Consider using argon2-cffi directly and dropping passlib

[legoktm]

passlib was introduced in #2918, on the basis that it would give us "future proof and easily migrateable password management should we change password hashing algorithms/parameters."

Unfortunately passlib looks unmaintained (no commits in 2 years and the upstream issue tracker has literal spam tickets sitting for weeks). We're also not using any of the migration functionality, we're just invoking argon2 hashing directly:

        self.passphrase_hash = argon2.using(**ARGON2_PARAMS).hash(passphrase)

I don't think the migration functionality is worth the ~20k lines of Python passlib brings in (counted by tokei, minus tests). If we need migration, we'd probably implement it with something like:

if hash.startswith('$argon2'):
    verify_argon2(hash, passphrase)
    self.passprase_hash = hash_passphrase(passphrase)
    self.save()
else:
    verify_modern(hash, passphrase)

So my preference would be to drop passlib and use argon2-cffi directly.

[legoktm]

Discussed at yesterday's team meeting and got a 👍🏾 to move forward on this and #6655.

[legoktm]

argon2-cffi handles migrations pretty well. First it reads the algorithm out of the generated hash, so we don't need any special handling for argon2i vs argon2id. Then it has a check_needs_rehash(hash) function which checks for type and any other parameters (like iterations, etc.) being out of sync and recommending a rehash if so. So going forward, if we want, we can increase the strength of the hashes pretty transparently.