web: auto verify user during user creation#435
Conversation
WalkthroughThe change adds email verification metadata to the Kratos identity payload during user creation in the admin user creation endpoint. A new Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Deploying kavach-docs with
|
| Latest commit: |
f224613
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://e642582f.kavach-docs.pages.dev |
| Branch Preview URL: | https://feat-verify-user.kavach-docs.pages.dev |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
server/action/admin/user/create.go(2 hunks)
🔇 Additional comments (1)
server/action/admin/user/create.go (1)
9-9: LGTM!The
timeimport is necessary for thetime.Now()calls added in the verifiable_addresses field.
| "verifiable_addresses": []map[string]interface{}{ | ||
| { | ||
| "created_at": time.Now(), | ||
| "status": "completed", | ||
| "updated_at": time.Now(), | ||
| "value": user.Email, | ||
| "verified": true, | ||
| "verified_at": time.Now(), | ||
| "via": "email", | ||
| }, | ||
| }, |
There was a problem hiding this comment.
🧩 Analysis chain
Verify the schema against Kratos Admin API documentation.
The verifiable_addresses field structure must exactly match what the Kratos Admin API expects. Additionally, auto-verifying users bypasses the email verification flow, which may have security or compliance implications for your use case.
Please verify:
- The field names, types, and structure match the Kratos Admin API schema for your version
- The timestamp format (
time.Now()serializes to RFC3339 in JSON) is compatible with Kratos - All required fields are present and no unsupported fields are included
- Auto-verification aligns with your security and compliance requirements
Run the following script to check for other usages of verifiable_addresses in the codebase for reference:
Additionally, please verify the Kratos Admin API documentation for the identity creation endpoint:
🏁 Script executed:
#!/bin/bash
# Search for other usages of verifiable_addresses to verify schema consistency
rg -n -C5 'verifiable_addresses' --type=goLength of output: 687
🌐 Web query:
Ory Kratos Admin API verifiable_addresses schema for identity creation
💡 Result:
You can set verifiable addresses when creating/importing an identity via the Admin API by including a verifiable_addresses array on the identity payload. Each address object uses these fields (examples from Ory Kratos docs):
- value (string) — the address (e.g. email).
- verified (boolean) — whether the address is already verified.
- via (string) — channel, e.g. "email" or "sms".
- status (string) — e.g. "pending" or "completed".
- id, created_at, updated_at, verified_at (server-generated on return).
Example create/import payload:
{
"schema_id": "preset://email",
"traits": { "email": "user@example.org" },
"verifiable_addresses": [
{
"value": "user@example.org",
"verified": true,
"via": "email",
"status": "completed"
}
]
}
See Ory Kratos docs for creating/importing identities and verifiable addresses. [1][2]
Sources:
[1] Ory — Import user accounts / importing verified addresses (Admin identities).
[2] Ory — Create/manage identities (example responses showing verifiable_addresses).
Remove server-generated fields from verifiable_addresses payload.
The Kratos Admin API documentation states that id, created_at, updated_at, verified_at are server-generated fields, meaning they should not be included in the client request payload. Remove the following lines from the verifiable_addresses object:
"created_at": time.Now()"updated_at": time.Now()"verified_at": time.Now()
Keep only: value, verified, via, and status.
🤖 Prompt for AI Agents
In server/action/admin/user/create.go around lines 54 to 64, the
verifiable_addresses payload currently includes server-generated timestamp
fields (created_at, updated_at, verified_at) which should not be sent; remove
the "created_at": time.Now(), "updated_at": time.Now(), and "verified_at":
time.Now() entries and leave only "value", "verified", "via", and "status" in
the verifiable_addresses map so the request conforms to Kratos Admin API
expectations.
1 participant
Summary by CodeRabbit