Use password hashes for authentication

app.py

@@ -5,6 +5,7 @@ Flask app with HTTP Basic Authentication
 
 from flask import Flask, render_template, request, send_file, send_from_directory, jsonify
 from flask_httpauth import HTTPBasicAuth
+from werkzeug.security import check_password_hash
 from functools import wraps
 import os
 from datetime import datetime
@@ -19,12 +20,24 @@ auth = HTTPBasicAuth()
 
 # Benutzer für Beta-Phase (in Produktion aus env-Variablen laden!)
 BETA_USERS = {
-    "beta": "rollcalc_beta_2026",   # ⚠️ ÄNDERN!
-    "naue": "naue_access_2026",     # ⚠️ ÄNDERN!
-    "cniehues": "beta_test_2026",   # ⚠️ ÄNDERN!
-    "lvollmert": "Geheim!",         # ⚠️ ÄNDERN!
-    "mtazl": "rollcalc",            # ⚠️ ÄNDERN!
-    "controlling": "beta2026"       # ⚠️ ÄNDERN!
+    "beta": {
+        "password_hash": "pbkdf2:sha256:600000$HNtF3VdZKdmtg8Vw$8f976a99a457c5e924916dc6f735dd631042c8c126af8d4bda9abcd7532d904f"
+    },
+    "naue": {
+        "password_hash": "pbkdf2:sha256:600000$RVPiW2mYXJJIp3d7$0f838b8619d386e2da57e60ae8ccb944bb0f9f63d81ce3d174ec3034b0abcd19"
+    },
+    "cniehues": {
+        "password_hash": "pbkdf2:sha256:600000$iNmhakf34xk26xrz$ae78846461370c52b7f56fad5ac0ae8e33860d6f00075ac78e3a5b8c31d51a3d"
+    },
+    "lvollmert": {
+        "password_hash": "pbkdf2:sha256:600000$8FGop5ymmHpuIqfK$8ba223e20c514cf6bc1297435a2e7e2be81668951297f0e01ad6a931718ad7de"
+    },
+    "mtazl": {
+        "password_hash": "pbkdf2:sha256:600000$H19skoalhWxlLnY5$d30bfeae38470b19900648fd110978b3677607c3a161d663a7e5d5c2167a3710"
+    },
+    "controlling": {
+        "password_hash": "pbkdf2:sha256:600000$ksj86lrKz6nnSpXz$5161e0b5c76bd72d6b2cd04866ef49e69f463f474d7e47075171894bf3366f29"
+    }
 }
 
 # Logging für Auditing
@@ -74,7 +87,12 @@ def inject_build_info():
 @auth.verify_password
 def verify_password(username, password):
     """Verify HTTP Basic Auth credentials"""
-    if username in BETA_USERS and BETA_USERS[username] == password:
+    user_config = BETA_USERS.get(username)
+    if not user_config:
+        return None
+
+    password_hash = user_config.get("password_hash")
+    if password_hash and check_password_hash(password_hash, password):
         return username
     return None