chore(innkeeper): upgrade bcrypt to 5.x and add 72-byte compat

.gitignore

@@ -13,3 +13,7 @@ plugins/poetry.lock
 .idea
 **/.idea
 .python-version
+
+# pytest-cov
+.coverage
+**/.coverage

plugins/traction_innkeeper/pyproject.toml

@@ -16,12 +16,13 @@ packages = [{include = "traction_innkeeper"}]
 python = "^3.13"
 acapy-agent = { version = "1.5.0rc0" }
 python-dateutil = "^2.9.0"
-bcrypt = "^4.2.1"
+bcrypt = "^5.0.0"
 mergedeep = "^1.3.4"
 typing-extensions = "4.15.0"
 anoncreds = "^0.2.3"
-multitenant-provider = {git = "https://github.com/openwallet-foundation/acapy-plugins", rev = "1.4.0", subdirectory = "multitenant_provider"}
-connections = {git = "https://github.com/openwallet-foundation/acapy-plugins", rev = "1.4.0", subdirectory = "connections"}
+# main: multitenant_provider and connections use bcrypt ^5.0.0
+multitenant-provider = {git = "https://github.com/openwallet-foundation/acapy-plugins", rev = "main", subdirectory = "multitenant_provider"}
+connections = {git = "https://github.com/openwallet-foundation/acapy-plugins", rev = "main", subdirectory = "connections"}
 
 [tool.poetry.group.dev.dependencies]
 ruff = "^0.14.5"

plugins/traction_innkeeper/traction_innkeeper/v1_0/innkeeper/bcrypt_compat.py

@@ -0,0 +1,20 @@
+"""Bcrypt 5.x compatibility: limit password to 72 bytes to avoid ValueError."""
+
+import logging
+
+# Bcrypt 5.0+ raises ValueError for passwords longer than 72 bytes
+BCRYPT_MAX_PASSWORD_BYTES = 72
+
+LOGGER = logging.getLogger(__name__)
+
+
+def limit_for_bcrypt(password_bytes: bytes) -> bytes:
+    """Truncate password to 72 bytes for bcrypt 5.x compatibility."""
+    if len(password_bytes) > BCRYPT_MAX_PASSWORD_BYTES:
+        LOGGER.warning(
+            "Password or key input exceeded 72 bytes (bcrypt limit); truncated to 72 bytes for hashing. "
+            "Original length: %d bytes.",
+            len(password_bytes),
+        )
+        return password_bytes[:BCRYPT_MAX_PASSWORD_BYTES]
+    return password_bytes

plugins/traction_innkeeper/traction_innkeeper/v1_0/innkeeper/tenant_manager.py

@@ -2,6 +2,8 @@
 import logging
 from typing import List, Optional
 
+from .bcrypt_compat import limit_for_bcrypt
+
 from acapy_agent.core.error import BaseError
 from acapy_agent.core.profile import Profile
 from acapy_agent.messaging.models.base import BaseModelError
@@ -240,19 +242,20 @@ def check_reservation_password(
             return None
 
         # make a hash from passed in value with saved salt...
+        pwd_bytes = limit_for_bcrypt(reservation_pwd.encode("utf-8"))
         reservation_token = bcrypt.hashpw(
-            reservation_pwd.encode("utf-8"),
+            pwd_bytes,
             reservation.reservation_token_salt.encode("utf-8"),
         )
         # check the passed in value/hash against the calculated hash.
-        checkpw = bcrypt.checkpw(reservation_pwd.encode("utf-8"), reservation_token)
+        checkpw = bcrypt.checkpw(pwd_bytes, reservation_token)
         self._logger.debug(
             f"bcrypt.checkpw(reservation_pwd.encode('utf-8'), reservation_token) = {checkpw}"
         )
 
         # check the passed in value against the saved hash
         checkpw2 = bcrypt.checkpw(
-            reservation_pwd.encode("utf-8"),
+            pwd_bytes,
             reservation.reservation_token_hash.encode("utf-8"),
         )
         self._logger.debug(
@@ -315,19 +318,20 @@ def check_api_key(self, api_key: str, apiRecord: TenantAuthenticationApiRecord):
             return None
 
         # make a hash from passed in value with saved salt...
+        key_bytes = limit_for_bcrypt(api_key.encode("utf-8"))
         key_token = bcrypt.hashpw(
-            api_key.encode("utf-8"),
+            key_bytes,
             apiRecord.api_key_token_salt.encode("utf-8"),
         )
         # check the passed in value/hash against the calculated hash.
-        checkpw = bcrypt.checkpw(api_key.encode("utf-8"), key_token)
+        checkpw = bcrypt.checkpw(key_bytes, key_token)
         self._logger.debug(
             f"bcrypt.checkpw(api_key.encode('utf-8'), key_token) = {checkpw}"
         )
 
         # check the passed in value against the saved hash
         checkpw2 = bcrypt.checkpw(
-            api_key.encode("utf-8"),
+            key_bytes,
             apiRecord.api_key_token_hash.encode("utf-8"),
         )
         self._logger.debug(