feat: support external_id in identity commands

.github/workflows/ci.yaml

@@ -28,7 +28,7 @@ jobs:
           key: ${{ runner.os }}-playwright-${{ hashFiles('go.mod') }}
           restore-keys: ${{ runner.os }}-playwright-
       - run:
-          go run github.com/playwright-community/playwright-go/cmd/playwright
+          go run github.com/mxschmitt/playwright-go/cmd/playwright
           install chromium --with-deps
       - run: make lint
       - run: go test -race ./...

cmd/cloudx/client/command_helper_test.go

@@ -12,8 +12,8 @@ import (
 	"testing"
 	"time"
 
+	"github.com/mxschmitt/playwright-go"
 	"github.com/pkg/errors"
-	"github.com/playwright-community/playwright-go"
 
 	"github.com/ory/x/cmdx"
 	"github.com/ory/x/randx"

cmd/cloudx/client/http_client.go

@@ -19,3 +19,18 @@ func newOAuth2TokenClient(token oauth2.TokenSource) *http.Client {
 		Timeout: time.Second * 30,
 	}
 }
+
+// setHeaderTransport sets a fixed header on every outgoing request. It is used
+// to attach the Ory-RateLimit-Action header (see ORY_RATE_LIMIT_HEADER) to the
+// project HTTP client so that admin API calls issued by the wrapped Ory Kratos
+// and Ory Hydra CLI commands are not rate limited during E2E tests.
+type setHeaderTransport struct {
+	base       http.RoundTripper
+	key, value string
+}
+
+func (t *setHeaderTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	req = req.Clone(req.Context())
+	req.Header.Set(t.key, t.value)
+	return t.base.RoundTrip(req)
+}

cmd/cloudx/client/sdks.go

@@ -125,6 +125,9 @@ func (h *CommandHelper) newProjectHTTPClient(ctx context.Context) (*http.Client,
 		Base:   c.Transport,
 		Source: tokenSource,
 	}
+	if rateLimitHeader != "" {
+		c.Transport = &setHeaderTransport{base: c.Transport, key: "Ory-RateLimit-Action", value: rateLimitHeader}
+	}
 
 	return c, baseURL, nil
 }

cmd/cloudx/identity/get_external_id_test.go

@@ -0,0 +1,57 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package identity_test
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/tidwall/gjson"
+
+	"github.com/ory/cli/cmd/cloudx/testhelpers"
+	"github.com/ory/x/randx"
+)
+
+func TestGetIdentityByExternalID(t *testing.T) {
+	t.Parallel()
+
+	// The external_id column is VARCHAR(64), so keep this well under that limit.
+	externalID := "customer-" + randx.MustString(16, randx.AlphaLowerNum)
+	email := testhelpers.FakeEmail()
+
+	importPath := filepath.Join(t.TempDir(), "import.json")
+	require.NoError(t, os.WriteFile(importPath, []byte(`{
+  "schema_id": "preset://username",
+  "traits": {
+    "username": "`+email+`"
+  },
+  "external_id": "`+externalID+`"
+}`), 0o600))
+
+	stdout, stderr, err := defaultCmd.Exec(nil, "import", "identities", "--format", "json", "--project", defaultProject.Id, importPath)
+	require.NoError(t, err, stderr)
+	imported := gjson.Parse(stdout)
+	require.True(t, gjson.Valid(stdout))
+	userID := imported.Get("id").String()
+	require.NotEmpty(t, userID)
+	// the import must persist the external ID
+	assert.Equal(t, externalID, imported.Get("external_id").String(), stdout)
+
+	t.Run("is able to get identity by external ID", func(t *testing.T) {
+		stdout, stderr, err := defaultCmd.Exec(nil, "get", "identity", "--external-id", "--format", "json", "--project", defaultProject.Id, externalID)
+		require.NoError(t, err, stderr)
+		out := gjson.Parse(stdout)
+		assert.True(t, gjson.Valid(stdout))
+		assert.Equal(t, userID, out.Get("id").String(), stdout)
+		assert.Equal(t, externalID, out.Get("external_id").String(), stdout)
+	})
+
+	t.Run("fails to get identity by unknown external ID", func(t *testing.T) {
+		_, _, err := defaultCmd.Exec(nil, "get", "identity", "--external-id", "--project", defaultProject.Id, "unknown-"+randx.MustString(16, randx.AlphaLowerNum))
+		require.Error(t, err)
+	})
+}

cmd/cloudx/testhelpers/testhelpers.go

@@ -18,7 +18,7 @@ import (
 
 	"github.com/ory/cli/cmd"
 
-	"github.com/playwright-community/playwright-go"
+	"github.com/mxschmitt/playwright-go"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/tidwall/gjson"
@@ -29,8 +29,10 @@ import (
 	"github.com/ory/x/randx"
 )
 
-const testProjectPattern = "ory-cy-e2e-da2f162d-af61-42dd-90dc-e3fcfa7c84a0-"
-const testAccountPrefix = "dev+orycye2eda2f162daf6142dd"
+const (
+	testProjectPattern = "ory-cy-e2e-da2f162d-af61-42dd-90dc-e3fcfa7c84a0-"
+	testAccountPrefix  = "dev+orycye2eda2f162daf6142dd"
+)
 
 func TestName() string {
 	return testProjectPattern + randx.MustString(16, randx.AlphaLowerNum)
@@ -131,7 +133,7 @@ func MakeRandomIdentity(t testing.TB, email string) string {
   "traits": {
     "username": "`+email+`"
   }
-}`), 0600))
+}`), 0o600))
 	return path
 }
 
@@ -143,7 +145,7 @@ func MakeRandomClient(t testing.TB, name string) string {
   {
     "client_name": "`+name+`"
   }
-]`), 0600))
+]`), 0o600))
 	return path
 }
 

go.mod

@@ -15,6 +15,7 @@ require (
 	github.com/gofrs/uuid v4.4.0+incompatible
 	github.com/gomarkdown/markdown v0.0.0-20260417124207-7d523f7318df
 	github.com/hashicorp/go-retryablehttp v0.7.8
+	github.com/mxschmitt/playwright-go v0.6100.0
 	github.com/ory/client-go v1.22.51
 	github.com/ory/gochimp3 v0.0.0-20200417124117-ccd242db3655
 	github.com/ory/graceful v0.2.0
@@ -23,11 +24,10 @@ require (
 	github.com/ory/hydra/v2 v2.3.1-0.20260608173701-e93cfd611f53
 	github.com/ory/jsonschema/v3 v3.0.9-0.20250317235931-280c5fc7bf0e
 	github.com/ory/keto v0.14.1-0.20260609063042-5da3a68a58d9
-	github.com/ory/kratos v1.3.1-0.20260608173705-6611397deb2b
-	github.com/ory/x v0.0.730-0.20260608173703-f144602ce3cf
+	github.com/ory/kratos v1.3.1-0.20260709105504-7b4ac2b73600
+	github.com/ory/x v0.0.730-0.20260708100811-e26a5b71beb3
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c
 	github.com/pkg/errors v0.9.1
-	github.com/playwright-community/playwright-go v0.4702.0
 	github.com/rs/cors v1.11.1
 	github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06
 	github.com/spf13/cobra v1.10.2
@@ -44,6 +44,7 @@ require (
 require (
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
 	code.dny.dev/ssrf v0.2.0 // indirect
+	connectrpc.com/connect v1.20.0 // indirect
 	filippo.io/edwards25519 v1.2.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/sprig/v3 v3.3.0 // indirect
@@ -71,7 +72,7 @@ require (
 	github.com/coreos/go-oidc/v3 v3.18.0 // indirect
 	github.com/cristalhq/jwt/v4 v4.0.2 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/deckarep/golang-set/v2 v2.6.0 // indirect
+	github.com/deckarep/golang-set/v2 v2.8.0 // indirect
 	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1 // indirect
 	github.com/dghubble/oauth1 v0.7.3 // indirect
 	github.com/dgraph-io/ristretto/v2 v2.4.0 // indirect
@@ -126,37 +127,27 @@ require (
 	github.com/google/go-tpm v0.9.8 // indirect
 	github.com/google/pprof v0.0.0-20260507013755-92041b743c96 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/gopherjs/gopherjs v1.20.1 // indirect
-	github.com/gorilla/context v1.1.2 // indirect
 	github.com/gorilla/css v1.0.1 // indirect
-	github.com/gorilla/mux v1.8.1 // indirect
-	github.com/gorilla/pat v1.0.2 // indirect
 	github.com/gorilla/securecookie v1.1.2 // indirect
 	github.com/gorilla/sessions v1.4.0 // indirect
 	github.com/gorilla/websocket v1.5.3 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3 // indirect
 	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
-	github.com/gtank/cryptopasta v0.0.0-20170601214702-1f550f6f2f69 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/huandu/xstrings v1.5.0 // indirect
-	github.com/ian-kent/envconf v0.0.0-20141026121121-c19809918c02 // indirect
-	github.com/ian-kent/go-log v0.0.0-20160113211217-5731446c36ab // indirect
-	github.com/ian-kent/goose v0.0.0-20141221090059-c3541ea826ad // indirect
-	github.com/ian-kent/linkio v0.0.0-20170807205755-97566b872887 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/inhies/go-bytesize v0.0.0-20220417184213-4913239db9cf // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
 	github.com/jackc/pgx/v5 v5.9.2 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
-	github.com/jaegertracing/jaeger-idl v0.7.1 // indirect
+	github.com/jaegertracing/jaeger-idl v0.9.0 // indirect
 	github.com/jmoiron/sqlx v1.4.0 // indirect
 	github.com/joho/godotenv v1.5.1 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
-	github.com/jtolds/gls v4.20.0+incompatible // indirect
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
 	github.com/knadh/koanf/maps v0.1.2 // indirect
 	github.com/knadh/koanf/parsers/json v1.0.0 // indirect
@@ -173,10 +164,6 @@ require (
 	github.com/lestrrat-go/option v1.0.1 // indirect
 	github.com/lib/pq v1.12.3 // indirect
 	github.com/magiconair/properties v1.8.9 // indirect
-	github.com/mailhog/MailHog-Server v1.0.1 // indirect
-	github.com/mailhog/data v1.0.1 // indirect
-	github.com/mailhog/smtp v1.0.1 // indirect
-	github.com/mailhog/storage v1.0.1 // indirect
 	github.com/mailru/easyjson v0.9.2 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.22 // indirect
@@ -220,7 +207,7 @@ require (
 	github.com/pquerna/otp v1.5.0 // indirect
 	github.com/prometheus/client_golang v1.23.2 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.67.5 // indirect
+	github.com/prometheus/common v0.68.1 // indirect
 	github.com/prometheus/procfs v0.20.1 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/rogpeppe/go-internal v1.14.1 // indirect
@@ -234,7 +221,6 @@ require (
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/sirupsen/logrus v1.9.4 // indirect
 	github.com/slack-go/slack v0.23.1 // indirect
-	github.com/smarty/assertions v1.16.0 // indirect
 	github.com/soheilhy/cmux v0.1.5 // indirect
 	github.com/sourcegraph/annotate v0.0.0-20160123013949-f4cad6c6324d // indirect
 	github.com/sourcegraph/conc v0.3.0 // indirect
@@ -243,7 +229,6 @@ require (
 	github.com/spf13/cast v1.10.0 // indirect
 	github.com/spf13/viper v1.18.2 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
-	github.com/t-k/fluent-logger-golang v1.0.0 // indirect
 	github.com/thales-e-security/pool v0.0.2 // indirect
 	github.com/tidwall/match v1.2.0 // indirect
 	github.com/tidwall/pretty v1.2.1 // indirect
@@ -258,19 +243,19 @@ require (
 	github.com/zmb3/spotify/v2 v2.4.3 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.68.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 // indirect
-	go.opentelemetry.io/contrib/propagators/b3 v1.43.0 // indirect
-	go.opentelemetry.io/contrib/propagators/jaeger v1.43.0 // indirect
-	go.opentelemetry.io/contrib/samplers/jaegerremote v0.37.0 // indirect
-	go.opentelemetry.io/otel v1.43.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.69.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 // indirect
+	go.opentelemetry.io/contrib/propagators/b3 v1.44.0 // indirect
+	go.opentelemetry.io/contrib/propagators/jaeger v1.44.0 // indirect
+	go.opentelemetry.io/contrib/samplers/jaegerremote v0.37.1 // indirect
+	go.opentelemetry.io/otel v1.44.0 // indirect
 	go.opentelemetry.io/otel/exporters/jaeger v1.17.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 // indirect
-	go.opentelemetry.io/otel/exporters/zipkin v1.43.0 // indirect
-	go.opentelemetry.io/otel/metric v1.43.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.43.0 // indirect
-	go.opentelemetry.io/otel/trace v1.43.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.44.0 // indirect
+	go.opentelemetry.io/otel/exporters/zipkin v1.44.0 // indirect
+	go.opentelemetry.io/otel/metric v1.44.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.44.0 // indirect
+	go.opentelemetry.io/otel/trace v1.44.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.10.0 // indirect
 	go.uber.org/automaxprocs v1.6.0 // indirect
 	go.uber.org/mock v0.6.0 // indirect
@@ -285,19 +270,18 @@ require (
 	golang.org/x/sys v0.46.0 // indirect
 	golang.org/x/telemetry v0.0.0-20260508192327-42602be52be6 // indirect
 	golang.org/x/tools v0.45.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260519071638-aa98bba5eb94 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260519071638-aa98bba5eb94 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
 	google.golang.org/grpc v1.81.1 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
-	gopkg.in/mgo.v2 v2.0.0-20190816093944-a6b53ec6cb22 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	kernel.org/pub/linux/libs/security/libcap/psx v1.2.78 // indirect
 	modernc.org/libc v1.72.3 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect
-	modernc.org/sqlite v1.50.1 // indirect
+	modernc.org/sqlite v1.52.0 // indirect
 	sigs.k8s.io/yaml v1.6.0 // indirect
 )