I have an authentication system, where the passwords are stored with bcrypt hash (node passport module).
My server generates a random key (128bytes) at startup.
Whenever a user logs in, the server calculates the SHA-1 of his password (right after a successful authentication), encrypts it using AES with the randomly generated key, and temporarely stores it in a database, along with the other hash.
This SHA-1 sum will be used as an AES key to encrypt/decrypt user information that will be stored in the same database.
Is this method safe?