Update app.py

app.py

@@ -1,4 +1,5 @@
 import os, io, json, subprocess, tempfile, secrets, shutil
+import bcrypt
 from datetime import datetime, timedelta
 from typing import Optional
 from pathlib import Path
@@ -7,7 +8,6 @@ from fastapi import FastAPI, UploadFile, File, HTTPException, Depends, Form, Req
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import JSONResponse, HTMLResponse, PlainTextResponse, Response
 from pydantic import BaseModel
-from passlib.context import CryptContext
 from jose import JWTError, jwt
 
 # ── Config ────────────────────────────────────────────────────────────────────
@@ -40,21 +40,20 @@ def save_db(db: dict):
     DB_FILE.write_text(json.dumps(db, indent=2))
 
 # ── Security ──────────────────────────────────────────────────────────────────
-pwd_ctx = CryptContext(
-    schemes=["bcrypt"],
-    deprecated="auto",
-    bcrypt__rounds=10
-)
-
 def hash_password(p: str) -> str:
     try:
-        return pwd_ctx.hash(p[:72])
+        # Encode to bytes and safely truncate to 72 bytes (bcrypt's limit)
+        pwd_bytes = p.encode('utf-8')[:72]
+        salt = bcrypt.gensalt(rounds=10)
+        return bcrypt.hashpw(pwd_bytes, salt).decode('utf-8')
     except Exception as e:
         raise HTTPException(500, f"Password hashing error: {e}")
 
 def verify_password(plain: str, hashed: str) -> bool:
     try:
-        return pwd_ctx.verify(plain[:72], hashed)
+        pwd_bytes = plain.encode('utf-8')[:72]
+        hashed_bytes = hashed.encode('utf-8')
+        return bcrypt.checkpw(pwd_bytes, hashed_bytes)
     except:
         return False