docs: def policy_factory_from_module(config, module):
      """Create a policy factory that works by config.include()'ing a module.
  
      This function does some trickery with the Pyramid config system. Loosely,
      it does config.include(module), and then sucks out information about the
      authn policy that was registered.  It's complicated by pyramid's delayed-
      commit system, which means we have to do the work via callbacks.
      """
      # Remember the policy that's active before including the module, if any.
      orig_policy = config.registry.queryUtility(IAuthenticationPolicy)
      # Include the module, so we get any default views etc.
      config.include(module)
      # That might have registered and commited a new policy object.
      policy = config.registry.queryUtility(IAuthenticationPolicy)
      if policy is not None and policy is not orig_policy:
          return lambda: policy
      # Or it might have set up a pending action to register one later.
      # Find the most recent IAuthenticationPolicy action, and grab
      # out the registering function so we can call it ourselves.
      for action in reversed(config.action_state.actions):
          # Extract the discriminator and callable.  This is complicated by
          # Pyramid 1.3 changing action from a tuple to a dict.
          try:
              discriminator = action["discriminator"]
              callable = action["callable"]
          except TypeError:              # pragma: nocover
              discriminator = action[0]  # pragma: nocover
              callable = action[1]       # pragma: nocover
          # If it's not setting the authn policy, keep looking.
          if discriminator is not IAuthenticationPolicy:
              continue
  
          # Otherwise, wrap it up so we can extract the registered object.
          def grab_policy(register=callable):
              old_policy = config.registry.queryUtility(IAuthenticationPolicy)
              register()
              new_policy = config.registry.queryUtility(IAuthenticationPolicy)
              config.registry.registerUtility(old_policy, IAuthenticationPolicy)
              return new_policy
  
          return grab_policy
      # Or it might not have done *anything*.
      # So return a null policy factory.
      return lambda: None