Repository: privacyidea/privacyidea

Issue:
Extend Policy Documentation
We have a number of undocumented policies. We should add them to the documentation.

# Policies with missing documentation

## admin:
- [x] caconnectordelete
- [x] caconnectorread
- [x] caconnectorwrite
- [x] clienttype
- [x] delete (listed as `remove`)
- [x] fetch_authentication_items
- [x] machinelist
- [x] manage_machine_tokens
- [x] managesubscription
- [x] privacyideaserver_read
- [x] privacyideaserver_write
- [x] radiusserver_read
- [x] radiusserver_write
- [x] reset
- [x] set_hsm_password
- [x] set
- [x] settokeninfo
- [x] spass_otp_pin_contents (These are referenced [here](https://github.com/privacyidea/privacyidea/blob/9094bc5e0f1742af600dc448b07784b7a47ba47d/doc/policies/admin.rst#otp_pin_contents), I see no necessity to explicitly name them, @cornelinux )
- [x] spass_otp_pin_maxlength
- [x] spass_otp_pin_minlength
- [x] statistics_delete
- [x] statistics_read
- [x] tokenrealms
- [x] triggerchallenge (listed as trigger_challenge)
- [x] enroll* (listed as `init`)

## user
- [x] otp_pin_set_random
- [x] spass_otp_pin_contents (These are referenced [here](https://github.com/privacyidea/privacyidea/blob/9094bc5e0f1742af600dc448b07784b7a47ba47d/doc/policies/user.rst#otp_pin_maxlength), I see no necessity to add its own section / @cornelinux)
- [x] spass_otp_pin_maxlength
- [x] spass_otp_pin_minlength
- [x] userlist

## webui
- [x] dialog_no_token
- [x] hide_welcome_info
- [x] privacy_statement_link
- [x] show_seed
- [x] timeout_action
- [x] tokenwizard_2nd_token
- [x] user_details

## enrollment
- [x] appimageurl
- [x] hotp_yubikey_access_code (is not used anymore?, see below)
- [x] push_ssl_verify
- [x] webauthn_challenge_text

## register
- [x] registration_body

## authentication
- [x] push_ssl_verify
- [x] sms_challenge_text, u2f_challenge_text, email_challenge_text
- [x] webauthn_challenge_text

# Documented but not in privacyIDEA anymore

## admin
- [x] init (remove and add enroll section like in user scope documentation)
- [x] manageToken (is called tokenrealms now)
- [x] remove (duplicate of `delete`?)

## enrollment

- [x] yubikey_access_code is not used anymore by the code. Remove all occurrences.


Discussion:
@laclaro Really? Please be more specific!
```
# get documentation policies
for scope in admin user webui register enrollment authentication authorization; do wget https://privacyidea.readthedocs.io/en/latest/policies/$scope.html -qO- [ ] | grep -E 'h2|h3' | grep -Eo ' </span>.*<a class="headerlink' | sed 's/\( <\/span>\|<a class=\"headerlink\)//g;s/|/\n/g;s/, /\n/g;s/ and /\n/g' | sort | uniq > ${scope}-pol-doc.txt; done
# get api policies
for scope in admin user webui register enrollment authentication authorization; do http http://localhost:5000/policy/defs/$scope authorization:$tok | jq -r '.result.value' > /tmp/${scope}-pol.json;  jq 'keys' /tmp/${scope}-pol.json | awk -F'"' '$0=$2' | sort | uniq > ${scope}-pol-api.txt; done
```

_List moved to the first post._
@cornelinux should we delete the `spass_otp_pin_*` policies because we have tokentype as an extended condition?
The yubikey_access_code / hotp_yubikey_access_code results from the `yubikey_access_code` being defined in the HOTPTokenClass.

It was added in 2016 (pycharm git blame is your friend) and ment to be used by the admin cliend / enrollment client.

Resolving patch:
diff --git a/privacyidea/lib/tokens/hotptoken.py b/privacyidea/lib/tokens/hotptoken.py
--- a/privacyidea/lib/tokens/hotptoken.py
+++ b/privacyidea/lib/tokens/hotptoken.py
@@ -142,11 +142,6 @@ def get_class_info(key=None, ret='all'):
                            'desc': _("The user may only have this maximum number of active HOTP tokens assigned."),
                            'group': GROUP.TOKEN
                        },
-                       'yubikey_access_code': {
-                           'type': 'str',
-                           'desc': _("The Yubikey access code used to "
-                                     "initialize Yubikeys.")
-                       },
                        'hotp_2step_clientsize': {
                            'type': 'int',
                            'desc': _("The size of the OTP seed part contributed "
diff --git a/privacyidea/lib/tokens/yubikeytoken.py b/privacyidea/lib/tokens/yubikeytoken.py
--- a/privacyidea/lib/tokens/yubikeytoken.py
+++ b/privacyidea/lib/tokens/yubikeytoken.py
@@ -175,7 +175,12 @@ def get_class_info(key=None, ret='all'):
                            'desc': _(
                                "The user may only have this maximum number of active Yubikey tokens assigned."),
                            'group': GROUP.TOKEN
-                       }
+                       },
+                       'yubikey_access_code': {
+                           'type': 'str',
+                           'desc': _("The Yubikey access code can be read by an enrollment client to "
+                                     "initialize Yubikeys.")
+                       },
                    }
                }
         }


Test patch: