fix: drop passlib, hash with bcrypt directly

passlib 1.7.4 imports bcrypt.__about__ at module load to detect the
bcrypt version. That attribute was removed in bcrypt 4.x, so once
the dependabot bcrypt 5.0.0 bump lands, passlib raises AttributeError
on import and the backend fails its health check at startup.

passlib is effectively unmaintained (last release 2020). Rather than
work around the import, replace the CryptContext usage in
src/app/core/security.py with direct bcrypt calls — the API surface
we use is just hashpw/checkpw plus a salt.

Also pin the pyro-camera-api-client git dep via [tool.uv.sources]
so 'uv sync --locked' stays stable after this lockfile change.

Author: Mateo Lostanlen

pyproject.toml

@@ -12,6 +12,7 @@ package = false
 
 [tool.uv.sources]
 pyroclient = { path = "client", editable = true }
+pyro-camera-api-client = { git = "https://github.com/pyronear/pyro-engine.git", subdirectory = "pyro_camera_api/client", rev = "6d525b150a764447e62beec26e39702f71d8461e" }
 
 [dependency-groups]
 server = [
@@ -21,7 +22,6 @@ server = [
     "pydantic-settings>=2.0.0,<3.0.0",
     "requests>=2.32.0,<3.0.0",
     "PyJWT>=2.12.0,<3.0.0",
-    "passlib[bcrypt]>=1.7.4,<2.0.0",
     "bcrypt==5.0.0",
     "uvicorn>=0.11.1,<1.0.0",
     "asyncpg>=0.25.0,<1.0.0",
@@ -33,7 +33,7 @@ server = [
     "python-magic>=0.4.17,<0.5.0",
     "boto3>=1.26.0,<1.36.0", # https://github.com/boto/boto3/issues/4435
     "httpx>=0.24.0,<1.0.0",
-    "pyro-camera-api-client @ git+https://github.com/pyronear/pyro-engine.git@main#subdirectory=pyro_camera_api/client",
+    "pyro-camera-api-client",
     "geopy>=2.4.0,<3.0.0",
     "networkx>=3.2.0,<4.0.0",
     "numpy>=2.4.4,<3.0.0",
@@ -48,7 +48,6 @@ quality = [
     "types-requests>=2.0.0",
     "types-python-dateutil>=2.8.0,<3.0.0",
     "sqlalchemy-stubs>=0.4,<0.5",
-    "types-passlib>=1.7.0",
 ]
 test = [
     "pytest==9.0.3",

src/app/core/security.py

@@ -6,16 +6,14 @@
 from datetime import timedelta
 from typing import Any, Dict, Optional
 
+import bcrypt
 import jwt
-from passlib.context import CryptContext
 
 from app.core.config import settings
 from app.core.time import utcnow
 
 __all__ = ["create_access_token", "hash_password", "verify_password"]
 
-pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
-
 
 def create_access_token(content: Dict[str, Any], expires_minutes: Optional[int] = None) -> str:
     """Encode content dict using security algorithm, setting expiration."""
@@ -25,8 +23,8 @@ def create_access_token(content: Dict[str, Any], expires_minutes: Optional[int]
 
 
 def verify_password(plain_password: str, hashed_password: str) -> bool:
-    return pwd_context.verify(plain_password, hashed_password)
+    return bcrypt.checkpw(plain_password.encode("utf-8"), hashed_password.encode("utf-8"))
 
 
 def hash_password(password: str) -> str:
-    return pwd_context.hash(password)
+    return bcrypt.hashpw(password.encode("utf-8"), bcrypt.gensalt()).decode("utf-8")