a420aa5f75
Replace the random-number stub at dbus.rs:132 with state.issue_recovery, add ListRecoveryCodes (returns Vec<RecoveryCodeSummary>) and RevokeRecoveryCode. New polkit actions list-recovery / revoke-recovery (auth_admin_keep). Adds 4 D-Bus integration tests; the previously-stub generate-code test now exercises the real Argon2id-backed write path. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
101 lines
3.9 KiB
XML
101 lines
3.9 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE policyconfig PUBLIC
|
|
"-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
|
|
"http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
|
|
<policyconfig>
|
|
|
|
<vendor>Dangerous Things</vendor>
|
|
<vendor_url>https://dangerousthings.com</vendor_url>
|
|
|
|
<action id="io.dangerousthings.AuthForge.enroll-own">
|
|
<description>Enroll a security key for your own account</description>
|
|
<message>Authentication is required to enroll a security key.</message>
|
|
<defaults>
|
|
<allow_any>auth_self_keep</allow_any>
|
|
<allow_inactive>auth_self_keep</allow_inactive>
|
|
<allow_active>auth_self_keep</allow_active>
|
|
</defaults>
|
|
</action>
|
|
|
|
<action id="io.dangerousthings.AuthForge.remove-own">
|
|
<description>Remove a security key from your own account</description>
|
|
<message>Authentication is required to remove a security key.</message>
|
|
<defaults>
|
|
<allow_any>auth_self_keep</allow_any>
|
|
<allow_inactive>auth_self_keep</allow_inactive>
|
|
<allow_active>auth_self_keep</allow_active>
|
|
</defaults>
|
|
</action>
|
|
|
|
<action id="io.dangerousthings.AuthForge.enroll-other">
|
|
<description>Enroll a security key for another user</description>
|
|
<message>Administrator authentication is required to enroll on behalf of another user.</message>
|
|
<defaults>
|
|
<allow_any>auth_admin_keep</allow_any>
|
|
<allow_inactive>auth_admin_keep</allow_inactive>
|
|
<allow_active>auth_admin_keep</allow_active>
|
|
</defaults>
|
|
</action>
|
|
|
|
<action id="io.dangerousthings.AuthForge.set-policy">
|
|
<description>Change AuthForge MFA policy</description>
|
|
<message>Administrator authentication is required to change MFA policy.</message>
|
|
<defaults>
|
|
<allow_any>auth_admin_keep</allow_any>
|
|
<allow_inactive>auth_admin_keep</allow_inactive>
|
|
<allow_active>auth_admin_keep</allow_active>
|
|
</defaults>
|
|
</action>
|
|
|
|
<action id="io.dangerousthings.AuthForge.set-pending">
|
|
<description>Set a first-login enrollment flag for a user</description>
|
|
<message>Administrator authentication is required to require enrollment for a user.</message>
|
|
<defaults>
|
|
<allow_any>auth_admin_keep</allow_any>
|
|
<allow_inactive>auth_admin_keep</allow_inactive>
|
|
<allow_active>auth_admin_keep</allow_active>
|
|
</defaults>
|
|
</action>
|
|
|
|
<action id="io.dangerousthings.AuthForge.clear-pending">
|
|
<description>Clear a user's first-login enrollment flag</description>
|
|
<message>Administrator authentication is required to clear a pending-enrollment flag.</message>
|
|
<defaults>
|
|
<allow_any>auth_admin_keep</allow_any>
|
|
<allow_inactive>auth_admin_keep</allow_inactive>
|
|
<allow_active>auth_admin_keep</allow_active>
|
|
</defaults>
|
|
</action>
|
|
|
|
<action id="io.dangerousthings.AuthForge.generate-recovery">
|
|
<description>Generate a one-time recovery code for a user</description>
|
|
<message>Administrator authentication is required to generate a recovery code.</message>
|
|
<defaults>
|
|
<allow_any>auth_admin_keep</allow_any>
|
|
<allow_inactive>auth_admin_keep</allow_inactive>
|
|
<allow_active>auth_admin_keep</allow_active>
|
|
</defaults>
|
|
</action>
|
|
|
|
<action id="io.dangerousthings.AuthForge.list-recovery">
|
|
<description>List active recovery codes</description>
|
|
<message>Administrator authentication is required to list recovery codes.</message>
|
|
<defaults>
|
|
<allow_any>auth_admin_keep</allow_any>
|
|
<allow_inactive>auth_admin_keep</allow_inactive>
|
|
<allow_active>auth_admin_keep</allow_active>
|
|
</defaults>
|
|
</action>
|
|
|
|
<action id="io.dangerousthings.AuthForge.revoke-recovery">
|
|
<description>Revoke a recovery code</description>
|
|
<message>Administrator authentication is required to revoke a recovery code.</message>
|
|
<defaults>
|
|
<allow_any>auth_admin_keep</allow_any>
|
|
<allow_inactive>auth_admin_keep</allow_inactive>
|
|
<allow_active>auth_admin_keep</allow_active>
|
|
</defaults>
|
|
</action>
|
|
|
|
</policyconfig>
|