fix: replace passlib with direct bcrypt calls to fix bcrypt 5.x incompatibility

passlib 1.7.4 is incompatible with bcrypt>=5.0.0. When passlib initializes
its bcrypt backend, it calls detect_wrap_bug() with a >72-byte test password.
bcrypt 5.0.0 raises ValueError for such passwords, crashing the initialization
before any user code runs.

Fix: replace passlib[bcrypt] with direct bcrypt==4.3.0 usage:
- security.py: use bcrypt.hashpw()/checkpw() instead of CryptContext
- requirements.txt: replace passlib[bcrypt]==1.7.4 with bcrypt==4.3.0

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Agent-Logs-Url: https://github.com/christianlouis/pop_puller_to_gmail/sessions/a2327bbe-cc06-4c1f-9010-380fb0fd7d67

backend/app/core/security.py

@@ -6,8 +6,8 @@ import hashlib
 import secrets
 from datetime import datetime, timedelta
 from typing import Optional, Dict, Any
+import bcrypt
 from jose import JWTError, jwt
-from passlib.context import CryptContext
 from cryptography.fernet import Fernet
 from cryptography.hazmat.primitives import hashes
 from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
@@ -15,18 +15,17 @@ import base64
 
 from app.core.config import settings
 
-# Password hashing context
-pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
-
 
 def verify_password(plain_password: str, hashed_password: str) -> bool:
     """Verify a password against its hash"""
-    return pwd_context.verify(plain_password, hashed_password)
+    return bcrypt.checkpw(
+        plain_password.encode("utf-8"), hashed_password.encode("utf-8")
+    )
 
 
 def get_password_hash(password: str) -> str:
     """Generate password hash"""
-    return pwd_context.hash(password)
+    return bcrypt.hashpw(password.encode("utf-8"), bcrypt.gensalt()).decode("utf-8")
 
 
 def create_access_token(

backend/requirements.txt

@@ -12,7 +12,7 @@ asyncpg==0.29.0
 
 # Authentication
 python-jose[cryptography]==3.3.0
-passlib[bcrypt]==1.7.4
+bcrypt==4.3.0
 python-multipart==0.0.22  # Updated: Fixed multiple vulnerabilities (was 0.0.6)
 authlib==1.6.9  # Updated: Fixed OIDC hash binding, JWE RSA1_5 padding oracle, alg:none bypass, JWK header injection (was 1.6.6)
 httpx==0.26.0