fris

.env

@@ -6,7 +6,7 @@ DATABASE_URL=postgresql://neondb_owner:npg_MmFvJBHT8Y0k@ep-silent-thunder-ab0rbv
 # Application Settings
 APP_NAME=Task CRUD API
 DEBUG=True
-CORS_ORIGINS=http://localhost:3000
+CORS_ORIGINS=https://hacathoon-ii-phase2-deployment.vercel.app
 
 # Authentication
 BETTER_AUTH_SECRET=zMdW1P03wJvWJnLKzQ8YYO26vHeinqmR

src/core/security.py

@@ -109,7 +109,6 @@ Security utilities for authentication and authorization.
 """
 from datetime import datetime, timedelta
 from typing import Dict, Any
-import hashlib
 
 import jwt
 from passlib.context import CryptContext
@@ -119,7 +118,7 @@ from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
 from src.core.config import settings
 
 # =========================
-# Password hashing (bcrypt-safe FINAL)
+# Password hashing (bcrypt SAFE)
 # =========================
 
 pwd_context = CryptContext(
@@ -129,46 +128,33 @@ pwd_context = CryptContext(
 
 security = HTTPBearer()
 
+MAX_BCRYPT_BYTES = 72
 
-def _normalize_password(password: str) -> bytes:
+
+def _bcrypt_safe(password: str) -> bytes:
     """
-    Convert password to fixed-length digest.
-    This COMPLETELY avoids bcrypt 72-byte crashes.
+    bcrypt supports MAX 72 bytes.
+    Always truncate BEFORE hashing or verifying.
     """
-    return hashlib.sha256(password.encode("utf-8")).digest()
+    return password.encode("utf-8")[:MAX_BCRYPT_BYTES]
 
 
 def hash_password(password: str) -> str:
     """
-    Hash password safely (SHA256 → bcrypt).
+    Hash password safely (NO crashes).
     """
-    return pwd_context.hash(_normalize_password(password))
+    return pwd_context.hash(_bcrypt_safe(password))
 
 
 def verify_password(plain_password: str, hashed_password: str) -> bool:
     """
-    Verify password with AUTO migration from legacy hashes.
+    Verify password safely (NO crashes).
     """
     try:
-        # New method (SHA256 → bcrypt)
-        normalized = hashlib.sha256(
-            plain_password.encode("utf-8")
-        ).digest()
-
-        if pwd_context.verify(normalized, hashed_password):
-            return True
-
-    except Exception:
-        pass
-
-    # 🔁 Legacy fallback (OLD system)
-    try:
-        legacy = hashlib.sha256(
-            plain_password.encode("utf-8")
-        ).hexdigest()
-
-        return pwd_context.verify(legacy, hashed_password)
-
+        return pwd_context.verify(
+            _bcrypt_safe(plain_password),
+            hashed_password
+        )
     except Exception:
         return False
 
@@ -230,9 +216,6 @@ def verify_jwt_token(token: str, secret: str) -> dict:
 def get_current_user(
     credentials: HTTPAuthorizationCredentials = Depends(security)
 ) -> Dict[str, Any]:
-    """
-    Extract and validate JWT token from Authorization header.
-    """
     token = credentials.credentials
     payload = verify_jwt_token(token, settings.BETTER_AUTH_SECRET)
 

src/mcp/__init__.py

@@ -35,7 +35,8 @@ def load_tool_contract(tool_name: str) -> dict:
     # Get the project root directory
     current_file = Path(__file__)
     project_root = current_file.parent.parent.parent  # backend/src/mcp -> backend
-    contract_path = project_root.parent / "specs" / "001-openai-agent-mcp-tools" / "contracts" / f"{tool_name}.json"
+    contract_path = Path("C:/Users/Pcw/OneDrive/Desktop/phase-2-backend/taskflow-api/specs/001-openai-agent-mcp-tools/contracts") / f"{tool_name}.json"
+
 
     if not contract_path.exists():
         raise FileNotFoundError(f"Contract file not found: {contract_path}")