"""Provider-local activation after the guarded deployment; never changes tokens."""
import contextlib,io,json,logging
result={'success':False}
with contextlib.redirect_stdout(io.StringIO()),contextlib.redirect_stderr(io.StringIO()):
    try:
        logging.disable(logging.CRITICAL)
        from privacyidea.app import create_app
        from privacyidea.lib.policy import PolicyClass,set_policy
        app=create_app(config_name='production',silent=True)
        with app.app_context():
            if app.config.get('PI_INIT_CHECK_HOOK')!='keycape_onboarding_guard.check':raise ValueError('hook_not_active')
            from keycape_onboarding_guard import check
            rows=[r for r in PolicyClass().policies if r['scope']=='user' and r['active']]
            expected=next(r for r in rows if r['name']=='totp-self-enrollment')
            if expected['realm']!=['coulomb'] or expected.get('conditions') or expected['action'] not in [{'enrollTOTP':True,'delete':True,'disable':True},{'enrollTOTP':True}]:raise ValueError('self_service_policy_changed')
            if any(r['name'] not in {'totp-self-enrollment','keycape-pending-enrollment-cancel'} and (not r['realm'] or 'coulomb' in r['realm']) for r in rows):raise ValueError('additional_user_policy_requires_review')
            set_policy(name='totp-self-enrollment',scope='user',action='enrollTOTP',realm='coulomb')
            set_policy(name='keycape-pending-enrollment-cancel',scope='user',action='delete',realm='coulomb',conditions=[('token','rollout_state','equals','verify',True)])
            fresh=PolicyClass().policies
            active=next(r for r in fresh if r['name']=='totp-self-enrollment')
            pending=next(r for r in fresh if r['name']=='keycape-pending-enrollment-cancel')
            if active['action']!={'enrollTOTP':True} or not pending['conditions']:raise ValueError('readback_failed')
            result={'success':True,'hook':'keycape_onboarding_guard.check','self_service_enrollment':True,'pending_cancel_only':True,'active_factor_changes_require_recovery':True,'existing_tokens_changed':False}
    except Exception as error:result={'success':False,'failure_type':type(error).__name__}
print(json.dumps(result));raise SystemExit(0 if result['success'] else 1)