Function _auto_login_from_trusted_device

Scripts/ButSystem.py:1576–1613

If the user is not logged in, attempt auto-login using a trusted-device token cookie. Skips auto-login when 2FA is enabled for that account.

()

        conn = db_connect()
        rows = conn.execute("SELECT username FROM users WHERE is_admin=1 ORDER BY username ASC").fetchall()
        conn.close()
        return [r["username"] for r in rows]
    except Exception:
        return []

def csrf_token() -> str:
    """csrf_token.

Internal helper function.

This docstring was added automatically to improve maintainability.

Returns:
    Varies.
"""
    tok = session.get("_csrf")
    if not tok:
        tok = secrets.token_urlsafe(32)
        session["_csrf"] = tok
    return tok

def _same_origin_ok() -> bool:
    """Best-effort same-origin check using Origin / Referer headers.

    Notes:
    - We compare only the host:port (netloc) to avoid false failures behind TLS
      terminators (e.g., Cloudflared) where the app server may see HTTP.
    - If headers are missing, we allow the request.
    - If headers are present but malformed/unparseable, we fail closed.
    """
    from urllib.parse import urlparse

    expected = (request.host or "").lower().strip()
    if not expected:
        return False

    origin = (request.headers.get("Origin") or "").strip()
    ref = (request.headers.get("Referer") or "").strip()

    # If neither header is present, don't block legitimate requests.
    if not origin and not ref: