"""Enable possession proof for newly enrolled TOTP factors; never touch existing factors."""
import json,subprocess
def metadata(*args):
 r=subprocess.run(['kubectl',*args,'-o','json'],capture_output=True,check=True,timeout=20)
 return json.loads(r.stdout)['metadata']
assert metadata('get','ns','kube-system')['uid']=='a553c742-0115-43d4-99a4-a5ca56fe0786'
assert metadata('-n','mfa','get','deploy','privacyidea')['uid']=='58c7f96d-61cb-4dd4-bca2-54661c0ac375'
code='''import contextlib,io,json,logging
result={"success":False}
with contextlib.redirect_stdout(io.StringIO()),contextlib.redirect_stderr(io.StringIO()):
 try:
  logging.disable(logging.CRITICAL)
  from privacyidea.app import create_app
  from privacyidea.lib.policy import set_policy,PolicyClass
  app=create_app(config_name="production",silent=True)
  with app.app_context():
   name="keycape-confirm-totp-enrollment"
   set_policy(name=name,scope="enrollment",action="verify_enrollment=totp",realm="coulomb")
   rows=PolicyClass().list_policies(name=name)
   result={"success":len(rows)==1 and rows[0]["active"] and rows[0]["action"].get("verify_enrollment")=="totp","policy":name,"existing_factors_changed":False}
 except Exception:pass
print(json.dumps(result))
raise SystemExit(0 if result["success"] else 1)
'''
r=subprocess.run(['kubectl','-n','mfa','exec','deployment/privacyidea','-c','privacyidea','--','python3','-c',code],capture_output=True,timeout=45)
try:result=json.loads(r.stdout)
except Exception:result={'success':False}
assert set(result)<={'success','policy','existing_factors_changed'}
print(json.dumps(result))
raise SystemExit(0 if result.get('success') else 1)