tegwick
a5496170cf
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
25 lines
2.2 KiB
Python
25 lines
2.2 KiB
Python
"""Provider-local activation after the guarded deployment; never changes tokens."""
|
|
import contextlib,io,json,logging
|
|
result={'success':False}
|
|
with contextlib.redirect_stdout(io.StringIO()),contextlib.redirect_stderr(io.StringIO()):
|
|
try:
|
|
logging.disable(logging.CRITICAL)
|
|
from privacyidea.app import create_app
|
|
from privacyidea.lib.policy import PolicyClass,set_policy
|
|
app=create_app(config_name='production',silent=True)
|
|
with app.app_context():
|
|
if app.config.get('PI_INIT_CHECK_HOOK')!='keycape_onboarding_guard.check':raise ValueError('hook_not_active')
|
|
from keycape_onboarding_guard import check
|
|
rows=[r for r in PolicyClass().policies if r['scope']=='user' and r['active']]
|
|
expected=next(r for r in rows if r['name']=='totp-self-enrollment')
|
|
if expected['realm']!=['coulomb'] or expected.get('conditions') or expected['action'] not in [{'enrollTOTP':True,'delete':True,'disable':True},{'enrollTOTP':True}]:raise ValueError('self_service_policy_changed')
|
|
if any(r['name'] not in {'totp-self-enrollment','keycape-pending-enrollment-cancel'} and (not r['realm'] or 'coulomb' in r['realm']) for r in rows):raise ValueError('additional_user_policy_requires_review')
|
|
set_policy(name='totp-self-enrollment',scope='user',action='enrollTOTP',realm='coulomb')
|
|
set_policy(name='keycape-pending-enrollment-cancel',scope='user',action='delete',realm='coulomb',conditions=[('token','rollout_state','equals','verify',True)])
|
|
fresh=PolicyClass().policies
|
|
active=next(r for r in fresh if r['name']=='totp-self-enrollment')
|
|
pending=next(r for r in fresh if r['name']=='keycape-pending-enrollment-cancel')
|
|
if active['action']!={'enrollTOTP':True} or not pending['conditions']:raise ValueError('readback_failed')
|
|
result={'success':True,'hook':'keycape_onboarding_guard.check','self_service_enrollment':True,'pending_cancel_only':True,'active_factor_changes_require_recovery':True,'existing_tokens_changed':False}
|
|
except Exception as error:result={'success':False,'failure_type':type(error).__name__}
|
|
print(json.dumps(result));raise SystemExit(0 if result['success'] else 1)
|