Publish curated Unraid-AppOps-Gateway source from 451646fee806a47e3256731766980a05a262dcdd

backend/app/services/policy_engine.py

@@ -164,6 +164,29 @@ def evaluate_policy(
             "scope_decision": "allowed" if allowed else None,
         }
 
+    if action == "forge.oidc.provision":
+        # This is the only manual Authentik mutation exposed by AppOps. Requiring
+        # exactly one row for the action prevents a wildcard or duplicate row
+        # from becoming an alternate authorization path.
+        policies = session.exec(select(Policy).where(Policy.action == action)).all()
+        policy = policies[0] if len(policies) == 1 else None
+        allowed = bool(
+            source == "manual"
+            and target == "itworx-forge"
+            and policy is not None
+            and policy.target == "itworx-forge"
+            and policy.manual == "allowed"
+            and policy.voice == "blocked"
+            and policy.risk == "critical"
+        )
+        return {
+            "decision": "allowed" if allowed else "blocked",
+            "reason": "Forge OIDC provisioning requires one exact-target manual policy; voice is always blocked.",
+            "risk": "critical",
+            "policy_id": policy.id if allowed and policy is not None else None,
+            "scope_decision": "allowed" if allowed else None,
+        }
+
     if action in _DEFAULT_DECISIONS:
         reason = _DEFAULT_REASONS.get(action, 'Action uses default governance policy.')
         return {