05/22 Enhance codes and fix bugs

app/routes/auth.py

@@ -575,7 +575,9 @@ def change_password():
     current_auth_hash = data.get('current_auth_hash', '')
     new_auth_hash = data.get('new_auth_hash', '')
     new_enc_key_salt = data.get('new_enc_key_salt', '')
-    items = data.get('items', [])  # [{id, enc_data, iv}, ...]
+    items = data.get('items', [])  # [{id, enc_data, iv, enc_name?, iv_name?}, ...]
+    sharing_private_key_enc = data.get('sharing_private_key_enc', '')
+    sharing_private_key_iv = data.get('sharing_private_key_iv', '')
 
     if not current_auth_hash or not new_auth_hash or not new_enc_key_salt:
         return jsonify({'error': 'current_auth_hash, new_auth_hash, and new_enc_key_salt are required'}), 400
@@ -629,6 +631,11 @@ def change_password():
         # Clear recovery data — it was encrypted with the old vault key and is now invalid
         user.recovery_enc_salt = None
         user.recovery_iv = None
+        # Re-encrypt sharing private key with new vault key if the client sent it.
+        # Without this update, the old ciphertext would be undecryptable after key rotation.
+        if sharing_private_key_enc and sharing_private_key_iv:
+            user.sharing_private_key_enc = sharing_private_key_enc
+            user.sharing_private_key_iv = sharing_private_key_iv
 
         AuditLog.log(
             user_id=user.id,
@@ -976,7 +983,13 @@ def recovery_items():
     items = VaultItem.query.filter_by(user_id=user.id).all()
     return jsonify({
         'items': [
-            {'id': item.id, 'enc_data': item.enc_data, 'iv': item.iv}
+            {
+                'id': item.id,
+                'enc_data': item.enc_data,
+                'iv': item.iv,
+                'enc_name': item.enc_name,
+                'iv_name': item.iv_name,
+            }
             for item in items
         ]
     }), 200