app/auth.py

@@ -12,9 +12,9 @@ import secrets
 from datetime import datetime, timedelta
 from typing import Any
 
+import bcrypt
 from fastapi import APIRouter, HTTPException, Request
 from jose import JWTError, jwt
-from passlib.context import CryptContext
 from pydantic import BaseModel, Field
 
 from app.core.redis import get_redis
@@ -86,12 +86,12 @@ def _generate_backup_codes(count: int = 8) -> list:
 
 def _hash_backup_code(code: str) -> str:
     """Hash a backup code for storage (same as password hashing)."""
-    return pwd_context.hash(code)
+    return hash_password(code)
 
 
 def _verify_backup_code(code: str, hashed: str) -> bool:
     """Verify a backup code against its hash."""
-    return pwd_context.verify(code, hashed)
+    return verify_password(code, hashed)
 
 
 # ── Config ──
@@ -99,10 +99,6 @@ JWT_SECRET = os.getenv("JWT_SECRET", "rmi-jwt-secret-change-me")
 JWT_ALGORITHM = "HS256"
 JWT_EXPIRY_DAYS = 7
 
-import bcrypt  # noqa: E402
-
-pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
-
 
 def hash_password(password: str) -> str:
     """Hash password using bcrypt directly."""

app/routers/bulletin.py

@@ -31,7 +31,7 @@ from app.services.supabase_service import (  # noqa: E402
 )
 
 
-# Lazy auth dependency - avoids importing passlib+jose+bcrypt at module load
+# Lazy auth dependency - avoids importing jose+bcrypt at module load
 async def _require_public_profile(request: Request):
     from app.auth import require_public_profile
 

requirements.txt

@@ -6,7 +6,6 @@ pydantic>=2.9.0
 python-telegram-bot>=21.0
 supabase>=2.0.0
 python-jose[cryptography]>=3.3.0
-passlib[bcrypt]>=1.7.4
 python-multipart>=0.0.17
 aiohttp>=3.11.0
 feedparser>=6.0.11