refactor(security): migrate password hashing from passlib to pwdlib with argon2 support

app/core/security.py

@@ -7,13 +7,14 @@ from authlib.jose import jwt  # type: ignore
 from authlib.jose.errors import JoseError  # type: ignore
 from fastapi import Depends, HTTPException, status
 from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
-from passlib.context import CryptContext
+from pwdlib import PasswordHash
+from pwdlib.hashers.argon2 import Argon2Hasher
 
 from core.config import settings
 from models.auth import AccessTokenPayload, AuthUserDocument
 from repositories.auth import get_user_by_username, is_token_revoked
 
-pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
+pwd_context = PasswordHash((Argon2Hasher(),))
 bearer_scheme = HTTPBearer(auto_error=False)
 
 
@@ -41,7 +42,7 @@ def hash_password(password: str) -> str:
 
 
 def verify_password(plain_password: str, password_hash: str) -> bool:
-    return pwd_context.verify(plain_password, password_hash)
+    return pwd_context.check(plain_password, password_hash)
 
 
 def create_access_token(*, subject: str) -> str:
@@ -53,14 +54,18 @@ def create_access_token(*, subject: str) -> str:
         "alg": settings.JWT_ALGORITHM,
         "typ": "JWT",
     }
+
     payload = {
         "sub": subject,
         "jti": str(uuid4()),
         "exp": expires_at,
     }
+
     token = jwt.encode(header, payload, settings.JWT_SECRET_KEY)
+
     if isinstance(token, bytes):
         return token.decode("utf-8")
+
     return token