fix: skip empty optional fields in create_user

The form submits empty strings for unfilled optional schema fields
(e.g. givenName, dateOfBirth on the register step). The user_attributes
DB check constraint rejects empty values, so submit returns 500 and the
register flow stalls before passkey-upsell.

Skip empty-string values when building attributes, matching how the
flow field validator treats them as "no value provided".

Author: vitorbari

internal/domain/flow_on_success_create_user.go

@@ -57,6 +57,9 @@ func (h *FlowCreateUserHandler) Handle(ctx context.Context, client database.Quer
 		if !known || field.Challenge == FlowFieldChallengePassword {
 			continue
 		}
+		if s, ok := value.(string); ok && s == "" {
+			continue
+		}
 		uniqueScope := attributeUniquenessFor(name, identifierName, field.Unique)
 		attr, err := NewCreateAttribute(name, value, uniqueScope)
 		if err != nil {

internal/domain/flow_on_success_create_user_test.go

@@ -0,0 +1,77 @@
+package domain_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/zitadel/nextgen/internal/domain"
+	"github.com/zitadel/nextgen/internal/storage/database"
+)
+
+type fixedIDGenerator struct{ id string }
+
+func (f fixedIDGenerator) New(string) (string, error) { return f.id, nil }
+
+type recordingUserRepo struct{ created []*domain.CreateUser }
+
+func (r *recordingUserRepo) Create(_ context.Context, _ database.QueryExecutor, u *domain.CreateUser) error {
+	r.created = append(r.created, u)
+	return nil
+}
+
+type recordingUserPasswordRepo struct{ created []*domain.CreateUserPassword }
+
+func (r *recordingUserPasswordRepo) Create(_ context.Context, _ database.QueryExecutor, p *domain.CreateUserPassword) error {
+	r.created = append(r.created, p)
+	return nil
+}
+
+type prefixHasher struct{}
+
+func (prefixHasher) Hash(plain string) (string, error) { return "h:" + plain, nil }
+
+// Empty-string values from optional fields the user left blank must be
+// dropped before insert. The user_attributes DB check constraint rejects
+// "" values, so submitting a register step with unfilled optional inputs
+// would otherwise 500.
+func TestFlowCreateUserHandler_Handle_SkipsEmptyOptionalAttributes(t *testing.T) {
+	users := &recordingUserRepo{}
+	pws := &recordingUserPasswordRepo{}
+	h := domain.NewFlowCreateUserHandler(fixedIDGenerator{id: "user_TEST"}, users, pws, prefixHasher{})
+
+	resolved := domain.FlowResolvedFields{
+		Fields: map[string]domain.FlowField{
+			"email":      {Challenge: domain.FlowFieldChallengeIdentifier},
+			"givenName":  {},
+			"familyName": {},
+			"password":   {Challenge: domain.FlowFieldChallengePassword},
+		},
+	}
+
+	res, err := h.Handle(t.Context(), nil, domain.FlowOnSuccessInput{
+		ProjectID:     "proj_X",
+		UserSchemaURL: "https://example.test/schema.json",
+		Resolved:      resolved,
+		State: &domain.FlowState{FlowProgress: domain.FlowProgress{CollectedData: map[string]any{
+			"email":      "alice@example.com",
+			"givenName":  "Alice",
+			"familyName": "",
+			"password":   "secret-pass",
+		}}},
+	})
+	require.NoError(t, err)
+	assert.Equal(t, "user_TEST", res.UserID)
+
+	require.Len(t, users.created, 1)
+	got := make(map[string]any, len(users.created[0].Attributes))
+	for _, a := range users.created[0].Attributes {
+		got[a.Key] = a.Value
+	}
+	assert.Equal(t, map[string]any{
+		"email":     "alice@example.com",
+		"givenName": "Alice",
+	}, got)
+}