1171a35d9f
Some checks failed
CI / build (pull_request) Failing after 2s
The reported symptom (AttributeError: module 'bcrypt' has no attribute
'__about__') was misleading. passlib 1.7.4 (the latest released version
— the project is unmaintained) actually traps that AttributeError with
a bare `except:` and continues. The real failure occurs later in
`passlib.handlers.bcrypt._finalize_backend_mixin`:
detect_wrap_bug -> verify(secret, bug_hash)
where secret = (b"0123456789"*26)[:255] # 255-byte test secret
bcrypt 4.0+ removed silent 72-byte truncation and now raises
`ValueError: password cannot be longer than 72 bytes`, breaking the
backend probe and crashing every `pwd_context.hash()/verify()` call.
Three options were considered:
A. Upgrade passlib — impossible, 1.7.4 is the latest PyPI release.
B. Pin bcrypt<4.0 — conflicts with chromadb 1.1.1 (>=4.0.1 required),
even though chromadb's bcrypt usage is optional and still works
at runtime in practice.
C. Shim bcrypt.__about__ — doesn't fix the actual truncation error.
Chosen: refactor app/auth.py to use bcrypt directly for backup-code
hashing too (the main `hash_password`/`verify_password` already did).
Drops the passlib dependency entirely, restoring bcrypt 5.x for chromadb
compatibility and eliminating the unmaintained passlib pin.
Verified:
* hash_password / verify_password round-trip OK
* _hash_backup_code / _verify_backup_code round-trip OK on
freshly generated 8-digit backup codes
* `pytest tests/unit` -> 717 passed, 32 warnings, 60 subtests passed
34 lines
648 B
Text
34 lines
648 B
Text
fastapi>=0.115.0
|
|
uvicorn[standard]>=0.32.0
|
|
redis>=5.2.0
|
|
httpx>=0.27.0
|
|
pydantic>=2.9.0
|
|
python-telegram-bot>=21.0
|
|
supabase>=2.0.0
|
|
python-jose[cryptography]>=3.3.0
|
|
python-multipart>=0.0.17
|
|
aiohttp>=3.11.0
|
|
feedparser>=6.0.11
|
|
websockets>=13.0
|
|
flask>=3.0.0
|
|
flask-cors>=5.0.0
|
|
gunicorn>=23.0.0
|
|
requests>=2.32.0
|
|
numpy>=1.26.0
|
|
sentence-transformers>=3.0.0
|
|
duckdb>=0.10.0
|
|
--extra-index-url https://download.pytorch.org/whl/cpu
|
|
torch>=2.3.0
|
|
faiss-cpu>=1.8.0
|
|
pandas>=2.2.0
|
|
cloudscraper>=1.2.71
|
|
eth-account>=0.13.0
|
|
pynacl>=1.5.0
|
|
base58>=2.1.0
|
|
solana>=0.34.0
|
|
slowapi>=0.1.9
|
|
psutil>=5.9
|
|
bip-utils>=2.12
|
|
email-validator>=2.0
|
|
email-validator>=2.0.0
|
|
websockets>=12.0
|