security.py

src/core/security.py

@@ -146,12 +146,19 @@ def hash_password(password: str) -> str:
 
 def verify_password(plain_password: str, hashed_password: str) -> bool:
     """
-    Verify a password against its bcrypt hash.
+    Verify password while supporting legacy SHA256+bcrypt hashes.
     """
-    return pwd_context.verify(
-        _bcrypt_safe(plain_password),
-        hashed_password
-    )
+    try:
+        # New bcrypt-safe method
+        return pwd_context.verify(
+            plain_password.encode("utf-8")[:72],
+            hashed_password
+        )
+    except ValueError:
+        # Fallback for OLD hashes (sha256 -> bcrypt)
+        import hashlib
+        legacy = hashlib.sha256(plain_password.encode("utf-8")).hexdigest()
+        return pwd_context.verify(legacy, hashed_password)
 
 # =========================
 # JWT utilities