truncate passwords to 72 bytes to prevent bcrypt hashing errors

main.py

@@ -37,10 +37,11 @@ app = FastAPI()
 app.add_middleware(SessionMiddleware, secret_key=ENCRYPTION_KEY)
 
 def get_password_hash(password):
-    return pwd_context.hash(password)
+    # bcrypt has a 72-byte limit
+    return pwd_context.hash(password[:72])
 
 def verify_password(plain_password, hashed_password):
-    return pwd_context.verify(plain_password, hashed_password)
+    return pwd_context.verify(plain_password[:72], hashed_password)
 
 def init_db():
     conn = sqlite3.connect(DB_PATH)

requirements.txt

@@ -5,4 +5,5 @@ pyotp==2.9.0
 httpx==0.25.1
 pydantic==2.4.2
 itsdangerous==2.1.2
-passlib[bcrypt]==1.7.4
+passlib==1.7.4
+bcrypt==3.2.2