Admin recovery link returns 404 for an invalid request body

[gha]

Describe the bug

The admin /recovery/link endpoint returns a 404 not found if the JSON body contains invalid properties. It should return a 400 bad request in this case.

I encountered this when accidentally giving the identity_id property as just identity

Reproducing the bug

Steps to reproduce the behavior:

curl --request POST
--url http://localhost:4434/recovery/link
--header 'Content-Type: application/json'
--data '{
"expires_in": "12h",
"identity": "abcd-1234"
}'

Server logs

Server configuration

version: v0.4.6-alpha.1

serve:
  public:
    base_url: http://127.0.0.1:4433/
    cors:
      enabled: true
  admin:
    base_url: http://kratos:4434/

selfservice:
  default_browser_return_url: http://127.0.0.1:4455/
  whitelisted_return_urls:
    - http://127.0.0.1:4455

  methods:
    password:
      enabled: true
    link:
      enabled: true

  flows:
    error:
      ui_url: http://127.0.0.1:4455/error

    settings:
      ui_url: http://127.0.0.1:4455/settings
      privileged_session_max_age: 15m

    recovery:
      enabled: true
      ui_url: http://127.0.0.1:4455/recovery

    verification:
      enabled: false

    logout:
      after:
        default_browser_return_url: http://127.0.0.1:4455/auth/login

    login:
      ui_url: http://127.0.0.1:4455/auth/login
      lifespan: 10m

    registration:
      lifespan: 10m
      ui_url: http://127.0.0.1:4455/

identity:
  default_schema_url: file:///etc/config/kratos/identity.schema.json

Expected behavior

I would expect a 400 bad request possibly with any missing or invalid fields

Environment

• Version: v0.7.1-alpha.1
• Environment: Docker

[aeneasr]

Nice find, PRs welcomed :) The 404 happens because the identity is not found (because it is empty)

[gha]

If I can find time I'll push a PR for this 🤞