From 78a96e092f6fcc4b5bd8bddce28a1c58bb30218c Mon Sep 17 00:00:00 2001
From: Nguyen Ngo <ngodanguyen@gmail.com>
Date: Mon, 18 May 2026 21:54:47 -0400
Subject: [PATCH] 05/18 Enhanced codes and functionalities 10

---
 app/models/emergency_access.py | 25 +++++++++++++++++++++++++
 app/static/js/vault.js         | 10 ++++++++++
 2 files changed, 35 insertions(+)

diff --git a/app/models/emergency_access.py b/app/models/emergency_access.py
index a6ce9e9..146cf87 100644
--- a/app/models/emergency_access.py
+++ b/app/models/emergency_access.py
@@ -62,4 +62,29 @@ class EmergencyAccess(db.Model):
                 self.request_initiated_at.isoformat() if self.request_initiated_at else None
             ),
             'created_at': self.created_at.isoformat() if self.created_at else None,
+            # True when enc_vault contains items in the old format (has a plaintext
+            # 'name' field instead of enc_name/iv_name). Grantor should re-provision.
+            'enc_vault_is_legacy': self._enc_vault_is_legacy(),
         }
+
+    def _enc_vault_is_legacy(self) -> bool:
+        """
+        Return True if the stored enc_vault snapshot was created before the
+        enc_name migration — i.e. any item has a 'name' key (plaintext) but
+        lacks 'enc_name'. Returns False if no snapshot exists or all items
+        use the new format.
+        """
+        if not self.enc_vault:
+            return False
+        try:
+            import json
+            items = json.loads(self.enc_vault)
+            if not isinstance(items, list):
+                return False
+            # Old format: item has 'name' and no 'enc_name'
+            return any(
+                isinstance(item, dict) and 'name' in item and 'enc_name' not in item
+                for item in items
+            )
+        except (ValueError, TypeError):
+            return False
\ No newline at end of file
diff --git a/app/static/js/vault.js b/app/static/js/vault.js
index 0dd04e7..acbb513 100644
--- a/app/static/js/vault.js
+++ b/app/static/js/vault.js
@@ -1816,6 +1816,16 @@ const Vault = (() => {
         if (g.status === "accepted") {
           actions = `<button class="btn-primary btn-sm" data-provide="${g.id}">Provide Recovery Data</button>`;
         }
+        if (g.status === "ready") {
+          // Check if the stored snapshot is in the old format (plaintext names).
+          if (g.enc_vault_is_legacy) {
+            actions = `
+              <span class="badge badge-warn" title="Recovery snapshot contains plaintext item names. Re-provision to encrypt them.">⚠ Outdated snapshot</span>
+              <button class="btn-primary btn-sm" data-provide="${g.id}">Re-provision</button>`;
+          } else {
+            actions = `<button class="btn-secondary btn-sm" data-provide="${g.id}">Update Recovery Data</button>`;
+          }
+        }
         if (g.status === "pending") {
           const waitInfo = g.wait_elapsed
             ? "Wait period elapsed"