Merge pull request #477 from zitadel/dockerize-ci

chore: dockerize CI
2025-08-11 13:19:21 +00:00 · 2025-07-02 10:09:15 +02:00
parent 9a26f49a0c 2e9c77405d
commit 3f641249fa
154 changed files with 1785 additions and 879 deletions
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,2 +0,0 @@
-/*
-!/docker
--- a/.github/workflows/close_pr.yml
+++ b/.github/workflows/close_pr.yml
@@ -0,0 +1,35 @@
+name: Auto-close PRs and guide to correct repo
+
+on:
+  pull_request_target:
+    types: [opened]
+
+jobs:
+  auto-close:
+    runs-on: ubuntu-latest
+    if: github.repository_id == '622995060'
+    steps:
+      - name: Comment and close PR
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const message = `
+            👋 **Thanks for your contribution!**
+            
+            This repository \`${{ github.repository }}\` is a read-only mirror of our internal development in [\`zitadel/zitadel\`](https://github.com/zitadel/zitadel).
+            Therefore, we close this pull request automatically, but submitting your changes to the main repository is easy:
+            1. Fork and clone zitadel/zitadel
+            2. Create a new branch for your changes
+            3. Pull your changes into the new fork by running `make login_pull LOGIN_REMOTE_URL=<your-typescript-fork-org>/typescript LOGIN_REMOTE_BRANCH=<your-typescript-fork-branch>`.
+            4. Push your changes and open a pull request to zitadel/zitadel
+            `.trim();
+            await github.rest.issues.createComment({
+                ...context.repo,
+              issue_number: context.issue.number,
+              body: message
+            });
+            await github.rest.pulls.update({
+                ...context.repo,
+              pull_number: context.issue.number,
+              state: "closed"
+            });
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -1,109 +0,0 @@
-name: Docker
-
-on:
-  push:
-    branches:
-      - main
-      - qa
-  workflow_dispatch:
-
-permissions:
-  packages: write
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 2
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-
-      - name: Cache turbo build setup
-        uses: actions/cache@v4
-        with:
-          path: .turbo
-          key: ${{ runner.os }}-turbo-${{ github.sha }}
-          restore-keys: |
-            ${{ runner.os }}-turbo-
-
-      - name: Setup Node.js environment
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-        with:
-          driver: docker-container
-
-      - name: Login Public
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Login Private
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ secrets.DOCKER_REGISTRY }}
-          username: ${{ secrets.DOCKER_REGISTRY_USERNAME }}
-          password: ${{ secrets.DOCKER_REGISTRY_PASSWORD }}
-
-      - name: Docker meta
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: |
-            ghcr.io/zitadel/login
-            ${{ secrets.DOCKER_IMAGE }}
-          tags: |
-            type=edge
-            type=ref,event=branch
-            type=ref,event=tag
-            type=ref,event=pr
-            type=sha
-
-      - name: Install dependencies
-        run: pnpm install
-
-      - name: Generate stubs
-        run: pnpm generate
-
-      - name: Build for Docker
-        run: NEXT_PUBLIC_BASE_PATH=/ui/v2/login pnpm build:docker
-
-      - name: Build and Push Image
-        id: build
-        uses: docker/build-push-action@v5
-        timeout-minutes: 10
-        with:
-          context: .
-          push: true
-          platforms: linux/amd64,linux/arm64
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-
-      - name: Export digest
-        run: |
-          mkdir -p /tmp/digests/app
-          digest="${{ steps.build.outputs.digest }}"
-          touch "/tmp/digests/app/${digest#sha256:}"
-
-      - name: Upload digest
-        uses: actions/upload-artifact@v4
-        with:
-          name: digests
-          path: /tmp/digests
-          if-no-files-found: error
-          retention-days: 1
--- a/.github/workflows/issues.yml
+++ b/.github/workflows/issues.yml
@@ -4,14 +4,12 @@ on:
  issues:
    types:
      - opened
-  pull_request_target:
-    types:
-      - opened

 jobs:
  add-to-project:
    name: Add issue and community pr to project
    runs-on: ubuntu-latest
+    if: github.repository_id == '622995060'
    steps:
      - name: add issue
        uses: actions/add-to-project@v1.0.2
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -10,6 +10,7 @@ concurrency: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  release:
    runs-on: ubuntu-latest
+    if: github.repository_id != '622995060'
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
@@ -28,4 +29,4 @@ jobs:
      - name: Create Release Pull Request
        uses: changesets/action@v1
        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -1,129 +1,67 @@
 name: Quality
-
 on:
  pull_request:
-  # schedule:
-    # Every morning at 6:00 AM CET
-    # - cron: '0 4 * * *'
  workflow_dispatch:
    inputs:
-      target-env:
-        description: 'Zitadel target environment to run the acceptance tests against.'
-        required: true
-        type: choice
-        options:
-          - 'qa'
-          - 'prod'
-
+      ignore-run-cache:
+        description: 'Whether to ignore the run cache'
+        required: false
+        default: true
+      ref-tag:
+        description: 'overwrite the DOCKER_METADATA_OUTPUT_VERSION environment variable used by the make file'
+        required: false
+        default: ''
 jobs:
-  matrix:
-    # If the workflow is triggered by a schedule event, only the acceptance tests run against QA and Prod.
-    name: Matrix
-    runs-on: ubuntu-latest
-    outputs:
-      matrix: ${{ steps.matrix.outputs.matrix }}
-    steps:
-      - name: Matrix
-        id: matrix
-        run: |
-          if [ -n "${{ github.event.schedule }}" ]; then
-            echo 'matrix=["test:acceptance:qa", "test:acceptance:prod"]' >> $GITHUB_OUTPUT
-          elif [ -n "${{ github.event.inputs.target-env }}" ]; then
-            echo 'matrix=["test:acceptance:${{ github.event.inputs.target-env }}"]' >> $GITHUB_OUTPUT
-          else
-            echo 'matrix=["format --check", "lint", "test:unit", "test:integration", "test:acceptance"]' >> $GITHUB_OUTPUT
-          fi
-
  quality:
    name: Ensure Quality
-
-    runs-on: ubuntu-latest
-
+    if: github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'pull_request' && github.repository_id != '622995060')
+    runs-on: ubuntu-22.04
    timeout-minutes: 30
-
    permissions:
-      contents: "read"
-
-    needs:
-      - matrix
-
-    strategy:
-      fail-fast: false
-      matrix:
-        command: ${{ fromJson( needs.matrix.outputs.matrix ) }}
-
+      contents: read # We only need read access to the repository contents
+      actions: write # We need write access to the actions cache
+    env:
+      CACHE_DIR: /tmp/login-run-caches
+    # Only run this job on workflow_dispatch or pushes to forks
    steps:
-      - name: Checkout Repo
-        uses: actions/checkout@v4
-
-      - name: Setup Buf
-        uses: bufbuild/buf-setup-action@v1.45.0
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4.0.0
-
-      - name: Setup Node.js 20.x
-        uses: actions/setup-node@v4
+      - uses: actions/checkout@v4
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
        with:
-          node-version: 20.x
-
-      - name: Install Dependencies
-        run: pnpm install --frozen-lockfile
-
-        # We can cache the Playwright binary independently from the pnpm cache, because we install it separately.
-        # After pnpm install --frozen-lockfile, we can get the version so we only have to download the binary once per version.
-      - run: echo "PLAYWRIGHT_VERSION=$(npx playwright --version | cut -d ' ' -f 2)" >> $GITHUB_ENV
-        if: ${{ startsWith(matrix.command, 'test:acceptance') }}
-
-      - name: Setup Playwright binary cache
-        uses: actions/cache@v4
-        id: playwright-cache
-        with:
-          path: ~/.cache/ms-playwright
-          key: ${{ runner.os }}-playwright-binary-${{ env.PLAYWRIGHT_VERSION }}
-          restore-keys: |
-            ${{ runner.os }}-playwright-binary-
-        if: ${{ startsWith(matrix.command, 'test:acceptance') }}
-
-      - name: Install Playwright Browsers
-        run: pnpm exec playwright install --with-deps
-        if: ${{ startsWith(matrix.command, 'test:acceptance') && steps.playwright-cache.outputs.cache-hit != 'true' }}
-
-      - name: Set up Docker Buildx
+          images: |
+            ghcr.io/zitadel/login
+          tags: |
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+      - name: Set up Buildx
        uses: docker/setup-buildx-action@v3
-        if: ${{ matrix.command == 'test:acceptance' }}
-
-      - name: Build acceptance setup image
-        run: |
-          cd acceptance
-          docker build -t acceptance-setup:latest .
-        if: ${{ matrix.command == 'test:acceptance' }}
-
-      - name: Run ZITADEL
-        run: ZITADEL_DEV_UID=root pnpm run-sink
-        if: ${{ matrix.command == 'test:acceptance' }}
-
-      - name: Create Cloud Env File
-        run: |
-          if [ "${{ matrix.command }}" == "test:acceptance:prod" ]; then
-            echo "${{ secrets.ENV_FILE_CONTENT_ACCEPTANCE_PROD }}" | tee apps/login/.env.local acceptance/tests/.env.local > /dev/null
-          else
-            echo "${{ secrets.ENV_FILE_CONTENT_ACCEPTANCE_QA }}" | tee apps/login/.env.local acceptance/tests/.env.local > /dev/null
-          fi
-        if: ${{ matrix.command == 'test:acceptance:qa' || matrix.command == 'test:acceptance:prod' }}
-
-      - name: Create Production Build
-        run: pnpm build
-        if: ${{ startsWith(matrix.command, 'test:acceptance') }}
-
-      - name: Run SAML SP
-        run: ZITADEL_DEV_UID=root pnpm run-samlsp
-        if: ${{ matrix.command == 'test:acceptance' }}
-
-      - name: Run OIDC RP
-        run: ZITADEL_DEV_UID=root pnpm run-oidcrp
-        if: ${{ matrix.command == 'test:acceptance' }}
-
-      - name: Check
-        id: check
-        run: pnpm ${{ contains(matrix.command, 'test:acceptance') && 'test:acceptance' || matrix.command }}
+      # Only with correctly restored build cache layers, the run caches work as expected.
+      # To restore docker build layer caches, extend the docker-bake.hcl to use the cache-from and cache-to options.
+      # https://docs.docker.com/build/ci/github-actions/cache/
+      # Alternatively, you can use a self-hosted runner or a third-party builder that restores build layer caches out-of-the-box, like https://depot.dev/
+      - name: Restore Run Caches
+        uses: actions/cache/restore@v4
+        id: run-caches-restore
+        with:
+          path: ${{ env.CACHE_DIR }}
+          key: ${{ runner.os }}-login-run-caches-${{github.ref_name}}-${{ github.sha }}-${{github.run_attempt}}
+          restore-keys: |
+            ${{ runner.os }}-login-run-caches-${{github.ref_name}}-${{ github.sha }}-
+            ${{ runner.os }}-login-run-caches-${{github.ref_name}}-
+            ${{ runner.os }}-login-run-caches-
+      - run: make login_quality
+        env:
+          IGNORE_RUN_CACHE: ${{ github.event.inputs.ignore-run-cache == 'true' }}
+          DOCKER_METADATA_OUTPUT_VERSION: ${{ github.event.inputs.ref-tag || env.DOCKER_METADATA_OUTPUT_VERSION || steps.meta.outputs.version }}
+      - name: Save Run Caches
+        uses: actions/cache/save@v4
+        with:
+          path: ${{ env.CACHE_DIR }}
+          key: ${{ steps.run-caches-restore.outputs.cache-primary-key }}
+        if: always()
--- a/.gitignore
+++ b/.gitignore
@@ -7,20 +7,12 @@ dist
 dist-ssr
 *.local
 .env
-apps/login/.env.local
-apps/login/.env.acceptance
-.cache
 server/dist
 public/dist
-.turbo
-packages/zitadel-server/src/app/proto
 .vscode
 .idea
 .vercel
 .env*.local
-/test-results/
-/playwright-report/
 /blob-report/
-/playwright/.cache/
 /out
 /docker
--- a/.prettierignore
+++ b/.prettierignore
@@ -2,6 +2,7 @@
 .changeset/
 .github/
 dist/
+standalone/
 packages/zitadel-proto/google
 packages/zitadel-proto/protoc-gen-openapiv2
 packages/zitadel-proto/validate
--- a/.prettierrc
+++ b/.prettierrc
@@ -1,6 +1,6 @@
 {
  "printWidth": 125,
  "trailingComma": "all",
-  "plugins": ["prettier-plugin-organize-imports"]
+  "plugins": ["prettier-plugin-organize-imports"],
+  "filepath": ""
 }
-	
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -24,43 +24,10 @@ Please consider the following guidelines when creating a pull request.

 - The latest changes are always in `main`, so please make your pull request against that branch.
 - pull requests should be raised for any change
- Pull requests need approval of a ZITADEL core engineer @zitadel/engineers before merging
+- Pull requests need approval of a Zitadel core engineer @zitadel/engineers before merging
 - We use ESLint/Prettier for linting/formatting, so please run `pnpm lint:fix` before committing to make resolving conflicts easier (VSCode users, check out [this ESLint extension](https://marketplace.visualstudio.com/items?itemName=dbaeumer.vscode-eslint) and [this Prettier extension](https://marketplace.visualstudio.com/items?itemName=esbenp.prettier-vscode) to fix lint and formatting issues in development)
 - If you add new functionality, please provide the corresponding documentation as well and make it part of the pull request

-## Setting Up The ZITADEL API
-
-If you want to have a one-liner to get you up and running,
-or if you want to develop against a ZITADEL API with the latest features,
-or even add changes to ZITADEL itself at the same time,
-you should develop against your local ZITADEL process.
-However, it might be easier to develop against your ZITADEL Cloud instance
-if you don't have docker installed
-or have limited resources on your local machine.
-
-### Developing Against Your Local ZITADEL Instance
-
-```sh
-# To have your service user key and environment file written with the correct ownership, export your current users ID.
-export ZITADEL_DEV_UID="$(id -u)"
-
-# Pull images
-docker compose --file ./acceptance/docker-compose.yaml pull
-
-# Run ZITADEL with local notification sink and configure ./apps/login/.env.local
-pnpm run-sink
-```
-
-### Developing Against Your ZITADEL Cloud Instance
-
-Configure your shell by exporting the following environment variables:
-
-```sh
-export ZITADEL_API_URL=<your cloud instance URL here>
-export ZITADEL_ORG_ID=<your service accounts organization id here>
-export ZITADEL_SERVICE_USER_TOKEN=<your service account personal access token here>
-```
-
 ### Setting up local environment

 ```sh
@@ -70,40 +37,170 @@ pnpm install
 # Generate gRPC stubs
 pnpm generate

-# Start a local development server
+# Start a local development server for the login and manually configure apps/login/.env.local
 pnpm dev
 ```

 The application is now available at `http://localhost:3000`

-### Adding applications and IDPs
+Configure apps/login/.env.local to target the Zitadel instance of your choice.
+The login app live-reloads on changes, so you can start developing right away.
+
+### <a name="latest"></a>Developing Against A Local Latest Zitadel Release
+
+The following command uses Docker to run a local Zitadel instance and the login application in live-reloading dev mode.
+Additionally, it runs a Traefik reverse proxy that exposes the login with a self-signed certificate at https://127.0.0.1.sslip.io
+127.0.0.1.sslip.io is a special domain that resolves to your localhost, so it's safe to allow your browser to proceed with loading the page.

 ```sh
-# OPTIONAL Run SAML SP
-pnpm run-samlsp
+# Install dependencies. Developing requires Node.js v20
+pnpm install

-# OPTIONAL Run OIDC RP
-pnpm run-oidcrp
+# Generate gRPC stubs
+pnpm generate

-# OPTIONAL Run SAML IDP
-pnpm run-samlidp
-
-# OPTIONAL Run OIDC OP
-pnpm run-oidcop
+# Start a local development server and have apps/login/.env.test.local configured for you to target the local Zitadel instance.
+pnpm dev:local
 ```

-### Testing
+Log in at https://127.0.0.1.sslip.io/ui/v2/login/loginname and use the following credentials:
+**Loginname**: *zitadel-admin@zitadel.127.0.0.1.sslip.io*
+**Password**: _Password1!_.

-You can execute the following commands `pnpm test` for a single test run or `pnpm test:watch` in the following directories:
+The login app live-reloads on changes, so you can start developing right away.

- apps/login
- packages/zitadel-proto
- packages/zitadel-client
- packages/zitadel-node
- The projects root directory: all tests in the project are executed
+### <a name="local"></a>Developing Against A Locally Compiled Zitadel

-In apps/login, these commands also spin up the application and a ZITADEL gRPC API mock server to run integration tests using [Cypress](https://www.cypress.io/) against them.
-If you want to run the integration tests standalone against an environment of your choice, navigate to ./apps/login, [configure your shell as you like](# Developing Against Your ZITADEL Cloud Instance) and run `pnpm test:integration:run` or `pnpm test:integration:open`.
-Then you need to lifecycle the mock process using the command `pnpm mock` or the more fine grained commands `pnpm mock:build`, `pnpm mock:build:nocache`, `pnpm mock:run` and `pnpm mock:destroy`.
+To develop against a locally compiled version of Zitadel, you need to build the Zitadel docker image first.
+Clone the [Zitadel repository](https://github.com/zitadel/zitadel.git) and run the following command from its root:

-That's it! 🎉
+```sh
+# This compiles a Zitadel binary if it does not exist at ./zitadel already and copies it into a Docker image.
+# If you want to recompile the binary, run `make compile` first
+make login_dev
+```
+
+Open another terminal session at zitadel/zitadel/login and run the following commands to start the dev server.
+
+```bash
+# Install dependencies. Developing requires Node.js v20
+pnpm install
+
+# Start a local development server and have apps/login/.env.test.local configured for you to target the local Zitadel instance.
+NODE_ENV=test pnpm dev
+```
+
+Log in at https://127.0.0.1.sslip.io/ui/v2/login/loginname and use the following credentials:
+**Loginname**: *zitadel-admin@zitadel.127.0.0.1.sslip.io*
+**Password**: _Password1!_.
+
+The login app live-reloads on changes, so you can start developing right away.
+
+### Quality Assurance
+
+Use `make` commands to test the quality of your code against a production build without installing any dependencies besides Docker.
+Using `make` commands, you can reproduce and debug the CI pipelines locally.
+
+```sh
+# Reproduce the whole CI pipeline in docker
+make login_quality
+# Show other options with make
+make help
+```
+
+Use `pnpm` commands to run the tests in dev mode with live reloading and debugging capabilities.
+
+#### Linting and formatting
+
+Check the formatting and linting of the code in docker
+
+```sh
+make login_lint
+```
+
+Check the linting of the code using pnpm
+
+```sh
+pnpm lint
+pnpm format
+```
+
+Fix the linting of your code
+
+```sh
+pnpm lint:fix
+pnpm format:fix
+```
+
+#### Running Unit Tests
+
+Run the tests in docker
+
+```sh
+make login_test_unit
+```
+
+Run unit tests with live-reloading
+
+```sh
+pnpm test:unit
+```
+
+#### Running Integration Tests
+
+Run the test in docker
+
+```sh
+make login_test_integration
+```
+
+Alternatively, run a live-reloading development server with an interactive Cypress test suite.
+First, set up your local test environment.
+
+```sh
+# Install dependencies. Developing requires Node.js v20
+pnpm install
+
+# Generate gRPC stubs
+pnpm generate
+
+# Start a local development server and use apps/login/.env.test to use the locally mocked Zitadel API.
+pnpm test:integration:setup
+```
+
+Now, in another terminal session, open the interactive Cypress integration test suite.
+
+```sh
+pnpm test:integration open
+```
+
+Show more options with Cypress
+
+```sh
+pnpm test:integration help
+```
+
+#### Running Acceptance Tests
+
+To run the tests in docker against the latest release of Zitadel, use the following command:
+
+:warning: The acceptance tests are not reliable at the moment :construction:
+
+```sh
+make login_test_acceptance
+```
+
+Alternatively, run can use a live-reloading development server with an interactive Playwright test suite.
+Set up your local environment by running the commands either for [developing against a local latest Zitadel release](latest) or for [developing against a locally compiled Zitadel](compiled).
+
+Now, in another terminal session, open the interactive Playwright acceptance test suite.
+
+```sh
+pnpm test:acceptance open
+```
+
+Show more options with Playwright
+
+```sh
+pnpm test:acceptance help
+```
--- a/18
+++ b/18
@@ -1,18 +0,0 @@
-FROM node:20-alpine
-
-WORKDIR /app
-
-RUN addgroup --system --gid 1001 nodejs
-RUN adduser --system --uid 1001 nextjs
-
-# If /.env-file/.env is mounted into the container, its variables are made available to the server before it starts up.
-RUN mkdir -p /.env-file && touch /.env-file/.env && chown -R nextjs:nodejs /.env-file
-
-COPY --chown=nextjs:nodejs ./docker/apps/login/.next/standalone ./
-COPY --chown=nextjs:nodejs ./docker/apps/login/.next/static ./apps/login/.next/static
-COPY --chown=nextjs:nodejs ./docker/apps/login/public ./apps/login/public
-
-USER nextjs
-ENV HOSTNAME="0.0.0.0"
-
-CMD ["/bin/sh", "-c", " set -o allexport && . /.env-file/.env && set +o allexport && node apps/login/server.js"]
--- a/137
+++ b/137
@@ -0,0 +1,137 @@
+XDG_CACHE_HOME ?= $(HOME)/.cache
+export CACHE_DIR ?= $(XDG_CACHE_HOME)/zitadel-make
+
+LOGIN_DIR ?= ./
+LOGIN_BAKE_CLI ?= docker buildx bake
+LOGIN_BAKE_CLI_WITH_ARGS := $(LOGIN_BAKE_CLI) --file $(LOGIN_DIR)docker-bake.hcl --file $(LOGIN_DIR)apps/login-test-acceptance/docker-compose.yaml
+LOGIN_BAKE_CLI_ADDITIONAL_ARGS ?=
+LOGIN_BAKE_CLI_WITH_ARGS += $(LOGIN_BAKE_CLI_ADDITIONAL_ARGS)
+
+export COMPOSE_BAKE=true
+export UID := $(id -u)
+export GID := $(id -g)
+
+export LOGIN_TEST_ACCEPTANCE_BUILD_CONTEXT := $(LOGIN_DIR)apps/login-test-acceptance
+
+export DOCKER_METADATA_OUTPUT_VERSION ?= local
+export LOGIN_TAG ?= login:${DOCKER_METADATA_OUTPUT_VERSION}
+export LOGIN_TEST_UNIT_TAG := login-test-unit:${DOCKER_METADATA_OUTPUT_VERSION}
+export LOGIN_TEST_INTEGRATION_TAG := login-test-integration:${DOCKER_METADATA_OUTPUT_VERSION}
+export LOGIN_TEST_ACCEPTANCE_TAG := login-test-acceptance:${DOCKER_METADATA_OUTPUT_VERSION}
+export LOGIN_TEST_ACCEPTANCE_SETUP_TAG := login-test-acceptance-setup:${DOCKER_METADATA_OUTPUT_VERSION}
+export LOGIN_TEST_ACCEPTANCE_SINK_TAG := login-test-acceptance-sink:${DOCKER_METADATA_OUTPUT_VERSION}
+export LOGIN_TEST_ACCEPTANCE_OIDCRP_TAG := login-test-acceptance-oidcrp:${DOCKER_METADATA_OUTPUT_VERSION}
+export LOGIN_TEST_ACCEPTANCE_OIDCOP_TAG := login-test-acceptance-oidcop:${DOCKER_METADATA_OUTPUT_VERSION}
+export LOGIN_TEST_ACCEPTANCE_SAMLSP_TAG := login-test-acceptance-samlsp:${DOCKER_METADATA_OUTPUT_VERSION}
+export LOGIN_TEST_ACCEPTANCE_SAMLIDP_TAG := login-test-acceptance-samlidp:${DOCKER_METADATA_OUTPUT_VERSION}
+export POSTGRES_TAG := postgres:17.0-alpine3.19
+export GOLANG_TAG := golang:1.24-alpine
+export ZITADEL_TAG ?= ghcr.io/zitadel/zitadel:latest
+export LOGIN_CORE_MOCK_TAG := login-core-mock:${DOCKER_METADATA_OUTPUT_VERSION}
+
+login_help:
+	@echo "Makefile for the login service"
+	@echo "Available targets:"
+	@echo "  login_help              - Show this help message."
+	@echo "  login_quality           - Run all quality checks (login_lint, login_test_unit, login_test_integration, login_test_acceptance)."
+	@echo "  login_standalone_build  - Build the docker image for production login containers."
+	@echo "  login_lint              - Run linting and formatting checks. IGNORE_RUN_CACHE=true prevents skipping."
+	@echo "  login_test_unit         - Run unit tests. Tests without any dependencies. IGNORE_RUN_CACHE=true prevents skipping."
+	@echo "  login-test_integration  - Run integration tests. Tests a login production build against a mocked Zitadel core API. IGNORE_RUN_CACHE=true prevents skipping."
+	@echo "  login_test_acceptance   - Run acceptance tests. Tests a login production build with a local Zitadel instance behind a reverse proxy. IGNORE_RUN_CACHE=true prevents skipping."
+	@echo "  typescript_generate	 - Generate TypeScript client code from Protobuf definitions."
+	@echo "  show_run_caches         - Show all run caches with image ids and exit codes."
+	@echo "  clean_run_caches        - Remove all run caches."
+
+
+login_lint:
+	@echo "Running login linting and formatting checks"
+	$(LOGIN_BAKE_CLI_WITH_ARGS) login-lint
+
+login_test_unit:
+	@echo "Running login unit tests"
+	$(LOGIN_BAKE_CLI_WITH_ARGS) login-test-unit
+
+login_test_integration_build:
+	@echo "Building login integration test environment with the local core mock image"
+	$(LOGIN_BAKE_CLI_WITH_ARGS) core-mock login-test-integration login-standalone --load
+
+login_test_integration_dev: login_test_integration_cleanup
+	@echo "Starting login integration test environment with the local core mock image"
+	$(LOGIN_BAKE_CLI_WITH_ARGS) core-mock && docker compose --file $(LOGIN_DIR)apps/login-test-integration/docker-compose.yaml run --service-ports --rm core-mock
+
+login_test_integration_run: login_test_integration_cleanup
+	@echo "Running login integration tests"
+	docker compose --file $(LOGIN_DIR)apps/login-test-integration/docker-compose.yaml run --rm integration
+
+login_test_integration_cleanup:
+	@echo "Cleaning up login integration test environment"
+	docker compose --file $(LOGIN_DIR)apps/login-test-integration/docker-compose.yaml down --volumes
+
+login_test_integration: login_test_integration_build
+	$(LOGIN_DIR)scripts/run_or_skip.sh login_test_integration_run \
+	"$(LOGIN_TAG) \
+	$(LOGIN_CORE_MOCK_TAG) \
+	$(LOGIN_TEST_INTEGRATION_TAG)"
+
+login_test_acceptance_build_bake:
+	@echo "Building login test acceptance images as defined in the docker-bake.hcl"
+	$(LOGIN_BAKE_CLI_WITH_ARGS) login-test-acceptance login-standalone --load
+
+login_test_acceptance_build_compose:
+	@echo "Building login test acceptance images as defined in the docker-compose.yaml"
+	$(LOGIN_BAKE_CLI_WITH_ARGS) --load setup sink
+
+# login_test_acceptance_build is overwritten by the login_dev target in zitadel/zitadel/Makefile
+login_test_acceptance_build: login_test_acceptance_build_compose login_test_acceptance_build_bake
+
+login_test_acceptance_run: login_test_acceptance_cleanup
+	@echo "Running login test acceptance tests"
+	docker compose --file $(LOGIN_DIR)apps/login-test-acceptance/docker-compose.yaml --file $(LOGIN_DIR)apps/login-test-acceptance/docker-compose-ci.yaml run --rm --service-ports acceptance
+
+login_test_acceptance_cleanup:
+	@echo "Cleaning up login test acceptance environment"
+	docker compose --file $(LOGIN_DIR)apps/login-test-acceptance/docker-compose.yaml --file $(LOGIN_DIR)apps/login-test-acceptance/docker-compose-ci.yaml down --volumes
+
+login_test_acceptance: login_test_acceptance_build
+	$(LOGIN_DIR)scripts/run_or_skip.sh login_test_acceptance_run \
+		"$(LOGIN_TAG) \
+  		$(ZITADEL_TAG) \
+  		$(POSTGRES_TAG) \
+  		$(GOLANG_TAG) \
+  		$(LOGIN_TEST_ACCEPTANCE_TAG) \
+  		$(LOGIN_TEST_ACCEPTANCE_SETUP_TAG) \
+  		$(LOGIN_TEST_ACCEPTANCE_SINK_TAG)"
+
+login_test_acceptance_setup_env: login_test_acceptance_build_compose login_test_acceptance_cleanup
+	@echo "Setting up the login test acceptance environment and writing the env.test.local file"
+	docker compose --file $(LOGIN_DIR)apps/login-test-acceptance/docker-compose.yaml run setup
+
+login_test_acceptance_setup_dev:
+	@echo "Starting the login test acceptance environment with the local zitadel image"
+	docker compose --file $(LOGIN_DIR)apps/login-test-acceptance/docker-compose.yaml up --no-recreate zitadel traefik sink
+
+login_quality: login_lint login_test_unit login_test_integration
+	@echo "Running login quality checks: lint, unit tests, integration tests"
+
+login_standalone_build:
+	@echo "Building the login standalone docker image with tag: $(LOGIN_TAG)"
+	$(LOGIN_BAKE_CLI_WITH_ARGS) login-standalone --load
+
+login_standalone_out:
+	$(LOGIN_BAKE_CLI_WITH_ARGS) login-standalone-out
+
+typescript_generate:
+	@echo "Generating TypeScript client and writing to local $(LOGIN_DIR)packages/zitadel-proto"
+	$(LOGIN_BAKE_CLI_WITH_ARGS) login-typescript-proto-client-out
+
+clean_run_caches:
+	@echo "Removing cache directory: $(CACHE_DIR)"
+	rm -rf "$(CACHE_DIR)"
+
+show_run_caches:
+	@echo "Showing run caches with docker image ids and exit codes in $(CACHE_DIR):"
+	@find "$(CACHE_DIR)" -type f 2>/dev/null | while read file; do \
+		echo "$$file: $$(cat $$file)"; \
+	done
+
--- a/README.md
+++ b/README.md
@@ -158,15 +158,14 @@ To find the keys more easily, you can inspect the HTML and search for a `data-i1

 ## Useful Commands

- `pnpm generate` - Build proto stubs for server and client package
- `pnpm build` - Build all packages and the login app
- `pnpm test` - Test all packages and the login app
- `pnpm test:watch` - Rerun tests on file change
+- `make login-quality` - Check the quality of your code against a production build without installing any dependencies besides Docker
+- `pnpm generate` - Build proto stubs for the client package
 - `pnpm dev` - Develop all packages and the login app
- `pnpm lint` - Lint all packages
- `pnpm changeset` - Generate a changeset
+- `pnpm build` - Build all packages and the login app
 - `pnpm clean` - Clean up all `node_modules` and `dist` folders (runs each package's clean script)

+Learn more about developing the login UI in the [contribution guide](/CONTRIBUTING.md).
+
 ## Versioning And Publishing Packages

 Package publishing has been configured using [Changesets](https://github.com/changesets/changesets).
--- a/acceptance/Dockerfile
+++ b/acceptance/Dockerfile
@@ -1,5 +0,0 @@
-FROM golang:1.24-alpine
-RUN apk add curl jq
-COPY setup.sh /setup.sh
-RUN chmod +x /setup.sh
-ENTRYPOINT [ "/setup.sh" ]
--- a/acceptance/idp/oidc/docker-compose.yaml
+++ b/acceptance/idp/oidc/docker-compose.yaml
@@ -1,20 +0,0 @@
-services:
-  oidcop:
-    image: golang:1.24-alpine
-    container_name: oidcop
-    command: go run main.go
-    environment:
-      API_URL: 'http://localhost:8080'
-      API_DOMAIN: 'localhost:8080'
-      PAT_FILE: '/pat/zitadel-admin-sa.pat'
-      SCHEMA: 'http'
-      HOST: 'localhost'
-      PORT: "8004"
-    working_dir: /oidc
-    ports:
-      - 8004:8004
-    volumes:
-      - "../../pat:/pat"
-      - "./:/oidc"
-    extra_hosts:
-      - "localhost:host-gateway"
--- a/acceptance/idp/saml/docker-compose.yaml
+++ b/acceptance/idp/saml/docker-compose.yaml
@@ -1,20 +0,0 @@
-services:
-  samlidp:
-    image: golang:1.24-alpine
-    container_name: samlidp
-    command: go run main.go
-    environment:
-      API_URL: 'http://localhost:8080'
-      API_DOMAIN: 'localhost:8080'
-      PAT_FILE: '/pat/zitadel-admin-sa.pat'
-      SCHEMA: 'http'
-      HOST: 'localhost'
-      PORT: "8003"
-    working_dir: /saml
-    ports:
-      - 8003:8003
-    volumes:
-      - "../../pat:/pat"
-      - "./:/saml"
-    extra_hosts:
-      - "localhost:host-gateway"
--- a/acceptance/oidc/docker-compose.yaml
+++ b/acceptance/oidc/docker-compose.yaml
@@ -1,22 +0,0 @@
-services:
-  oidcrp:
-    image: golang:1.24-alpine
-    container_name: oidcrp
-    command: go run main.go
-    environment:
-      API_URL: 'http://localhost:8080'
-      API_DOMAIN: 'localhost:8080'
-      PAT_FILE: '/pat/zitadel-admin-sa.pat'
-      LOGIN_URL: 'http://localhost:3000'
-      ISSUER: 'http://localhost:3000'
-      HOST: 'http://localhost'
-      PORT: '8000'
-      SCOPES: 'openid profile email'
-    working_dir: /oidc
-    ports:
-      - 8000:8000
-    volumes:
-      - "../pat:/pat"
-      - "./:/oidc"
-    extra_hosts:
-      - "localhost:host-gateway"
--- a/acceptance/pat/.gitignore
+++ b/acceptance/pat/.gitignore
@@ -1,2 +0,0 @@
-*
-!.gitkeep
--- a/acceptance/saml/docker-compose.yaml
+++ b/acceptance/saml/docker-compose.yaml
@@ -1,22 +0,0 @@
-services:
-  samlsp:
-    image: golang:1.24-alpine
-    container_name: samlsp
-    command: go run main.go
-    environment:
-      API_URL: 'http://localhost:8080'
-      API_DOMAIN: 'localhost:8080'
-      PAT_FILE: '/pat/zitadel-admin-sa.pat'
-      LOGIN_URL: 'http://localhost:3000'
-      IDP_URL: 'http://localhost:3000/saml/v2/metadata'
-      HOST: 'http://localhost'
-      PORT: '8001'
-    working_dir: /saml
-    ports:
-      - 8001:8001
-    volumes:
-      - "../pat:/pat"
-      - "./:/saml"
-    extra_hosts:
-      - "localhost:host-gateway"
-
--- a/acceptance/tests/sink.ts
+++ b/acceptance/tests/sink.ts
@@ -1,55 +0,0 @@
-import axios from "axios";
-
-export async function getOtpFromSink(key: string): Promise<any> {
-  try {
-    const response = await axios.post(
-      process.env.SINK_NOTIFICATION_URL!,
-      {
-        recipient: key,
-      },
-      {
-        headers: {
-          "Content-Type": "application/json",
-          Authorization: `Bearer ${process.env.ZITADEL_SERVICE_USER_TOKEN}`,
-        },
-      },
-    );
-
-    if (response.status >= 400) {
-      const error = `HTTP Error: ${response.status} - ${response.statusText}`;
-      console.error(error);
-      throw new Error(error);
-    }
-    return response.data.args.oTP;
-  } catch (error) {
-    console.error("Error making request:", error);
-    throw error;
-  }
-}
-
-export async function getCodeFromSink(key: string): Promise<any> {
-  try {
-    const response = await axios.post(
-      process.env.SINK_NOTIFICATION_URL!,
-      {
-        recipient: key,
-      },
-      {
-        headers: {
-          "Content-Type": "application/json",
-          Authorization: `Bearer ${process.env.ZITADEL_SERVICE_USER_TOKEN}`,
-        },
-      },
-    );
-
-    if (response.status >= 400) {
-      const error = `HTTP Error: ${response.status} - ${response.statusText}`;
-      console.error(error);
-      throw new Error(error);
-    }
-    return response.data.args.code;
-  } catch (error) {
-    console.error("Error making request:", error);
-    throw error;
-  }
-}
--- a/apps/login-test-acceptance/.gitignore
+++ b/apps/login-test-acceptance/.gitignore
@@ -0,0 +1 @@
+go-command
--- a/apps/login-test-acceptance/docker-compose-ci.yaml
+++ b/apps/login-test-acceptance/docker-compose-ci.yaml
@@ -0,0 +1,59 @@
+services:
+
+  zitadel:
+    environment:
+      ZITADEL_EXTERNALDOMAIN: traefik
+
+  traefik:
+    labels: !reset []
+
+  setup:
+    environment:
+      ZITADEL_API_DOMAIN: traefik
+      ZITADEL_API_URL: https://traefik
+      LOGIN_BASE_URL: https://traefik/ui/v2/login/
+      SINK_NOTIFICATION_URL: http://sink:3333/notification
+      ZITADEL_ADMIN_USER: zitadel-admin@zitadel.traefik
+
+  login:
+    image: "${LOGIN_TAG:-login:local}"
+    container_name: acceptance-login
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.login.rule=PathPrefix(`/ui/v2/login`)"
+    ports:
+      - "3000:3000"
+    environment:
+      - NODE_TLS_REJECT_UNAUTHORIZED=0
+    depends_on:
+      setup:
+        condition: service_completed_successfully
+
+  acceptance:
+    image: "${LOGIN_TEST_ACCEPTANCE_TAG:-login-test-acceptance:local}"
+    container_name: acceptance
+    environment:
+      - CI
+      - LOGIN_BASE_URL=https://traefik/ui/v2/login/
+      - NODE_TLS_REJECT_UNAUTHORIZED=0
+    volumes:
+      - ../login/.env.test.local:/build/apps/login/.env.test.local
+      - ./test-results:/build/apps/login-test-acceptance/test-results
+      - ./playwright-report:/build/apps/login-test-acceptance/playwright-report
+    ports:
+      - 9323:9323
+    ipc: "host"
+    init: true
+    depends_on:
+      login:
+        condition: "service_healthy"
+      sink:
+        condition: service_healthy
+#      oidcrp:
+#        condition: service_healthy
+#      oidcop:
+#        condition: service_healthy
+#      samlsp:
+#        condition: service_healthy
+#      samlidp:
+#        condition: service_healthy
--- a/apps/login-test-acceptance/docker-compose.yaml
+++ b/apps/login-test-acceptance/docker-compose.yaml
@@ -0,0 +1,237 @@
+services:
+
+  zitadel:
+    user: "${UID:-1000}:${GID:-1000}"
+    image: "${ZITADEL_TAG:-ghcr.io/zitadel/zitadel:latest}"
+    container_name: acceptance-zitadel
+    command: 'start-from-init --masterkey "MasterkeyNeedsToHave32Characters" --config /zitadel.yaml --steps /zitadel.yaml'
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.zitadel.rule=!PathPrefix(`/ui/v2/login`)"
+      #      - "traefik.http.middlewares.zitadel.headers.customrequestheaders.Host=localhost"
+#      - "traefik.http.routers.zitadel.middlewares=zitadel@docker"
+      - "traefik.http.services.zitadel-service.loadbalancer.server.scheme=h2c"
+    ports:
+      - "8080:8080"
+    volumes:
+      - ./pat:/pat
+      - ./zitadel.yaml:/zitadel.yaml
+    depends_on:
+      db:
+        condition: "service_healthy"
+
+  db:
+    restart: "always"
+    image: ${LOGIN_TEST_ACCEPTANCE_POSTGES_TAG:-postgres:17.0-alpine3.19}
+    container_name: acceptance-db
+    environment:
+      - POSTGRES_USER=zitadel
+      - PGUSER=zitadel
+      - POSTGRES_DB=zitadel
+      - POSTGRES_HOST_AUTH_METHOD=trust
+    command: postgres -c shared_preload_libraries=pg_stat_statements -c pg_stat_statements.track=all -c shared_buffers=1GB -c work_mem=16MB -c effective_io_concurrency=100 -c wal_level=minimal -c archive_mode=off -c max_wal_senders=0
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready"]
+      interval: "10s"
+      timeout: "30s"
+      retries: 5
+      start_period: "20s"
+    ports:
+      - "5432:5432"
+
+  wait-for-zitadel:
+    image: curlimages/curl:8.00.1
+    container_name: acceptance-wait-for-zitadel
+    command: /bin/sh -c "until curl -s -o /dev/null -i -f http://zitadel:8080/debug/ready; do echo 'waiting' && sleep 1; done; echo 'ready' && sleep 5;" || false
+    depends_on:
+      - zitadel
+
+  traefik:
+    image: "traefik:v3.4"
+    container_name: "acceptance-traefik"
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.login.rule=PathPrefix(`/ui/v2/login`)"
+      - "traefik.http.services.login-service.loadbalancer.server.url=http://host.docker.internal:3000"
+    command:
+#      - "--log.level=DEBUG"
+      - "--ping"
+      - "--api.insecure=true"
+      - "--providers.docker=true"
+      - "--providers.docker.exposedbydefault=false"
+      - "--entrypoints.websecure.http.tls=true"
+      - "--entryPoints.websecure.address=:443"
+    healthcheck:
+      test: ["CMD", "traefik", "healthcheck", "--ping"]
+      interval: "10s"
+      timeout: "30s"
+      retries: 5
+      start_period: "20s"
+    ports:
+      - "443:443"
+      - "8090:8080"
+    volumes:
+      - "/var/run/docker.sock:/var/run/docker.sock:ro"
+    extra_hosts:
+      - host.docker.internal:host-gateway
+
+  setup:
+    user: "${UID:-1000}:${GID:-1000}"
+    image: ${LOGIN_TEST_ACCEPTANCE_SETUP_TAG:-login-test-acceptance-setup:local}
+    container_name: acceptance-setup
+    restart: no
+    build:
+      context: "${LOGIN_TEST_ACCEPTANCE_BUILD_CONTEXT:-.}/setup"
+      dockerfile: ../go-command.Dockerfile
+    entrypoint: "./setup.sh"
+    environment:
+      PAT_FILE: /pat/zitadel-admin-sa.pat
+      ZITADEL_API_INTERNAL_URL: http://zitadel:8080
+      WRITE_ENVIRONMENT_FILE: /login-env/.env.test.local
+      SINK_EMAIL_INTERNAL_URL: http://sink:3333/email
+      SINK_SMS_INTERNAL_URL: http://sink:3333/sms
+      SINK_NOTIFICATION_URL: http://localhost:3333/notification
+      LOGIN_BASE_URL: https://127.0.0.1.sslip.io/ui/v2/login/
+      ZITADEL_API_URL: https://127.0.0.1.sslip.io
+      ZITADEL_API_DOMAIN: 127.0.0.1.sslip.io
+      ZITADEL_ADMIN_USER: zitadel-admin@zitadel.127.0.0.1.sslip.io
+    volumes:
+      - ./pat:/pat # Read the PAT file from zitadels setup
+      - ../login:/login-env # Write the environment variables file for the login
+    depends_on:
+      traefik:
+        condition: "service_healthy"
+      wait-for-zitadel:
+        condition: "service_completed_successfully"
+
+  sink:
+    image: ${LOGIN_TEST_ACCEPTANCE_SINK_TAG:-login-test-acceptance-sink:local}
+    container_name: acceptance-sink
+    build:
+      context: "${LOGIN_TEST_ACCEPTANCE_BUILD_CONTEXT:-.}/sink"
+      dockerfile: ../go-command.Dockerfile
+      args:
+        - LOGIN_TEST_ACCEPTANCE_GOLANG_TAG=${LOGIN_TEST_ACCEPTANCE_GOLANG_TAG:-golang:1.24-alpine}
+    environment:
+      PORT: '3333'
+    command:
+      - -port
+      - '3333'
+      - -email
+      - '/email'
+      - -sms
+      - '/sms'
+      - -notification
+      - '/notification'
+    ports:
+      - "3333:3333"
+    depends_on:
+      setup:
+        condition: "service_completed_successfully"
+
+  oidcrp:
+    user: "${UID:-1000}:${GID:-1000}"
+    image: ${LOGIN_TEST_ACCEPTANCE_OIDCRP_TAG:-login-test-acceptance-oidcrp:local}
+    container_name: acceptance-oidcrp
+    build:
+      context: "${LOGIN_TEST_ACCEPTANCE_BUILD_CONTEXT:-.}/oidcrp"
+      dockerfile: ../go-command.Dockerfile
+      args:
+        - LOGIN_TEST_ACCEPTANCE_GOLANG_TAG=${LOGIN_TEST_ACCEPTANCE_GOLANG_TAG:-golang:1.24-alpine}
+    environment:
+      API_URL: 'http://traefik'
+      API_DOMAIN: 'traefik'
+      PAT_FILE: '/pat/zitadel-admin-sa.pat'
+      LOGIN_URL: 'https://traefik/ui/v2/login'
+      ISSUER: 'https://traefik'
+      HOST: 'traefik'
+      PORT: '8000'
+      SCOPES: 'openid profile email'
+    ports:
+      - "8000:8000"
+    volumes:
+      - "./pat:/pat"
+    depends_on:
+      traefik:
+        condition: "service_healthy"
+      setup:
+        condition: "service_completed_successfully"
+
+  oidcop:
+    user: "${UID:-1000}:${GID:-1000}"
+    image: ${LOGIN_TEST_ACCEPTANCE_OIDCOP_TAG:-login-test-acceptance-oidcop:local}
+    container_name: acceptance-oidcop
+    build:
+      context: "${LOGIN_TEST_ACCEPTANCE_BUILD_CONTEXT:-.}/idp/oidc"
+      dockerfile: ../../go-command.Dockerfile
+      args:
+        - LOGIN_TEST_ACCEPTANCE_GOLANG_TAG=${LOGIN_TEST_ACCEPTANCE_GOLANG_TAG:-golang:1.24-alpine}
+    environment:
+      API_URL: 'http://traefik'
+      API_DOMAIN: 'traefik'
+      PAT_FILE: '/pat/zitadel-admin-sa.pat'
+      SCHEMA: 'https'
+      HOST: 'traefik'
+      PORT: "8004"
+    ports:
+      - 8004:8004
+    volumes:
+      - "./pat:/pat"
+    depends_on:
+      traefik:
+        condition: "service_healthy"
+      setup:
+        condition: "service_completed_successfully"
+
+  samlsp:
+    user: "${UID:-1000}:${GID:-1000}"
+    image: "${LOGIN_TEST_ACCEPTANCE_SAMLSP_TAG:-login-test-acceptance-samlsp:local}"
+    container_name: acceptance-samlsp
+    build:
+      context: "${LOGIN_TEST_ACCEPTANCE_BUILD_CONTEXT:-.}/samlsp"
+      dockerfile: ../go-command.Dockerfile
+      args:
+        - LOGIN_TEST_ACCEPTANCE_GOLANG_TAG=${LOGIN_TEST_ACCEPTANCE_GOLANG_TAG:-golang:1.24-alpine}
+    environment:
+      API_URL: 'http://traefik'
+      API_DOMAIN: 'traefik'
+      PAT_FILE: '/pat/zitadel-admin-sa.pat'
+      LOGIN_URL: 'https://traefik/ui/v2/login'
+      IDP_URL: 'http://zitadel:8080/saml/v2/metadata'
+      HOST: 'https://traefik'
+      PORT: '8001'
+    ports:
+      - 8001:8001
+    volumes:
+      - "./pat:/pat"
+    depends_on:
+      traefik:
+        condition: "service_healthy"
+      setup:
+        condition: "service_completed_successfully"
+
+  samlidp:
+    user: "${UID:-1000}:${GID:-1000}"
+    image: "${LOGIN_TEST_ACCEPTANCE_SAMLIDP_TAG:-login-test-acceptance-samlidp:local}"
+    container_name: acceptance-samlidp
+    build:
+      context: "${LOGIN_TEST_ACCEPTANCE_BUILD_CONTEXT:-.}/idp/saml"
+      dockerfile: ../../go-command.Dockerfile
+      args:
+        - LOGIN_TEST_ACCEPTANCE_GOLANG_TAG=${LOGIN_TEST_ACCEPTANCE_GOLANG_TAG:-golang:1.24-alpine}
+    environment:
+      API_URL: 'http://traefik:8080'
+      API_DOMAIN: 'traefik'
+      PAT_FILE: '/pat/zitadel-admin-sa.pat'
+      SCHEMA: 'https'
+      HOST: 'traefik'
+      PORT: "8003"
+    ports:
+      - 8003:8003
+    volumes:
+      - "./pat:/pat"
+    depends_on:
+      traefik:
+        condition: "service_healthy"
+      setup:
+        condition: "service_completed_successfully"
--- a/apps/login-test-acceptance/go-command.Dockerfile
+++ b/apps/login-test-acceptance/go-command.Dockerfile
@@ -0,0 +1,11 @@
+ARG LOGIN_TEST_ACCEPTANCE_GOLANG_TAG="golang:1.24-alpine"
+
+FROM ${LOGIN_TEST_ACCEPTANCE_GOLANG_TAG}
+RUN apk add curl jq
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+RUN go build -o /go-command .
+HEALTHCHECK --interval=30s --timeout=10s --start-period=5s \
+  CMD curl -f http://localhost:${PORT}/healthy || exit 1
+ENTRYPOINT [ "/go-command" ]
--- a/apps/login-test-acceptance/idp/oidc/go.mod
+++ b/apps/login-test-acceptance/idp/oidc/go.mod
--- a/apps/login-test-acceptance/idp/oidc/go.sum
+++ b/apps/login-test-acceptance/idp/oidc/go.sum
--- a/apps/login-test-acceptance/idp/oidc/main.go
+++ b/apps/login-test-acceptance/idp/oidc/main.go
--- a/apps/login-test-acceptance/idp/saml/go.mod
+++ b/apps/login-test-acceptance/idp/saml/go.mod
--- a/apps/login-test-acceptance/idp/saml/go.sum
+++ b/apps/login-test-acceptance/idp/saml/go.sum
--- a/apps/login-test-acceptance/idp/saml/main.go
+++ b/apps/login-test-acceptance/idp/saml/main.go
--- a/apps/login-test-acceptance/oidcrp/go.mod
+++ b/apps/login-test-acceptance/oidcrp/go.mod
--- a/apps/login-test-acceptance/oidcrp/go.sum
+++ b/apps/login-test-acceptance/oidcrp/go.sum
--- a/apps/login-test-acceptance/oidcrp/main.go
+++ b/apps/login-test-acceptance/oidcrp/main.go
@@ -3,6 +3,7 @@ package main
 import (
 	"bytes"
 	"context"
+	"crypto/tls"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -37,11 +38,10 @@ func main() {
 	domain := os.Getenv("API_DOMAIN")
 	loginURL := os.Getenv("LOGIN_URL")
 	issuer := os.Getenv("ISSUER")
-	host := os.Getenv("HOST")
 	port := os.Getenv("PORT")
 	scopeList := strings.Split(os.Getenv("SCOPES"), " ")

-	redirectURI := fmt.Sprintf("%v:%v%v", host, port, callbackPath)
+	redirectURI := fmt.Sprintf("%s%s", issuer, callbackPath)
 	cookieHandler := httphelper.NewCookieHandler(key, key, httphelper.WithUnsecure())

 	clientID, clientSecret, err := createZitadelResources(apiURL, pat, domain, redirectURI, loginURL)
@@ -57,6 +57,11 @@ func main() {
 	)
 	client := &http.Client{
 		Timeout: time.Minute,
+		Transport: &http.Transport{
+			TLSClientConfig: &tls.Config{
+				InsecureSkipVerify: true,
+			},
+		},
 	}
 	// enable outgoing request logging
 	logging.EnableHTTPClient(client,
@@ -69,6 +74,7 @@ func main() {
 		rp.WithHTTPClient(client),
 		rp.WithLogger(logger),
 		rp.WithSigningAlgsFromDiscovery(),
+		rp.WithCustomDiscoveryUrl(issuer + "/.well-known/openid-configuration"),
 	}
 	if clientSecret == "" {
 		options = append(options, rp.WithPKCE(cookieHandler))
@@ -140,6 +146,9 @@ func main() {
 		}),
 	)

+	http.Handle("/healthy", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { return }))
+	fmt.Println("/healthy returns 200 OK")
+
 	server := &http.Server{
 		Addr:    ":" + port,
 		Handler: mw(http.DefaultServeMux),
--- a/apps/login-test-acceptance/package.json
+++ b/apps/login-test-acceptance/package.json
@@ -0,0 +1,18 @@
+{
+  "name": "login-test-acceptance",
+  "private": true,
+  "scripts": {
+    "test:acceptance": "dotenv -e ../login/.env.test.local pnpm exec playwright",
+    "test:acceptance:setup": "cd ../.. && make login_test_acceptance_setup_env && NODE_ENV=test pnpm exec turbo run test:acceptance:setup:dev",
+    "test:acceptance:setup:dev": "cd ../.. && make login_test_acceptance_setup_dev"
+  },
+  "devDependencies": {
+    "@faker-js/faker": "^9.7.0",
+    "@otplib/core": "^12.0.0",
+    "@otplib/plugin-crypto": "^12.0.0",
+    "@otplib/plugin-thirty-two": "^12.0.0",
+    "@playwright/test": "^1.52.0",
+    "gaxios": "^7.1.0",
+    "typescript": "^5.8.3"
+  }
+}
--- a/apps/login-test-acceptance/pat/.gitignore
+++ b/apps/login-test-acceptance/pat/.gitignore
@@ -0,0 +1,2 @@
+*
+!.gitkeep
--- a/apps/login-test-acceptance/pat/.gitkeep
+++ b/apps/login-test-acceptance/pat/.gitkeep
--- a/apps/login-test-acceptance/playwright-report/.gitignore
+++ b/apps/login-test-acceptance/playwright-report/.gitignore
@@ -0,0 +1,2 @@
+*
+!.gitkeep
--- a/apps/login-test-acceptance/playwright-report/.gitkeep
+++ b/apps/login-test-acceptance/playwright-report/.gitkeep
--- a/apps/login-test-acceptance/playwright.config.ts
+++ b/apps/login-test-acceptance/playwright.config.ts
@@ -1,36 +1,41 @@
 import { defineConfig, devices } from "@playwright/test";
+import dotenv from "dotenv";
+import path from "path";

-/**
- * Read environment variables from file.
- * https://github.com/motdotla/dotenv
- */
-// import dotenv from 'dotenv';
-// import path from 'path';
-// dotenv.config({ path: path.resolve(__dirname, '.env') });
+dotenv.config({ path: path.resolve(__dirname, "../login/.env.test.local") });

 /**
 * See https://playwright.dev/docs/test-configuration.
 */
 export default defineConfig({
-  testDir: "./acceptance/tests",
+  testDir: "./tests",
  /* Run tests in files in parallel */
  fullyParallel: true,
  /* Fail the build on CI if you accidentally left test.only in the source code. */
  forbidOnly: !!process.env.CI,
  /* Retry on CI only */
  retries: process.env.CI ? 2 : 0,
-  /* Opt out of parallel tests on CI. */
-  workers: process.env.CI ? 1 : undefined,
+  expect: {
+    timeout: 10_000, // 10 seconds
+  },
+  timeout: 300 * 1000, // 5 minutes
+  globalTimeout: 30 * 60_000, // 30 minutes
  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
-  reporter: "html",
+  reporter: [
+    ["line"],
+    ["html", { open: process.env.CI ? "never" : "on-failure", host: "0.0.0.0", outputFolder: "./playwright-report/html" }],
+  ],
  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
  use: {
    /* Base URL to use in actions like `await page.goto('/')`. */
-    baseURL: "http://localhost:3000",
-
-    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
-    trace: "on-first-retry",
+    baseURL: process.env.LOGIN_BASE_URL || "http://127.0.0.1:3000",
+    trace: "retain-on-failure",
+    headless: true,
+    screenshot: "only-on-failure",
+    video: "retain-on-failure",
+    ignoreHTTPSErrors: true,
  },
+  outputDir: "test-results/results",

  /* Configure projects for major browsers */
  projects: [
@@ -70,13 +75,4 @@ export default defineConfig({
    //   use: { ...devices['Desktop Chrome'], channel: 'chrome' },
    // },
  ],
-
-  /* Run local dev server before starting the tests */
-
-  webServer: {
-    command: "pnpm start:built",
-    url: "http://127.0.0.1:3000",
-    reuseExistingServer: !process.env.CI,
-    timeout: 5 * 60_000,
-  },
 });
--- a/apps/login-test-acceptance/samlsp/go.mod
+++ b/apps/login-test-acceptance/samlsp/go.mod
--- a/apps/login-test-acceptance/samlsp/go.sum
+++ b/apps/login-test-acceptance/samlsp/go.sum
--- a/apps/login-test-acceptance/samlsp/main.go
+++ b/apps/login-test-acceptance/samlsp/main.go
@@ -106,7 +106,7 @@ func main() {
 	idpMetadata, err := samlsp.FetchMetadata(context.Background(), http.DefaultClient,
 		*idpMetadataURL)
 	if err != nil {
-		panic(err)
+		panic(fmt.Errorf("failed to fetch IDP metadata from %s: %w", idpURL, err))
 	}
 	fmt.Printf("idpMetadata: %+v\n", idpMetadata)
 	rootURL, err := url.Parse(host + ":" + port)
@@ -145,6 +145,9 @@ func main() {
 		panic(err)
 	}

+	http.Handle("/healthy", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { return }))
+	fmt.Println("/healthy returns 200 OK")
+
 	sigChan := make(chan os.Signal, 1)
 	signal.Notify(sigChan, syscall.SIGINT, syscall.SIGTERM)
 	<-sigChan
@@ -238,8 +241,10 @@ func CreateApp(apiURL, pat, domain, projectID string, spMetadata []byte, loginUR
 			},
 		},
 	}
-
 	_, err := doRequestWithHeaders(apiURL+"/management/v1/projects/"+projectID+"/apps/saml", pat, domain, createApp)
+	if err != nil {
+		return fmt.Errorf("error creating saml app with request %+v: %v", *createApp, err)
+	}
 	return err
 }

--- a/apps/login-test-acceptance/setup/go.mod
+++ b/apps/login-test-acceptance/setup/go.mod
@@ -0,0 +1,3 @@
+module github.com/zitadel/typescript/apps/login-test-acceptance/setup
+
+go 1.23.3
--- a/apps/login-test-acceptance/setup/go.sum
+++ b/apps/login-test-acceptance/setup/go.sum
--- a/apps/login-test-acceptance/setup/main.go
+++ b/apps/login-test-acceptance/setup/main.go
@@ -0,0 +1,3 @@
+package main
+
+func main() {}
--- a/apps/login-test-acceptance/setup/setup.sh
+++ b/apps/login-test-acceptance/setup/setup.sh
@@ -1,8 +1,9 @@
 #!/bin/sh

-set -ex
+set -e pipefail

 PAT_FILE=${PAT_FILE:-./pat/zitadel-admin-sa.pat}
+LOGIN_BASE_URL=${LOGIN_BASE_URL:-"http://localhost:3000"}
 ZITADEL_API_PROTOCOL="${ZITADEL_API_PROTOCOL:-http}"
 ZITADEL_API_DOMAIN="${ZITADEL_API_DOMAIN:-localhost}"
 ZITADEL_API_PORT="${ZITADEL_API_PORT:-8080}"
@@ -11,6 +12,7 @@ ZITADEL_API_INTERNAL_URL="${ZITADEL_API_INTERNAL_URL:-${ZITADEL_API_URL}}"
 SINK_EMAIL_INTERNAL_URL="${SINK_EMAIL_INTERNAL_URL:-"http://sink:3333/email"}"
 SINK_SMS_INTERNAL_URL="${SINK_SMS_INTERNAL_URL:-"http://sink:3333/sms"}"
 SINK_NOTIFICATION_URL="${SINK_NOTIFICATION_URL:-"http://localhost:3333/notification"}"
+WRITE_ENVIRONMENT_FILE=${WRITE_ENVIRONMENT_FILE:-$(dirname "$0")/../apps/login/.env.test.local}

 if [ -z "${PAT}" ]; then
  echo "Reading PAT from file ${PAT_FILE}"
@@ -55,23 +57,23 @@ echo "Received ServiceAccount Token: ${SA_PAT}"
 # Environment files
 #################################################################

-WRITE_ENVIRONMENT_FILE=${WRITE_ENVIRONMENT_FILE:-$(dirname "$0")/../apps/login/.env.local}
-echo "Writing environment file to ${WRITE_ENVIRONMENT_FILE} when done."
-WRITE_TEST_ENVIRONMENT_FILE=${WRITE_TEST_ENVIRONMENT_FILE:-$(dirname "$0")/../acceptance/tests/.env.local}
-echo "Writing environment file to ${WRITE_TEST_ENVIRONMENT_FILE} when done."
+echo "Writing environment file ${WRITE_ENVIRONMENT_FILE}."

 echo "ZITADEL_API_URL=${ZITADEL_API_URL}
 ZITADEL_SERVICE_USER_TOKEN=${SA_PAT}
 ZITADEL_ADMIN_TOKEN=${PAT}
 SINK_NOTIFICATION_URL=${SINK_NOTIFICATION_URL}
 EMAIL_VERIFICATION=true
-DEBUG=true"| tee "${WRITE_ENVIRONMENT_FILE}" "${WRITE_TEST_ENVIRONMENT_FILE}" > /dev/null
+DEBUG=false
+LOGIN_BASE_URL=${LOGIN_BASE_URL}
+NODE_TLS_REJECT_UNAUTHORIZED=0
+ZITADEL_ADMIN_USER=${ZITADEL_ADMIN_USER:-"zitadel-admin@zitadel.localhost"}
+NEXT_PUBLIC_BASE_PATH=/ui/v2/login
+" > ${WRITE_ENVIRONMENT_FILE}
+
 echo "Wrote environment file ${WRITE_ENVIRONMENT_FILE}"
 cat ${WRITE_ENVIRONMENT_FILE}

-echo "Wrote environment file ${WRITE_TEST_ENVIRONMENT_FILE}"
-cat ${WRITE_TEST_ENVIRONMENT_FILE}
-
 #################################################################
 # SMS provider with HTTP
 #################################################################
--- a/apps/login-test-acceptance/sink/go.mod
+++ b/apps/login-test-acceptance/sink/go.mod
--- a/apps/login-test-acceptance/sink/go.sum
+++ b/apps/login-test-acceptance/sink/go.sum
--- a/apps/login-test-acceptance/sink/main.go
+++ b/apps/login-test-acceptance/sink/main.go
@@ -84,12 +84,17 @@ func main() {
 			http.Error(w, err.Error(), http.StatusBadRequest)
 			return
 		}
-
-		serializableData, err := json.Marshal(messages[response.Recipient])
+		msg, ok := messages[response.Recipient]
+		if !ok {
+			http.Error(w, "No messages found for recipient: "+response.Recipient, http.StatusNotFound)
+			return
+		}
+		serializableData, err := json.Marshal(msg)
 		if err != nil {
 			http.Error(w, err.Error(), http.StatusInternalServerError)
 			return
 		}
+		w.Header().Set("Content-Type", "application/json")
 		io.WriteString(w, string(serializableData))
 	})

@@ -97,6 +102,8 @@ func main() {
 	fmt.Println(*email, " for email handling")
 	fmt.Println(*sms, " for sms handling")
 	fmt.Println(*notification, " for retrieving notifications")
+	http.Handle("/healthy", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { return }))
+	fmt.Println("/healthy returns 200 OK")
 	err := http.ListenAndServe(":"+*port, nil)
 	if err != nil {
 		panic("Server could not be started: " + err.Error())
--- a/apps/login-test-acceptance/test-results/.gitignore
+++ b/apps/login-test-acceptance/test-results/.gitignore
@@ -0,0 +1,2 @@
+*
+!.gitkeep
--- a/apps/login-test-acceptance/test-results/.gitkeep
+++ b/apps/login-test-acceptance/test-results/.gitkeep
--- a/apps/login-test-acceptance/tests/admin.spec.ts
+++ b/apps/login-test-acceptance/tests/admin.spec.ts
@@ -2,6 +2,6 @@ import { test } from "@playwright/test";
 import { loginScreenExpect, loginWithPassword } from "./login";

 test("admin login", async ({ page }) => {
-  await loginWithPassword(page, "zitadel-admin@zitadel.localhost", "Password1!");
+  await loginWithPassword(page, process.env["ZITADEL_ADMIN_USER"], "Password1!");
  await loginScreenExpect(page, "ZITADEL Admin");
 });
--- a/apps/login-test-acceptance/tests/code-screen.ts
+++ b/apps/login-test-acceptance/tests/code-screen.ts
--- a/apps/login-test-acceptance/tests/code.ts
+++ b/apps/login-test-acceptance/tests/code.ts
@@ -3,8 +3,6 @@ import { codeScreen } from "./code-screen";
 import { getOtpFromSink } from "./sink";

 export async function otpFromSink(page: Page, key: string) {
-  // wait for send of the code
-  await page.waitForTimeout(3000);
  const c = await getOtpFromSink(key);
  await code(page, c);
 }
--- a/apps/login-test-acceptance/tests/email-verify-screen.ts
+++ b/apps/login-test-acceptance/tests/email-verify-screen.ts
--- a/apps/login-test-acceptance/tests/email-verify.spec.ts
+++ b/apps/login-test-acceptance/tests/email-verify.spec.ts
@@ -9,7 +9,7 @@ import { getCodeFromSink } from "./sink";
 import { PasswordUser } from "./user";

 // Read from ".env" file.
-dotenv.config({ path: path.resolve(__dirname, ".env.local") });
+dotenv.config({ path: path.resolve(__dirname, "../../login/.env.test.local") });

 const test = base.extend<{ user: PasswordUser }>({
  user: async ({ page }, use) => {
@@ -32,11 +32,10 @@ const test = base.extend<{ user: PasswordUser }>({

 test("user email not verified, verify", async ({ user, page }) => {
  await loginWithPassword(page, user.getUsername(), user.getPassword());
-  // auto-redirect on /verify
-  // wait for send of the code
-  await page.waitForTimeout(3000);
  const c = await getCodeFromSink(user.getUsername());
  await emailVerify(page, c);
+  // wait for resend of the code
+  await page.waitForTimeout(2000);
  await loginScreenExpect(page, user.getFullName());
 });

@@ -44,22 +43,19 @@ test("user email not verified, resend, verify", async ({ user, page }) => {
  await loginWithPassword(page, user.getUsername(), user.getPassword());
  // auto-redirect on /verify
  await emailVerifyResend(page);
-  // wait for send of the code
-  await page.waitForTimeout(3000);
  const c = await getCodeFromSink(user.getUsername());
+  // wait for resend of the code
+  await page.waitForTimeout(2000);
  await emailVerify(page, c);
  await loginScreenExpect(page, user.getFullName());
 });

 test("user email not verified, resend, old code", async ({ user, page }) => {
  await loginWithPassword(page, user.getUsername(), user.getPassword());
-  // auto-redirect on /verify
-  // wait for send of the code
-  await page.waitForTimeout(3000);
  const c = await getCodeFromSink(user.getUsername());
  await emailVerifyResend(page);
  // wait for resend of the code
-  await page.waitForTimeout(1000);
+  await page.waitForTimeout(2000);
  await emailVerify(page, c);
  await emailVerifyScreenExpect(page, c);
 });
--- a/apps/login-test-acceptance/tests/email-verify.ts
+++ b/apps/login-test-acceptance/tests/email-verify.ts
@@ -2,7 +2,7 @@ import { Page } from "@playwright/test";
 import { emailVerifyScreen } from "./email-verify-screen";

 export async function startEmailVerify(page: Page, loginname: string) {
-  await page.goto("/verify");
+  await page.goto("./verify");
 }

 export async function emailVerify(page: Page, code: string) {
--- a/apps/login-test-acceptance/tests/idp-apple.spec.ts
+++ b/apps/login-test-acceptance/tests/idp-apple.spec.ts
@@ -4,6 +4,7 @@
 import test from "@playwright/test";

 test("login with Apple IDP", async ({ page }) => {
+  test.skip();
  // Given an Apple IDP is configured on the organization
  // Given the user has an Apple added as auth method
  // User authenticates with Apple
@@ -12,6 +13,7 @@ test("login with Apple IDP", async ({ page }) => {
 });

 test("login with Apple IDP - error", async ({ page }) => {
+  test.skip();
  // Given an Apple IDP is configured on the organization
  // Given the user has an Apple added as auth method
  // User is redirected to Apple
@@ -21,6 +23,7 @@ test("login with Apple IDP - error", async ({ page }) => {
 });

 test("login with Apple IDP, no user existing - auto register", async ({ page }) => {
+  test.skip();
  // Given idp Apple is configure on the organization as only authencation method
  // Given idp Apple is configure with account creation alloweed, and automatic creation enabled
  // Given no user exists yet
@@ -32,6 +35,7 @@ test("login with Apple IDP, no user existing - auto register", async ({ page })
 });

 test("login with Apple IDP, no user existing - auto register not possible", async ({ page }) => {
+  test.skip();
  // Given idp Apple is configure on the organization as only authencation method
  // Given idp Apple is configure with account creation alloweed, and automatic creation enabled
  // Given no user exists yet
@@ -49,6 +53,7 @@ test("login with Apple IDP, no user existing - auto register not possible", asyn
 test("login with Apple IDP, no user existing - auto register enabled - manual creation disabled, creation not possible", async ({
  page,
 }) => {
+  test.skip();
  // Given idp Apple is configure on the organization as only authencation method
  // Given idp Apple is configure with account creation not allowed, and automatic creation enabled
  // Given no user exists yet
@@ -60,6 +65,7 @@ test("login with Apple IDP, no user existing - auto register enabled - manual cr
 });

 test("login with Apple IDP, no user linked - auto link", async ({ page }) => {
+  test.skip();
  // Given idp Apple is configure on the organization as only authencation method
  // Given idp Apple is configure with account linking allowed, and linking set to existing email
  // Given user with email address user@zitadel.com exists
@@ -71,6 +77,7 @@ test("login with Apple IDP, no user linked - auto link", async ({ page }) => {
 });

 test("login with Apple IDP, no user linked, linking not possible", async ({ page }) => {
+  test.skip();
  // Given idp Apple is configure on the organization as only authencation method
  // Given idp Apple is configure with manually account linking  not allowed, and linking set to existing email
  // Given user with email address user@zitadel.com doesn't exists
@@ -82,6 +89,7 @@ test("login with Apple IDP, no user linked, linking not possible", async ({ page
 });

 test("login with Apple IDP, no user linked, user link successful", async ({ page }) => {
+  test.skip();
  // Given idp Apple is configure on the organization as only authencation method
  // Given idp Apple is configure with manually account linking allowed, and linking set to existing email
  // Given user with email address user@zitadel.com doesn't exists
--- a/apps/login-test-acceptance/tests/idp-generic-jwt.spec.ts
+++ b/apps/login-test-acceptance/tests/idp-generic-jwt.spec.ts
@@ -1,6 +1,7 @@
 import test from "@playwright/test";

 test("login with Generic JWT IDP", async ({ page }) => {
+  test.skip();
  // Given a Generic JWT IDP is configured on the organization
  // Given the user has Generic JWT IDP added as auth method
  // User authenticates with the Generic JWT IDP
@@ -9,6 +10,7 @@ test("login with Generic JWT IDP", async ({ page }) => {
 });

 test("login with Generic JWT IDP - error", async ({ page }) => {
+  test.skip();
  // Given the Generic JWT IDP is configured on the organization
  // Given the user has Generic JWT IDP added as auth method
  // User is redirected to the Generic JWT IDP
@@ -18,6 +20,7 @@ test("login with Generic JWT IDP - error", async ({ page }) => {
 });

 test("login with Generic JWT IDP, no user existing - auto register", async ({ page }) => {
+  test.skip();
  // Given idp Generic JWT is configure on the organization as only authencation method
  // Given idp Generic JWT is configure with account creation alloweed, and automatic creation enabled
  // Given no user exists yet
@@ -29,6 +32,7 @@ test("login with Generic JWT IDP, no user existing - auto register", async ({ pa
 });

 test("login with Generic JWT IDP, no user existing - auto register not possible", async ({ page }) => {
+  test.skip();
  // Given idp Generic JWT is configure on the organization as only authencation method
  // Given idp Generic JWT is configure with account creation alloweed, and automatic creation enabled
  // Given no user exists yet
@@ -46,6 +50,7 @@ test("login with Generic JWT IDP, no user existing - auto register not possible"
 test("login with Generic JWT IDP, no user existing - auto register enabled - manual creation disabled, creation not possible", async ({
  page,
 }) => {
+  test.skip();
  // Given idp Generic JWT is configure on the organization as only authencation method
  // Given idp Generic JWT is configure with account creation not allowed, and automatic creation enabled
  // Given no user exists yet
@@ -57,6 +62,7 @@ test("login with Generic JWT IDP, no user existing - auto register enabled - man
 });

 test("login with Generic JWT IDP, no user linked - auto link", async ({ page }) => {
+  test.skip();
  // Given idp Generic JWT is configure on the organization as only authencation method
  // Given idp Generic JWT is configure with account linking allowed, and linking set to existing email
  // Given user with email address user@zitadel.com exists
@@ -68,6 +74,7 @@ test("login with Generic JWT IDP, no user linked - auto link", async ({ page })
 });

 test("login with Generic JWT IDP, no user linked, linking not possible", async ({ page }) => {
+  test.skip();
  // Given idp Generic JWT is configure on the organization as only authencation method
  // Given idp Generic JWT is configure with manually account linking  not allowed, and linking set to existing email
  // Given user with email address user@zitadel.com doesn't exists
@@ -79,6 +86,7 @@ test("login with Generic JWT IDP, no user linked, linking not possible", async (
 });

 test("login with Generic JWT IDP, no user linked, linking successful", async ({ page }) => {
+  test.skip();
  // Given idp Generic JWT is configure on the organization as only authencation method
  // Given idp Generic JWT is configure with manually account linking allowed, and linking set to existing email
  // Given user with email address user@zitadel.com doesn't exists
--- a/apps/login-test-acceptance/tests/idp-generic-oauth.spec.ts
+++ b/apps/login-test-acceptance/tests/idp-generic-oauth.spec.ts
@@ -1,6 +1,7 @@
 import test from "@playwright/test";

 test("login with Generic OAuth IDP", async ({ page }) => {
+  test.skip();
  // Given a Generic OAuth IDP is configured on the organization
  // Given the user has Generic OAuth IDP added as auth method
  // User authenticates with the Generic OAuth IDP
@@ -9,6 +10,7 @@ test("login with Generic OAuth IDP", async ({ page }) => {
 });

 test("login with Generic OAuth IDP - error", async ({ page }) => {
+  test.skip();
  // Given the Generic OAuth IDP is configured on the organization
  // Given the user has Generic OAuth IDP added as auth method
  // User is redirected to the Generic OAuth IDP
@@ -18,6 +20,7 @@ test("login with Generic OAuth IDP - error", async ({ page }) => {
 });

 test("login with Generic OAuth IDP, no user existing - auto register", async ({ page }) => {
+  test.skip();
  // Given idp Generic OAuth is configure on the organization as only authencation method
  // Given idp Generic OAuth is configure with account creation alloweed, and automatic creation enabled
  // Given no user exists yet
@@ -29,6 +32,7 @@ test("login with Generic OAuth IDP, no user existing - auto register", async ({
 });

 test("login with Generic OAuth IDP, no user existing - auto register not possible", async ({ page }) => {
+  test.skip();
  // Given idp Generic OAuth is configure on the organization as only authencation method
  // Given idp Generic OAuth is configure with account creation alloweed, and automatic creation enabled
  // Given no user exists yet
@@ -46,6 +50,7 @@ test("login with Generic OAuth IDP, no user existing - auto register not possibl
 test("login with Generic OAuth IDP, no user existing - auto register enabled - manual creation disabled, creation not possible", async ({
  page,
 }) => {
+  test.skip();
  // Given idp Generic OAuth is configure on the organization as only authencation method
  // Given idp Generic OAuth is configure with account creation not allowed, and automatic creation enabled
  // Given no user exists yet
@@ -57,6 +62,7 @@ test("login with Generic OAuth IDP, no user existing - auto register enabled - m
 });

 test("login with Generic OAuth IDP, no user linked - auto link", async ({ page }) => {
+  test.skip();
  // Given idp Generic OAuth is configure on the organization as only authencation method
  // Given idp Generic OAuth is configure with account linking allowed, and linking set to existing email
  // Given user with email address user@zitadel.com exists
@@ -68,6 +74,7 @@ test("login with Generic OAuth IDP, no user linked - auto link", async ({ page }
 });

 test("login with Generic OAuth IDP, no user linked, linking not possible", async ({ page }) => {
+  test.skip();
  // Given idp Generic OAuth is configure on the organization as only authencation method
  // Given idp Generic OAuth is configure with manually account linking  not allowed, and linking set to existing email
  // Given user with email address user@zitadel.com doesn't exists
@@ -79,6 +86,7 @@ test("login with Generic OAuth IDP, no user linked, linking not possible", async
 });

 test("login with Generic OAuth IDP, no user linked, linking successful", async ({ page }) => {
+  test.skip();
  // Given idp Generic OAuth is configure on the organization as only authencation method
  // Given idp Generic OAuth is configure with manually account linking allowed, and linking set to existing email
  // Given user with email address user@zitadel.com doesn't exists
--- a/apps/login-test-acceptance/tests/idp-generic-oidc.spec.ts
+++ b/apps/login-test-acceptance/tests/idp-generic-oidc.spec.ts
@@ -3,6 +3,7 @@
 import test from "@playwright/test";

 test("login with Generic OIDC IDP", async ({ page }) => {
+  test.skip();
  // Given a Generic OIDC IDP is configured on the organization
  // Given the user has Generic OIDC IDP added as auth method
  // User authenticates with the Generic OIDC IDP
@@ -11,6 +12,7 @@ test("login with Generic OIDC IDP", async ({ page }) => {
 });

 test("login with Generic OIDC IDP - error", async ({ page }) => {
+  test.skip();
  // Given the Generic OIDC IDP is configured on the organization
  // Given the user has Generic OIDC IDP added as auth method
  // User is redirected to the Generic OIDC IDP
@@ -20,6 +22,7 @@ test("login with Generic OIDC IDP - error", async ({ page }) => {
 });

 test("login with Generic OIDC IDP, no user existing - auto register", async ({ page }) => {
+  test.skip();
  // Given idp Generic OIDC is configure on the organization as only authencation method
  // Given idp Generic OIDC is configure with account creation alloweed, and automatic creation enabled
  // Given no user exists yet
@@ -31,6 +34,7 @@ test("login with Generic OIDC IDP, no user existing - auto register", async ({ p
 });

 test("login with Generic OIDC IDP, no user existing - auto register not possible", async ({ page }) => {
+  test.skip();
  // Given idp Generic OIDC is configure on the organization as only authencation method
  // Given idp Generic OIDC is configure with account creation alloweed, and automatic creation enabled
  // Given no user exists yet
@@ -48,6 +52,7 @@ test("login with Generic OIDC IDP, no user existing - auto register not possible
 test("login with Generic OIDC IDP, no user existing - auto register enabled - manual creation disabled, creation not possible", async ({
  page,
 }) => {
+  test.skip();
  // Given idp Generic OIDC is configure on the organization as only authencation method
  // Given idp Generic OIDC is configure with account creation not allowed, and automatic creation enabled
  // Given no user exists yet
@@ -59,6 +64,7 @@ test("login with Generic OIDC IDP, no user existing - auto register enabled - ma
 });

 test("login with Generic OIDC IDP, no user linked - auto link", async ({ page }) => {
+  test.skip();
  // Given idp Generic OIDC is configure on the organization as only authencation method
  // Given idp Generic OIDC is configure with account linking allowed, and linking set to existing email
  // Given user with email address user@zitadel.com exists
@@ -70,6 +76,7 @@ test("login with Generic OIDC IDP, no user linked - auto link", async ({ page })
 });

 test("login with Generic OIDC IDP, no user linked, linking not possible", async ({ page }) => {
+  test.skip();
  // Given idp Generic OIDC is configure on the organization as only authencation method
  // Given idp Generic OIDC is configure with manually account linking  not allowed, and linking set to existing email
  // Given user with email address user@zitadel.com doesn't exists
@@ -81,6 +88,7 @@ test("login with Generic OIDC IDP, no user linked, linking not possible", async
 });

 test("login with Generic OIDC IDP, no user linked, linking successful", async ({ page }) => {
+  test.skip();
  // Given idp Generic OIDC is configure on the organization as only authencation method
  // Given idp Generic OIDC is configure with manually account linking allowed, and linking set to existing email
  // Given user with email address user@zitadel.com doesn't exists
--- a/apps/login-test-acceptance/tests/idp-github-enterprise.spec.ts
+++ b/apps/login-test-acceptance/tests/idp-github-enterprise.spec.ts
@@ -1,6 +1,7 @@
 import test from "@playwright/test";

 test("login with GitHub Enterprise IDP", async ({ page }) => {
+  test.skip();
  // Given a GitHub Enterprise IDP is configured on the organization
  // Given the user has GitHub Enterprise IDP added as auth method
  // User authenticates with the GitHub Enterprise IDP
@@ -9,6 +10,7 @@ test("login with GitHub Enterprise IDP", async ({ page }) => {
 });

 test("login with GitHub Enterprise IDP - error", async ({ page }) => {
+  test.skip();
  // Given the GitHub Enterprise IDP is configured on the organization
  // Given the user has GitHub Enterprise IDP added as auth method
  // User is redirected to the GitHub Enterprise IDP
@@ -18,6 +20,7 @@ test("login with GitHub Enterprise IDP - error", async ({ page }) => {
 });

 test("login with GitHub Enterprise IDP, no user existing - auto register", async ({ page }) => {
+  test.skip();
  // Given idp GitHub Enterprise is configure on the organization as only authencation method
  // Given idp GitHub Enterprise is configure with account creation alloweed, and automatic creation enabled
  // Given ZITADEL Action is added to autofill missing user information
@@ -30,6 +33,7 @@ test("login with GitHub Enterprise IDP, no user existing - auto register", async
 });

 test("login with GitHub Enterprise IDP, no user existing - auto register not possible", async ({ page }) => {
+  test.skip();
  // Given idp GitHub Enterprise is configure on the organization as only authencation method
  // Given idp GitHub Enterprise is configure with account creation alloweed, and automatic creation enabled
  // Given no user exists yet
@@ -47,6 +51,7 @@ test("login with GitHub Enterprise IDP, no user existing - auto register not pos
 test("login with GitHub Enterprise IDP, no user existing - auto register enabled - manual creation disabled, creation not possible", async ({
  page,
 }) => {
+  test.skip();
  // Given idp GitHub Enterprise is configure on the organization as only authencation method
  // Given idp GitHub Enterprise is configure with account creation not allowed, and automatic creation enabled
  // Given no user exists yet
@@ -58,6 +63,7 @@ test("login with GitHub Enterprise IDP, no user existing - auto register enabled
 });

 test("login with GitHub Enterprise IDP, no user linked - auto link", async ({ page }) => {
+  test.skip();
  // Given idp GitHub Enterprise is configure on the organization as only authencation method
  // Given idp GitHub Enterprise is configure with account linking allowed, and linking set to existing email
  // Given ZITADEL Action is added to autofill missing user information
@@ -70,6 +76,7 @@ test("login with GitHub Enterprise IDP, no user linked - auto link", async ({ pa
 });

 test("login with GitHub Enterprise IDP, no user linked, linking not possible", async ({ page }) => {
+  test.skip();
  // Given idp GitHub Enterprise is configure on the organization as only authencation method
  // Given idp GitHub Enterprise is configure with manually account linking  not allowed, and linking set to existing email
  // Given ZITADEL Action is added to autofill missing user information
@@ -82,6 +89,7 @@ test("login with GitHub Enterprise IDP, no user linked, linking not possible", a
 });

 test("login with GitHub Enterprise IDP, no user linked, linking successful", async ({ page }) => {
+  test.skip();
  // Given idp GitHub Enterprise is configure on the organization as only authencation method
  // Given idp GitHub Enterprise is configure with manually account linking allowed, and linking set to existing email
  // Given ZITADEL Action is added to autofill missing user information
--- a/apps/login-test-acceptance/tests/idp-github.spec.ts
+++ b/apps/login-test-acceptance/tests/idp-github.spec.ts
@@ -1,6 +1,7 @@
 import test from "@playwright/test";

 test("login with GitHub IDP", async ({ page }) => {
+  test.skip();
  // Given a GitHub IDP is configured on the organization
  // Given the user has GitHub IDP added as auth method
  // User authenticates with the GitHub IDP
@@ -9,6 +10,7 @@ test("login with GitHub IDP", async ({ page }) => {
 });

 test("login with GitHub IDP - error", async ({ page }) => {
+  test.skip();
  // Given the GitHub IDP is configured on the organization
  // Given the user has GitHub IDP added as auth method
  // User is redirected to the GitHub IDP
@@ -18,6 +20,7 @@ test("login with GitHub IDP - error", async ({ page }) => {
 });

 test("login with GitHub IDP, no user existing - auto register", async ({ page }) => {
+  test.skip();
  // Given idp GitHub is configure on the organization as only authencation method
  // Given idp GitHub is configure with account creation alloweed, and automatic creation enabled
  // Given ZITADEL Action is added to autofill missing user information
@@ -30,6 +33,7 @@ test("login with GitHub IDP, no user existing - auto register", async ({ page })
 });

 test("login with GitHub IDP, no user existing - auto register not possible", async ({ page }) => {
+  test.skip();
  // Given idp GitHub is configure on the organization as only authencation method
  // Given idp GitHub is configure with account creation alloweed, and automatic creation enabled
  // Given no user exists yet
@@ -47,6 +51,7 @@ test("login with GitHub IDP, no user existing - auto register not possible", asy
 test("login with GitHub IDP, no user existing - auto register enabled - manual creation disabled, creation not possible", async ({
  page,
 }) => {
+  test.skip();
  // Given idp GitHub is configure on the organization as only authencation method
  // Given idp GitHub is configure with account creation not allowed, and automatic creation enabled
  // Given no user exists yet
@@ -58,6 +63,7 @@ test("login with GitHub IDP, no user existing - auto register enabled - manual c
 });

 test("login with GitHub IDP, no user linked - auto link", async ({ page }) => {
+  test.skip();
  // Given idp GitHub is configure on the organization as only authencation method
  // Given idp GitHub is configure with account linking allowed, and linking set to existing email
  // Given ZITADEL Action is added to autofill missing user information
@@ -70,6 +76,7 @@ test("login with GitHub IDP, no user linked - auto link", async ({ page }) => {
 });

 test("login with GitHub IDP, no user linked, linking not possible", async ({ page }) => {
+  test.skip();
  // Given idp GitHub is configure on the organization as only authencation method
  // Given idp GitHub is configure with manually account linking  not allowed, and linking set to existing email
  // Given ZITADEL Action is added to autofill missing user information
@@ -82,6 +89,7 @@ test("login with GitHub IDP, no user linked, linking not possible", async ({ pag
 });

 test("login with GitHub IDP, no user linked, linking successful", async ({ page }) => {
+  test.skip();
  // Given idp GitHub is configure on the organization as only authencation method
  // Given idp GitHub is configure with manually account linking allowed, and linking set to existing email
  // Given ZITADEL Action is added to autofill missing user information
--- a/apps/login-test-acceptance/tests/idp-gitlab-self-hosted.spec.ts
+++ b/apps/login-test-acceptance/tests/idp-gitlab-self-hosted.spec.ts
@@ -1,6 +1,7 @@
 import test from "@playwright/test";

 test("login with GitLab Self-Hosted IDP", async ({ page }) => {
+  test.skip();
  // Given a GitLab Self-Hosted IDP is configured on the organization
  // Given the user has GitLab Self-Hosted IDP added as auth method
  // User authenticates with the GitLab Self-Hosted IDP
@@ -9,6 +10,7 @@ test("login with GitLab Self-Hosted IDP", async ({ page }) => {
 });

 test("login with GitLab Self-Hosted IDP - error", async ({ page }) => {
+  test.skip();
  // Given the GitLab Self-Hosted IDP is configured on the organization
  // Given the user has GitLab Self-Hosted IDP added as auth method
  // User is redirected to the GitLab Self-Hosted IDP
@@ -18,6 +20,7 @@ test("login with GitLab Self-Hosted IDP - error", async ({ page }) => {
 });

 test("login with Gitlab Self-Hosted IDP, no user existing - auto register", async ({ page }) => {
+  test.skip();
  // Given idp Gitlab Self-Hosted is configure on the organization as only authencation method
  // Given idp Gitlab Self-Hosted is configure with account creation alloweed, and automatic creation enabled
  // Given ZITADEL Action is added to autofill missing user information
@@ -30,6 +33,7 @@ test("login with Gitlab Self-Hosted IDP, no user existing - auto register", asyn
 });

 test("login with Gitlab Self-Hosted IDP, no user existing - auto register not possible", async ({ page }) => {
+  test.skip();
  // Given idp Gitlab Self-Hosted is configure on the organization as only authencation method
  // Given idp Gitlab Self-Hosted is configure with account creation alloweed, and automatic creation enabled
  // Given no user exists yet
@@ -47,6 +51,7 @@ test("login with Gitlab Self-Hosted IDP, no user existing - auto register not po
 test("login with Gitlab Self-Hosted IDP, no user existing - auto register enabled - manual creation disabled, creation not possible", async ({
  page,
 }) => {
+  test.skip();
  // Given idp Gitlab Self-Hosted is configure on the organization as only authencation method
  // Given idp Gitlab Self-Hosted is configure with account creation not allowed, and automatic creation enabled
  // Given no user exists yet
@@ -58,6 +63,7 @@ test("login with Gitlab Self-Hosted IDP, no user existing - auto register enable
 });

 test("login with Gitlab Self-Hosted IDP, no user linked - auto link", async ({ page }) => {
+  test.skip();
  // Given idp Gitlab Self-Hosted is configure on the organization as only authencation method
  // Given idp Gitlab Self-Hosted is configure with account linking allowed, and linking set to existing email
  // Given ZITADEL Action is added to autofill missing user information
@@ -70,6 +76,7 @@ test("login with Gitlab Self-Hosted IDP, no user linked - auto link", async ({ p
 });

 test("login with Gitlab Self-Hosted IDP, no user linked, linking not possible", async ({ page }) => {
+  test.skip();
  // Given idp Gitlab Self-Hosted is configure on the organization as only authencation method
  // Given idp Gitlab Self-Hosted is configure with manually account linking  not allowed, and linking set to existing email
  // Given ZITADEL Action is added to autofill missing user information
@@ -82,6 +89,7 @@ test("login with Gitlab Self-Hosted IDP, no user linked, linking not possible",
 });

 test("login with Gitlab Self-Hosted IDP, no user linked, linking successful", async ({ page }) => {
+  test.skip();
  // Given idp Gitlab Self-Hosted is configure on the organization as only authencation method
  // Given idp Gitlab Self-Hosted is configure with manually account linking allowed, and linking set to existing email
  // Given ZITADEL Action is added to autofill missing user information
--- a/apps/login-test-acceptance/tests/idp-gitlab.spec.ts
+++ b/apps/login-test-acceptance/tests/idp-gitlab.spec.ts
@@ -1,6 +1,7 @@
 import test from "@playwright/test";

 test("login with GitLab IDP", async ({ page }) => {
+  test.skip();
  // Given a GitLab IDP is configured on the organization
  // Given the user has GitLab IDP added as auth method
  // User authenticates with the GitLab IDP
@@ -9,6 +10,7 @@ test("login with GitLab IDP", async ({ page }) => {
 });

 test("login with GitLab IDP - error", async ({ page }) => {
+  test.skip();
  // Given the GitLab IDP is configured on the organization
  // Given the user has GitLab IDP added as auth method
  // User is redirected to the GitLab IDP
@@ -18,6 +20,7 @@ test("login with GitLab IDP - error", async ({ page }) => {
 });

 test("login with Gitlab IDP, no user existing - auto register", async ({ page }) => {
+  test.skip();
  // Given idp Gitlab is configure on the organization as only authencation method
  // Given idp Gitlab is configure with account creation alloweed, and automatic creation enabled
  // Given ZITADEL Action is added to autofill missing user information
@@ -30,6 +33,7 @@ test("login with Gitlab IDP, no user existing - auto register", async ({ page })
 });

 test("login with Gitlab IDP, no user existing - auto register not possible", async ({ page }) => {
+  test.skip();
  // Given idp Gitlab is configure on the organization as only authencation method
  // Given idp Gitlab is configure with account creation alloweed, and automatic creation enabled
  // Given no user exists yet
@@ -47,6 +51,7 @@ test("login with Gitlab IDP, no user existing - auto register not possible", asy
 test("login with Gitlab IDP, no user existing - auto register enabled - manual creation disabled, creation not possible", async ({
  page,
 }) => {
+  test.skip();
  // Given idp Gitlab is configure on the organization as only authencation method
  // Given idp Gitlab is configure with account creation not allowed, and automatic creation enabled
  // Given no user exists yet
@@ -58,6 +63,7 @@ test("login with Gitlab IDP, no user existing - auto register enabled - manual c
 });

 test("login with Gitlab IDP, no user linked - auto link", async ({ page }) => {
+  test.skip();
  // Given idp Gitlab is configure on the organization as only authencation method
  // Given idp Gitlab is configure with account linking allowed, and linking set to existing email
  // Given ZITADEL Action is added to autofill missing user information
@@ -70,6 +76,7 @@ test("login with Gitlab IDP, no user linked - auto link", async ({ page }) => {
 });

 test("login with Gitlab IDP, no user linked, linking not possible", async ({ page }) => {
+  test.skip();
  // Given idp Gitlab is configure on the organization as only authencation method
  // Given idp Gitlab is configure with manually account linking  not allowed, and linking set to existing email
  // Given ZITADEL Action is added to autofill missing user information
@@ -82,6 +89,7 @@ test("login with Gitlab IDP, no user linked, linking not possible", async ({ pag
 });

 test("login with Gitlab IDP, no user linked, linking successful", async ({ page }) => {
+  test.skip();
  // Given idp Gitlab is configure on the organization as only authencation method
  // Given idp Gitlab is configure with manually account linking allowed, and linking set to existing email
  // Given ZITADEL Action is added to autofill missing user information
--- a/apps/login-test-acceptance/tests/idp-google.spec.ts
+++ b/apps/login-test-acceptance/tests/idp-google.spec.ts
@@ -1,6 +1,7 @@
 import test from "@playwright/test";

 test("login with Google IDP", async ({ page }) => {
+  test.skip();
  // Given a Google IDP is configured on the organization
  // Given the user has Google IDP added as auth method
  // User authenticates with the Google IDP
@@ -9,6 +10,7 @@ test("login with Google IDP", async ({ page }) => {
 });

 test("login with Google IDP - error", async ({ page }) => {
+  test.skip();
  // Given the Google IDP is configured on the organization
  // Given the user has Google IDP added as auth method
  // User is redirected to the Google IDP
@@ -18,6 +20,7 @@ test("login with Google IDP - error", async ({ page }) => {
 });

 test("login with Google IDP, no user existing - auto register", async ({ page }) => {
+  test.skip();
  // Given idp Google is configure on the organization as only authencation method
  // Given idp Google is configure with account creation alloweed, and automatic creation enabled
  // Given no user exists yet
@@ -29,6 +32,7 @@ test("login with Google IDP, no user existing - auto register", async ({ page })
 });

 test("login with Google IDP, no user existing - auto register not possible", async ({ page }) => {
+  test.skip();
  // Given idp Google is configure on the organization as only authencation method
  // Given idp Google is configure with account creation alloweed, and automatic creation enabled
  // Given no user exists yet
@@ -46,6 +50,7 @@ test("login with Google IDP, no user existing - auto register not possible", asy
 test("login with Google IDP, no user existing - auto register enabled - manual creation disabled, creation not possible", async ({
  page,
 }) => {
+  test.skip();
  // Given idp Google is configure on the organization as only authencation method
  // Given idp Google is configure with account creation not allowed, and automatic creation enabled
  // Given no user exists yet
@@ -57,6 +62,7 @@ test("login with Google IDP, no user existing - auto register enabled - manual c
 });

 test("login with Google IDP, no user linked - auto link", async ({ page }) => {
+  test.skip();
  // Given idp Google is configure on the organization as only authencation method
  // Given idp Google is configure with account linking allowed, and linking set to existing email
  // Given user with email address user@zitadel.com exists
@@ -68,6 +74,7 @@ test("login with Google IDP, no user linked - auto link", async ({ page }) => {
 });

 test("login with Google IDP, no user linked, linking not possible", async ({ page }) => {
+  test.skip();
  // Given idp Google is configure on the organization as only authencation method
  // Given idp Google is configure with manually account linking  not allowed, and linking set to existing email
  // Given user with email address user@zitadel.com doesn't exists
@@ -79,6 +86,7 @@ test("login with Google IDP, no user linked, linking not possible", async ({ pag
 });

 test("login with Google IDP, no user linked, linking successful", async ({ page }) => {
+  test.skip();
  // Given idp Google is configure on the organization as only authencation method
  // Given idp Google is configure with manually account linking allowed, and linking set to existing email
  // Given user with email address user@zitadel.com doesn't exists
--- a/apps/login-test-acceptance/tests/idp-ldap.spec.ts
+++ b/apps/login-test-acceptance/tests/idp-ldap.spec.ts
@@ -1,6 +1,7 @@
 import test from "@playwright/test";

 test("login with LDAP IDP", async ({ page }) => {
+  test.skip();
  // Given a LDAP IDP is configured on the organization
  // Given the user has LDAP IDP added as auth method
  // User authenticates with the LDAP IDP
@@ -9,6 +10,7 @@ test("login with LDAP IDP", async ({ page }) => {
 });

 test("login with LDAP IDP - error", async ({ page }) => {
+  test.skip();
  // Given the LDAP IDP is configured on the organization
  // Given the user has LDAP IDP added as auth method
  // User is redirected to the LDAP IDP
@@ -18,6 +20,7 @@ test("login with LDAP IDP - error", async ({ page }) => {
 });

 test("login with LDAP IDP, no user existing - auto register", async ({ page }) => {
+  test.skip();
  // Given idp LDAP is configure on the organization as only authencation method
  // Given idp LDAP is configure with account creation alloweed, and automatic creation enabled
  // Given no user exists yet
@@ -29,6 +32,7 @@ test("login with LDAP IDP, no user existing - auto register", async ({ page }) =
 });

 test("login with LDAP IDP, no user existing - auto register not possible", async ({ page }) => {
+  test.skip();
  // Given idp LDAP is configure on the organization as only authencation method
  // Given idp LDAP is configure with account creation alloweed, and automatic creation enabled
  // Given no user exists yet
@@ -46,6 +50,7 @@ test("login with LDAP IDP, no user existing - auto register not possible", async
 test("login with LDAP IDP, no user existing - auto register enabled - manual creation disabled, creation not possible", async ({
  page,
 }) => {
+  test.skip();
  // Given idp LDAP is configure on the organization as only authencation method
  // Given idp LDAP is configure with account creation not allowed, and automatic creation enabled
  // Given no user exists yet
@@ -57,6 +62,7 @@ test("login with LDAP IDP, no user existing - auto register enabled - manual cre
 });

 test("login with LDAP IDP, no user linked - auto link", async ({ page }) => {
+  test.skip();
  // Given idp LDAP is configure on the organization as only authencation method
  // Given idp LDAP is configure with account linking allowed, and linking set to existing email
  // Given user with email address user@zitadel.com exists
@@ -68,6 +74,7 @@ test("login with LDAP IDP, no user linked - auto link", async ({ page }) => {
 });

 test("login with LDAP IDP, no user linked, linking not possible", async ({ page }) => {
+  test.skip();
  // Given idp LDAP is configure on the organization as only authencation method
  // Given idp LDAP is configure with manually account linking  not allowed, and linking set to existing email
  // Given user with email address user@zitadel.com doesn't exists
@@ -79,6 +86,7 @@ test("login with LDAP IDP, no user linked, linking not possible", async ({ page
 });

 test("login with LDAP IDP, no user linked, linking successful", async ({ page }) => {
+  test.skip();
  // Given idp LDAP is configure on the organization as only authencation method
  // Given idp LDAP is configure with manually account linking allowed, and linking set to existing email
  // Given user with email address user@zitadel.com doesn't exists
--- a/apps/login-test-acceptance/tests/idp-microsoft.spec.ts
+++ b/apps/login-test-acceptance/tests/idp-microsoft.spec.ts
@@ -4,6 +4,7 @@
 import test from "@playwright/test";

 test("login with Microsoft IDP", async ({ page }) => {
+  test.skip();
  // Given a Microsoft IDP is configured on the organization
  // Given the user has Microsoft IDP added as auth method
  // User authenticates with the Microsoft IDP
@@ -12,6 +13,7 @@ test("login with Microsoft IDP", async ({ page }) => {
 });

 test("login with Microsoft IDP - error", async ({ page }) => {
+  test.skip();
  // Given the Microsoft IDP is configured on the organization
  // Given the user has Microsoft IDP added as auth method
  // User is redirected to the Microsoft IDP
@@ -21,6 +23,7 @@ test("login with Microsoft IDP - error", async ({ page }) => {
 });

 test("login with Microsoft IDP, no user existing - auto register", async ({ page }) => {
+  test.skip();
  // Given idp Microsoft is configure on the organization as only authencation method
  // Given idp Microsoft is configure with account creation alloweed, and automatic creation enabled
  // Given no user exists yet
@@ -32,6 +35,7 @@ test("login with Microsoft IDP, no user existing - auto register", async ({ page
 });

 test("login with Microsoft IDP, no user existing - auto register not possible", async ({ page }) => {
+  test.skip();
  // Given idp Microsoft is configure on the organization as only authencation method
  // Given idp Microsoft is configure with account creation alloweed, and automatic creation enabled
  // Given no user exists yet
@@ -49,6 +53,7 @@ test("login with Microsoft IDP, no user existing - auto register not possible",
 test("login with Microsoft IDP, no user existing - auto register enabled - manual creation disabled, creation not possible", async ({
  page,
 }) => {
+  test.skip();
  // Given idp Microsoft is configure on the organization as only authencation method
  // Given idp Microsoft is configure with account creation not allowed, and automatic creation enabled
  // Given no user exists yet
@@ -60,6 +65,7 @@ test("login with Microsoft IDP, no user existing - auto register enabled - manua
 });

 test("login with Microsoft IDP, no user linked - auto link", async ({ page }) => {
+  test.skip();
  // Given idp Microsoft is configure on the organization as only authencation method
  // Given idp Microsoft is configure with account linking allowed, and linking set to existing email
  // Given user with email address user@zitadel.com exists
@@ -71,6 +77,7 @@ test("login with Microsoft IDP, no user linked - auto link", async ({ page }) =>
 });

 test("login with Microsoft IDP, no user linked, linking not possible", async ({ page }) => {
+  test.skip();
  // Given idp Microsoft is configure on the organization as only authencation method
  // Given idp Microsoft is configure with manually account linking  not allowed, and linking set to existing email
  // Given user with email address user@zitadel.com doesn't exists
@@ -82,6 +89,7 @@ test("login with Microsoft IDP, no user linked, linking not possible", async ({
 });

 test("login with Microsoft IDP, no user linked, linking successful", async ({ page }) => {
+  test.skip();
  // Given idp Microsoft is configure on the organization as only authencation method
  // Given idp Microsoft is configure with manually account linking allowed, and linking set to existing email
  // Given user with email address user@zitadel.com doesn't exists
--- a/apps/login-test-acceptance/tests/idp-saml.spec.ts
+++ b/apps/login-test-acceptance/tests/idp-saml.spec.ts
@@ -1,6 +1,7 @@
 import test from "@playwright/test";

 test("login with SAML IDP", async ({ page }) => {
+  test.skip();
  // Given a SAML IDP is configured on the organization
  // Given the user has SAML IDP added as auth method
  // User authenticates with the SAML IDP
@@ -9,6 +10,7 @@ test("login with SAML IDP", async ({ page }) => {
 });

 test("login with SAML IDP - error", async ({ page }) => {
+  test.skip();
  // Given the SAML IDP is configured on the organization
  // Given the user has SAML IDP added as auth method
  // User is redirected to the SAML IDP
@@ -18,6 +20,7 @@ test("login with SAML IDP - error", async ({ page }) => {
 });

 test("login with SAML IDP, no user existing - auto register", async ({ page }) => {
+  test.skip();
  // Given idp SAML is configure on the organization as only authencation method
  // Given idp SAML is configure with account creation alloweed, and automatic creation enabled
  // Given ZITADEL Action is added to autofill missing user information
@@ -30,6 +33,7 @@ test("login with SAML IDP, no user existing - auto register", async ({ page }) =
 });

 test("login with SAML IDP, no user existing - auto register not possible", async ({ page }) => {
+  test.skip();
  // Given idp SAML is configure on the organization as only authencation method
  // Given idp SAML is configure with account creation alloweed, and automatic creation enabled
  // Given no user exists yet
@@ -47,6 +51,7 @@ test("login with SAML IDP, no user existing - auto register not possible", async
 test("login with SAML IDP, no user existing - auto register enabled - manual creation disabled, creation not possible", async ({
  page,
 }) => {
+  test.skip();
  // Given idp SAML is configure on the organization as only authencation method
  // Given idp SAML is configure with account creation not allowed, and automatic creation enabled
  // Given no user exists yet
@@ -58,6 +63,7 @@ test("login with SAML IDP, no user existing - auto register enabled - manual cre
 });

 test("login with SAML IDP, no user linked - auto link", async ({ page }) => {
+  test.skip();
  // Given idp SAML is configure on the organization as only authencation method
  // Given idp SAML is configure with account linking allowed, and linking set to existing email
  // Given ZITADEL Action is added to autofill missing user information
@@ -70,6 +76,7 @@ test("login with SAML IDP, no user linked - auto link", async ({ page }) => {
 });

 test("login with SAML IDP, no user linked, linking not possible", async ({ page }) => {
+  test.skip();
  // Given idp SAML is configure on the organization as only authencation method
  // Given idp SAML is configure with manually account linking  not allowed, and linking set to existing email
  // Given ZITADEL Action is added to autofill missing user information
@@ -82,6 +89,7 @@ test("login with SAML IDP, no user linked, linking not possible", async ({ page
 });

 test("login with SAML IDP, no user linked, linking successful", async ({ page }) => {
+  test.skip();
  // Given idp SAML is configure on the organization as only authencation method
  // Given idp SAML is configure with manually account linking allowed, and linking set to existing email
  // Given ZITADEL Action is added to autofill missing user information
--- a/apps/login-test-acceptance/tests/login-configuration-possiblities.spec.ts
+++ b/apps/login-test-acceptance/tests/login-configuration-possiblities.spec.ts
@@ -1,6 +1,7 @@
 import test from "@playwright/test";

 test("login with mfa setup, mfa setup prompt", async ({ page }) => {
+  test.skip();
  // Given the organization has enabled at least one mfa types
  // Given the user has a password but no mfa registered
  // User authenticates with login name and password
@@ -8,6 +9,7 @@ test("login with mfa setup, mfa setup prompt", async ({ page }) => {
 });

 test("login with mfa setup, no mfa setup prompt", async ({ page }) => {
+  test.skip();
  // Given the organization has set "multifactor init check time" to 0
  // Given the organization has enabled mfa types
  // Given the user has a password but no mfa registered
@@ -16,6 +18,7 @@ test("login with mfa setup, no mfa setup prompt", async ({ page }) => {
 });

 test("login with mfa setup, force mfa for local authenticated users", async ({ page }) => {
+  test.skip();
  // Given the organization has enabled force mfa for local authentiacted users
  // Given the organization has enabled all possible mfa types
  // Given the user has a password but no mfa registered
@@ -24,6 +27,7 @@ test("login with mfa setup, force mfa for local authenticated users", async ({ p
 });

 test("login with mfa setup, force mfa - local user", async ({ page }) => {
+  test.skip();
  // Given the organization has enabled force mfa for local authentiacted users
  // Given the organization has enabled all possible mfa types
  // Given the user has a password but no mfa registered
@@ -32,6 +36,7 @@ test("login with mfa setup, force mfa - local user", async ({ page }) => {
 });

 test("login with mfa setup, force mfa - external user", async ({ page }) => {
+  test.skip();
  // Given the organization has enabled force mfa
  // Given the organization has enabled all possible mfa types
  // Given the user has an idp but no mfa registered
@@ -41,6 +46,7 @@ test("login with mfa setup, force mfa - external user", async ({ page }) => {
 });

 test("login with mfa setup, force mfa - local user, wrong password", async ({ page }) => {
+  test.skip();
  // Given the organization has a password lockout policy set to 1 on the max password attempts
  // Given the user has only a password as auth methos
  // enter login name
--- a/apps/login-test-acceptance/tests/login.ts
+++ b/apps/login-test-acceptance/tests/login.ts
@@ -5,7 +5,7 @@ import { password } from "./password";
 import { totp } from "./zitadel";

 export async function startLogin(page: Page) {
-  await page.goto("/loginname");
+  await page.goto(`./loginname`);
 }

 export async function loginWithPassword(page: Page, username: string, pw: string) {
@@ -21,7 +21,7 @@ export async function loginWithPasskey(page: Page, authenticatorId: string, user
 }

 export async function loginScreenExpect(page: Page, fullName: string) {
-  await expect(page).toHaveURL(/signedin.*/);
+  await expect(page).toHaveURL(/.*signedin.*/);
  await expect(page.getByRole("heading")).toContainText(fullName);
 }

--- a/apps/login-test-acceptance/tests/loginname-screen.ts
+++ b/apps/login-test-acceptance/tests/loginname-screen.ts
--- a/apps/login-test-acceptance/tests/loginname.ts
+++ b/apps/login-test-acceptance/tests/loginname.ts
--- a/apps/login-test-acceptance/tests/passkey.ts
+++ b/apps/login-test-acceptance/tests/passkey.ts
--- a/apps/login-test-acceptance/tests/password-screen.ts
+++ b/apps/login-test-acceptance/tests/password-screen.ts
@@ -3,7 +3,6 @@ import { getCodeFromSink } from "./sink";

 const codeField = "code-text-input";
 const passwordField = "password-text-input";
-const passwordConfirmField = "password-confirm-text-input";
 const passwordChangeField = "password-change-text-input";
 const passwordChangeConfirmField = "password-change-confirm-text-input";
 const passwordSetField = "password-set-text-input";
@@ -75,8 +74,6 @@ async function checkContent(page: Page, testid: string, match: boolean) {
 }

 export async function resetPasswordScreen(page: Page, username: string, password1: string, password2: string) {
-  // wait for send of the code
-  await page.waitForTimeout(3000);
  const c = await getCodeFromSink(username);
  await page.getByTestId(codeField).pressSequentially(c);
  await page.getByTestId(passwordSetField).pressSequentially(password1);
--- a/apps/login-test-acceptance/tests/password.ts
+++ b/apps/login-test-acceptance/tests/password.ts
@@ -5,7 +5,7 @@ const passwordSubmitButton = "submit-button";
 const passwordResetButton = "reset-button";

 export async function startChangePassword(page: Page, loginname: string) {
-  await page.goto("/password/change?" + new URLSearchParams({ loginName: loginname }));
+  await page.goto("./password/change?" + new URLSearchParams({ loginName: loginname }));
 }

 export async function changePassword(page: Page, password: string) {
--- a/apps/login-test-acceptance/tests/register-screen.ts
+++ b/apps/login-test-acceptance/tests/register-screen.ts
--- a/apps/login-test-acceptance/tests/register.spec.ts
+++ b/apps/login-test-acceptance/tests/register.spec.ts
@@ -7,7 +7,7 @@ import { registerWithPasskey, registerWithPassword } from "./register";
 import { removeUserByUsername } from "./zitadel";

 // Read from ".env" file.
-dotenv.config({ path: path.resolve(__dirname, ".env.local") });
+dotenv.config({ path: path.resolve(__dirname, "../../login/.env.test.local") });

 test("register with password", async ({ page }) => {
  const username = faker.internet.email();
@@ -19,7 +19,7 @@ test("register with password", async ({ page }) => {
  await loginScreenExpect(page, firstname + " " + lastname);

  // wait for projection of user
-  await page.waitForTimeout(2000);
+  await page.waitForTimeout(10000);
  await removeUserByUsername(username);
 });

@@ -32,11 +32,12 @@ test("register with passkey", async ({ page }) => {
  await loginScreenExpect(page, firstname + " " + lastname);

  // wait for projection of user
-  await page.waitForTimeout(2000);
+  await page.waitForTimeout(10000);
  await removeUserByUsername(username);
 });

 test("register with username and password - only password enabled", async ({ page }) => {
+  test.skip();
  // Given on the default organization "username and password is allowed" is enabled
  // Given on the default organization "username registeration allowed" is enabled
  // Given on the default organization no idp is configured and enabled
@@ -50,6 +51,7 @@ test("register with username and password - only password enabled", async ({ pag
 });

 test("register with username and password - wrong password not enough characters", async ({ page }) => {
+  test.skip();
  // Given on the default organization "username and password is allowed" is enabled
  // Given on the default organization "username registeration allowed" is enabled
  // Given on the default organization no idp is configured and enabled
@@ -64,6 +66,7 @@ test("register with username and password - wrong password not enough characters
 });

 test("register with username and password - wrong password number missing", async ({ page }) => {
+  test.skip();
  // Given on the default organization "username and password is allowed" is enabled
  // Given on the default organization "username registeration allowed" is enabled
  // Given on the default organization no idp is configured and enabled
@@ -78,6 +81,7 @@ test("register with username and password - wrong password number missing", asyn
 });

 test("register with username and password - wrong password upper case missing", async ({ page }) => {
+  test.skip();
  // Given on the default organization "username and password is allowed" is enabled
  // Given on the default organization "username registeration allowed" is enabled
  // Given on the default organization no idp is configured and enabled
@@ -92,6 +96,7 @@ test("register with username and password - wrong password upper case missing",
 });

 test("register with username and password - wrong password lower case missing", async ({ page }) => {
+  test.skip();
  // Given on the default organization "username and password is allowed" is enabled
  // Given on the default organization "username registeration allowed" is enabled
  // Given on the default organization no idp is configured and enabled
@@ -106,6 +111,7 @@ test("register with username and password - wrong password lower case missing",
 });

 test("register with username and password - wrong password symboo missing", async ({ page }) => {
+  test.skip();
  // Given on the default organization "username and password is allowed" is enabled
  // Given on the default organization "username registeration allowed" is enabled
  // Given on the default organization no idp is configured and enabled
@@ -120,6 +126,7 @@ test("register with username and password - wrong password symboo missing", asyn
 });

 test("register with username and password - password and passkey enabled", async ({ page }) => {
+  test.skip();
  // Given on the default organization "username and password is allowed" is enabled
  // Given on the default organization "username registeration allowed" is enabled
  // Given on the default organization no idp is configured and enabled
@@ -135,6 +142,7 @@ test("register with username and password - password and passkey enabled", async
 });

 test("register with username and passkey - password and passkey enabled", async ({ page }) => {
+  test.skip();
  // Given on the default organization "username and password is allowed" is enabled
  // Given on the default organization "username registeration allowed" is enabled
  // Given on the default organization no idp is configured and enabled
@@ -151,6 +159,7 @@ test("register with username and passkey - password and passkey enabled", async
 });

 test("register with username and password - registration disabled", async ({ page }) => {
+  test.skip();
  // Given on the default organization "username and password is allowed" is enabled
  // Given on the default organization "username registeration allowed" is enabled
  // Given on the default organization no idp is configured and enabled
@@ -159,6 +168,7 @@ test("register with username and password - registration disabled", async ({ pag
 });

 test("register with username and password - multiple registration options", async ({ page }) => {
+  test.skip();
  // Given on the default organization "username and password is allowed" is enabled
  // Given on the default organization "username registeration allowed" is enabled
  // Given on the default organization one idp is configured and enabled
--- a/apps/login-test-acceptance/tests/register.ts
+++ b/apps/login-test-acceptance/tests/register.ts
@@ -12,23 +12,21 @@ export async function registerWithPassword(
  password1: string,
  password2: string,
 ) {
-  await page.goto("/register");
+  await page.goto("./register");
  await registerUserScreenPassword(page, firstname, lastname, email);
  await page.getByTestId("submit-button").click();
  await registerPasswordScreen(page, password1, password2);
  await page.getByTestId("submit-button").click();
-  await page.waitForTimeout(3000);
-
  await verifyEmail(page, email);
 }

 export async function registerWithPasskey(page: Page, firstname: string, lastname: string, email: string): Promise<string> {
-  await page.goto("/register");
+  await page.goto("./register");
  await registerUserScreenPasskey(page, firstname, lastname, email);
  await page.getByTestId("submit-button").click();

  // wait for projection of user
-  await page.waitForTimeout(3000);
+  await page.waitForTimeout(10000);
  const authId = await passkeyRegister(page);

  await verifyEmail(page, email);
@@ -36,7 +34,6 @@ export async function registerWithPasskey(page: Page, firstname: string, lastnam
 }

 async function verifyEmail(page: Page, email: string) {
-  await page.waitForTimeout(1000);
  const c = await getCodeFromSink(email);
  await emailVerify(page, c);
 }
--- a/apps/login-test-acceptance/tests/select-account.ts
+++ b/apps/login-test-acceptance/tests/select-account.ts
--- a/apps/login-test-acceptance/tests/sink.ts
+++ b/apps/login-test-acceptance/tests/sink.ts
@@ -0,0 +1,43 @@
+import { Gaxios, GaxiosResponse } from "gaxios";
+
+const awaitNotification = new Gaxios({
+  url: process.env.SINK_NOTIFICATION_URL,
+  method: "POST",
+  retryConfig: {
+    httpMethodsToRetry: ["POST"],
+    statusCodesToRetry: [[404, 404]],
+    retry: Number.MAX_SAFE_INTEGER, // totalTimeout limits the number of retries
+    totalTimeout: 10000, // 10 seconds
+    onRetryAttempt: (error) => {
+      console.warn(`Retrying request to sink notification service: ${error.message}`);
+    },
+  },
+});
+
+export async function getOtpFromSink(recipient: string): Promise<any> {
+  return awaitNotification.request({ data: { recipient } }).then((response) => {
+    expectSuccess(response);
+    const otp = response?.data?.args?.otp;
+    if (!otp) {
+      throw new Error(`Response does not contain an otp property: ${JSON.stringify(response.data, null, 2)}`);
+    }
+    return otp;
+  });
+}
+
+export async function getCodeFromSink(recipient: string): Promise<any> {
+  return awaitNotification.request({ data: { recipient } }).then((response) => {
+    expectSuccess(response);
+    const code = response?.data?.args?.code;
+    if (!code) {
+      throw new Error(`Response does not contain a code property: ${JSON.stringify(response.data, null, 2)}`);
+    }
+    return code;
+  });
+}
+
+function expectSuccess(response: GaxiosResponse): void {
+  if (response.status !== 200) {
+    throw new Error(`Expected HTTP status 200, but got: ${response.status} - ${response.statusText}`);
+  }
+}
--- a/apps/login-test-acceptance/tests/user.ts
+++ b/apps/login-test-acceptance/tests/user.ts
@@ -1,6 +1,6 @@
 import { Page } from "@playwright/test";
 import { registerWithPasskey } from "./register";
-import { activateOTP, addTOTP, addUser, getUserByUsername, removeUser } from "./zitadel";
+import { activateOTP, addTOTP, addUser, eventualNewUser, getUserByUsername, removeUser } from "./zitadel";

 export interface userProps {
  email: string;
@@ -68,8 +68,7 @@ class User {
 export class PasswordUser extends User {
  async ensure(page: Page) {
    await super.ensure(page);
-    // wait for projection of user
-    await page.waitForTimeout(2000);
+    await eventualNewUser(this.getUserId());
  }
 }

@@ -111,11 +110,8 @@ export class PasswordUserWithOTP extends User {

  async ensure(page: Page) {
    await super.ensure(page);
-
    await activateOTP(this.getUserId(), this.type);
-
-    // wait for projection of user
-    await page.waitForTimeout(2000);
+    await eventualNewUser(this.getUserId());
  }
 }

@@ -124,11 +120,8 @@ export class PasswordUserWithTOTP extends User {

  async ensure(page: Page) {
    await super.ensure(page);
-
    this.secret = await addTOTP(this.getUserId());
-
-    // wait for projection of user
-    await page.waitForTimeout(2000);
+    await eventualNewUser(this.getUserId());
  }

  public getSecret(): string {
@@ -167,7 +160,7 @@ export class PasskeyUser extends User {
    this.authenticatorId = authId;

    // wait for projection of user
-    await page.waitForTimeout(2000);
+    await page.waitForTimeout(10000);
  }

  async cleanup() {
--- a/apps/login-test-acceptance/tests/username-passkey.spec.ts
+++ b/apps/login-test-acceptance/tests/username-passkey.spec.ts
@@ -6,7 +6,7 @@ import { loginScreenExpect, loginWithPasskey } from "./login";
 import { PasskeyUser } from "./user";

 // Read from ".env" file.
-dotenv.config({ path: path.resolve(__dirname, ".env.local") });
+dotenv.config({ path: path.resolve(__dirname, "../../login/.env.test.local") });

 const test = base.extend<{ user: PasskeyUser }>({
  user: async ({ page }, use) => {
@@ -31,6 +31,7 @@ test("username and passkey login", async ({ user, page }) => {
 });

 test("username and passkey login, multiple auth methods", async ({ page }) => {
+  test.skip();
  // Given passkey and password is enabled on the organization of the user
  // Given the user has password and passkey registered
  // enter username
--- a/apps/login-test-acceptance/tests/username-password-change-required.spec.ts
+++ b/apps/login-test-acceptance/tests/username-password-change-required.spec.ts
@@ -7,7 +7,7 @@ import { changePassword } from "./password";
 import { PasswordUser } from "./user";

 // Read from ".env" file.
-dotenv.config({ path: path.resolve(__dirname, ".env.local") });
+dotenv.config({ path: path.resolve(__dirname, "../../login/.env.test.local") });

 const test = base.extend<{ user: PasswordUser }>({
  user: async ({ page }, use) => {
@@ -32,7 +32,7 @@ test("username and password login, change required", async ({ user, page }) => {
  const changedPw = "ChangedPw1!";

  await loginWithPassword(page, user.getUsername(), user.getPassword());
-  await page.waitForTimeout(100);
+  await page.waitForTimeout(10000);
  await changePassword(page, changedPw);
  await loginScreenExpect(page, user.getFullName());

--- a/apps/login-test-acceptance/tests/username-password-changed.spec.ts
+++ b/apps/login-test-acceptance/tests/username-password-changed.spec.ts
@@ -8,7 +8,7 @@ import { changePasswordScreen, changePasswordScreenExpect } from "./password-scr
 import { PasswordUser } from "./user";

 // Read from ".env" file.
-dotenv.config({ path: path.resolve(__dirname, ".env.local") });
+dotenv.config({ path: path.resolve(__dirname, "../../login/.env.test.local") });

 const test = base.extend<{ user: PasswordUser }>({
  user: async ({ page }, use) => {
@@ -34,7 +34,7 @@ test("username and password changed login", async ({ user, page }) => {
  await loginWithPassword(page, user.getUsername(), user.getPassword());

  // wait for projection of token
-  await page.waitForTimeout(2000);
+  await page.waitForTimeout(10000);

  await startChangePassword(page, user.getUsername());
  await changePassword(page, changedPw);
--- a/apps/login-test-acceptance/tests/username-password-otp_email.spec.ts
+++ b/apps/login-test-acceptance/tests/username-password-otp_email.spec.ts
@@ -8,7 +8,7 @@ import { loginScreenExpect, loginWithPassword, loginWithPasswordAndEmailOTP } fr
 import { OtpType, PasswordUserWithOTP } from "./user";

 // Read from ".env" file.
-dotenv.config({ path: path.resolve(__dirname, ".env.local") });
+dotenv.config({ path: path.resolve(__dirname, "../../login/.env.test.local") });

 const test = base.extend<{ user: PasswordUserWithOTP; sink: any }>({
  user: async ({ page }, use) => {
@@ -31,7 +31,7 @@ const test = base.extend<{ user: PasswordUserWithOTP; sink: any }>({
  },
 });

-test("username, password and email otp login, enter code manually", async ({ user, page }) => {
+test.skip("DOESN'T WORK: username, password and email otp login, enter code manually", async ({ user, page }) => {
  // Given email otp is enabled on the organization of the user
  // Given the user has only email otp configured as second factor
  // User enters username
@@ -44,6 +44,7 @@ test("username, password and email otp login, enter code manually", async ({ use
 });

 test("username, password and email otp login, click link in email", async ({ page }) => {
+  base.skip();
  // Given email otp is enabled on the organization of the user
  // Given the user has only email otp configured as second factor
  // User enters username
@@ -53,7 +54,7 @@ test("username, password and email otp login, click link in email", async ({ pag
  // User is redirected to the app (default redirect url)
 });

-test("username, password and email otp login, resend code", async ({ user, page }) => {
+test.skip("DOESN'T WORK: username, password and email otp login, resend code", async ({ user, page }) => {
  // Given email otp is enabled on the organization of the user
  // Given the user has only email otp configured as second factor
  // User enters username
@@ -84,6 +85,7 @@ test("username, password and email otp login, wrong code", async ({ user, page }
 });

 test("username, password and email otp login, multiple mfa options", async ({ page }) => {
+  base.skip();
  // Given email otp and sms otp is enabled on the organization of the user
  // Given the user has email and sms otp configured as second factor
  // User enters username
--- a/apps/login-test-acceptance/tests/username-password-otp_sms.spec.ts
+++ b/apps/login-test-acceptance/tests/username-password-otp_sms.spec.ts
@@ -8,7 +8,7 @@ import { loginScreenExpect, loginWithPassword, loginWithPasswordAndPhoneOTP } fr
 import { OtpType, PasswordUserWithOTP } from "./user";

 // Read from ".env" file.
-dotenv.config({ path: path.resolve(__dirname, ".env.local") });
+dotenv.config({ path: path.resolve(__dirname, "../../login/.env.test.local") });

 const test = base.extend<{ user: PasswordUserWithOTP; sink: any }>({
  user: async ({ page }, use) => {
@@ -31,7 +31,7 @@ const test = base.extend<{ user: PasswordUserWithOTP; sink: any }>({
  },
 });

-test("username, password and sms otp login, enter code manually", async ({ user, page }) => {
+test.skip("DOESN'T WORK: username, password and sms otp login, enter code manually", async ({ user, page }) => {
  // Given sms otp is enabled on the organization of the user
  // Given the user has only sms otp configured as second factor
  // User enters username
@@ -43,7 +43,7 @@ test("username, password and sms otp login, enter code manually", async ({ user,
  await loginScreenExpect(page, user.getFullName());
 });

-test("username, password and sms otp login, resend code", async ({ user, page }) => {
+test.skip("DOESN'T WORK: username, password and sms otp login, resend code", async ({ user, page }) => {
  // Given sms otp is enabled on the organization of the user
  // Given the user has only sms otp configured as second factor
  // User enters username
--- a/apps/login-test-acceptance/tests/username-password-set.spec.ts
+++ b/apps/login-test-acceptance/tests/username-password-set.spec.ts
@@ -9,7 +9,7 @@ import { resetPasswordScreen, resetPasswordScreenExpect } from "./password-scree
 import { PasswordUser } from "./user";

 // Read from ".env" file.
-dotenv.config({ path: path.resolve(__dirname, ".env.local") });
+dotenv.config({ path: path.resolve(__dirname, "../../login/.env.test.local") });

 const test = base.extend<{ user: PasswordUser }>({
  user: async ({ page }, use) => {
--- a/apps/login-test-acceptance/tests/username-password-totp.spec.ts
+++ b/apps/login-test-acceptance/tests/username-password-totp.spec.ts
@@ -8,7 +8,7 @@ import { loginScreenExpect, loginWithPassword, loginWithPasswordAndTOTP } from "
 import { PasswordUserWithTOTP } from "./user";

 // Read from ".env" file.
-dotenv.config({ path: path.resolve(__dirname, ".env.local") });
+dotenv.config({ path: path.resolve(__dirname, "../../login/.env.test.local") });

 const test = base.extend<{ user: PasswordUserWithTOTP; sink: any }>({
  user: async ({ page }, use) => {
@@ -57,6 +57,7 @@ test("username, password and totp otp login, wrong code", async ({ user, page })
 });

 test("username, password and totp login, multiple mfa options", async ({ page }) => {
+  test.skip();
  // Given totp and email otp is enabled on the organization of the user
  // Given the user has totp and email otp configured as second factor
  // User enters username
--- a/apps/login-test-acceptance/tests/username-password-u2f.spec.ts
+++ b/apps/login-test-acceptance/tests/username-password-u2f.spec.ts
@@ -1,6 +1,7 @@
 import { test } from "@playwright/test";

 test("username, password and u2f login", async ({ page }) => {
+  test.skip();
  // Given u2f is enabled on the organization of the user
  // Given the user has only u2f configured as second factor
  // User enters username
@@ -11,6 +12,7 @@ test("username, password and u2f login", async ({ page }) => {
 });

 test("username, password and u2f login, multiple mfa options", async ({ page }) => {
+  test.skip();
  // Given u2f and semailms otp is enabled on the organization of the user
  // Given the user has u2f and email otp configured as second factor
  // User enters username
--- a/apps/login-test-acceptance/tests/username-password.spec.ts
+++ b/apps/login-test-acceptance/tests/username-password.spec.ts
@@ -10,7 +10,7 @@ import { passwordScreenExpect } from "./password-screen";
 import { PasswordUser } from "./user";

 // Read from ".env" file.
-dotenv.config({ path: path.resolve(__dirname, ".env.local") });
+dotenv.config({ path: path.resolve(__dirname, "../../login/.env.test.local") });

 const test = base.extend<{ user: PasswordUser }>({
  user: async ({ page }, use) => {
@@ -51,6 +51,7 @@ test("username and password login, wrong password", async ({ user, page }) => {
 });

 test("username and password login, wrong username, ignore unknown usernames", async ({ user, page }) => {
+  test.skip();
  // Given user doesn't exist but ignore unknown usernames setting is set to true
  // Given username password login is enabled on the users organization
  // enter login name
@@ -59,6 +60,7 @@ test("username and password login, wrong username, ignore unknown usernames", as
 });

 test("username and password login, initial password change", async ({ user, page }) => {
+  test.skip();
  // Given user is created and has changePassword set to true
  // Given username password login is enabled on the users organization
  // enter login name
@@ -67,6 +69,7 @@ test("username and password login, initial password change", async ({ user, page
 });

 test("username and password login, reset password hidden", async ({ user, page }) => {
+  test.skip();
  // Given the organization has enabled "Password reset hidden" in the login policy
  // Given username password login is enabled on the users organization
  // enter login name
@@ -74,6 +77,7 @@ test("username and password login, reset password hidden", async ({ user, page }
 });

 test("username and password login, reset password - enter code manually", async ({ user, page }) => {
+  test.skip();
  // Given user has forgotten password and clicks the forgot password button
  // Given username password login is enabled on the users organization
  // enter login name
@@ -83,6 +87,7 @@ test("username and password login, reset password - enter code manually", async
 });

 test("username and password login, reset password - click link", async ({ user, page }) => {
+  test.skip();
  // Given user has forgotten password and clicks the forgot password button, and then the link in the email
  // Given username password login is enabled on the users organization
  // enter login name
@@ -93,6 +98,7 @@ test("username and password login, reset password - click link", async ({ user,
 });

 test("username and password login, reset password, resend code", async ({ user, page }) => {
+  test.skip();
  // Given user has forgotten password and clicks the forgot password button and then resend code
  // Given username password login is enabled on the users organization
  // enter login name
@@ -103,6 +109,7 @@ test("username and password login, reset password, resend code", async ({ user,
 });

 test("email login enabled", async ({ user, page }) => {
+  test.skip();
  // Given user with the username "testuser", email test@zitadel.com and phone number 0711111111 exists
  // Given no other user with the same email address exists
  // enter email address "test@zitadel.com " in login screen
@@ -110,6 +117,7 @@ test("email login enabled", async ({ user, page }) => {
 });

 test("email login disabled", async ({ user, page }) => {
+  test.skip();
  // Given user with the username "testuser", email test@zitadel.com and phone number 0711111111 exists
  // Given no other user with the same email address exists
  // enter email address "test@zitadel.com" in login screen
@@ -117,6 +125,7 @@ test("email login disabled", async ({ user, page }) => {
 });

 test("email login enabled - multiple users", async ({ user, page }) => {
+  test.skip();
  // Given user with the username "testuser", email test@zitadel.com and phone number 0711111111 exists
  // Given a second user with the username "testuser2", email test@zitadel.com and phone number 0711111111 exists
  // enter email address "test@zitadel.com" in login screen
@@ -124,6 +133,7 @@ test("email login enabled - multiple users", async ({ user, page }) => {
 });

 test("phone login enabled", async ({ user, page }) => {
+  test.skip();
  // Given user with the username "testuser", email test@zitadel.com and phone number 0711111111 exists
  // Given no other user with the same phon number exists
  // enter phone number "0711111111" in login screen
@@ -131,6 +141,7 @@ test("phone login enabled", async ({ user, page }) => {
 });

 test("phone login disabled", async ({ user, page }) => {
+  test.skip();
  // Given user with the username "testuser", email test@zitadel.com and phone number 0711111111 exists
  // Given no other user with the same phone number exists
  // enter phone number "0711111111" in login screen
@@ -138,6 +149,7 @@ test("phone login disabled", async ({ user, page }) => {
 });

 test("phone login enabled - multiple users", async ({ user, page }) => {
+  test.skip();
  // Given user with the username "testuser", email test@zitadel.com and phone number 0711111111 exists
  // Given a second user with the username "testuser2", email test@zitadel.com and phone number 0711111111 exists
  // enter phone number "0711111111" in login screen
--- a/apps/login-test-acceptance/tests/welcome.ts
+++ b/apps/login-test-acceptance/tests/welcome.ts
@@ -1,6 +1,6 @@
 import { test } from "@playwright/test";

 test("login is accessible", async ({ page }) => {
-  await page.goto("http://localhost:3000/");
+  await page.goto("./");
  await page.getByRole("heading", { name: "Welcome back!" }).isVisible();
 });
--- a/apps/login-test-acceptance/tests/zitadel.ts
+++ b/apps/login-test-acceptance/tests/zitadel.ts
@@ -2,8 +2,13 @@ import { Authenticator } from "@otplib/core";
 import { createDigest, createRandomBytes } from "@otplib/plugin-crypto";
 import { keyDecoder, keyEncoder } from "@otplib/plugin-thirty-two"; // use your chosen base32 plugin
 import axios from "axios";
+import dotenv from "dotenv";
+import { request } from "gaxios";
+import path from "path";
 import { OtpType, userProps } from "./user";

+dotenv.config({ path: path.resolve(__dirname, "../../login/.env.test.local") });
+
 export async function addUser(props: userProps) {
  const body = {
    username: props.email,
@@ -164,3 +169,22 @@ export function totp(secret: string) {

  return token;
 }
+
+export async function eventualNewUser(id: string) {
+  return request({
+    url: `${process.env.ZITADEL_API_URL}/v2/users/${id}`,
+    method: "GET",
+    headers: {
+      Authorization: `Bearer ${process.env.ZITADEL_ADMIN_TOKEN}`,
+      "Content-Type": "application/json",
+    },
+    retryConfig: {
+      statusCodesToRetry: [[404, 404]],
+      retry: Number.MAX_SAFE_INTEGER, // totalTimeout limits the number of retries
+      totalTimeout: 10000, // 10 seconds
+      onRetryAttempt: (error) => {
+        console.warn(`Retrying to query new user ${id}: ${error.message}`);
+      },
+    },
+  });
+}
--- a/apps/login-test-acceptance/turbo.json
+++ b/apps/login-test-acceptance/turbo.json
@@ -0,0 +1,10 @@
+{
+  "extends": ["//"],
+  "tasks": {
+    "test:acceptance:setup:dev": {
+      "interactive": true,
+      "cache": false,
+      "persistent": true
+    }
+  }
+}
--- a/apps/login-test-acceptance/zitadel.yaml
+++ b/apps/login-test-acceptance/zitadel.yaml
@@ -1,3 +1,8 @@
+ExternalDomain: 127.0.0.1.sslip.io
+ExternalSecure: true
+ExternalPort: 443
+TLS.Enabled: false
+
 FirstInstance:
  PatPath: /pat/zitadel-admin-sa.pat
  Org:
@@ -42,6 +47,15 @@ DefaultInstance:
    HelpLink: "https://zitadel.com/docs"
    SupportEmail: "support@zitadel.com"
    DocsLink: "https://zitadel.com/docs"
+  Features:
+    LoginV2:
+      Required: true
+
+OIDC:
+  DefaultLoginURLV2: "/ui/v2/login/login?authRequest="
+
+SAML:
+  DefaultLoginURLV2: "/ui/v2/login/login?authRequest="

 Database:
  EventPushConnRatio: 0.2 # 4
--- a/apps/login-test-integration/.gitignore
+++ b/apps/login-test-integration/.gitignore
--- a/apps/login-test-integration/core-mock/Dockerfile
+++ b/apps/login-test-integration/core-mock/Dockerfile
@@ -0,0 +1,9 @@
+FROM golang:1.20.5-alpine3.18
+
+RUN go install github.com/eliobischof/grpc-mock/cmd/grpc-mock@01b09f60db1b501178af59bed03b2c22661df48c
+
+COPY mocked-services.cfg .
+COPY initial-stubs initial-stubs
+COPY --from=protos . .
+
+ENTRYPOINT [ "sh", "-c", "grpc-mock -v 1 -proto $(tr '\n' ',' < ./mocked-services.cfg) -stub-dir ./initial-stubs -mock-addr :22222" ]
--- a/apps/login-test-integration/core-mock/initial-stubs/zitadel.settings.v2.SettingsService.json
+++ b/apps/login-test-integration/core-mock/initial-stubs/zitadel.settings.v2.SettingsService.json
--- a/apps/login-test-integration/core-mock/mocked-services.cfg
+++ b/apps/login-test-integration/core-mock/mocked-services.cfg
--- a/apps/login-test-integration/cypress.config.ts
+++ b/apps/login-test-integration/cypress.config.ts
@@ -2,9 +2,11 @@ import { defineConfig } from "cypress";

 export default defineConfig({
  reporter: "list",
+
  e2e: {
-    baseUrl: "http://localhost:3000",
-    specPattern: "cypress/integration/**/*.cy.{js,jsx,ts,tsx}",
+    baseUrl: process.env.LOGIN_BASE_URL || "http://localhost:3000",
+    specPattern: "integration/**/*.cy.{js,jsx,ts,tsx}",
+    supportFile: "support/e2e.{js,jsx,ts,tsx}",
    setupNodeEvents(on, config) {
      // implement node event listeners here
    },
--- a/Show More
+++ b/Show More