05/19 Enhance codes 4

app/routes/vault.py

@@ -262,4 +262,40 @@ def import_items():
             ip_address=client_ip(),
         )
         db.session.commit()
-    return jsonify({'imported': imported, 'skipped': skipped}), 200
+    return jsonify({'imported': imported, 'skipped': skipped}), 200
+
+@vault_bp.route('/audit-export', methods=['POST'])
+@limiter.limit('30 per minute')
+@require_jwt
+def audit_bulk_export():
+    """
+    Record a client-side bulk export in the audit log.
+
+    The bulk export is built entirely in the browser (no server round-trip),
+    so the server calls this endpoint after the download is triggered.
+    Accepts a JSON body: { "item_ids": [int, ...] }
+    Validates that every supplied ID belongs to the current user before logging.
+    """
+    data = request.get_json(silent=True) or {}
+    raw_ids = data.get('item_ids', [])
+    if not isinstance(raw_ids, list):
+        return jsonify({'error': 'item_ids must be an array'}), 400
+
+    # Validate ownership — only log IDs that belong to the current user.
+    valid_ids = [
+        item.id for item in VaultItem.query.filter(
+            VaultItem.id.in_(raw_ids),
+            VaultItem.user_id == g.current_user_id,
+        ).all()
+    ]
+
+    AuditLog.log(
+        user_id=g.current_user_id,
+        action='vault_item.export_selection',
+        resource_type='vault_item',
+        resource_id=None,
+        detail=f'Bulk exported {len(valid_ids)} selected item(s) (ids: {sorted(valid_ids)[:20]})',
+        ip_address=client_ip(),
+    )
+    db.session.commit()
+    return jsonify({'logged': len(valid_ids)}), 200