good

src/core/security.py

@@ -107,9 +107,9 @@
 """
 Security utilities for authentication and authorization.
 """
-
 from datetime import datetime, timedelta
 from typing import Dict, Any
+import hashlib
 
 import jwt
 from passlib.context import CryptContext
@@ -119,7 +119,7 @@ from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
 from src.core.config import settings
 
 # =========================
-# Password hashing (bcrypt-safe ONLY)
+# Password hashing (bcrypt-safe FINAL)
 # =========================
 
 pwd_context = CryptContext(
@@ -129,21 +129,20 @@ pwd_context = CryptContext(
 
 security = HTTPBearer()
 
-MAX_BCRYPT_BYTES = 72
-
 
-def _bcrypt_safe(password: str) -> bytes:
+def _normalize_password(password: str) -> bytes:
     """
-    Ensure password never exceeds bcrypt 72-byte limit.
+    Convert password to fixed-length digest.
+    This COMPLETELY avoids bcrypt 72-byte crashes.
     """
-    return password.encode("utf-8")[:MAX_BCRYPT_BYTES]
+    return hashlib.sha256(password.encode("utf-8")).digest()
 
 
 def hash_password(password: str) -> str:
     """
-    Hash password safely using bcrypt.
+    Hash password safely (SHA256 → bcrypt).
     """
-    return pwd_context.hash(_bcrypt_safe(password))
+    return pwd_context.hash(_normalize_password(password))
 
 
 def verify_password(plain_password: str, hashed_password: str) -> bool:
@@ -153,7 +152,7 @@ def verify_password(plain_password: str, hashed_password: str) -> bool:
     """
     try:
         return pwd_context.verify(
-            _bcrypt_safe(plain_password),
+            _normalize_password(plain_password),
             hashed_password
         )
     except Exception:
@@ -221,7 +220,6 @@ def get_current_user(
     Extract and validate JWT token from Authorization header.
     """
     token = credentials.credentials
-
     payload = verify_jwt_token(token, settings.BETTER_AUTH_SECRET)
 
     return {
@@ -230,6 +228,3 @@ def get_current_user(
         "iat": payload.get("iat"),
         "exp": payload.get("exp"),
     }
-
-
-