wholeboard.auth

Optional password for other computers on the network.

When a password is set, any client that is not this computer (loopback) must log in. A signed, expiring cookie then covers the web page, the API and the live WebSocket. Changing or clearing the password signs everyone out. The password itself is never stored, only a PBKDF2 hash.

AuthMiddleware

ASGI middleware, so it guards HTTP and WebSocket requests alike.

set_password(password)

Set (or with None/'' clear) the password; a new secret signs every browser out.

allow_attempt(ip)

At most 8 password tries a minute from one address.