04/26 Enhanced app and extension security

migrations/versions/c3d4e5f6a7b8_encrypt_vault_item_name.py

@@ -0,0 +1,27 @@
+"""encrypt vault item name client-side
+
+Revision ID: c3d4e5f6a7b8
+Revises: a1b2c3d4e5f6
+Create Date: 2026-04-26 00:00:00.000000
+
+Adds enc_name (AES-256-GCM ciphertext) and iv_name (nonce) columns to vault_items.
+The plaintext name column is retained for backward-compatibility and audit logs only.
+Clients populate enc_name/iv_name on create/update; the server never decrypts it.
+"""
+from alembic import op
+import sqlalchemy as sa
+
+revision = 'c3d4e5f6a7b8'
+down_revision = 'a1b2c3d4e5f6'
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    op.add_column('vault_items', sa.Column('enc_name', sa.Text(), nullable=True))
+    op.add_column('vault_items', sa.Column('iv_name', sa.String(length=64), nullable=True))
+
+
+def downgrade():
+    op.drop_column('vault_items', 'iv_name')
+    op.drop_column('vault_items', 'enc_name')