ir/aars
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(auth): switch to bcrypt primary scheme, keep sha256_crypt for migration

Browse Source 
- database.py: CryptContext = ['bcrypt', 'sha256_crypt'] with sha256_crypt deprecated
- database.py: add verify_and_update_password() returning (ok, new_hash)
- main.py: login uses verify_and_update; on successful verify transparently
  commits new bcrypt hash when old hash is sha256_crypt
- requirements.txt: passlib[bcrypt]==1.7.4 + bcrypt==4.0.1 (compat with passlib 1.7.4)

Migration: zero-touch. Admin's first login after this deploy will
auto-upgrade the stored hash from $5$... to $2b$...

Avoids the passlib sha256_crypt cross-version verify bug that bit us
this morning. bcrypt is OpenSSL-native and stable across passlib
versions.
This commit is contained in:
IT狗
2026-07-22 12:07:51 +08:00
parent f6712d9d0e
commit acbc767247
3 changed files with 29 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/requirements.txt
+2 -1
View File
@@ -3,7 +3,8 @@ uvicorn[standard]==0.30.6
sqlalchemy==2.0.35
pydantic==2.9.2
python-jose[cryptography]==3.3.0
passlib==1.7.4
passlib[bcrypt]==1.7.4
bcrypt==4.0.1
python-multipart==0.0.12
openpyxl==3.1.5
reportlab==4.2.5