Fix: Replace passlib with bcrypt directly to fix compatibility bug

passlib has a known issue with newer bcrypt versions causing ValueError
on startup. Using bcrypt library directly avoids this entirely.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

chatkit/backend/app/auth.py

@@ -5,7 +5,7 @@ from __future__ import annotations
 from datetime import datetime, timedelta
 from typing import Optional
 
-from passlib.context import CryptContext
+import bcrypt
 from jose import JWTError, jwt
 from fastapi import Depends, HTTPException, status
 from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
@@ -13,16 +13,15 @@ from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
 from .config import get_settings
 from .database import get_user_by_email, get_user_by_id, create_user, update_last_login
 
-pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
 security = HTTPBearer(auto_error=False)
 
 
 def hash_password(password: str) -> str:
-    return pwd_context.hash(password)
+    return bcrypt.hashpw(password.encode("utf-8"), bcrypt.gensalt()).decode("utf-8")
 
 
 def verify_password(plain: str, hashed: str) -> bool:
-    return pwd_context.verify(plain, hashed)
+    return bcrypt.checkpw(plain.encode("utf-8"), hashed.encode("utf-8"))
 
 
 def create_access_token(data: dict, expires_delta: Optional[timedelta] = None) -> str:

chatkit/backend/pyproject.toml

@@ -8,7 +8,7 @@ dependencies = [
     "uvicorn[standard]>=0.36,<0.37",
     "openai>=1.40",
     "python-jose[cryptography]>=3.3.0",
-    "passlib[bcrypt]>=1.7.4",
+    "bcrypt>=4.0.0",
     "python-multipart>=0.0.6",
     "python-dotenv>=1.0.0",
     "aiosqlite>=0.19.0",