Restrict bcrypt version to <5

[Minei3oat]

Starting with version 5.0.0, bcrypt will throw a ValueError if the input is more than 72 bytes.
passlib's hash processes the input such that more than 72 bytes are passed to bcrypt, independently of the input length. As a result, the backend of firegex breaks when calculating the hash in set_psw.

[koraynilay]

Hi, thank you for the PR, but I think it would be better to just switch to bcrypt's own password hashing (using gensalt(), hashpw and checkpw()) and then remove passlib (since it's only used there anyway).

possible guide

[domysh]

I will check better this issue in the next days, after that I will release a version with all the changes on pull request you done.

Thank you for supporting this project

[domysh]

I will consider changing library, or the way the password is managed, but as now, I will merge this change and release now the new version

[Minei3oat]

In case of a migration, I propose migrating to python's internal hashlib.

For example:

import hashlib

def hash_psw(psw: str):
    salt = db.get("salt")
    if not salt:
        salt = secrets.token_hex(32)
        db.put("salt", salt)
    return hashlib.pbkdf2_hmac("sha256", psw.encode(), salt.encode(), 500_000).hex()

def set_psw(psw: str):
    db.put("password", hash_psw(psw))

async def login_api(form: OAuth2PasswordRequestForm = Depends()):
    # ...
    if db.get("password") == hash_psw(form.password):
        return {"access_token": create_access_token({"logged_in": True}), "token_type": "bearer"}

[domysh]

I'm following your changes, thanks again!