good

src/core/security.py

@@ -147,14 +147,28 @@ def hash_password(password: str) -> str:
 
 def verify_password(plain_password: str, hashed_password: str) -> bool:
     """
-    Verify password safely.
-    NEVER crashes.
+    Verify password with AUTO migration from legacy hashes.
     """
     try:
-        return pwd_context.verify(
-            _normalize_password(plain_password),
-            hashed_password
-        )
+        # New method (SHA256 → bcrypt)
+        normalized = hashlib.sha256(
+            plain_password.encode("utf-8")
+        ).digest()
+
+        if pwd_context.verify(normalized, hashed_password):
+            return True
+
+    except Exception:
+        pass
+
+    # 🔁 Legacy fallback (OLD system)
+    try:
+        legacy = hashlib.sha256(
+            plain_password.encode("utf-8")
+        ).hexdigest()
+
+        return pwd_context.verify(legacy, hashed_password)
+
     except Exception:
         return False