perf(auth): make password hashing non-blocking and batch CSV user import (#25804)

Co-authored-by: Tim Baek <tim@openwebui.com>

backend/open_webui/utils/auth.py

@@ -158,9 +158,11 @@ def get_license_data(app, key):
 bearer_security = HTTPBearer(auto_error=False)
 
 
-def get_password_hash(password: str) -> str:
-    """Hash a password using bcrypt"""
-    return bcrypt.hashpw(password.encode('utf-8'), bcrypt.gensalt()).decode('utf-8')
+async def get_password_hash(password: str) -> str:
+    """Hash a password using bcrypt in a thread pool (non-blocking)."""
+    import asyncio
+
+    return (await asyncio.to_thread(bcrypt.hashpw, password.encode('utf-8'), bcrypt.gensalt())).decode('utf-8')
 
 
 def validate_password(password: str) -> bool:
@@ -486,7 +488,7 @@ async def create_admin_user(email: str, password: str, name: str = 'Admin'):
 
     log.info(f'Creating admin account from environment variables: {email}')
     try:
-        hashed = get_password_hash(password)
+        hashed = await get_password_hash(password)
         user = await Auths.insert_new_auth(
             email=email.lower(),
             password=hashed,

backend/open_webui/utils/oauth.py

@@ -1871,7 +1871,7 @@ class OAuthManager:
 
                     user = await Auths.insert_new_auth(
                         email=email,
-                        password=get_password_hash(str(uuid.uuid4())),  # Random password, not used
+                        password=await get_password_hash(str(uuid.uuid4())),  # Random password, not used
                         name=name,
                         profile_image_url=picture_url,
                         role=await self.get_user_role(None, user_data),