04/16 Upload codebase

app/models/shared_item.py

@@ -0,0 +1,58 @@
+from datetime import datetime
+
+from sqlalchemy.dialects.mysql import INTEGER
+
+from app import db
+
+
+class SharedItem(db.Model):
+    """
+    A vault item shared by one user with another.
+
+    Zero-knowledge: enc_data is re-encrypted by the SENDER using the ECDH shared
+    secret derived from sender's private key + recipient's P-256 public key.
+    The server stores only the ciphertext — it cannot decrypt it.
+    """
+    __tablename__ = 'shared_items'
+
+    id = db.Column(INTEGER(unsigned=True), autoincrement=True, primary_key=True)
+    item_id = db.Column(
+        INTEGER(unsigned=True),
+        db.ForeignKey('vault_items.id', ondelete='CASCADE'),
+        nullable=False,
+    )
+    owner_id = db.Column(
+        INTEGER(unsigned=True),
+        db.ForeignKey('users.id', ondelete='CASCADE'),
+        nullable=False,
+    )
+    recipient_email = db.Column(db.String(255), nullable=False)
+    recipient_id = db.Column(
+        INTEGER(unsigned=True),
+        db.ForeignKey('users.id', ondelete='SET NULL'),
+        nullable=True,
+    )
+    # Plaintext metadata — not sensitive, used for display before decryption
+    item_name = db.Column(db.String(255), nullable=False)
+    item_type = db.Column(db.String(20), nullable=False, default='password')
+    # ECDH-encrypted payload
+    enc_data = db.Column(db.Text, nullable=False)
+    iv = db.Column(db.String(64), nullable=False)
+
+    accepted = db.Column(db.Boolean, default=False, nullable=False)
+    created_at = db.Column(db.DateTime, default=datetime.utcnow, nullable=False)
+
+    def to_dict(self):
+        return {
+            'id': self.id,
+            'item_id': self.item_id,
+            'owner_id': self.owner_id,
+            'recipient_email': self.recipient_email,
+            'recipient_id': self.recipient_id,
+            'item_name': self.item_name,
+            'item_type': self.item_type,
+            'enc_data': self.enc_data,
+            'iv': self.iv,
+            'accepted': self.accepted,
+            'created_at': self.created_at.isoformat() if self.created_at else None,
+        }