[skip ci]

If you submit a browser login flow with an `Accept` header of `application/json`, but the login flow requires AAL2, then there is no way for the code to know it needs to redirect the user to the 2FA page. Instead of responding with the `Session` in this scenario, this PR changes the behaviour to respond with a `browser_location_change_required` error (status `422`) to indicate that the browser needs to open a specific URL, /self-service/login/browser?aal=aal2. 

Co-authored-by: Henning Perl <henning.perl@ory.sh>

Should be able to login with the `code` credential even if the user did not register on the `code` credential. 
Only `identifier` matching is done and validation based on the identity schema.

[skip ci]

[skip ci]

[skip ci]

…ry#3589)

* fix: on verification required after registration, preserve return_to

* test: return_to on verification flow

* chore: refactor

Co-authored-by: Jonas Hungershausen <jonas.hungershausen@ory.sh>

---------

Co-authored-by: Jonas Hungershausen <jonas.hungershausen@ory.sh>

…ory#3597)

* makefile fix

Signed-off-by: nxy7 <lolnoxy@gmail.com>

* shebangs changed to /usr/bin/env bash

Signed-off-by: nxy7 <lolnoxy@gmail.com>

---------

Signed-off-by: nxy7 <lolnoxy@gmail.com>

…al to be completed by strategy (ory#3525)

Returning anything else here may cause Kratos to respond with two concatenated JSON objects: new login flow with actual error message as the first one and a very confusing '500, aborted registration hook execution' as the second one.

* fix: return HTTP 400 if key unmarshal fails

* fix: apply reviewer's suggestion, prepare for  bump

* fix: follow up reviewer suggestion from ory/x

* chore: bump ory/x

[skip ci]

* fix: registration should accept hydra login

* fix: oauth2 registration flow with session

* wip: registration oauth flow tests

* wip: refactor oauth flows test

* wip: refactor op_registration_test

* wip: oauth provider registration test

* wip: refactor oauth flows test

* fix(test): oauth provider login

* style: format

Allows one to parametrize how many messages the courier will fetch and how often it will fetch messages.

[skip ci]

[skip ci]

When user tries to login with OIDC for the first time but has already registered before with email/password a credentials identifier conflict may be detected by Kratos. In this case user needs to login with email/password first and then link OIDC credentials on a settings screen.
This PR simplifies UX and allows user to link OIDC credentials to existing account right in the login flow, without
switching to settings flow.

Closes ory#2727
Closes ory#3222

[skip ci]

[skip ci]

This reverts commit 52639e6.

This reverts commit 316cd4a.

[skip ci]

…y#3608)

Whenever an user is asked to reauthenticate (e.g. because they wish to execute settings flow touching their credentials and their session is no longer privileged) they are asked to provide their credentials again. The forced-refresh login flow generated for such cases already excludes some strategies that are enabled in Kratos but cannot be used to authenticate as current identity, and for example the form presented to the user will not have a password field if the identity does not have a password credential.

This, however, does not currently apply to OIDC providers; the user will always see the full set even if some of them can't be used to sign in as current identity. This change causes forced refresh login flows to also omit irrelevant OIDC providers in generated form in order to avoid confunding the user about which strategies/providers are valid and can actually be used to reauthenticate.

[skip ci]

[skip ci]

[skip ci]

This change allows to filter `GET /admin/identities` by ID with the following syntax:

```
/admin/identities?ids=id1&ids=id2&ids=id3
```

Closes ory#2448

[skip ci]

[skip ci]

---------

Co-authored-by: Henning Perl <henning.perl@ory.sh>
Co-authored-by: Alano Terblanche <18033717+Benehiko@users.noreply.github.com>
Co-authored-by: aeneasr <3372410+aeneasr@users.noreply.github.com>

Adds the ability to complete the recovery flow properly on API flows. This PR also streamlines the behavior for SPA flows to not return 422 errors anymore. To enable this new behavior, set the features.use_continue_with_transitions flag in the config to `true`.

See also ory#3273

[skip ci]

This also improves tracing in the OIDC strategy.

[skip ci]

[skip ci]

[skip ci]

…ory#3645)

[skip ci]

[skip ci]

[skip ci]

[skip ci]

[skip ci]

…ry#3634)

Bumps [github.com/go-jose/go-jose/v3](https://github.com/go-jose/go-jose) from 3.0.0 to 3.0.1.
- [Release notes](https://github.com/go-jose/go-jose/releases)
- [Changelog](https://github.com/go-jose/go-jose/blob/v3/CHANGELOG.md)
- [Commits](go-jose/go-jose@v3.0.0...v3.0.1)

---
updated-dependencies:
- dependency-name: github.com/go-jose/go-jose/v3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

[skip ci]

[skip ci]

* fix: don't return nil if code is invalid

* chore: add test

[skip ci]

Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.15.0 to 0.17.0.
- [Commits](golang/crypto@v0.15.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

[skip ci]

[skip ci]

Co-authored-by: zepatrik <zepatrik@users.noreply.github.com>

[skip ci]

Closes ory#3676 ory#3675

[skip ci]

[skip ci]

…ry#3699)

[skip ci]

[skip ci]

…okenizer (ory#3701)

[skip ci]

[skip ci]

Closes ory#3705

[skip ci]

[skip ci]

This change queries for all user information available with the `User.Read` scope
during OIDC, and populates the `RawClaims` field.

[skip ci]