04/26 Enhanced app and extension security

app/models/vault_item.py

@@ -29,6 +29,11 @@ class VaultItem(db.Model):
     name = db.Column(db.String(255), nullable=False)
     enc_data = db.Column(db.Text, nullable=False)   # base64-encoded AES-256-GCM ciphertext
     iv = db.Column(db.String(64), nullable=False)   # base64-encoded 12-byte GCM nonce
+    # enc_name / iv_name: AES-256-GCM encrypted item name (client-side, same vault key).
+    # Nullable for backward-compatibility with existing rows — clients fall back to
+    # the plaintext 'name' column when enc_name is absent.
+    enc_name = db.Column(db.Text, nullable=True)
+    iv_name = db.Column(db.String(64), nullable=True)
     created_at = db.Column(db.DateTime, default=datetime.utcnow, nullable=False)
     updated_at = db.Column(db.DateTime, default=datetime.utcnow, onupdate=datetime.utcnow, nullable=False)
 
@@ -44,6 +49,8 @@ class VaultItem(db.Model):
             'folder_id': self.folder_id,
             'enc_data': self.enc_data,
             'iv': self.iv,
+            'enc_name': self.enc_name,
+            'iv_name': self.iv_name,
             'created_at': self.created_at.isoformat() if self.created_at else None,
             'updated_at': self.updated_at.isoformat() if self.updated_at else None,
         }