Secret Vault Module

app/routers/secret_vault.py handles enrolment, unlock, item/attachment, backup and recovery flows. app/services/secret_vault.py owns cryptographic and package operations; app/core/kayavault.py supports portable packages; models cover vault control, sessions, collections, items, versions, attachments and backup records.

Each vault has a random AES-256-GCM master key wrapped independently by Scrypt-derived PIN and recovery keys and by a key derived from Kaya's ENCRYPTION_KEY. Original filenames and user content are encrypted. Attachments use random storage IDs under /app/data/secret-vault by default.

Vault sessions are server-side, application-session bound, idle-expiring and limited to eight hours. Sensitive reveal/download events are audited without plaintext. OIDC step-up requires a fresh, identity-bound MFA result.

Current implementation includes private vaults, collections, item types, protected fields, one attachment at item creation, portable export/restore and recovery-key PIN reset. Collection-membership UI, key rotation, emergency access, malware scanning and escrow are incomplete/unavailable.