feat: passkeys!

[hperl]

BREAKING CHANGES: This feature enables two-step registration per default. Two-step registration is a significantly improved sign up flow and recommended when using more than one sign up methods. To disable two-step registration, set `selfservice.flows.registration.enable_legacy_flow` to `true`. This value defaults to `false`.

TODOs

• Submit button is on the top of the UI nodes list (should be last item) for API and browser flows
• Social sign in needs to be an option on the first step, not the second one
• Add test case for missing traits with OIDC
• Do not use 422 but instead 400 for API flows and Browser + JSON flows
• Add tests for mobile app
• Back button for sign up with code
• Rename config option to enable_legacy_one_step

Related issue(s)

Checklist

• I have read the contributing guidelines.
• I have referenced an issue containing the design document if my change
  introduces a new feature.
• I am following the
  contributing code guidelines.
• I have read the security policy.
• I confirm that this pull request does not address a security
  vulnerability. If this pull request addresses a security vulnerability, I
  confirm that I got the approval (please contact
  [email protected]) from the maintainers to push
  the changes.
• I have added tests that prove my fix is effective or that my feature
  works.
• I have added or changed the documentation.

Further Comments

[aeneasr]

To do:

1. Submit button is on the top of the UI nodes list (should be last item) for API and browser flows
2. Social sign in needs to be an option on the first step, not the second one:
   • Add test case for missing traits
3. Do not use 422 but instead 400 for API flows and Browser + JSON flows
4. Add tests for mobile app
5. Back button for sign up with code

[aeneasr]

I unfortunately still receive an error when both passkeys + webauthn with passwordless are enabled and I try to sign up using webauthn:

[aeneasr]

Amazing job

[bcspragu]

Hi there,

First time Ory-er (Kratos-er?) here, thanks for building great software! I think some of the docs need to be updated (example), because they show the createRegistrationFlow response containing a password field, and I could not figure out for the life of me why I wasn't getting a password field in my response with the default identity schema.

After enabling selfservice.flows.registration.enable_legacy_one_step, the password field showed up in the response.