeeper:4456/.well-known/jwks.json
     networks:
       - intranet
+    restart: on-failure
 
   oathkeeper:
-    image: oryd/oathkeeper:v0.35.0-alpha.1
+    image: oryd/oathkeeper:v0.35.5-beta.1
+    depends_on:
+      - kratos
     ports:
       - "4455:4455"
       - "4456:4456"
@@ -62,10 +63,7 @@ services:
   kratos:
     depends_on:
       - kratos-migrate
-      - kratos-selfservice-ui-node
-    build:
-      context: .
-      dockerfile: Dockerfile-build
+    image: oryd/kratos:latest
     ports:
       - "4433:4433" # public
       - "4434:4434" # admin
diff --git a/session/handler.go b/session/handler.go
index 798746eb6..6b1430e4a 100644
--- a/session/handler.go
+++ b/session/handler.go
@@ -50,7 +50,7 @@ func (h *Handler) RegisterAdminRoutes(admin *x.RouterAdmin) {
 func (h *Handler) fromCookie(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
 	s, err := h.r.SessionManager().FetchFromRequest(r.Context(), w, r)
 	if err != nil {
-		h.r.Writer().WriteError(w, r, err)
+		h.r.Writer().WriteError(w, r, herodot.ErrUnauthorized.WithReasonf("No valid session cookie found.").WithDebugf("%+v", err))
 		return
 	}
 
diff --git a/session/manager_http.go b/session/manager_http.go
index 85852c6c5..9d5efb099 100644
--- a/session/manager_http.go
+++ b/session/manager_http.go
@@ -6,6 +6,7 @@ import (
 	"time"
 
 	"github.com/gorilla/securecookie"
+	"github.com/ory/x/sqlcon"
 	"github.com/pkg/errors"
 
 	"github.com/ory/herodot"
@@ -84,7 +85,9 @@ func (s *ManagerHTTP) FetchFromRequest(ctx context.Context, w http.ResponseWrite
 	}
 
 	se, err := s.r.SessionPersister().GetSession(ctx, x.ParseUUID(sid))
-	if err != nil && err.Error() == herodot.ErrNotFound.Error() {
+	if err != nil && (
+		err.Error() == herodot.ErrNotFound.Error() ||
+			err.Error() == sqlcon.ErrNoRows.Error()) {
 		return nil, errors.WithStack(ErrNoActiveSessionFound)
 	} else if err != nil {
 		return nil, err


Test patch:
diff --git a/driver/configuration/provider_viper_test.go b/driver/configuration/provider_viper_test.go
index 18a6397c5..8b742678e 100644
--- a/driver/configuration/provider_viper_test.go
+++ b/driver/configuration/provider_viper_test.go
@@ -108,7 +108,7 @@ func TestViperProvider(t *testing.T) {
 
 			t.Run("hook=before", func(t *testing.T) {
 				hook := p.SelfServiceRegistrationBeforeHooks()[0]
-				assert.EqualValues(t, "redirect", hook.Run)
+				assert.EqualValues(t, "redirect", hook.Job)
 				assert.JSONEq(t, `{"allow_user_defined_redirect":false,"default_redirect_url":"http://test.kratos.ory.sh:4000/"}`, string(hook.Config))
 			})
 
@@ -129,10 +129,10 @@ func TestViperProvider(t *testing.T) {
 					hooks := p.SelfServiceRegistrationAfterHooks(tc.strategy)
 
 					hook := hooks[0]
-					assert.EqualValues(t, "session", hook.Run)
+					assert.EqualValues(t, "session", hook.Job)
 
 					hook = hooks[1]
-					assert.EqualValues(t, "redirect", hook.Run)
+					assert.EqualValues(t, "redirect", hook.Job)
 					assert.JSONEq(t, tc.redirectConfig, string(hook.Config))
 				})
 			}
@@ -144,7 +144,7 @@ func TestViperProvider(t *testing.T) {
 
 			t.Run("hook=before", func(t *testing.T) {
 				hook := p.SelfServiceLoginBeforeHooks()[0]
-				assert.EqualValues(t, "redirect", hook.Run)
+				assert.EqualValues(t, "redirect", hook.Job)
 				assert.JSONEq(t, `{"allow_user_defined_redirect":false,"default_redirect_url":"http://test.kratos.ory.sh:4000/"}`, string(hook.Config))
 			})
 
@@ -165,13 +165,13 @@ func TestViperProvider(t *testing.T) {
 					hooks := p.SelfServiceLoginAfterHooks(tc.strategy)
 
 					hook := hooks[0]
-					assert.EqualValues(t, "revoke_active_sessions", hook.Run)
+					assert.EqualValues(t, "revoke_active_sessions", hook.Job)
 
 					hook = hooks[1]
-					assert.EqualValues(t, "session", hook.Run)
+					assert.EqualValues(t, "session", hook.Job)
 
 					hook = hooks[2]
-					assert.EqualValues(t, "redirect", hook.Run)
+					assert.EqualValues(t, "redirect", hook.Job)
 					assert.JSONEq(t, tc.redirectConfig, string(hook.Config))
 				})
 			}
diff --git a/selfservice/strategy/oidc/strategy_test.go b/selfservice/strategy/oidc/strategy_test.go
index a8e2f9a27..be8999095 100644
--- a/selfservice/strategy/oidc/strategy_test.go
+++ b/selfservice/strategy/oidc/strategy_test.go
@@ -42,10 +42,10 @@ func hookConfig(u string) (m []map[string]interface{}) {
 	var b bytes.Buffer
 	if _, err := fmt.Fprintf(&b, `[
 	{
-		"run": "session"
+		"job": "session"
 	},
 	{
-		"run": "redirect",
+		"job": "redirect",
 		"config": {
           "default_redirect_url": "%s",
           "allow_user_defined_redirect": true
diff --git a/selfservice/strategy/password/strategy_test.go b/selfservice/strategy/password/strategy_test.go
index ae4645fd5..4c54b51e5 100644
--- a/selfservice/strategy/password/strategy_test.go
+++ b/selfservice/strategy/password/strategy_test.go
@@ -41,10 +41,10 @@ func hookConfig(u string) (m []map[string]interface{}) {
 	var b bytes.Buffer
 	if _, err := fmt.Fprintf(&b, `[
 	{
-		"run": "session"
+		"job": "session"
 	},
 	{
-		"run": "redirect",
+		"job": "redirect",
 		"config": {
           "default_redirect_url": "%s",
           "allow_user_defined_redirect": true
diff --git a/tests/fixtures/config.schema.test.success/allKeys.selfServiceRedirectHook.yaml b/tests/fixtures/config.schema.test.success/allKeys.selfServiceRedirectHook.yaml
index afc52c8b6..d854de781 100644
--- a/tests/fixtures/config.schema.test.success/allKeys.selfServiceRedirectHook.yaml
+++ b/tests/fixtures/config.schema.test.success/allKeys.selfServiceRedirectHook.yaml
@@ -1,4 +1,4 @@
-run: redirect
+job: redirect
 config:
   default_redirect_url: https://example.com
   allow_user_defined_redirect: true
diff --git a/tests/fixtures/config.schema.test.success/allKeys.selfServiceSessionIssuerHook.yaml b/tests/fixtures/config.schema.test.success/allKeys.selfServiceSessionIssuerHook.yaml
index 333d89dde..d30688767 100644
--- a/tests/fixtures/config.schema.test.success/allKeys.selfServiceSessionIssuerHook.yaml
+++ b/tests/fixtures/config.schema.test.success/allKeys.selfServiceSessionIssuerHook.yaml
@@ -1,1 +1,1 @@
-run: session
+job: session
diff --git a/tests/fixtures/config.schema.test.success/allKeys.selfServiceSessionRevokerHook.yaml b/tests/fixtures/config.schema.test.success/allKeys.selfServiceSessionRevokerHook.yaml
index b098d4163..f447ac294 100644
--- a/tests/fixtures/config.schema.test.success/allKeys.selfServiceSessionRevokerHook.yaml
+++ b/tests/fixtures/config.schema.test.success/allKeys.selfServiceSessionRevokerHook.yaml
@@ -1,1 +1,1 @@
-run: revoke_active_sessions
\ No newline at end of file
+job: revoke_active_sessions
\ No newline at end of file