05/02/2026 updated code for security 4

app/routes/sharing.py

@@ -233,19 +233,21 @@ def accept_share(share_id):
     share.accepted = True
     share.recipient_id = user.id
 
+    # Look up owner email for the audit log before committing
+    owner = db.session.get(User, share.owner_id)
+    owner_email = owner.email if owner else f'user_id={share.owner_id}'
+
     AuditLog.log(
         user_id=g.current_user_id,
         action='shared_item.accept',
         resource_type='shared_item',
         resource_id=share.id,
-        detail=f'Accepted shared item "{share.item_name}" from {share.recipient_email}',
+        detail=f'Accepted shared item "{share.item_name}" from {owner_email}',
         ip_address=_client_ip(),
     )
     db.session.commit()
 
     d = share.to_dict()
-    owner = db.session.get(User, share.owner_id)
+    d['owner_email'] = owner_email
-    d['owner_email'] = owner.email if owner else 'Unknown'
     d['owner_public_key'] = owner.sharing_public_key if owner else None
     return jsonify(d), 200
-

app/routes/vault.py

@@ -104,16 +104,27 @@ def update_item(item_id):
     if 'iv_name' in data:
         item.iv_name = data['iv_name'] or None
 
-    db.session.flush()
+    # Explicitly set updated_at — SQLAlchemy's onupdate lambda only fires when
-    AuditLog.log(
+    # it detects a column-level change, which can be skipped if the session
-        user_id=g.current_user_id,
+    # dirty-tracking misses a mutation (e.g. only enc_data/iv changed).
-        action='vault_item.update',
+    from datetime import datetime, timezone
-        resource_type='vault_item',
+    item.updated_at = datetime.now(timezone.utc).replace(tzinfo=None)
-        resource_id=item.id,
+
-        detail=f'Updated item: "{item.name}"',
+    try:
-        ip_address=_client_ip(),
+        db.session.flush()
-    )
+        AuditLog.log(
-    db.session.commit()
+            user_id=g.current_user_id,
+            action='vault_item.update',
+            resource_type='vault_item',
+            resource_id=item.id,
+            detail=f'Updated item: "{item.name}"',
+            ip_address=_client_ip(),
+        )
+        db.session.commit()
+    except Exception as e:
+        db.session.rollback()
+        return jsonify({'error': f'Database error: {str(e)}'}), 500
+
     return jsonify(item.to_dict()), 200