05/18 Enhanced codes and functionalities

app/routes/vault.py

@@ -1,6 +1,7 @@
 from flask import Blueprint, request, jsonify, g
 from app import db, limiter, client_ip
 from app.models.vault_item import VaultItem, ItemType
+from app.models.folder import Folder
 from app.models.audit_log import AuditLog
 from app.services.auth_service import require_jwt
 
@@ -9,6 +10,25 @@ vault_bp = Blueprint('vault', __name__)
 VALID_TYPES = {t.value for t in ItemType}
 
 
+def _validate_folder_id(folder_id, user_id: int):
+    """
+    Verify folder_id belongs to user_id.
+    Returns the sanitised folder_id (int or None).
+    Raises ValueError with a safe message if the folder doesn't exist or
+    belongs to another user.
+    """
+    if folder_id is None:
+        return None
+    try:
+        folder_id = int(folder_id)
+    except (TypeError, ValueError):
+        raise ValueError('folder_id must be an integer')
+    folder = Folder.query.filter_by(id=folder_id, user_id=user_id).first()
+    if not folder:
+        raise ValueError('Folder not found')
+    return folder_id
+
+
 @vault_bp.route('', methods=['GET'])
 @limiter.limit('120 per minute')
 @require_jwt
@@ -40,6 +60,11 @@ def create_item():
     if not enc_data or not iv:
         return jsonify({'error': 'enc_data and iv are required'}), 400
 
+    try:
+        folder_id = _validate_folder_id(folder_id, g.current_user_id)
+    except ValueError as e:
+        return jsonify({'error': str(e)}), 400
+
     item = VaultItem(
         user_id=g.current_user_id,
         folder_id=folder_id,
@@ -93,7 +118,10 @@ def update_item(item_id):
             return jsonify({'error': 'name cannot be empty'}), 400
         item.name = name
     if 'folder_id' in data:
-        item.folder_id = data['folder_id']
+        try:
+            item.folder_id = _validate_folder_id(data['folder_id'], g.current_user_id)
+        except ValueError as e:
+            return jsonify({'error': str(e)}), 400
     if 'enc_data' in data:
         item.enc_data = data['enc_data']
     if 'iv' in data:
@@ -204,6 +232,10 @@ def import_items():
             skipped += 1
             continue
         folder_id = row.get('folder_id')
+        try:
+            folder_id = _validate_folder_id(folder_id, g.current_user_id)
+        except ValueError:
+            folder_id = None  # invalid/foreign folder — import to root instead of skipping
         enc_name = row.get('enc_name') or None
         iv_name = row.get('iv_name') or None
         item = VaultItem(