05/02/2026 updated code for security 4

app/routes/vault.py

@@ -104,16 +104,27 @@ def update_item(item_id):
     if 'iv_name' in data:
         item.iv_name = data['iv_name'] or None
 
-    db.session.flush()
-    AuditLog.log(
-        user_id=g.current_user_id,
-        action='vault_item.update',
-        resource_type='vault_item',
-        resource_id=item.id,
-        detail=f'Updated item: "{item.name}"',
-        ip_address=_client_ip(),
-    )
-    db.session.commit()
+    # Explicitly set updated_at — SQLAlchemy's onupdate lambda only fires when
+    # it detects a column-level change, which can be skipped if the session
+    # dirty-tracking misses a mutation (e.g. only enc_data/iv changed).
+    from datetime import datetime, timezone
+    item.updated_at = datetime.now(timezone.utc).replace(tzinfo=None)
+
+    try:
+        db.session.flush()
+        AuditLog.log(
+            user_id=g.current_user_id,
+            action='vault_item.update',
+            resource_type='vault_item',
+            resource_id=item.id,
+            detail=f'Updated item: "{item.name}"',
+            ip_address=_client_ip(),
+        )
+        db.session.commit()
+    except Exception as e:
+        db.session.rollback()
+        return jsonify({'error': f'Database error: {str(e)}'}), 500
+
     return jsonify(item.to_dict()), 200
 
 
@@ -217,4 +228,4 @@ def import_items():
             ip_address=_client_ip(),
         )
         db.session.commit()
-    return jsonify({'imported': imported, 'skipped': skipped}), 200
+    return jsonify({'imported': imported, 'skipped': skipped}), 200