Login

Verify the password and, on success, issue a session cookie.

Checks against auth.json (mode "full") when a password has been set, or the identity file's sticker password (mode "initial") when one hasn't but an identity file is present -- see :func:~palmimo_portal.core.identity.compute_auth_state. Response mode lets the frontend route straight to change-password after an initial-mode login. Fixed rate limit: 5 failures locks attempts out for 60s (see :class:~palmimo_portal.core.auth.LoginRateLimiter), regardless of which mode was checked.

Raises: PortalError: 409 auth_state_corrupt if auth.json exists but cannot be read (see :func:setup); 429 auth_rate_limited while locked out; 401 invalid_credentials on a wrong password; 409 auth_not_set if no password has been set yet and no identity file is present either (the DIY out-of-box state -- POST /setup first), or if auth.json is deleted between the classification above and the verify call running (a race, not reachable from a normal request); 503 identity_unavailable if the identity file could not be read (see :func:setup).