Implement scoped P06 authentication policy and guarded optional onboarding

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6

sso-mfa/k8s/privacyidea/test_onboarding_guard_deploy.py

@@ -0,0 +1,39 @@
+import copy
+import importlib.util
+from pathlib import Path
+import tempfile
+import unittest
+
+spec = importlib.util.spec_from_file_location("guard_deploy", Path(__file__).with_name("deploy-onboarding-guard.py"))
+module = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(module)
+
+class GuardDeploymentTest(unittest.TestCase):
+    def test_preserves_custody_and_recovery_and_replays(self):
+        config = {"data": {"pi.cfg": "EXISTING=True\n", "other": "unchanged"}}
+        deployment = {"spec": {"template": {"spec": {
+            "containers": [{"name": name, "image": "pinned", "envFrom": [{"secretRef": {"name": "existing"}}], "volumeMounts": [{"name": "data", "mountPath": "/etc/privacyidea"}]} for name in ["privacyidea", "factor-recovery", "unrelated"]],
+            "volumes": [{"name": "data", "persistentVolumeClaim": {"claimName": "existing"}}],
+        }}}}
+        original = copy.deepcopy(deployment)
+        with tempfile.TemporaryDirectory() as directory:
+            source = Path(directory); (source / "scripts").mkdir()
+            (source / "scripts/keycape_onboarding_guard.py").write_text("def check(request, action): return True\n")
+            cm, updated, planned = module.plan(source, config, deployment)
+            self.assertEqual(deployment, original)
+            self.assertEqual(updated, config["data"]["pi.cfg"] + module.SUFFIX)
+            self.assertTrue(cm["immutable"])
+            for before, after in zip(original["spec"]["template"]["spec"]["containers"], planned["containers"]):
+                if before["name"] == "unrelated":
+                    self.assertEqual(before, after)
+                else:
+                    self.assertEqual(before["envFrom"], after["envFrom"])
+                    self.assertEqual(before["image"], after["image"])
+                    self.assertEqual(after["env"], [{"name": "PYTHONPATH", "value": "/opt/keycape-onboarding"}])
+                    self.assertIn(before["volumeMounts"][0], after["volumeMounts"])
+            replay = module.plan(source, {"data": {"pi.cfg": updated}}, {"spec": {"template": {"spec": planned}}})
+            self.assertEqual(replay, (cm, updated, planned))
+            with self.assertRaisesRegex(RuntimeError, "existing_hook_requires_review"):
+                module.plan(source, {"data": {"pi.cfg": "PI_INIT_CHECK_HOOK='another.check'"}}, deployment)
+
+if __name__ == "__main__": unittest.main()