Implement scoped P06 authentication policy and guarded optional onboarding

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6

sso-mfa/k8s/privacyidea/activate-onboarding-policy.py

@@ -0,0 +1,25 @@
+"""Provider-local activation after the guarded deployment; never changes tokens."""
+import contextlib,io,json,logging
+result={'success':False}
+with contextlib.redirect_stdout(io.StringIO()),contextlib.redirect_stderr(io.StringIO()):
+    try:
+        logging.disable(logging.CRITICAL)
+        from privacyidea.app import create_app
+        from privacyidea.lib.policy import PolicyClass,set_policy
+        app=create_app(config_name='production',silent=True)
+        with app.app_context():
+            if app.config.get('PI_INIT_CHECK_HOOK')!='keycape_onboarding_guard.check':raise ValueError('hook_not_active')
+            from keycape_onboarding_guard import check
+            rows=[r for r in PolicyClass().policies if r['scope']=='user' and r['active']]
+            expected=next(r for r in rows if r['name']=='totp-self-enrollment')
+            if expected['realm']!=['coulomb'] or expected.get('conditions') or expected['action'] not in [{'enrollTOTP':True,'delete':True,'disable':True},{'enrollTOTP':True}]:raise ValueError('self_service_policy_changed')
+            if any(r['name'] not in {'totp-self-enrollment','keycape-pending-enrollment-cancel'} and (not r['realm'] or 'coulomb' in r['realm']) for r in rows):raise ValueError('additional_user_policy_requires_review')
+            set_policy(name='totp-self-enrollment',scope='user',action='enrollTOTP',realm='coulomb')
+            set_policy(name='keycape-pending-enrollment-cancel',scope='user',action='delete',realm='coulomb',conditions=[('token','rollout_state','equals','verify',True)])
+            fresh=PolicyClass().policies
+            active=next(r for r in fresh if r['name']=='totp-self-enrollment')
+            pending=next(r for r in fresh if r['name']=='keycape-pending-enrollment-cancel')
+            if active['action']!={'enrollTOTP':True} or not pending['conditions']:raise ValueError('readback_failed')
+            result={'success':True,'hook':'keycape_onboarding_guard.check','self_service_enrollment':True,'pending_cancel_only':True,'active_factor_changes_require_recovery':True,'existing_tokens_changed':False}
+    except Exception as error:result={'success':False,'failure_type':type(error).__name__}
+print(json.dumps(result));raise SystemExit(0 if result['success'] else 1)