Sep 16 - Optimize code, part 1

routes/auth.py

@@ -86,10 +86,11 @@ def login():
             flash('Please enter both username and password.', 'error')
             return render_template('login.html')
 
-        # Rate-limit check — blocks IPs with 5+ failed attempts in 15 minutes
+        # Rate-limit check — 5 failures for this IP + username, or 20 for the
+        # username from any IP, within 15 minutes (see SecurityManager)
         from flask import current_app
         sec_mgr = getattr(current_app, 'security_manager', None)
-        if sec_mgr and sec_mgr.is_auth_rate_limited():
+        if sec_mgr and sec_mgr.is_auth_rate_limited(username):
             logger_handler.log_security_event(
                 event_type="login_rate_limited",
                 description=f"Login blocked by rate limiter for username: {username}",