feat: Make admin recovery to work without emails #1419

persistence/sql/migrations/sql/20210913095309000000_identity_recovery_tokens.cockroach.down.sql

@@ -0,0 +1 @@
+ALTER TABLE "identity_recovery_tokens" DROP COLUMN "identity_id";

persistence/sql/migrations/sql/20210913095309000000_identity_recovery_tokens.cockroach.up.sql

@@ -0,0 +1 @@
+ALTER TABLE "identity_recovery_tokens" ADD COLUMN "identity_id" UUID NOT NULL;

persistence/sql/migrations/sql/20210913095309000000_identity_recovery_tokens.mysql.down.sql

@@ -0,0 +1 @@
+ALTER TABLE `identity_recovery_tokens` DROP COLUMN `identity_id`;

persistence/sql/migrations/sql/20210913095309000000_identity_recovery_tokens.mysql.up.sql

@@ -0,0 +1 @@
+ALTER TABLE `identity_recovery_tokens` ADD COLUMN `identity_id` char(36) NOT NULL;

persistence/sql/migrations/sql/20210913095309000000_identity_recovery_tokens.postgres.down.sql

@@ -0,0 +1 @@
+ALTER TABLE "identity_recovery_tokens" DROP COLUMN "identity_id";

persistence/sql/migrations/sql/20210913095309000000_identity_recovery_tokens.postgres.up.sql

@@ -0,0 +1 @@
+ALTER TABLE "identity_recovery_tokens" ADD COLUMN "identity_id" UUID NOT NULL;

persistence/sql/migrations/sql/20210913095309000000_identity_recovery_tokens.sqlite3.down.sql

@@ -0,0 +1 @@
+ALTER TABLE "_identity_recovery_tokens_tmp" RENAME TO "identity_recovery_tokens";

persistence/sql/migrations/sql/20210913095309000000_identity_recovery_tokens.sqlite3.up.sql

@@ -0,0 +1 @@
+ALTER TABLE "identity_recovery_tokens" ADD COLUMN "identity_id" char(36) NOT NULL;

persistence/sql/migrations/sql/20210913095309000001_identity_recovery_tokens.cockroach.down.sql

@@ -0,0 +1 @@
+ALTER TABLE "identity_recovery_tokens" ADD CONSTRAINT "identity_recovery_tokens_identity_recovery_addresses_id_fk" FOREIGN KEY ("identity_recovery_address_id") REFERENCES "identity_recovery_addresses" ("id") ON UPDATE NO ACTION ON DELETE CASCADE;

persistence/sql/migrations/sql/20210913095309000001_identity_recovery_tokens.cockroach.up.sql

@@ -0,0 +1 @@
+ALTER TABLE "identity_recovery_tokens" DROP CONSTRAINT "identity_recovery_tokens_identity_recovery_addresses_id_fk";

persistence/sql/migrations/sql/20210913095309000001_identity_recovery_tokens.mysql.down.sql

@@ -0,0 +1 @@
+ALTER TABLE `identity_recovery_tokens` MODIFY `identity_recovery_address_id` char(36) NOT NULL;

persistence/sql/migrations/sql/20210913095309000001_identity_recovery_tokens.mysql.up.sql

@@ -0,0 +1 @@
+ALTER TABLE `identity_recovery_tokens` MODIFY `identity_recovery_address_id` char(36);

persistence/sql/migrations/sql/20210913095309000001_identity_recovery_tokens.postgres.down.sql

@@ -0,0 +1 @@
+ALTER TABLE "identity_recovery_tokens" ALTER COLUMN "identity_recovery_address_id" TYPE UUID, ALTER COLUMN "identity_recovery_address_id" SET NOT NULL;

persistence/sql/migrations/sql/20210913095309000001_identity_recovery_tokens.postgres.up.sql

@@ -0,0 +1 @@
+ALTER TABLE "identity_recovery_tokens" ALTER COLUMN "identity_recovery_address_id" TYPE UUID, ALTER COLUMN "identity_recovery_address_id" DROP NOT NULL;

persistence/sql/migrations/sql/20210913095309000001_identity_recovery_tokens.sqlite3.down.sql

@@ -0,0 +1,2 @@
+
+DROP TABLE "identity_recovery_tokens";

persistence/sql/migrations/sql/20210913095309000001_identity_recovery_tokens.sqlite3.up.sql

@@ -0,0 +1 @@
+DROP INDEX IF EXISTS "identity_recovery_tokens_nid_idx";

persistence/sql/migrations/sql/20210913095309000002_identity_recovery_tokens.cockroach.down.sql

@@ -0,0 +1 @@
+ALTER TABLE "identity_recovery_tokens" DROP COLUMN "_identity_recovery_address_id_tmp";

persistence/sql/migrations/sql/20210913095309000002_identity_recovery_tokens.cockroach.up.sql

@@ -0,0 +1 @@
+ALTER TABLE "identity_recovery_tokens" RENAME COLUMN "identity_recovery_address_id" TO "_identity_recovery_address_id_tmp";

persistence/sql/migrations/sql/20210913095309000002_identity_recovery_tokens.sqlite3.down.sql

@@ -0,0 +1 @@
+INSERT INTO "_identity_recovery_tokens_tmp" (id, token, used, used_at, identity_recovery_address_id, selfservice_recovery_flow_id, created_at, updated_at, expires_at, issued_at, nid) SELECT id, token, used, used_at, identity_recovery_address_id, selfservice_recovery_flow_id, created_at, updated_at, expires_at, issued_at, nid FROM "identity_recovery_tokens";

persistence/sql/migrations/sql/20210913095309000002_identity_recovery_tokens.sqlite3.up.sql

@@ -0,0 +1 @@
+DROP INDEX IF EXISTS "identity_recovery_addresses_code_idx";

persistence/sql/migrations/sql/20210913095309000003_identity_recovery_tokens.cockroach.down.sql

@@ -0,0 +1 @@
+ALTER TABLE "identity_recovery_tokens" ALTER COLUMN "identity_recovery_address_id" SET NOT NULL;

persistence/sql/migrations/sql/20210913095309000003_identity_recovery_tokens.cockroach.up.sql

@@ -0,0 +1 @@
+ALTER TABLE "identity_recovery_tokens" ADD COLUMN "identity_recovery_address_id" UUID;

persistence/sql/migrations/sql/20210913095309000003_identity_recovery_tokens.sqlite3.down.sql

@@ -0,0 +1 @@
+CREATE INDEX "identity_recovery_tokens_nid_idx" ON "_identity_recovery_tokens_tmp" (id, nid);

persistence/sql/migrations/sql/20210913095309000003_identity_recovery_tokens.sqlite3.up.sql

@@ -0,0 +1 @@
+DROP INDEX IF EXISTS "identity_recovery_addresses_code_uq_idx";

persistence/sql/migrations/sql/20210913095309000004_identity_recovery_tokens.cockroach.down.sql

@@ -0,0 +1 @@
+UPDATE "identity_recovery_tokens" SET "identity_recovery_address_id" = "_identity_recovery_address_id_tmp";

persistence/sql/migrations/sql/20210913095309000004_identity_recovery_tokens.cockroach.up.sql

@@ -0,0 +1 @@
+UPDATE "identity_recovery_tokens" SET "identity_recovery_address_id" = "_identity_recovery_address_id_tmp";

persistence/sql/migrations/sql/20210913095309000004_identity_recovery_tokens.sqlite3.down.sql

@@ -0,0 +1 @@
+CREATE INDEX "identity_recovery_addresses_code_idx" ON "_identity_recovery_tokens_tmp" (token);

persistence/sql/migrations/sql/20210913095309000004_identity_recovery_tokens.sqlite3.up.sql

@@ -0,0 +1,16 @@
+CREATE TABLE "_identity_recovery_tokens_tmp" (
+"id" TEXT PRIMARY KEY,
+"token" TEXT NOT NULL,
+"used" bool NOT NULL DEFAULT 'false',
+"used_at" DATETIME,
+"identity_recovery_address_id" char(36),
+"selfservice_recovery_flow_id" char(36),
+"created_at" DATETIME NOT NULL,
+"updated_at" DATETIME NOT NULL,
+"expires_at" DATETIME NOT NULL DEFAULT '2000-01-01 00:00:00',
+"issued_at" DATETIME NOT NULL DEFAULT '2000-01-01 00:00:00',
+"nid" char(36),
+"identity_id" char(36) NOT NULL,
+FOREIGN KEY (selfservice_recovery_flow_id) REFERENCES selfservice_recovery_flows (id) ON UPDATE NO ACTION ON DELETE CASCADE,
+FOREIGN KEY (identity_recovery_address_id) REFERENCES identity_recovery_addresses (id) ON UPDATE NO ACTION ON DELETE CASCADE
+);

persistence/sql/migrations/sql/20210913095309000005_identity_recovery_tokens.cockroach.down.sql

@@ -0,0 +1 @@
+ALTER TABLE "identity_recovery_tokens" ADD COLUMN "identity_recovery_address_id" UUID;

persistence/sql/migrations/sql/20210913095309000005_identity_recovery_tokens.cockroach.up.sql

@@ -0,0 +1 @@
+ALTER TABLE "identity_recovery_tokens" DROP COLUMN "_identity_recovery_address_id_tmp";

persistence/sql/migrations/sql/20210913095309000005_identity_recovery_tokens.sqlite3.down.sql

@@ -0,0 +1 @@
+CREATE UNIQUE INDEX "identity_recovery_addresses_code_uq_idx" ON "_identity_recovery_tokens_tmp" (token);

persistence/sql/migrations/sql/20210913095309000005_identity_recovery_tokens.sqlite3.up.sql

@@ -0,0 +1 @@
+CREATE INDEX "identity_recovery_tokens_nid_idx" ON "_identity_recovery_tokens_tmp" (id, nid);

persistence/sql/migrations/sql/20210913095309000006_identity_recovery_tokens.cockroach.down.sql

@@ -0,0 +1 @@
+ALTER TABLE "identity_recovery_tokens" RENAME COLUMN "identity_recovery_address_id" TO "_identity_recovery_address_id_tmp";

persistence/sql/migrations/sql/20210913095309000006_identity_recovery_tokens.cockroach.up.sql

@@ -0,0 +1 @@
+ALTER TABLE "identity_recovery_tokens" ADD CONSTRAINT "identity_recovery_tokens_identity_recovery_addresses_id_fk" FOREIGN KEY ("identity_recovery_address_id") REFERENCES "identity_recovery_addresses" ("id") ON UPDATE NO ACTION ON DELETE CASCADE;

persistence/sql/migrations/sql/20210913095309000006_identity_recovery_tokens.sqlite3.down.sql

@@ -0,0 +1,15 @@
+CREATE TABLE "_identity_recovery_tokens_tmp" (
+"id" TEXT PRIMARY KEY,
+"token" TEXT NOT NULL,
+"used" bool NOT NULL DEFAULT 'false',
+"used_at" DATETIME,
+"identity_recovery_address_id" char(36) NOT NULL,
+"selfservice_recovery_flow_id" char(36),
+"created_at" DATETIME NOT NULL,
+"updated_at" DATETIME NOT NULL,
+"expires_at" DATETIME NOT NULL DEFAULT '2000-01-01 00:00:00',
+"issued_at" DATETIME NOT NULL DEFAULT '2000-01-01 00:00:00',
+"nid" char(36),
+FOREIGN KEY (identity_recovery_address_id) REFERENCES identity_recovery_addresses (id) ON UPDATE NO ACTION ON DELETE CASCADE,
+FOREIGN KEY (selfservice_recovery_flow_id) REFERENCES selfservice_recovery_flows (id) ON UPDATE NO ACTION ON DELETE CASCADE
+);

persistence/sql/migrations/sql/20210913095309000006_identity_recovery_tokens.sqlite3.up.sql

@@ -0,0 +1 @@
+CREATE INDEX "identity_recovery_addresses_code_idx" ON "_identity_recovery_tokens_tmp" (token);

persistence/sql/migrations/sql/20210913095309000007_identity_recovery_tokens.cockroach.down.sql

@@ -0,0 +1 @@
+ALTER TABLE "identity_recovery_tokens" DROP CONSTRAINT "identity_recovery_tokens_identity_recovery_addresses_id_fk";

persistence/sql/migrations/sql/20210913095309000007_identity_recovery_tokens.sqlite3.down.sql

@@ -0,0 +1 @@
+DROP INDEX IF EXISTS "identity_recovery_tokens_nid_idx";

persistence/sql/migrations/sql/20210913095309000007_identity_recovery_tokens.sqlite3.up.sql

@@ -0,0 +1 @@
+CREATE UNIQUE INDEX "identity_recovery_addresses_code_uq_idx" ON "_identity_recovery_tokens_tmp" (token);

persistence/sql/migrations/sql/20210913095309000008_identity_recovery_tokens.sqlite3.down.sql

@@ -0,0 +1 @@
+DROP INDEX IF EXISTS "identity_recovery_addresses_code_idx";

persistence/sql/migrations/sql/20210913095309000008_identity_recovery_tokens.sqlite3.up.sql

@@ -0,0 +1 @@
+INSERT INTO "_identity_recovery_tokens_tmp" (id, token, used, used_at, identity_recovery_address_id, selfservice_recovery_flow_id, created_at, updated_at, expires_at, issued_at, nid, identity_id) SELECT id, token, used, used_at, identity_recovery_address_id, selfservice_recovery_flow_id, created_at, updated_at, expires_at, issued_at, nid, identity_id FROM "identity_recovery_tokens";

persistence/sql/migrations/sql/20210913095309000009_identity_recovery_tokens.sqlite3.down.sql

@@ -0,0 +1 @@
+DROP INDEX IF EXISTS "identity_recovery_addresses_code_uq_idx";

persistence/sql/migrations/sql/20210913095309000009_identity_recovery_tokens.sqlite3.up.sql

@@ -0,0 +1 @@
+DROP TABLE "identity_recovery_tokens";

persistence/sql/migrations/sql/20210913095309000010_identity_recovery_tokens.sqlite3.down.sql

@@ -0,0 +1 @@
+ALTER TABLE "_identity_recovery_tokens_tmp" RENAME TO "identity_recovery_tokens";

persistence/sql/migrations/sql/20210913095309000010_identity_recovery_tokens.sqlite3.up.sql

@@ -0,0 +1 @@
+ALTER TABLE "_identity_recovery_tokens_tmp" RENAME TO "identity_recovery_tokens";

persistence/sql/migrations/sql/20210913095309000011_identity_recovery_tokens.sqlite3.down.sql

@@ -0,0 +1 @@
+DROP TABLE "identity_recovery_tokens";

persistence/sql/migrations/sql/20210913095309000012_identity_recovery_tokens.sqlite3.down.sql

@@ -0,0 +1 @@
+INSERT INTO "_identity_recovery_tokens_tmp" (id, token, used, used_at, identity_recovery_address_id, selfservice_recovery_flow_id, created_at, updated_at, expires_at, issued_at, nid, identity_id) SELECT id, token, used, used_at, identity_recovery_address_id, selfservice_recovery_flow_id, created_at, updated_at, expires_at, issued_at, nid, identity_id FROM "identity_recovery_tokens";

persistence/sql/migrations/sql/20210913095309000013_identity_recovery_tokens.sqlite3.down.sql

@@ -0,0 +1 @@
+CREATE INDEX "identity_recovery_tokens_nid_idx" ON "_identity_recovery_tokens_tmp" (id, nid);

persistence/sql/migrations/sql/20210913095309000014_identity_recovery_tokens.sqlite3.down.sql

@@ -0,0 +1 @@
+CREATE INDEX "identity_recovery_addresses_code_idx" ON "_identity_recovery_tokens_tmp" (token);

persistence/sql/migrations/sql/20210913095309000015_identity_recovery_tokens.sqlite3.down.sql

@@ -0,0 +1 @@
+CREATE UNIQUE INDEX "identity_recovery_addresses_code_uq_idx" ON "_identity_recovery_tokens_tmp" (token);

persistence/sql/migrations/sql/20210913095309000016_identity_recovery_tokens.sqlite3.down.sql

@@ -0,0 +1,16 @@
+CREATE TABLE "_identity_recovery_tokens_tmp" (
+"id" TEXT PRIMARY KEY,
+"token" TEXT NOT NULL,
+"used" bool NOT NULL DEFAULT 'false',
+"used_at" DATETIME,
+"identity_recovery_address_id" char(36) NOT NULL,
+"selfservice_recovery_flow_id" char(36),
+"created_at" DATETIME NOT NULL,
+"updated_at" DATETIME NOT NULL,
+"expires_at" DATETIME NOT NULL DEFAULT '2000-01-01 00:00:00',
+"issued_at" DATETIME NOT NULL DEFAULT '2000-01-01 00:00:00',
+"nid" char(36),
+"identity_id" char(36) NOT NULL,
+FOREIGN KEY (identity_recovery_address_id) REFERENCES identity_recovery_addresses (id) ON UPDATE NO ACTION ON DELETE CASCADE,
+FOREIGN KEY (selfservice_recovery_flow_id) REFERENCES selfservice_recovery_flows (id) ON UPDATE NO ACTION ON DELETE CASCADE
+);

persistence/sql/migrations/sql/20210913095309000017_identity_recovery_tokens.sqlite3.down.sql

@@ -0,0 +1 @@
+DROP INDEX IF EXISTS "identity_recovery_tokens_nid_idx";

persistence/sql/migrations/sql/20210913095309000018_identity_recovery_tokens.sqlite3.down.sql

@@ -0,0 +1 @@
+DROP INDEX IF EXISTS "identity_recovery_addresses_code_idx";

persistence/sql/migrations/sql/20210913095309000019_identity_recovery_tokens.sqlite3.down.sql

@@ -0,0 +1 @@
+DROP INDEX IF EXISTS "identity_recovery_addresses_code_uq_idx";

persistence/sql/migrations/templates/20210913095309_identity_recovery_tokens.down.fizz

@@ -0,0 +1,2 @@
+change_column("identity_recovery_tokens", "identity_recovery_address_id", "uuid", {"size": 36})
+drop_column("identity_recovery_tokens", "identity_id")

persistence/sql/migrations/templates/20210913095309_identity_recovery_tokens.up.fizz

@@ -0,0 +1,2 @@
+add_column("identity_recovery_tokens", "identity_id", "uuid", {"size": 36})
+change_column("identity_recovery_tokens", "identity_recovery_address_id", "uuid", {"size": 36,"null": true})

persistence/sql/persister_recovery.go

@@ -6,11 +6,10 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/ory/kratos/corp"
-	"github.com/ory/kratos/identity"
-
 	"github.com/gobuffalo/pop/v5"
 	"github.com/gofrs/uuid"
+	"github.com/ory/kratos/corp"
+	"github.com/ory/kratos/identity"
 
 	"github.com/ory/x/sqlcon"
 
@@ -75,12 +74,10 @@ func (p *Persister) UseRecoveryToken(ctx context.Context, token string) (*link.R
 		}
 
 		var ra identity.RecoveryAddress
-		if err := tx.Where("id = ? AND nid = ?", rt.RecoveryAddressID, nid).First(&ra); err != nil {
-			return sqlcon.HandleError(err)
+		if err := tx.Where("id = ? AND nid = ?", rt.RecoveryAddressID, nid).First(&ra); err == nil {
+			rt.RecoveryAddress = &ra
 		}
 
-		rt.RecoveryAddress = &ra
-
 		/* #nosec G201 TableName is static */
 		return tx.RawQuery(fmt.Sprintf("UPDATE %s SET used=true, used_at=? WHERE id=? AND nid = ?", rt.TableName(ctx)), time.Now().UTC(), rt.ID, nid).Exec()
 	})); err != nil {

selfservice/strategy/link/strategy_recovery.go

@@ -162,23 +162,14 @@ func (s *Strategy) createRecoveryLink(w http.ResponseWriter, r *http.Request, _
 		s.d.Writer().WriteError(w, r, err)
 		return
 	}
-
-	if len(id.RecoveryAddresses) == 0 {
-		s.d.Writer().WriteError(w, r, errors.WithStack(herodot.ErrBadRequest.WithReasonf("The identity does not have any recovery addresses set.")))
-		return
-	}
-
-	address := id.RecoveryAddresses[0]
-	token := NewRecoveryToken(&address, expiresIn)
+	token := NewRecoveryToken(id.ID, expiresIn)
 	if err := s.d.RecoveryTokenPersister().CreateRecoveryToken(r.Context(), token); err != nil {
 		s.d.Writer().WriteError(w, r, err)
 		return
 	}
 
 	s.d.Audit().
-		WithField("via", address.Via).
-		WithField("identity_id", address.IdentityID).
-		WithSensitiveField("email_address", address.Value).
+		WithField("identity_id", id.ID).
 		WithSensitiveField("recovery_link_token", token).
 		Info("A recovery link has been created.")
 
@@ -327,7 +318,7 @@ func (s *Strategy) recoveryUseToken(w http.ResponseWriter, r *http.Request, body
 		return s.HandleRecoveryError(w, r, f, body, err)
 	}
 
-	return s.recoveryIssueSession(w, r, f, token.RecoveryAddress.IdentityID)
+	return s.recoveryIssueSession(w, r, f, token.IdentityID)
 }
 
 func (s *Strategy) retryRecoveryFlowWithMessage(w http.ResponseWriter, r *http.Request, ft flow.Type, message *text.Message) error {

selfservice/strategy/link/strategy_recovery_test.go

@@ -100,16 +100,30 @@ func TestAdminStrategy(t *testing.T) {
 		assert.EqualError(t, err.(*kratos.GenericOpenAPIError), "404 Not Found")
 	})
 
-	t.Run("description=should not be able to recover an account that does not have a recovery email", func(t *testing.T) {
+	t.Run("description=should create a valid recovery link without email", func(t *testing.T) {
 		id := identity.Identity{Traits: identity.Traits(`{}`)}
+
 		require.NoError(t, reg.IdentityManager().Create(context.Background(),
 			&id, identity.ManagerAllowWriteProtectedTraits))
 
-		_, _, err := adminSDK.V0alpha1Api.AdminCreateSelfServiceRecoveryLink(context.Background()).AdminCreateSelfServiceRecoveryLinkBody(kratos.AdminCreateSelfServiceRecoveryLinkBody{
+		publicTS, adminTS := testhelpers.NewKratosServer(t, reg)
+		adminSDK := testhelpers.NewSDKClient(adminTS)
+
+		rl, _, err := adminSDK.V0alpha1Api.AdminCreateSelfServiceRecoveryLink(context.Background()).AdminCreateSelfServiceRecoveryLinkBody(kratos.AdminCreateSelfServiceRecoveryLinkBody{
 			IdentityId: id.ID.String(),
+			ExpiresIn:  pointerx.String("100ms"),
 		}).Execute()
-		require.IsType(t, err, new(kratos.GenericOpenAPIError), "%T", err)
-		assert.EqualError(t, err.(*kratos.GenericOpenAPIError), "400 Bad Request")
+		require.NoError(t, err)
+
+		time.Sleep(time.Millisecond * 100)
+		checkLink(t, rl, time.Now().Add(conf.SelfServiceFlowRecoveryRequestLifespan()))
+		res, err := publicTS.Client().Get(rl.RecoveryLink)
+		require.NoError(t, err)
+
+		require.Equal(t, http.StatusOK, res.StatusCode)
+
+		// We end up here because the link is expired.
+		assert.Contains(t, res.Request.URL.Path, "/recover", rl.RecoveryLink)
 	})
 
 	t.Run("description=should create a valid recovery link and set the expiry time and not be able to recover the account", func(t *testing.T) {

selfservice/strategy/link/token_recovery.go

@@ -28,7 +28,7 @@ type RecoveryToken struct {
 	Token string `json:"-" db:"token"`
 
 	// RecoveryAddress links this token to a recovery address.
-	// required: true
+	// required: false
 	RecoveryAddress *identity.RecoveryAddress `json:"recovery_address" belongs_to:"identity_recovery_addresses" fk_id:"RecoveryAddressID"`
 
 	// ExpiresAt is the time (UTC) when the token expires.
@@ -44,10 +44,11 @@ type RecoveryToken struct {
 	// UpdatedAt is a helper struct field for gobuffalo.pop.
 	UpdatedAt time.Time `json:"-" faker:"-" db:"updated_at"`
 	// RecoveryAddressID is a helper struct field for gobuffalo.pop.
-	RecoveryAddressID uuid.UUID `json:"-" faker:"-" db:"identity_recovery_address_id"`
+	RecoveryAddressID uuid.NullUUID `json:"-" faker:"-" db:"identity_recovery_address_id"`
 	// FlowID is a helper struct field for gobuffalo.pop.
-	FlowID uuid.NullUUID `json:"-" faker:"-" db:"selfservice_recovery_flow_id"`
-	NID    uuid.UUID     `json:"-"  faker:"-" db:"nid"`
+	FlowID     uuid.NullUUID `json:"-" faker:"-" db:"selfservice_recovery_flow_id"`
+	NID        uuid.UUID     `json:"-"  faker:"-" db:"nid"`
+	IdentityID uuid.UUID     `json:"identity_id"  faker:"-" db:"identity_id"`
 }
 
 func (RecoveryToken) TableName(ctx context.Context) string {
@@ -56,23 +57,34 @@ func (RecoveryToken) TableName(ctx context.Context) string {
 
 func NewSelfServiceRecoveryToken(address *identity.RecoveryAddress, f *recovery.Flow, expiresIn time.Duration) *RecoveryToken {
 	now := time.Now().UTC()
+	var identityId = uuid.UUID{}
+	var recoveryAddressID = uuid.NullUUID{UUID: uuid.UUID{}, Valid: false}
+	if address != nil {
+		identityId = address.IdentityID
+		recoveryAddressID.UUID = address.ID
+		recoveryAddressID.Valid = true
+	}
 	return &RecoveryToken{
-		ID:              x.NewUUID(),
-		Token:           randx.MustString(32, randx.AlphaNum),
-		RecoveryAddress: address,
-		ExpiresAt:       now.Add(expiresIn),
-		IssuedAt:        now,
-		FlowID:          uuid.NullUUID{UUID: f.ID, Valid: true}}
+		ID:                x.NewUUID(),
+		Token:             randx.MustString(32, randx.AlphaNum),
+		RecoveryAddress:   address,
+		ExpiresAt:         now.Add(expiresIn),
+		IssuedAt:          now,
+		IdentityID:        identityId,
+		FlowID:            uuid.NullUUID{UUID: f.ID, Valid: true},
+		RecoveryAddressID: recoveryAddressID,
+	}
 }
 
-func NewRecoveryToken(address *identity.RecoveryAddress, expiresIn time.Duration) *RecoveryToken {
+func NewRecoveryToken(identityID uuid.UUID, expiresIn time.Duration) *RecoveryToken {
 	now := time.Now().UTC()
 	return &RecoveryToken{
-		ID:              x.NewUUID(),
-		Token:           randx.MustString(32, randx.AlphaNum),
-		RecoveryAddress: address,
-		ExpiresAt:       now.Add(expiresIn),
-		IssuedAt:        now,
+		ID:                x.NewUUID(),
+		Token:             randx.MustString(32, randx.AlphaNum),
+		ExpiresAt:         now.Add(expiresIn),
+		IssuedAt:          now,
+		IdentityID:        identityID,
+		RecoveryAddressID: uuid.NullUUID{UUID: uuid.UUID{}, Valid: false},
 	}
 }