Hash and verify passwords off the event loop (B-55)

Argon2 is deliberately expensive — tens of milliseconds of CPU per call. Called
inline from the async handlers for register, login, change-password and the
admin reset, that cost froze the entire process for its duration: every other
request, plus all six background tasks (scheduler, confirmation poller, RBF
bumper, listener, both reconcilers). A burst of unauthenticated login attempts
was therefore not just slow logins, it delayed draws and confirmations.

hash_password_async/verify_password_async wrap the existing pair in
run_in_threadpool, and every async caller now uses them. The synchronous
functions stay: they're what the wrappers call, and what tests and scripts (no
running loop) use directly.

The regression test runs a heartbeat task alongside the hashing and counts how
often the loop got to run it — 1 tick with the old inline call, many with the
threadpooled one.

Also drops the running "already fixed and removed" list from BUGS.md: the file
tracks open findings, and `git log --all --grep 'B-nn'` is the record of how a
closed one was closed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/api/routes/admin.py

@@ -8,7 +8,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.api.timeutil import isoformat_utc
 from app.audit.log import write_audit_log
-from app.auth.security import hash_password
+from app.auth.security import hash_password_async
 from app.config import settings
 from app.db.models import AuditLog, BugReport, PendingTransaction, Round, User
 from app.db.session import get_session
@@ -217,7 +217,7 @@ async def reset_user_password(
         raise HTTPException(status.HTTP_404_NOT_FOUND, "user not found")
 
     new_password = secrets.token_urlsafe(12)
-    user.password_hash = hash_password(new_password)
+    user.password_hash = await hash_password_async(new_password)
     # B-34: this endpoint exists precisely for the "account compromised" case —
     # without bumping token_version, whoever was already logged in (the
     # attacker, if that's who prompted the reset) stayed logged in on their

app/api/routes/users.py

@@ -6,7 +6,12 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from app.api.errors import http_error
 from app.api.timeutil import isoformat_utc
 from app.auth.dependencies import get_current_user
-from app.auth.security import MIN_PASSWORD_LENGTH, create_access_token, hash_password, verify_password
+from app.auth.security import (
+    MIN_PASSWORD_LENGTH,
+    create_access_token,
+    hash_password_async,
+    verify_password_async,
+)
 from app.db.models import Round, RoundParticipant, User
 from app.db.session import get_session
 from app.wallet.balance import compute_pending_balance
@@ -59,7 +64,7 @@ async def change_password(
     """Self-service password change — requires the current password, unlike the
     admin-only /admin/users/{id}/reset-password (which is for a user who's
     actually locked out and can't provide it)."""
-    if not verify_password(body.current_password, user.password_hash):
+    if not await verify_password_async(body.current_password, user.password_hash):
         raise http_error(
             status.HTTP_401_UNAUTHORIZED, "current_password_incorrect", "current password is incorrect"
         )
@@ -71,7 +76,7 @@ async def change_password(
             minimum=MIN_PASSWORD_LENGTH,
         )
 
-    user.password_hash = hash_password(body.new_password)
+    user.password_hash = await hash_password_async(body.new_password)
     # B-34: bumping token_version invalidates every token issued before this
     # point — including this very request's own bearer token, and any an
     # attacker who knew the old password might be holding. A fresh token is

app/auth/routes.py

@@ -7,7 +7,12 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from app.api.client_ip import client_ip as _client_ip
 from app.api.errors import http_error
 from app.auth.rate_limit import AuthRateLimiters
-from app.auth.security import MIN_PASSWORD_LENGTH, create_access_token, hash_password, verify_password
+from app.auth.security import (
+    MIN_PASSWORD_LENGTH,
+    create_access_token,
+    hash_password_async,
+    verify_password_async,
+)
 from app.db.models import User
 from app.db.session import get_session
 from app.wallet.hd import derive_user_address
@@ -74,7 +79,7 @@ async def register(
     if existing is not None:
         raise http_error(status.HTTP_409_CONFLICT, "username_taken", "username already taken")
 
-    password_hash = hash_password(body.password)
+    password_hash = await hash_password_async(body.password)
 
     for _ in range(_MAX_REGISTER_RETRIES):
         max_index = await session.scalar(select(func.max(User.derivation_index)))
@@ -130,7 +135,7 @@ async def login(
         raise _rate_limited_error(retry_after)
 
     user = await session.scalar(select(User).where(User.username == body.username))
-    if user is None or not verify_password(body.password, user.password_hash):
+    if user is None or not await verify_password_async(body.password, user.password_hash):
         # Same code path (and therefore the same response) whether the username
         # doesn't exist or the password is wrong — no enumeration oracle here.
         limiters.login.record_failure(username_key)

app/auth/security.py

@@ -5,6 +5,7 @@ import logging
 import jwt
 from argon2 import PasswordHasher
 from argon2.exceptions import InvalidHashError, VerificationError
+from starlette.concurrency import run_in_threadpool
 
 from app.config import settings
 
@@ -39,6 +40,28 @@ def verify_password(password: str, password_hash: str) -> bool:
         return False
 
 
+# --- B-55: the two Argon2 calls above must never run on the event loop ----------
+# Argon2 is deliberately expensive — tens of milliseconds of CPU per call, by
+# design. Called straight from an async handler that stalls the *whole* process
+# for that long: every other request, and all six background tasks (scheduler,
+# confirmation poller, RBF bumper, listener, both reconcilers). A burst of
+# unauthenticated login attempts was therefore a cheap way to delay draws and
+# confirmations, not just to slow down logins. The threadpool keeps the cost
+# where it belongs — on a worker thread, with the loop free to run everything
+# else meanwhile.
+#
+# The synchronous functions stay: they're what the wrappers call, and what tests
+# and scripts (no running loop) use directly. Every async caller must use these.
+
+
+async def hash_password_async(password: str) -> str:
+    return await run_in_threadpool(hash_password, password)
+
+
+async def verify_password_async(password: str, password_hash: str) -> bool:
+    return await run_in_threadpool(verify_password, password, password_hash)
+
+
 def create_access_token(user_id: int, token_version: int = 0) -> str:
     expires_at = datetime.now(timezone.utc) + timedelta(minutes=settings.jwt_expire_minutes)
     # "tv" lets get_current_user (app/auth/dependencies.py) reject a token issued