Implement scoped P06 authentication policy and guarded optional onboarding

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6

src/internal/server/oidc/native_optional_test.go

@@ -0,0 +1,124 @@
+package oidc_test
+
+import (
+	"context"
+	"crypto/hmac"
+	"crypto/sha1"
+	"encoding/base32"
+	"encoding/binary"
+	"encoding/json"
+	"fmt"
+	"keycape/internal/adapters/privacyidea"
+	"keycape/internal/domain"
+	"keycape/internal/server/oidc"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"strings"
+	"testing"
+	"time"
+)
+
+// Uses only the companion disposable provider fixture, never a production URL.
+func TestNativeOptionalEnrollmentAndOldSession(t *testing.T) {
+	base := os.Getenv("P06_NATIVE_PROVIDER_URL")
+	if base == "" {
+		t.Skip("requires disposable installed-provider fixture")
+	}
+	parsed, e := url.Parse(base)
+	if e != nil || parsed.Hostname() != "127.0.0.1" || parsed.Scheme != "http" {
+		t.Fatal("loopback fixture required")
+	}
+	call := func(method, path, token string, data url.Values) map[string]interface{} {
+		r, e := http.NewRequest(method, base+path, strings.NewReader(data.Encode()))
+		if e != nil {
+			t.Fatal("fixture request")
+		}
+		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		if token != "" {
+			r.Header.Set("Authorization", token)
+		}
+		client := &http.Client{Timeout: 10 * time.Second}
+		response, e := client.Do(r)
+		if e != nil {
+			t.Fatal("fixture unavailable")
+		}
+		defer response.Body.Close()
+		var body map[string]interface{}
+		if json.NewDecoder(response.Body).Decode(&body) != nil || response.StatusCode != 200 {
+			t.Fatal("fixture request failed", response.StatusCode)
+		}
+		return body
+	}
+	value := func(b map[string]interface{}) map[string]interface{} {
+		return b["result"].(map[string]interface{})["value"].(map[string]interface{})
+	}
+	reader := value(call("POST", "/auth", "", url.Values{"username": {"fixture-reader"}, "password": {"fixture-service-password"}}))["token"].(string)
+	user := value(call("POST", "/auth", "", url.Values{"username": {"native-alice"}, "password": {"fixture-password"}, "realm": {"fixture"}}))["token"].(string)
+	adapter := privacyidea.New(privacyidea.Config{BaseURL: base, Realm: "fixture", AdminToken: reader, ReadProbeSerial: "P06SCOPEPROBE", RequireForAll: true}, nil)
+	h := &oidc.AuthorizeHandler{ClientConfig: map[string]*domain.Client{"fixture": {ClientID: "fixture", MFAOptional: true}}, Auth: &mockAuthProvider{callbackResult: &domain.AuthResult{Username: "native-alice"}}, MFA: adapter, Sessions: oidc.NewSessionStore(), Logins: oidc.NewLoginSessionStore(), Emitter: &captureEmitter{}}
+	callback := func(acr []string, cookie *http.Cookie) *httptest.ResponseRecorder {
+		h.PendingStates().Store("native", &oidc.PendingState{ClientID: "fixture", RedirectURI: "https://fixture.test/callback", State: "native", ACRValues: acr, ExpiresAt: time.Now().Add(time.Minute)})
+		r := httptest.NewRequest("GET", "/authorize/callback?code=fixture&state=native", nil)
+		if cookie != nil {
+			r.AddCookie(cookie)
+		}
+		w := httptest.NewRecorder()
+		h.ServeHTTPCallback(w, r)
+		return w
+	}
+	first := callback(nil, nil)
+	if first.Code != 302 {
+		t.Fatal("native no-factor decision", first.Code)
+	}
+	cookie := first.Result().Cookies()[0]
+	detail := call("POST", "/token/init", user, url.Values{"type": {"totp"}, "genkey": {"1"}})["detail"].(map[string]interface{})
+	if detail["rollout_state"] != "verify" {
+		t.Fatal("possession confirmation not required")
+	}
+	if w := callback(nil, cookie); w.Code != 302 {
+		t.Fatal("pending setup activated MFA")
+	}
+	uri, e := url.Parse(detail["googleurl"].(map[string]interface{})["value"].(string))
+	if e != nil {
+		t.Fatal("invalid fixture enrollment URI")
+	}
+	key, e := base32.StdEncoding.WithPadding(base32.NoPadding).DecodeString(strings.TrimRight(uri.Query().Get("secret"), "="))
+	if e != nil {
+		t.Fatal("fixture seed format")
+	}
+	otp := func() string {
+		counter := make([]byte, 8)
+		binary.BigEndian.PutUint64(counter, uint64(time.Now().Unix()/30))
+		mac := hmac.New(sha1.New, key)
+		mac.Write(counter)
+		digest := mac.Sum(nil)
+		offset := digest[len(digest)-1] & 15
+		return fmt.Sprintf("%06d", (binary.BigEndian.Uint32(digest[offset:offset+4])&0x7fffffff)%1000000)
+	}
+	call("POST", "/token/init", user, url.Values{"serial": {detail["serial"].(string)}, "type": {"totp"}, "verify": {otp()}})
+	if enrolled, e := adapter.HasEnrolledFactor(context.Background(), "native-alice"); e != nil || !enrolled {
+		t.Fatal("native activation not observed")
+	}
+	if w := callback(nil, cookie); w.Code != 200 || !strings.Contains(w.Body.String(), "KeyCape MFA") {
+		t.Fatal("old AAL1 session bypassed native enrolled factor")
+	}
+	if w := callback([]string{"aal2"}, cookie); w.Code != 200 || !strings.Contains(w.Body.String(), "KeyCape MFA") {
+		t.Fatal("native explicit step-up bypassed")
+	}
+	// Confirmation consumed the current TOTP; wait for the next independent code.
+	time.Sleep(time.Duration(31-time.Now().Unix()%30) * time.Second)
+	request := httptest.NewRequest("POST", "/authorize/callback", strings.NewReader(url.Values{"state": {"native"}, "mfa_token": {otp()}}.Encode()))
+	request.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	response := httptest.NewRecorder()
+	h.ServeHTTPCallback(response, request)
+	if response.Code != 302 {
+		t.Fatal("native OTP sign-in failed", response.Code)
+	}
+	location, _ := url.Parse(response.Header().Get("Location"))
+	session, ok := h.Sessions.Get(location.Query().Get("code"))
+	if !ok || !session.MFAVerified {
+		t.Fatal("native OTP did not establish MFA")
+	}
+}