Validate cadence contract and require functional MFA verification

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ea3-7939-7b63-8125-699f8b50bedd

sso-mfa/k8s/privacyidea/bootstrap-realm.sh

@@ -24,6 +24,8 @@
 
 set -euo pipefail
 
+PI_HELPER="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/pi_api.py"
+
 NAMESPACE="mfa"
 SECRETS_DIR="${1:-../../bootstrap/secrets}"
 PI_URL="${2:-https://pink.coulomb.social}"
@@ -46,8 +48,8 @@ LDAP_SIZELIMIT="${LDAP_SIZELIMIT:-500}"
 PASS_COUNT=0
 FAIL_COUNT=0
 
-ok()   { echo "  [OK]   $1"; ((PASS_COUNT++)); }
-fail() { echo "  [FAIL] $1"; ((FAIL_COUNT++)); }
+ok()   { echo "  [OK]   $1"; PASS_COUNT=$((PASS_COUNT + 1)); }
+fail() { echo "  [FAIL] $1"; FAIL_COUNT=$((FAIL_COUNT + 1)); }
 info() { echo "  [INFO] $1"; }
 
 # ── Validate secrets ──────────────────────────────────────────────────────────
@@ -78,12 +80,10 @@ echo "Authenticating to privacyIDEA at $PI_URL ..."
 if ! AUTH_RESPONSE=$(PI_ADMIN_PASS="$PI_ADMIN_PASS" python3 -c '
 import json
 import os
+print()
 print(json.dumps({"username": "pi-admin", "password": os.environ["PI_ADMIN_PASS"]}))
-' | curl -sS -X POST "$PI_URL/auth" \
-    -H "Content-Type: application/json" \
-    --data-binary @- 2>/dev/null); then
-    echo "ERROR: Could not reach $PI_URL — is the cluster up and privacyIDEA running?" >&2
-    echo "       Run verify-t04.sh to diagnose." >&2
+' | python3 "$PI_HELPER" POST "$PI_URL/auth"); then
+    echo "ERROR: privacyIDEA authentication request failed." >&2
     exit 1
 fi
 
@@ -92,26 +92,14 @@ PI_TOKEN=$(echo "$AUTH_RESPONSE" | python3 -c \
 
 if [[ -z "$PI_TOKEN" ]]; then
     echo "ERROR: Authentication failed — check pi-admin credentials and MFA enrollment." >&2
-    echo "       Response: $AUTH_RESPONSE" >&2
     exit 1
 fi
 info "Authenticated as pi-admin (token obtained)"
 
 pi_api() {
-    # pi_api <method> <path> [json-body]
-    # Content-Type is only set on requests with a body — Werkzeug 3.x raises
-    # BadRequest if Content-Type: application/json is sent on a bodyless GET.
-    local method="$1"; local path="$2"; local body="${3:-}"
-    if [[ -n "$body" ]]; then
-        printf '%s' "$body" | curl -sf -X "$method" "$PI_URL$path" \
-            -H "Authorization: $PI_TOKEN" \
-            -H "Content-Type: application/json" \
-            --data-binary @- 2>/dev/null || echo "CURL_FAILED"
-    else
-        curl -sf -X "$method" "$PI_URL$path" \
-            -H "Authorization: $PI_TOKEN" \
-            2>/dev/null || echo "CURL_FAILED"
-    fi
+    local method="$1" path="$2" body="${3:-}"
+    { printf '%s\n' "$PI_TOKEN"; printf '%s' "$body"; } |
+        python3 "$PI_HELPER" "$method" "$PI_URL$path" || true
 }
 
 check_result() {
@@ -332,7 +320,7 @@ echo "       WebUI → Config → Policies → mfa-passthru-phase1 → set activ
 echo "       Create a new policy: scope=authentication, action=otppin=tokenpin, realm=$REALM_NAME"
 echo "       This blocks login for users without an enrolled token."
 echo ""
-echo "Next step: ./verify-t06.sh"
+echo "Next step: ../verify-t06.sh --user platform-root"
 
 if [[ "$FAIL_COUNT" -gt 0 ]]; then
     exit 1