switch password hashing to bcrypt and move the accounts database to be in the same database as everything else.

database/db_commands.py

@@ -1,30 +1,19 @@
 from datetime import datetime
-from database.db_connection import get_db, get_accounts_db
+from database.db_connection import get_db, get_db
 import hashlib
 import os
-
-
-def _hash_password(password: str, salt: str = None):
-    if salt is None:
-        salt = os.urandom(16).hex()
-    pw_hash = hashlib.sha256((salt + password).encode()).hexdigest()
-    return f"{salt}${pw_hash}"
-
-
-def _verify_password(stored: str, password: str) -> bool:
-    salt, _ = stored.split("$", 1)
-    return stored == _hash_password(password, salt)
+import bcrypt
 
 
 def register_user(username, email, password, account_type="private_user"):
-    with get_accounts_db() as conn:
+    with get_db() as conn:
         existing = conn.execute(
             "SELECT user_id FROM users WHERE username = ? OR email = ?",
             (username, email)
         ).fetchone()
         if existing:
             raise ValueError("A user with that username or email already exists.")
-        password_hash = _hash_password(password)
+        password_hash = bcrypt.hashpw(password.encode(), bcrypt.gensalt(14))
         conn.execute("""
             INSERT INTO users (username, email, password_hash, account_type, created_at)
             VALUES (?, ?, ?, ?, ?)
@@ -32,7 +21,7 @@ def register_user(username, email, password, account_type="private_user"):
 
 
 def login_user(username, password):
-    with get_accounts_db() as conn:
+    with get_db() as conn:
         row = conn.execute(
             "SELECT * FROM users WHERE username = ?",
             (username,)
@@ -40,7 +29,7 @@ def login_user(username, password):
         if not row:
             raise ValueError("Invalid username or password.")
         user = dict(row)
-        if not _verify_password(user["password_hash"], password):
+        if not bcrypt.checkpw(password.encode(), user["password_hash"]):
             raise ValueError("Invalid username or password.")
         return {k: user[k] for k in ("user_id", "username", "email", "account_type")}
 

database/db_connection.py

@@ -2,35 +2,28 @@ import sqlite3
 from contextlib import contextmanager
 
 DATABASE_PATH = "database/database.db"
-ACCOUNTS_DATABASE_PATH = "database/accounts.db"
+
+db = sqlite3.connect(DATABASE_PATH, check_same_thread=False)
+db.row_factory = sqlite3.Row
+db.execute("""
+    CREATE TABLE IF NOT EXISTS users (
+        user_id INTEGER PRIMARY KEY AUTOINCREMENT,
+        username TEXT UNIQUE NOT NULL,
+        email TEXT UNIQUE NOT NULL,
+        password_hash TEXT NOT NULL,
+        account_type TEXT NOT NULL DEFAULT 'private_user',
+        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+    )
+""")
+db.commit()
 
 @contextmanager
 def get_db():
-    conn = sqlite3.connect(DATABASE_PATH)
-    conn.row_factory = sqlite3.Row
+    conn = db.cursor()
     try:
         yield conn
-        conn.commit()
-    finally:
-        conn.close()
-
-@contextmanager
-def get_accounts_db():
-    conn = sqlite3.connect(ACCOUNTS_DATABASE_PATH)
-    conn.row_factory = sqlite3.Row
-    conn.execute("""
-        CREATE TABLE IF NOT EXISTS users (
-            user_id INTEGER PRIMARY KEY AUTOINCREMENT,
-            username TEXT UNIQUE NOT NULL,
-            email TEXT UNIQUE NOT NULL,
-            password_hash TEXT NOT NULL,
-            account_type TEXT NOT NULL DEFAULT 'private_user',
-            created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
-        )
-    """)
-    conn.commit()
-    try:
-        yield conn
-        conn.commit()
+        db.commit()
+    except:
+        db.rollback()
     finally:
         conn.close()

database/db_init.py

@@ -1,4 +1,4 @@
-from database.db_connection import get_db, get_accounts_db
+from database.db_connection import get_db, get_db
 from datetime import datetime
 
 SEED_SPECIES = [
@@ -137,7 +137,7 @@ def seed_species():
 
 
 def init_accounts_database():
-    with get_accounts_db() as conn:
+    with get_db() as conn:
         conn.execute("""
         CREATE TABLE IF NOT EXISTS users (
             user_id INTEGER PRIMARY KEY AUTOINCREMENT,

requirements.txt

@@ -1,3 +1,4 @@
+bcrypt==5.0.0
 blinker==1.9.0
 click==8.3.1
 Flask==3.1.2