04/26 Enhanced app and extension security

app/static/js/crypto.js

@@ -131,7 +131,45 @@ const Crypto = (() => {
     return bytesToBase64(window.crypto.getRandomValues(new Uint8Array(byteLength)));
   }
 
+  // ── Encrypt / Decrypt name string ───────────────────────────────────────
+
+  /**
+   * Encrypt a plain string (the item name) with the vault key.
+   * Uses a fresh random IV each call — same scheme as encryptItem.
+   * Returns { enc_name: base64, iv_name: base64 }
+   */
+  async function encryptName(vaultKey, nameStr) {
+    const iv = window.crypto.getRandomValues(new Uint8Array(12));
+    const plaintext = strToBytes(nameStr);
+    const ciphertext = await subtle.encrypt(
+      { name: 'AES-GCM', iv },
+      vaultKey,
+      plaintext
+    );
+    return {
+      enc_name: bytesToBase64(new Uint8Array(ciphertext)),
+      iv_name: bytesToBase64(iv),
+    };
+  }
+
+  /**
+   * Decrypt an enc_name blob back to a plain string.
+   * Returns null if decryption fails (e.g. legacy item without enc_name).
+   */
+  async function decryptName(vaultKey, enc_name, iv_name) {
+    try {
+      const plaintext = await subtle.decrypt(
+        { name: 'AES-GCM', iv: base64ToBytes(iv_name) },
+        vaultKey,
+        base64ToBytes(enc_name)
+      );
+      return new TextDecoder().decode(plaintext);
+    } catch {
+      return null;
+    }
+  }
+
   // ── Public API ───────────────────────────────────────────────────────────
 
-  return { deriveAuthHash, deriveVaultKey, encryptItem, decryptItem, generateSalt };
+  return { deriveAuthHash, deriveVaultKey, encryptItem, decryptItem, encryptName, decryptName, generateSalt };
 })();