Adding LDAP support

app/core/security.py

@@ -1,6 +1,7 @@
 """Password hashing and JWT token helpers."""
 
 import hashlib
+import secrets
 import uuid
 from datetime import UTC, datetime, timedelta
 
@@ -27,6 +28,16 @@ def verify_password(password: str, hashed: str) -> bool:
         return False
 
 
+def make_unusable_password() -> str:
+    """A sentinel hash that no password can match.
+
+    Used for externally-authenticated users (e.g. LDAP) who have no local
+    password. It is not a valid bcrypt hash, so ``verify_password`` always
+    returns ``False`` for it — local password auth can never succeed.
+    """
+    return "!" + secrets.token_urlsafe(32)
+
+
 # --- JWT ---------------------------------------------------------------------