auth: improve pam flow and user status

backend/auth.py

@@ -1,6 +1,7 @@
 import datetime as dt
 import grp
 import pwd
+import spwd
 from typing import List, Set, Optional
 
 import jwt
@@ -119,3 +120,17 @@ def list_manageable_users(settings: Settings) -> List[str]:
         candidates.append(entry.pw_name)
     candidates.sort()
     return candidates
+
+
+def is_account_locked(username: str) -> bool:
+    """Return True when the account is locked in /etc/shadow."""
+    try:
+        shadow_entry = spwd.getspnam(username)
+    except KeyError:
+        return False
+    except PermissionError:
+        return False
+    shadow_password = shadow_entry.sp_pwdp or ""
+    if shadow_password in ("*", "!", "!!"):
+        return True
+    return shadow_password.startswith("!")