app/core/security.py:15:pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
app/core/security.py:23:    return pwd_context.hash(p)
app/core/security.py:28:        return pwd_context.verify(plain, hashed)
=== security.py head ===
"""Security primitives: password hashing, JWT, CSRF, rate limiting, audit logging."""
import hashlib
import secrets
import time
from datetime import datetime, timedelta, timezone
from typing import Optional

import jwt
from passlib.context import CryptContext
from sqlalchemy import select
from sqlalchemy.ext.asyncio import AsyncSession

from app.core.config import settings

pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")

# Sensitive values that must never appear in logs or JSON responses.
SENSITIVE_KEYS = {"password", "client_secret", "refresh_token", "authorization_code",
                  "access_token", "secret", "token", "csrf", "new_password", "old_password"}


def hash_password(p: str) -> str:
    return pwd_context.hash(p)


def verify_password(plain: str, hashed: str) -> bool:
    try:
        return pwd_context.verify(plain, hashed)
    except Exception:
        return False


def create_access_token(user_id: int, expires_minutes: Optional[int] = None) -> str:
    payload = {
        "sub": str(user_id),
        "iat": int(time.time()),
        "exp": int(time.time()) + 60 * (expires_minutes or settings.ACCESS_TOKEN_EXPIRE_MINUTES),
        "jti": secrets.token_urlsafe(16),
    }
    return jwt.encode(payload, settings.SECRET_KEY, algorithm="HS256")