Present single-use password setup handoff

src/user_engine/web.py

@@ -302,6 +302,14 @@ class PortalApplication:
                     subject=result.external_subject, provider=result.provider,
                     correlation_id=correlation_id,
                 )
+                if result.password_setup_url:
+                    return self._html(
+                        start_response,
+                        self._password_setup_handoff(
+                            result.password_setup_url, tenant
+                        ),
+                        correlation_id,
+                    )
                 query = urlencode({"provisioned": user.user_id, "status": result.status})
                 return self._redirect(start_response, f"/admin/{tenant}?{query}", correlation_id)
             if len(parts) == 6 and parts[3] == "users" and parts[5] == "status":
@@ -481,6 +489,20 @@ class PortalApplication:
             f"<td>{'linked' if directory else 'pending'}</td><td>{action}</td></tr>"
         )
 
+    def _password_setup_handoff(self, setup_url: str, tenant: str) -> str:
+        if not setup_url.startswith("https://"):
+            raise ValidationError("password setup handoff must use HTTPS")
+        return self._page_html(
+            "Password setup",
+            "<h1>Login identity created</h1>"
+            "<p>The password is handled only by the NetKingdom identity "
+            "surface. This short-lived link is single use.</p>"
+            f'<p><a class="button" rel="noreferrer" href="{escape(setup_url)}">'
+            "Continue to password setup</a></p>"
+            f'<p><a href="/admin/{escape(tenant)}">'
+            "Return to tenant administration</a></p>",
+        )
+
     def _redirect(self, start_response: StartResponse, location: str, correlation_id: str) -> list[bytes]:
         start_response("303 See Other", [("Location", location), *self._security_headers(correlation_id)])
         return [b""]