Add prefix support to password policies

[wahajahmed010]

Summary

This PR adds a prefix field to password policy configuration in HashiCorp Vault, allowing generated passwords to include a configurable prefix string.

Problem

Currently, Vault-generated passwords have no prefix, making them impossible to identify with secret scanning tools. Vault already uses prefixes for its own tokens (e.g., hvs. for secrets), so this follows an existing pattern.

Changes

• vault/logical_system.go: Added Prefix field to passwordPolicyConfig struct; updated handlePoliciesPasswordSet to accept and store prefix; updated handlePoliciesPasswordGet to return prefix; updated handlePoliciesPasswordGenerate to prepend prefix to generated passwords
• vault/dynamic_system_view.go: Updated generatePassword to prepend prefix when set
• vault/logical_system_paths.go: Added prefix field to passwordPolicySchema
• vault/logical_system_test.go: Added tests for prefix functionality (with prefix, empty prefix)

Usage Example

# Create a policy with prefix
vault write sys/policies/password/my-policy \
  prefix="vault." \
  policy="length=20 rule \"charset\" { charset=\"abcdefghij\" }"

# Generate a password (e.g., "vault.ajdifbhoeigjhrfgc")
vault read sys/policies/password/my-policy/generate

Files Changed

• vault/logical_system.go (+9 lines)
• vault/dynamic_system_view.go (+9 lines)
• vault/logical_system_paths.go (+4 lines)
• vault/logical_system_test.go (+102 lines)

---

Closes #31889

[vercel]

Someone is attempting to deploy a commit to the HashiCorp Team on Vercel.

A member of the Team first needs to authorize it.

[hashicorp-cla-app]

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

---

Wahaj Ahmed seems not to be a GitHub user.
You need a GitHub account to be able to sign the CLA.
If you have already a GitHub account, please add the email address used for this commit to your account.

_{Have you signed the CLA already but the status is still pending? Recheck it.}

[wahajahmed010]

CLA has been signed. Ready for review!