Missing `cryptography` dependency breaks `/account/login` (regression from #12724)

[RsbhThakur]

Problem

A recent commit has accidentally removed cryptography==44.0.2 from requirements.txt. Because the core /account/login process imports and relies on cryptography.fernet.Fernet to encrypt S3 keys into session cookies, any clean build or new installation of the Open Library environment completely fails to log in, raising a ModuleNotFoundError and throwing a 500 Internal Server Error.

During login attempts, the traceback screen shows:

<class 'ModuleNotFoundError'> at /account/login
No module named 'cryptography'

Traceback:
Python  /openlibrary/openlibrary/accounts/model.py in _get_fernet, line 90
        def _get_fernet():
            from cryptography.fernet import Fernet

Root Cause Analysis

1. Commit e420e4506 ("feat(security): store S3 keys as encrypted session cookie") introduced cookie-based encryption for S3 keys. This feature imported cryptography.fernet.Fernet and pinned cryptography==44.0.2 in requirements.txt.
2. Commit 3ee6fa309 ("feat(proxy): route outbound requests through single authenticated http_proxy (feat(proxy): route outbound requests through single authenticated http_proxy #12724)") updated outbound requests proxy settings. During this commit, cryptography==44.0.2 was accidentally omitted/deleted from requirements.txt (likely due to an outdated local environment or merge conflict misresolution), while the application code (openlibrary/accounts/model.py) still expects it.

Proposed Fix

Add cryptography==44.0.2 back to requirements.txt under beautifulsoup4:

diff --git a/requirements.txt b/requirements.txt
index e1631b8fc..6e22e9408 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -3,6 +3,7  @@ amightygirl.paapi5-python-sdk==1.0.0
 APScheduler==3.11.2
 Babel==2.18.0
 beautifulsoup4==4.14.3
+cryptography==44.0.2
 eventer==0.1.1
 fastapi==0.136.3
 feedparser==6.0.12

Reproducing the bug

Method 1

1. Uninstall the package from your running container:

   docker compose exec -u root web python3 -m pip uninstall -y cryptography
   docker compose exec -u root fast_web python3 -m pip uninstall -y cryptography

2. Restart the web services to force Python to reload packages from disk:

   docker compose restart web fast_web

3. Go to http://localhost:8080/account/login and try to log in.
   • Expected behavior: Login succeeds and redirects you.
   • Actual behavior: Server responds with a 500 Internal Server Error due to ModuleNotFoundError: No module named 'cryptography'.

Method 2:

In any fresh setup (like CI/CD pipelines, staging/production builds, or clean checkouts):

1. Build the base image from scratch (ensuring local virtual environments like .venv are deleted or ignored so they don't break the build context on Windows):

   docker build -f docker/Dockerfile.olbase -t openlibrary/olbase:latest .

2. Build the development containers on top of your new base image:

   docker compose build --no-cache && docker compose up -d

3. Go to http://localhost:8080/account/login and attempt to log in.
   • Expected behavior: Login succeeds and redirects you.
   • Actual behavior: Login crashes with ModuleNotFoundError: No module named 'cryptography'.

Context

• Browser (Chrome, Safari, Firefox, etc):
• OS (Windows, Mac, etc):
• Logged in (Y/N):
• Environment (prod, dev, local): prod

Breakdown

Implementation Details (for maintainers)

Requirements Checklist

• [ ]

Related files

Stakeholders

---

Instructions for Contributors

• Please run these commands to ensure your repository is up to date before creating a new branch to work on this issue and each time after pushing code to Github, because the pre-commit bot may add commits to your PRs upstream.

[openlibrary-bot]

Thank you @RsbhThakur for submitting this issue!

⚠️ Contributors, this is a login regression that blocks fresh installs and clean builds. It is ready to work on — the fix is a single-line change to requirements.txt.

---

Context

The root cause has been independently confirmed against the current master branch:

• openlibrary/accounts/model.py (lines 89–116 on origin/master) defines _get_fernet() which does from cryptography.fernet import Fernet, and a second import from cryptography.fernet import InvalidToken. Both are live in the current codebase.
• PR feat(security): store S3 keys as encrypted session cookie #12860 (merged 2026-06-25) correctly added cryptography==44.0.2 to requirements.txt alongside the Fernet cookie logic.
• PR feat(proxy): route outbound requests through single authenticated http_proxy #12724 (merged 2026-06-27) — the proxy refactor — included a requirements.txt diff that removed cryptography==44.0.2 as a side effect of updating the file. The import in model.py was not touched, leaving the dependency uninstalled on fresh environments.
• Current requirements.txt on origin/master does not contain cryptography. The proposed one-line fix in the issue body is correct.

No existing open PR addresses this regression.

---

Issue Assessment

Action items

• Open a PR adding cryptography==44.0.2 back to requirements.txt (alphabetically, under beautifulsoup4) — the exact diff in the issue body is correct. This is the complete fix; no other files need to change.

---

Full triage checklist (maintainers / Richy)

• Triage — correct labels applied (Type: Bug, Priority: 1; Needs: Breakdown removed — one-line fix requires no breakdown)
• Problem / opportunity — problem is clear: login fails with ModuleNotFoundError on fresh installs
• Scope — tightly scoped: one-line requirements.txt change
• Justification — critical regression; any clean Docker build or CI environment cannot log in
• Success & testing criteria — login succeeds after adding the dependency back; can be reproduced via the uninstall/restart method in the issue
• Proposal & breakdown — proposed diff is correct and complete; no further breakdown needed
• Richy context — codebase confirmed: model.py imports cryptography.fernet; PR feat(proxy): route outbound requests through single authenticated http_proxy #12724 is the regressing commit; no fix PR exists yet
• References — screenshot, traceback, and git commit references all present

Note

This comment was automatically generated by Richy, via PAM, Open Library's Project AI Manager, on behalf of @mekarpeles. Richy is designed to provide status visibility, perform basic project management functions and relevant codebase research, and provide actionable feedback so contributors aren't left waiting.

[RsbhThakur]

I have opened a Pull Request (#13056) restoring cryptography back to requirements.txt.
All local pre-commit checks passed successfully, and I've verified that rebuilding the containers fully restores login functionality.

[RsbhThakur]

I noticed the cryptography fix has just been merged as part of the rebase cleanup in #13063. Since the issue is resolved now, I'll close this Issue. Glad to see it sorted out!