Updating native registration flow with OIDC ID token for existing identity returns breaking response #447
Description
Preflight checklist
- I could not find a solution in the existing issues, docs, nor discussions.
- I agree to follow this project's Code of Conduct.
- I have read and am following this repository's Contribution Guidelines.
- I have joined the Ory Community Slack.
- I am signed up to the Ory Security Patch Newsletter.
Ory Network Project
https://vigorous-leakey-ouzelmh6hd.projects.oryapis.com
Describe the bug
When updating a native registration flow (POST /self-service/registration) the identity property of the successful response is marked as required in the Open API specification. That property contains details about the new identity that was created.
However, when updating the registration flow with an ID token received from an OIDC provider and Ory finds an existing identity based on the subject in the token, then a login on that identity is performed instead. When that happens, the response format instead looks like the successful response from Submit a Login Flow (POST /self-service/login). In that response there is no identity property.
When using an auto generated client, the parsing of the response might fail since the identity is required and the caller does't know the registration ended up in a login. I would expect differences between how this is handled by clients in different programming languages, but in a strictly typed language like Swift this becomes a breaking error.
Reproducing the bug
- Create an identity using any OIDC provider
- Start a registration flow by calling Create Registration Flow for Native Apps
- Authenticate to receive an ID token from the same provider used in step 1.
- Complete registration with the ID token by calling Update Registration Flow
Expected 200 response:
A JSON object containing the required identity property at root level.
Actual 200 response:
A JSON object without the required identity property at root level. The identity is however included in the session property.
Relevant log output
Relevant configuration
Version
Ory Network
On which operating system are you observing this issue?
Ory Network
In which environment are you deploying?
Ory Network
Additional Context
No response