implement patches

app/routes/emergency.py

@@ -4,16 +4,21 @@ from flask import Blueprint, request, jsonify, g
 from app import db
 from app.models.user import User
 from app.models.emergency_access import EmergencyAccess
+from app.models.audit_log import AuditLog
 from app.services.auth_service import require_jwt
 
 emergency_bp = Blueprint('emergency', __name__)
 
 
+def _client_ip():
+    return request.headers.get('X-Forwarded-For', request.remote_addr or '').split(',')[0].strip()
+
+
 @emergency_bp.route('', methods=['GET'])
 @require_jwt
 def list_emergency():
     """Return emergency access records both as grantor and as grantee."""
-    user = User.query.get(g.current_user_id)
+    user = db.session.get(User, g.current_user_id)
 
     grants = EmergencyAccess.query.filter_by(grantor_id=user.id).order_by(
         EmergencyAccess.created_at.desc()
@@ -33,7 +38,7 @@ def list_emergency():
 
 
 def _ea_as_grantee(ea: EmergencyAccess) -> dict:
-    grantor = User.query.get(ea.grantor_id)
+    grantor = db.session.get(User, ea.grantor_id)
     d = ea.to_dict(grantor_email=grantor.email if grantor else None)
     d['grantor_public_key'] = grantor.sharing_public_key if grantor else None
     return d
@@ -52,15 +57,19 @@ def create_emergency():
     if not (1 <= wait_days <= 90):
         return jsonify({'error': 'wait_days must be between 1 and 90'}), 400
 
-    owner = User.query.get(g.current_user_id)
+    owner = db.session.get(User, g.current_user_id)
     if owner.email == grantee_email:
         return jsonify({'error': 'Cannot designate yourself as emergency contact'}), 400
 
-    # No duplicate active grants
+    # No duplicate active grants — exclude only 'denied' records so a grantor
+    # cannot re-invite a contact who already has an active/pending/ready grant,
+    # but CAN re-invite after explicitly removing a previous grant (deleted rows).
+    # Note: 'denied' status is a terminal reset-to-ready internal state, not a
+    # standalone tombstone, so we block on all non-denied statuses.
     existing = EmergencyAccess.query.filter(
         EmergencyAccess.grantor_id == g.current_user_id,
         EmergencyAccess.grantee_email == grantee_email,
-        EmergencyAccess.status != 'denied',
+        EmergencyAccess.status.in_(['invited', 'accepted', 'ready', 'pending']),
     ).first()
     if existing:
         return jsonify({'error': 'Emergency access already set up for this contact'}), 409
@@ -73,6 +82,16 @@ def create_emergency():
         wait_days=wait_days,
     )
     db.session.add(ea)
+    db.session.flush()  # populate ea.id before logging
+
+    AuditLog.log(
+        user_id=g.current_user_id,
+        action='emergency_access.create',
+        resource_type='emergency_access',
+        resource_id=ea.id,
+        detail=f'Created emergency access invitation for {grantee_email} (wait: {wait_days}d)',
+        ip_address=_client_ip(),
+    )
     db.session.commit()
 
     return jsonify(ea.to_dict(grantor_email=owner.email)), 201
@@ -85,7 +104,19 @@ def delete_emergency(ea_id):
     ea = EmergencyAccess.query.filter_by(id=ea_id, grantor_id=g.current_user_id).first()
     if not ea:
         return jsonify({'error': 'Not found'}), 404
+
+    grantee_email = ea.grantee_email
     db.session.delete(ea)
+    db.session.flush()
+
+    AuditLog.log(
+        user_id=g.current_user_id,
+        action='emergency_access.delete',
+        resource_type='emergency_access',
+        resource_id=ea_id,
+        detail=f'Removed emergency access grant for {grantee_email}',
+        ip_address=_client_ip(),
+    )
     db.session.commit()
     return jsonify({'message': 'Emergency access removed'}), 200
 
@@ -94,7 +125,7 @@ def delete_emergency(ea_id):
 @require_jwt
 def accept_emergency(ea_id):
     """Grantee accepts an emergency access invitation."""
-    user = User.query.get(g.current_user_id)
+    user = db.session.get(User, g.current_user_id)
     ea = EmergencyAccess.query.filter(
         EmergencyAccess.id == ea_id,
         EmergencyAccess.status == 'invited',
@@ -108,6 +139,15 @@ def accept_emergency(ea_id):
 
     ea.status = 'accepted'
     ea.grantee_id = user.id
+
+    AuditLog.log(
+        user_id=g.current_user_id,
+        action='emergency_access.accept',
+        resource_type='emergency_access',
+        resource_id=ea.id,
+        detail=f'Accepted emergency access invitation from grantor_id={ea.grantor_id}',
+        ip_address=_client_ip(),
+    )
     db.session.commit()
 
     return jsonify(_ea_as_grantee(ea)), 200
@@ -135,9 +175,18 @@ def provide_vault(ea_id):
 
     ea.enc_vault = enc_vault
     ea.status = 'ready'
+
+    AuditLog.log(
+        user_id=g.current_user_id,
+        action='emergency_access.provide_vault',
+        resource_type='emergency_access',
+        resource_id=ea.id,
+        detail=f'Provided encrypted vault snapshot for grantee {ea.grantee_email}',
+        ip_address=_client_ip(),
+    )
     db.session.commit()
 
-    grantor = User.query.get(g.current_user_id)
+    grantor = db.session.get(User, g.current_user_id)
     return jsonify(ea.to_dict(grantor_email=grantor.email)), 200
 
 
@@ -145,7 +194,7 @@ def provide_vault(ea_id):
 @require_jwt
 def request_access(ea_id):
     """Grantee initiates an access request, starting the wait-period clock."""
-    user = User.query.get(g.current_user_id)
+    user = db.session.get(User, g.current_user_id)
     ea = EmergencyAccess.query.filter(
         EmergencyAccess.id == ea_id,
         EmergencyAccess.status == 'ready',
@@ -159,6 +208,15 @@ def request_access(ea_id):
 
     ea.status = 'pending'
     ea.request_initiated_at = datetime.utcnow()
+
+    AuditLog.log(
+        user_id=g.current_user_id,
+        action='emergency_access.request',
+        resource_type='emergency_access',
+        resource_id=ea.id,
+        detail=f'Requested emergency vault access from grantor_id={ea.grantor_id} (wait: {ea.wait_days}d)',
+        ip_address=_client_ip(),
+    )
     db.session.commit()
 
     return jsonify(_ea_as_grantee(ea)), 200
@@ -176,9 +234,18 @@ def deny_access(ea_id):
 
     ea.status = 'ready'
     ea.request_initiated_at = None
+
+    AuditLog.log(
+        user_id=g.current_user_id,
+        action='emergency_access.deny',
+        resource_type='emergency_access',
+        resource_id=ea.id,
+        detail=f'Denied emergency access request from grantee {ea.grantee_email}',
+        ip_address=_client_ip(),
+    )
     db.session.commit()
 
-    grantor = User.query.get(g.current_user_id)
+    grantor = db.session.get(User, g.current_user_id)
     return jsonify(ea.to_dict(grantor_email=grantor.email)), 200
 
 
@@ -189,7 +256,7 @@ def get_emergency_vault(ea_id):
     Grantee retrieves the encrypted vault snapshot after the wait period has elapsed.
     Also returns the grantor's public key so the client can derive the ECDH secret.
     """
-    user = User.query.get(g.current_user_id)
+    user = db.session.get(User, g.current_user_id)
     ea = EmergencyAccess.query.filter(
         EmergencyAccess.id == ea_id,
         db.or_(
@@ -209,8 +276,19 @@ def get_emergency_vault(ea_id):
             'error': f'Wait period not yet elapsed ({days_left:.1f} day(s) remaining)'
         }), 403
 
-    grantor = User.query.get(ea.grantor_id)
+    AuditLog.log(
+        user_id=g.current_user_id,
+        action='emergency_access.vault_retrieved',
+        resource_type='emergency_access',
+        resource_id=ea.id,
+        detail=f'Retrieved emergency vault from grantor_id={ea.grantor_id}',
+        ip_address=_client_ip(),
+    )
+    db.session.commit()
+
+    grantor = db.session.get(User, ea.grantor_id)
     return jsonify({
         'enc_vault': ea.enc_vault,
         'grantor_public_key': grantor.sharing_public_key if grantor else None,
     }), 200
+