05/02/2026 updated code for security 4

app/routes/sharing.py

@@ -233,19 +233,21 @@ def accept_share(share_id):
     share.accepted = True
     share.recipient_id = user.id
 
+    # Look up owner email for the audit log before committing
+    owner = db.session.get(User, share.owner_id)
+    owner_email = owner.email if owner else f'user_id={share.owner_id}'
+
     AuditLog.log(
         user_id=g.current_user_id,
         action='shared_item.accept',
         resource_type='shared_item',
         resource_id=share.id,
-        detail=f'Accepted shared item "{share.item_name}" from {share.recipient_email}',
+        detail=f'Accepted shared item "{share.item_name}" from {owner_email}',
         ip_address=_client_ip(),
     )
     db.session.commit()
 
     d = share.to_dict()
-    owner = db.session.get(User, share.owner_id)
-    d['owner_email'] = owner.email if owner else 'Unknown'
+    d['owner_email'] = owner_email
     d['owner_public_key'] = owner.sharing_public_key if owner else None
-    return jsonify(d), 200
-
+    return jsonify(d), 200

app/routes/vault.py

@@ -104,16 +104,27 @@ def update_item(item_id):
     if 'iv_name' in data:
         item.iv_name = data['iv_name'] or None
 
-    db.session.flush()
-    AuditLog.log(
-        user_id=g.current_user_id,
-        action='vault_item.update',
-        resource_type='vault_item',
-        resource_id=item.id,
-        detail=f'Updated item: "{item.name}"',
-        ip_address=_client_ip(),
-    )
-    db.session.commit()
+    # Explicitly set updated_at — SQLAlchemy's onupdate lambda only fires when
+    # it detects a column-level change, which can be skipped if the session
+    # dirty-tracking misses a mutation (e.g. only enc_data/iv changed).
+    from datetime import datetime, timezone
+    item.updated_at = datetime.now(timezone.utc).replace(tzinfo=None)
+
+    try:
+        db.session.flush()
+        AuditLog.log(
+            user_id=g.current_user_id,
+            action='vault_item.update',
+            resource_type='vault_item',
+            resource_id=item.id,
+            detail=f'Updated item: "{item.name}"',
+            ip_address=_client_ip(),
+        )
+        db.session.commit()
+    except Exception as e:
+        db.session.rollback()
+        return jsonify({'error': f'Database error: {str(e)}'}), 500
+
     return jsonify(item.to_dict()), 200
 
 
@@ -217,4 +228,4 @@ def import_items():
             ip_address=_client_ip(),
         )
         db.session.commit()
-    return jsonify({'imported': imported, 'skipped': skipped}), 200
+    return jsonify({'imported': imported, 'skipped': skipped}), 200