new changes

YakPanel-server/backend/app/core/security.py

@@ -6,7 +6,8 @@ from passlib.context import CryptContext
 from app.core.config import get_settings
 
 settings = get_settings()
-pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
+# bcrypt_sha256: SHA-256 pre-hash then bcrypt (no 72-byte limit); bcrypt: verify legacy hashes
+pwd_context = CryptContext(schemes=["bcrypt_sha256", "bcrypt"], deprecated="auto")
 
 
 def verify_password(plain_password: str, hashed_password: str) -> bool:
@@ -15,7 +16,7 @@ def verify_password(plain_password: str, hashed_password: str) -> bool:
 
 
 def get_password_hash(password: str) -> str:
-    """Hash a password"""
+    """Hash a password (uses bcrypt_sha256; bcrypt only supports 72 raw bytes)."""
     return pwd_context.hash(password)
 
 

YakPanel-server/backend/requirements.txt

@@ -12,6 +12,8 @@ asyncpg>=0.29.0
 # Auth
 python-jose[cryptography]>=3.3.0
 passlib[bcrypt]>=1.7.4
+# passlib 1.7.4 breaks against bcrypt>=4.1 (ValueError in bcrypt self-test / 72-byte rules)
+bcrypt>=4.0.1,<4.1
 python-dotenv>=1.0.0
 
 # Redis & Celery