docs: def pin_auth(self, request):
          """Authenticates with the pin."""
          exhausted = False
          auth = False
          trust = self.check_pin_trust(request.environ)
  
          # If the trust return value is `None` it means that the cookie is
          # set but the stored pin hash value is bad.  This means that the
          # pin was changed.  In this case we count a bad auth and unset the
          # cookie.  This way it becomes harder to guess the cookie name
          # instead of the pin as we still count up failures.
          bad_cookie = False
          if trust is None:
              self._fail_pin_auth()
              bad_cookie = True
  
          # If we're trusted, we're authenticated.
          elif trust:
              auth = True
  
          # If we failed too many times, then we're locked out.
          elif self._failed_pin_auth > 10:
              exhausted = True
  
          # Otherwise go through pin based authentication
          else:
              entered_pin = request.args.get("pin")
              if entered_pin.strip().replace("-", "") == self.pin.replace("-", ""):
                  self._failed_pin_auth = 0
                  auth = True
              else:
                  self._fail_pin_auth()
  
          rv = Response(
              json.dumps({"auth": auth, "exhausted": exhausted}),
              mimetype="application/json",
          )
          if auth:
              rv.set_cookie(
                  self.pin_cookie_name,
                  "%s|%s" % (int(time.time()), hash_pin(self.pin)),
                  httponly=True,
              )
          elif bad_cookie:
              rv.delete_cookie(self.pin_cookie_name)
          return rv