"""Password hashing helpers.

Uses the `bcrypt` package directly (not passlib) — passlib's bcrypt backend
is known to break on newer bcrypt releases, so we call bcrypt straight.
bcrypt silently truncates input beyond 72 bytes, so we guard against that.
"""
import bcrypt

_MAX_BCRYPT_BYTES = 72


def hash_password(plain: str) -> str:
    pw = plain.encode("utf-8")[:_MAX_BCRYPT_BYTES]
    return bcrypt.hashpw(pw, bcrypt.gensalt()).decode("utf-8")


def verify_password(plain: str, hashed: str) -> bool:
    try:
        pw = plain.encode("utf-8")[:_MAX_BCRYPT_BYTES]
        return bcrypt.checkpw(pw, hashed.encode("utf-8"))
    except (ValueError, TypeError):
        return False