feature: root service and account status

backend/auth.py

@@ -2,7 +2,7 @@ import datetime as dt
 import grp
 import pwd
 import spwd
-from typing import List, Set, Optional
+from typing import List, Optional, Set
 
 import jwt
 import pam
@@ -123,14 +123,9 @@ def list_manageable_users(settings: Settings) -> List[str]:
 
 
 def is_account_locked(username: str) -> bool:
-    """Return True when the account is locked in /etc/shadow."""
     try:
-        shadow_entry = spwd.getspnam(username)
-    except KeyError:
+        entry = spwd.getspnam(username)
+    except (KeyError, PermissionError):
         return False
-    except PermissionError:
-        return False
-    shadow_password = shadow_entry.sp_pwdp or ""
-    if shadow_password in ("*", "!", "!!"):
-        return True
-    return shadow_password.startswith("!")
+    password_hash = entry.sp_pwdp or ""
+    return password_hash.startswith(("!", "*"))