coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Implement scoped P06 authentication policy and guarded optional onboarding
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m22s
Details
Authentication acceptance / provider-contract (push) Successful in 14s
Details
Build and Publish Container Image / build-and-push (push) Successful in 41s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
This commit is contained in:
tegwick 2026-09-14 00:00:05 +02:00
parent aa709fb854
commit e0b3c25f06
12 changed files with 1085 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

12
scripts/provider-onboarding-contract.py
View file

@ -22,6 +22,7 @@ def run():
from privacyidea.lib.auth import create_db_admin
from privacyidea.lib.resolvers.PasswdIdResolver import crypt_ctx
app=create_app(config_name="testing",config_file=str(cfg),silent=True)
app.config["PI_INIT_CHECK_HOOK"]="keycape_onboarding_guard.check"
phase="fixture_database"
with app.app_context():
check('database_isolated',str(db.engine.url)=='sqlite:///:memory:');db.create_all()
@ -34,7 +35,8 @@ def run():
create_db_admin('fixture-reader',password='fixture-service-password')
set_policy(name='fixture-admin-baseline',scope='admin',action='*',adminuser=['*','!fixture-reader'])
set_policy(name='fixture-reader',scope='admin',action='tokenlist',adminuser='fixture-reader',realm='fixture')
set_policy(name='fixture-user',scope='user',action='enrollTOTP,delete,disable',realm='fixture')
set_policy(name='fixture-user',scope='user',action='enrollTOTP',realm='fixture')
set_policy(name='fixture-pending-cancel',scope='user',action='delete',realm='fixture',conditions=[('token','rollout_state','equals','verify',True)])
set_policy(name='fixture-confirmation',scope='enrollment',action='verify_enrollment=totp',realm='fixture')
set_policy(name='fixture-passthru',scope='authentication',action='passthru',realm='fixture')
client=app.test_client()
@ -74,6 +76,14 @@ def run():
check('possession_confirmed',code==200 and body['result']['status'] and body['result']['value'] is True)
code,body=req('GET','/token/?user=alice&realm=fixture&active=True',token=reader)
check('confirmed_token_enrolled',code==200 and body['result']['value']['tokens'][0]['rollout_state']=='enrolled')
code,body=req('DELETE','/token/'+serial,token=user)
check('pre_enrollment_session_cannot_delete_confirmed_factor',code in (400,403))
code,body=req('POST','/token/disable',{'serial':serial},user)
check('self_service_cannot_disable_confirmed_factor',code in (400,403))
code,body=req('POST','/token/init',{'type':'totp','genkey':'1'},user)
check('pre_enrollment_session_cannot_add_another_factor',code in (400,403))
code,body=req('POST','/token/init',{'serial':serial,'type':'totp','genkey':'1'},user)
check('pre_enrollment_session_cannot_regenerate_active_factor',code in (400,403))
phase='provider_scope_withdrawal'
with app.app_context():enable_policy('fixture-reader',False)
code,body=req('GET','/token/?tokenrealm=fixture',token=reader)