fix: detect whether external_id is set in webhook response

hperl · ory-bot · commit 7d0d7f6069d9 · 2025-08-21T11:08:40.000Z
GitOrigin-RevId: 9caac2424ee78c08b7c81be7f15c2f3405665b90
diff --git a/selfservice/hook/.snapshots/TestWebHooks-update_identity_fields-case=update_identity_fields-case=body_is_empty.json b/selfservice/hook/.snapshots/TestWebHooks-update_identity_fields-case=update_identity_fields-case=body_is_empty.json
@@ -1,5 +1,6 @@
 {
   "id": "00000000-0000-0000-0000-000000000000",
+  "external_id": "original-external-id",
   "credentials": {
     "password": {
       "type": "password",
diff --git a/selfservice/hook/.snapshots/TestWebHooks-update_identity_fields-case=update_identity_fields-case=identity_has_updated_admin_metadata.json b/selfservice/hook/.snapshots/TestWebHooks-update_identity_fields-case=update_identity_fields-case=identity_has_updated_admin_metadata.json
@@ -1,5 +1,6 @@
 {
   "id": "00000000-0000-0000-0000-000000000000",
+  "external_id": "original-external-id",
   "credentials": {
     "password": {
       "type": "password",
diff --git a/selfservice/hook/.snapshots/TestWebHooks-update_identity_fields-case=update_identity_fields-case=identity_has_updated_external_id.json b/selfservice/hook/.snapshots/TestWebHooks-update_identity_fields-case=update_identity_fields-case=identity_has_updated_external_id.json
@@ -1,6 +1,6 @@
 {
   "id": "00000000-0000-0000-0000-000000000000",
-  "external_id": "some-external-id",
+  "external_id": "updated-external-id",
   "credentials": {
     "password": {
       "type": "password",
diff --git a/selfservice/hook/.snapshots/TestWebHooks-update_identity_fields-case=update_identity_fields-case=identity_has_updated_public_metadata.json b/selfservice/hook/.snapshots/TestWebHooks-update_identity_fields-case=update_identity_fields-case=identity_has_updated_public_metadata.json
@@ -1,5 +1,6 @@
 {
   "id": "00000000-0000-0000-0000-000000000000",
+  "external_id": "original-external-id",
   "credentials": {
     "password": {
       "type": "password",
diff --git a/selfservice/hook/.snapshots/TestWebHooks-update_identity_fields-case=update_identity_fields-case=identity_has_updated_recovery_addresses.json b/selfservice/hook/.snapshots/TestWebHooks-update_identity_fields-case=update_identity_fields-case=identity_has_updated_recovery_addresses.json
@@ -1,5 +1,6 @@
 {
   "id": "00000000-0000-0000-0000-000000000000",
+  "external_id": "original-external-id",
   "credentials": {
     "password": {
       "type": "password",
diff --git a/selfservice/hook/.snapshots/TestWebHooks-update_identity_fields-case=update_identity_fields-case=identity_has_updated_state.json b/selfservice/hook/.snapshots/TestWebHooks-update_identity_fields-case=update_identity_fields-case=identity_has_updated_state.json
@@ -1,5 +1,6 @@
 {
   "id": "00000000-0000-0000-0000-000000000000",
+  "external_id": "original-external-id",
   "credentials": {
     "password": {
       "type": "password",
diff --git a/selfservice/hook/.snapshots/TestWebHooks-update_identity_fields-case=update_identity_fields-case=identity_has_updated_traits.json b/selfservice/hook/.snapshots/TestWebHooks-update_identity_fields-case=update_identity_fields-case=identity_has_updated_traits.json
@@ -1,5 +1,6 @@
 {
   "id": "00000000-0000-0000-0000-000000000000",
+  "external_id": "original-external-id",
   "credentials": {
     "password": {
       "type": "password",
diff --git a/selfservice/hook/.snapshots/TestWebHooks-update_identity_fields-case=update_identity_fields-case=identity_has_updated_verified_addresses.json b/selfservice/hook/.snapshots/TestWebHooks-update_identity_fields-case=update_identity_fields-case=identity_has_updated_verified_addresses.json
@@ -1,5 +1,6 @@
 {
   "id": "00000000-0000-0000-0000-000000000000",
+  "external_id": "original-external-id",
   "credentials": {
     "password": {
       "type": "password",
diff --git a/selfservice/hook/.snapshots/TestWebHooks-update_identity_fields-case=update_identity_fields-case=identity_is_present_but_empty.json b/selfservice/hook/.snapshots/TestWebHooks-update_identity_fields-case=update_identity_fields-case=identity_is_present_but_empty.json
@@ -1,5 +1,6 @@
 {
   "id": "00000000-0000-0000-0000-000000000000",
+  "external_id": "original-external-id",
   "credentials": {
     "password": {
       "type": "password",
diff --git a/selfservice/hook/.snapshots/TestWebHooks-update_identity_fields-case=update_identity_fields-case=unset_external_id.json b/selfservice/hook/.snapshots/TestWebHooks-update_identity_fields-case=update_identity_fields-case=unset_external_id.json
@@ -0,0 +1,52 @@
+{
+  "id": "00000000-0000-0000-0000-000000000000",
+  "credentials": {
+    "password": {
+      "type": "password",
+      "identifiers": [
+        "test"
+      ],
+      "config": {
+        "hashed_password": "$argon2id$v=19$m=65536,t=1,p=1$Z3JlZW5hbmRlcnNlY3JldA$Z3JlZW5hbmRlcnNlY3JldA"
+      },
+      "version": 0,
+      "created_at": "0001-01-01T00:00:00Z",
+      "updated_at": "0001-01-01T00:00:00Z"
+    }
+  },
+  "schema_id": "default",
+  "schema_url": "file://stub/default.schema.json",
+  "state": "active",
+  "traits": {
+    "email": "some@example.org"
+  },
+  "verifiable_addresses": [
+    {
+      "id": "00000000-0000-0000-0000-000000000000",
+      "value": "some@example.org",
+      "verified": false,
+      "via": "email",
+      "status": "pending",
+      "created_at": "0001-01-01T00:00:00Z",
+      "updated_at": "0001-01-01T00:00:00Z"
+    }
+  ],
+  "recovery_addresses": [
+    {
+      "id": "00000000-0000-0000-0000-000000000000",
+      "value": "some@example.org",
+      "via": "email",
+      "created_at": "0001-01-01T00:00:00Z",
+      "updated_at": "0001-01-01T00:00:00Z"
+    }
+  ],
+  "metadata_public": {
+    "public": "data"
+  },
+  "metadata_admin": {
+    "admin": "data"
+  },
+  "created_at": "0001-01-01T00:00:00Z",
+  "updated_at": "0001-01-01T00:00:00Z",
+  "organization_id": null
+}
diff --git a/selfservice/hook/web_hook.go b/selfservice/hook/web_hook.go
@@ -17,6 +17,7 @@ import (
 	"github.com/gofrs/uuid"
 	"github.com/hashicorp/go-retryablehttp"
 	"github.com/pkg/errors"
+	"github.com/tidwall/gjson"
 	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/codes"
 	semconv "go.opentelemetry.io/otel/semconv/v1.11.0"
@@ -454,7 +455,12 @@ func parseWebhookResponse(resp *http.Response, id *identity.Identity) (err error
 		var hookResponse struct {
 			Identity *localIdentity `json:"identity"`
 		}
-		if err := json.NewDecoder(resp.Body).Decode(&hookResponse); err != nil {
+		// io.ReadAll is safe, because resp.Body is already a limited reader.
+		body, err := io.ReadAll(resp.Body)
+		if err != nil {
+			return errors.Wrap(err, "webhook response body could not be read")
+		}
+		if err = json.Unmarshal(body, &hookResponse); err != nil {
 			return errors.Wrap(err, "webhook response could not be unmarshalled properly from JSON")
 		}
 
@@ -494,7 +500,7 @@ func parseWebhookResponse(resp *http.Response, id *identity.Identity) (err error
 			id.MetadataAdmin = hookResponse.Identity.MetadataAdmin
 		}
 
-		if len(hookResponse.Identity.ExternalID) > 0 {
+		if gjson.GetBytes(body, "identity.external_id").Exists() {
 			id.ExternalID = hookResponse.Identity.ExternalID
 		}
 
diff --git a/selfservice/hook/web_hook_integration_test.go b/selfservice/hook/web_hook_integration_test.go
@@ -706,11 +706,17 @@ func TestWebHooks(t *testing.T) {
 
 		t.Run("case=update identity fields", func(t *testing.T) {
 			expected := identity.Identity{
-				Credentials: map[identity.CredentialsType]identity.Credentials{identity.CredentialsTypePassword: {Type: "password", Identifiers: []string{"test"}, Config: []byte(`{"hashed_password":"$argon2id$v=19$m=65536,t=1,p=1$Z3JlZW5hbmRlcnNlY3JldA$Z3JlZW5hbmRlcnNlY3JldA"}`)}},
-				SchemaID:    "default",
-				SchemaURL:   "file://stub/default.schema.json",
-				State:       identity.StateActive,
-				Traits:      []byte(`{"email":"some@example.org"}`),
+				Credentials: map[identity.CredentialsType]identity.Credentials{
+					identity.CredentialsTypePassword: {
+						Type:        "password",
+						Identifiers: []string{"test"},
+						Config:      []byte(`{"hashed_password":"$argon2id$v=19$m=65536,t=1,p=1$Z3JlZW5hbmRlcnNlY3JldA$Z3JlZW5hbmRlcnNlY3JldA"}`),
+					}},
+				ExternalID: "original-external-id",
+				SchemaID:   "default",
+				SchemaURL:  "file://stub/default.schema.json",
+				State:      identity.StateActive,
+				Traits:     []byte(`{"email":"some@example.org"}`),
 				VerifiableAddresses: []identity.VerifiableAddress{{
 					Value:    "some@example.org",
 					Verified: false,
@@ -766,7 +772,12 @@ func TestWebHooks(t *testing.T) {
 			})
 
 			t.Run("case=identity has updated external_id", func(t *testing.T) {
-				actual := run(t, expected, http.StatusOK, []byte(`{"identity":{"external_id":"some-external-id"}}`))
+				actual := run(t, expected, http.StatusOK, []byte(`{"identity":{"external_id":"updated-external-id"}}`))
+				snapshotx.SnapshotT(t, &actual)
+			})
+
+			t.Run("case=unset external_id", func(t *testing.T) {
+				actual := run(t, expected, http.StatusOK, []byte(`{"identity":{"external_id":""}}`))
 				snapshotx.SnapshotT(t, &actual)
 			})
 		})

Original file line number	Diff line number	Diff line change
`@@ -1,5 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"id": "00000000-0000-0000-0000-000000000000",`
	`3`	`+ "external_id": "original-external-id",`
`3`	`4`	`"credentials": {`
`4`	`5`	`"password": {`
`5`	`6`	`"type": "password",`
Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"id": "00000000-0000-0000-0000-000000000000",`
`3`		`- "external_id": "some-external-id",`
	`3`	`+ "external_id": "updated-external-id",`
`4`	`4`	`"credentials": {`
`5`	`5`	`"password": {`
`6`	`6`	`"type": "password",`