[Fix] passlib 제거 및 bcrypt 직접 사용으로 호환성 문제 해결

[zweadfx]

어떤 변경사항인가요?

passlib이 bcrypt 4.x 이상과 호환되지 않아 발생하는 회원가입/로그인 500 에러를 수정했습니다. passlib 의존성을 제거하고 bcrypt를 직접 사용하도록 변경했습니다.

작업 상세 내용

• src/core/security.py — passlib.CryptContext 제거, bcrypt.hashpw / bcrypt.checkpw 직접 사용으로 교체
• pyproject.toml — passlib[bcrypt]>=1.7 제거, bcrypt>=4.0 명시

체크리스트

• self-test를 수행하였는가?
• 관련 문서나 주석을 업데이트하였는가?
• 설정한 코딩 컨벤션을 준수하였는가?

관련 이슈

• 관련 이슈: [Fix] passlib과 bcrypt 버전 호환성 문제로 회원가입/로그인 500 에러 발생 #85

리뷰 포인트

• verify_password에서 bcrypt 예외를 except Exception으로 처리 — bcrypt가 잘못된 해시 포맷 등에서 다양한 예외를 던지기 때문
• 기존 passlib으로 생성된 해시가 있는 경우 $2b$ prefix 포맷이 동일하므로 하위 호환 문제 없음

참고사항 및 스크린샷(선택)

• chromadb>=1.5가 bcrypt>=4.0.1을 의존하므로 passlib 버전 다운그레이드 방식으로는 해결 불가

Summary by CodeRabbit

• Chores
  • Updated password security library dependencies to a current, compatible version.
  • Refactored internal password hashing and verification implementation to align with the updated dependency. Existing user passwords remain valid and authentication workflows continue to function without interruption.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: bf3b2ad4-eb88-48d6-ba14-fb1b1105fc44

📥 Commits

Reviewing files that changed from the base of the PR and between e29e66e and 06786ec.

📒 Files selected for processing (1)

• src/core/security.py

🚧 Files skipped from review as they are similar to previous changes (1)

• src/core/security.py

---

📝 Walkthrough

Walkthrough

Password hashing was switched from passlib[bcrypt] to direct bcrypt usage. The project dependency in pyproject.toml was changed and src/core/security.py now hashes and verifies passwords with bcrypt.hashpw() / bcrypt.checkpw() while keeping public function signatures.

Changes

Cohort / File(s)	Summary
Dependency Update pyproject.toml	Replaced passlib[bcrypt]>=1.7 with bcrypt>=4.0 in project dependencies.
Security Functions Refactoring src/core/security.py	Removed passlib.CryptContext usage and import; hash_password() now uses bcrypt.gensalt(rounds=12) + bcrypt.hashpw() and returns a decoded string; verify_password() uses bcrypt.checkpw() with UTF-8 encoding and returns False on ValueError/TypeError.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related issues

• [Fix] passlib과 bcrypt 버전 호환성 문제로 회원가입/로그인 500 에러 발생 #85 — Addresses the same passlib→bcrypt replacement and the passlib–bcrypt compatibility concerns.

Poem

🐇 I hopped from passlib to bcrypt neat,

Hashes warm and checks complete,
Salted rounds with twelvefold cheer,
Securely storing dreams and fear,
A little rabbit hops — code clear.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title in Korean accurately describes the main change: removing passlib and directly using bcrypt to resolve compatibility issues.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/bcrypt-passlib-compatibility

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

pyproject.toml (1)

24-24: Align the direct bcrypt version floor with the effective minimum (>=4.0.1).

Line 24 currently declares bcrypt>=4.0, but chromadb~=1.5 requires bcrypt>=4.0.1 (confirmed in chromadb's PyPI metadata). Matching the direct spec prevents resolver ambiguity and metadata drift.

Proposed diff

-    "bcrypt>=4.0",
+    "bcrypt>=4.0.1",

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@pyproject.toml` at line 24, Update the bcrypt dependency floor in
pyproject.toml from "bcrypt>=4.0" to "bcrypt>=4.0.1" so it matches chromadb's
required minimum and avoids resolver ambiguity; modify the bcrypt entry in
pyproject.toml accordingly and then regenerate your lockfile (or run the
dependency resolver) to ensure the effective metadata matches the declared
constraint.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/core/security.py`:
- Around line 16-19: The try/except in verify_password currently swallows all
exceptions from bcrypt.checkpw; change it to catch only expected input/hash
errors (e.g., ValueError and TypeError) and any bcrypt-specific invalid-hash
exception if available (import and include bcrypt.errors.InvalidSalt or
bcrypt.errors.InvalidHash when present) so malformed/invalid hash inputs return
False while other unexpected exceptions are allowed to propagate or get logged;
update the exception clause around bcrypt.checkpw(plain_password.encode(),
hashed_password.encode()) in verify_password accordingly.

---

Nitpick comments:
In `@pyproject.toml`:
- Line 24: Update the bcrypt dependency floor in pyproject.toml from
"bcrypt>=4.0" to "bcrypt>=4.0.1" so it matches chromadb's required minimum and
avoids resolver ambiguity; modify the bcrypt entry in pyproject.toml accordingly
and then regenerate your lockfile (or run the dependency resolver) to ensure the
effective metadata matches the declared constraint.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 9d399cb2-42de-4279-9a26-2e2faf02f0ed

📥 Commits

Reviewing files that changed from the base of the PR and between a1593e8 and e29e66e.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

• pyproject.toml
• src/core/security.py