Implement scoped P06 authentication policy and guarded optional onboarding

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6

sso-mfa/k8s/keycape/test_authentication_policy_rollout.py

@@ -0,0 +1,35 @@
+import base64,importlib.util,json,unittest
+from pathlib import Path
+import yaml
+spec=importlib.util.spec_from_file_location('rollout',Path(__file__).with_name('authentication-policy-rollout.py'))
+module=importlib.util.module_from_spec(spec);spec.loader.exec_module(module)
+class PolicyMigration(unittest.TestCase):
+    def secret(self):
+        raw='''# exact bytes outside reviewed fields must survive
+issuer: https://fixture.test
+authelia:
+  issuer: https://primary.test
+clients:
+  - clientId: user-engine-portal
+    clientType: public
+    grantTypes: [authorization_code]
+  - clientId: untouched
+    mfaRequired: true
+    clientSecret: fixture-secret
+  - clientId: vergabe-demo-company
+    clientType: public
+    grantTypes: [authorization_code]
+privacyidea:
+  requireForAll: true
+'''
+        return {'data':{'config.yaml':base64.b64encode(raw.encode()).decode(),'key.pem':'fixture-key'}}
+    def test_exact_migration_preserves_siblings_and_retries(self):
+        secret=self.secret();value,changed=module.replacement(secret);self.assertTrue(changed)
+        raw=base64.b64decode(value).decode();self.assertIn('# exact bytes',raw);self.assertIn('    clientSecret: fixture-secret\n',raw)
+        config=yaml.safe_load(raw);self.assertTrue(config['privacyidea']['requireForAll'])
+        self.assertTrue(config['clients'][0]['mfaOptional']);self.assertTrue(config['clients'][2]['mfaOptional'])
+        secret['data']['config.yaml']=value;again,changed=module.replacement(secret);self.assertFalse(changed);self.assertEqual(value,again)
+    def test_explicit_or_duplicate_registration_refused(self):
+        for edit in [lambda s:s.replace('    clientType: public','    mfaRequired: false\n    clientType: public',1),lambda s:s.replace('clientId: untouched','clientId: user-engine-portal')]:
+            secret=self.secret();secret['data']['config.yaml']=base64.b64encode(edit(base64.b64decode(secret['data']['config.yaml']).decode()).encode()).decode()
+            with self.assertRaises(module.Refused):module.replacement(secret)