good

src/core/security.py

@@ -104,7 +104,6 @@
 #             detail="Invalid token",
 #             headers={"WWW-Authenticate": "Bearer"}
 #         )
-
 """
 Security utilities for authentication and authorization.
 """
@@ -123,7 +122,11 @@ from src.core.config import settings
 # Password hashing (bcrypt-safe)
 # =========================
 
-pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
+pwd_context = CryptContext(
+    schemes=["bcrypt"],
+    deprecated="auto"
+)
+
 security = HTTPBearer()
 
 MAX_BCRYPT_BYTES = 72
@@ -131,34 +134,31 @@ MAX_BCRYPT_BYTES = 72
 
 def _bcrypt_safe(password: str) -> bytes:
     """
-    bcrypt only supports 72 bytes.
-    Truncate safely to avoid runtime crashes.
+    Ensure password never exceeds bcrypt 72-byte limit.
     """
     return password.encode("utf-8")[:MAX_BCRYPT_BYTES]
 
 
 def hash_password(password: str) -> str:
     """
-    Hash a password using bcrypt (safe for all environments).
+    Hash password safely using bcrypt.
     """
     return pwd_context.hash(_bcrypt_safe(password))
 
 
 def verify_password(plain_password: str, hashed_password: str) -> bool:
     """
-    Verify password while supporting legacy SHA256+bcrypt hashes.
+    Verify password safely.
+    Never throws bcrypt length errors.
     """
     try:
-        # New bcrypt-safe method
         return pwd_context.verify(
-            plain_password.encode("utf-8")[:72],
+            _bcrypt_safe(plain_password),
             hashed_password
         )
-    except ValueError:
-        # Fallback for OLD hashes (sha256 -> bcrypt)
-        import hashlib
-        legacy = hashlib.sha256(plain_password.encode("utf-8")).hexdigest()
-        return pwd_context.verify(legacy, hashed_password)
+    except Exception:
+        return False
+
 
 # =========================
 # JWT utilities
@@ -209,6 +209,7 @@ def verify_jwt_token(token: str, secret: str) -> dict:
             detail="Invalid token"
         )
 
+
 # =========================
 # FastAPI dependency
 # =========================