Aug 26 - Update password detect against off field 2

app/models/user.py

@@ -1,7 +1,5 @@
 from datetime import datetime, timezone
 from flask_login import UserMixin
-from argon2 import PasswordHasher
-from argon2.exceptions import VerifyMismatchError, VerificationError, InvalidHashError
 from sqlalchemy.dialects.mysql import INTEGER
 
 from app import db
@@ -70,12 +68,14 @@ class User(db.Model, UserMixin):
     folders = db.relationship('Folder', backref='owner', lazy='dynamic', cascade='all, delete-orphan')
     vault_items = db.relationship('VaultItem', backref='owner', lazy='dynamic', cascade='all, delete-orphan')
 
-    def check_password(self, auth_hash: str) -> bool:
-        ph = PasswordHasher()
-        try:
-            return ph.verify(self.master_hash, auth_hash)
-        except (VerifyMismatchError, VerificationError, InvalidHashError):
-            return False
+    # NOTE: there is intentionally no check_password() here.
+    #
+    # It existed, was called from nowhere, and used default Argon2 parameters
+    # with no rehash-on-login handling — so any caller that found it would have
+    # silently bypassed the transparent parameter upgrade in
+    # auth_service.verify_auth_token(). Verification goes through
+    # verify_auth_token(auth_hash, user.master_hash, user=user) so the stored
+    # hash is upgraded when ARGON2_* settings change.
 
     def __repr__(self):
         return f'<User {self.email}>'