RugMunchMedia/rmi-backend
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore: lint cleanup 1175→0 + auth.py fix + drop passlib #3

Merged
cryptorugmunch merged 4 commits from chore/lint-debt-cleanup into main 2026-07-06 16:47:12 +02:00
Conversation 0 Commits 4 Files changed 690 +5273 -5125
cryptorugmunch commented 2026-07-06 16:46:58 +02:00
Owner
Copy link

Promotes chore/lint-debt-cleanup (3 commits) to main.

Promotes chore/lint-debt-cleanup (3 commits) to main.
cryptorugmunch added 4 commits 2026-07-06 16:46:58 +02:00 
- Fix 71 invalid-syntax files (class-body newline-broken assignments)
- Add from/None chain to 307 B904 raise-without-from sites
- Add B008 ignore to ruff.toml (already in pyproject.toml)
- Noqa F401 on __init__.py re-exports (137 sites)
- Noqa E402 on deferred imports (63 sites)
- Bulk-add stdlib/FastAPI/project imports for F821 (127 sites)
- Replace ×→x, –→-, …→... in docstrings (4093 chars)
- Manual refactor of 5 SIM103/SIM116 patterns

Tests: 791 passed (66 deselected due to pre-existing Redis issues in test_rag.py)
Co-authored-by: opencode <opencode@rugmunch.io>
fix(rmi-backend): drop passlib — route backup codes through direct bcrypt
Some checks failed
CI / build (pull_request) Failing after 2s
Details
1171a35d9f 
The reported symptom (AttributeError: module 'bcrypt' has no attribute
'__about__') was misleading. passlib 1.7.4 (the latest released version
— the project is unmaintained) actually traps that AttributeError with
a bare `except:` and continues. The real failure occurs later in
`passlib.handlers.bcrypt._finalize_backend_mixin`:

  detect_wrap_bug -> verify(secret, bug_hash)
    where secret = (b"0123456789"*26)[:255]   # 255-byte test secret

bcrypt 4.0+ removed silent 72-byte truncation and now raises
`ValueError: password cannot be longer than 72 bytes`, breaking the
backend probe and crashing every `pwd_context.hash()/verify()` call.

Three options were considered:

  A. Upgrade passlib — impossible, 1.7.4 is the latest PyPI release.
  B. Pin bcrypt<4.0  — conflicts with chromadb 1.1.1 (>=4.0.1 required),
     even though chromadb's bcrypt usage is optional and still works
     at runtime in practice.
  C. Shim bcrypt.__about__ — doesn't fix the actual truncation error.

Chosen: refactor app/auth.py to use bcrypt directly for backup-code
hashing too (the main `hash_password`/`verify_password` already did).
Drops the passlib dependency entirely, restoring bcrypt 5.x for chromadb
compatibility and eliminating the unmaintained passlib pin.

Verified:
  * hash_password / verify_password round-trip OK
  * _hash_backup_code / _verify_backup_code round-trip OK on
    freshly generated 8-digit backup codes
  * `pytest tests/unit` -> 717 passed, 32 warnings, 60 subtests passed
cryptorugmunch merged commit 862fd05e08 into main 2026-07-06 16:47:12 +02:00
cryptorugmunch deleted branch chore/lint-debt-cleanup 2026-07-06 16:47:12 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: RugMunchMedia/rmi-backend#3
No description provided.
Delete branch "chore/lint-debt-cleanup"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?