feat: native save + auto-backup + folder customization + attachments + UX bundle

- File: native Save As dialog via Bridge.saveFile (replaces WebView2 browser download popup) for encrypted JSON + CSV exports. - Auto-backup: silent periodic encrypted JSON to a chosen folder, user-set interval + retention, separate DPAPI-stored password, runs 5s after unlock if due. New file/* bridge cmds (folder/pick, file/write, file/listMatch, file/delete). - Folders: per-folder color + icon (8-swatch palette, 8 icon presets), drag-reorder via HTML5 DnD with insert-line indicators, edit pencil on hover. New POST /folders/reorder + PUT /folders/{name}. Folder chip on cards inherits custom icon + color. - Recently used: vault_entries.accessed_at + POST /entries/{id}/touch (debounced 2s), sidebar Tools entry showing top-10 by accessed_at. - Encrypted attachments: per-entry file storage (5MB cap), AES-GCM with vault key, native Save As download, paperclip upload in slideover. New entry_attachments table + PM.Handler.Attachments. - Password expiry: vault_entries.password_changed_at (conditional bump via SQL CASE only when ciphertext differs), passwordExpiryDays setting, "Aged" badge on cards + matching Filters chip. - Recovery: Print button on generated code modal (A4 printable sheet via @media print, code in 32px monospace + instructions). - Audit log viewer (sidebar Tools, GET /audit with pagination cursor). - Plaintext CSV export + Filters dropdown with 9 predicates. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-06-21 23:12:06 +01:00
parent 63fac5b3b7
commit fa7ea191be
13 changed files with 3927 additions and 1378 deletions
@@ -0,0 +1,317 @@
+unit PM.Handler.Attachments;
+
+(*
+  Encrypted file attachments per entry.
+
+  GET    /entries/{id}/attachments         -> [{id, filename, mime, size_bytes, created_at}, ...]
+  POST   /entries/{id}/attachments         body {filename, mime, encrypted_blob, iv, size_bytes}
+                                            -> {id, filename, mime, size_bytes, created_at}
+  GET    /attachments/{id}                  -> {id, filename, mime, size_bytes, encrypted_blob, iv}
+  DELETE /attachments/{id}                  -> {message}
+
+  encrypted_blob is the base64-encoded AES-GCM ciphertext of the raw file
+  bytes, produced by the JS client with the per-user vault key. Server
+  never sees plaintext.
+
+  Per-attachment cap: ~10 MB of ciphertext-as-base64 (≈ 7.5 MB raw file).
+  Heavier attachments aren't appropriate for SQLite TEXT storage anyway.
+*)
+
+interface
+
+implementation
+
+uses
+  System.SysUtils, System.JSON,
+  FireDAC.Comp.Client, FireDAC.Stan.Param,
+  IdCustomHTTPServer,
+  PM.Router, PM.JSON, PM.Database, PM.Session, PM.Audit;
+
+const
+  MAX_ATTACHMENT_B64 = 10 * 1024 * 1024;   // 10 MB of base64 text
+
+function GetClientIP(ARequest: TIdHTTPRequestInfo): string;
+begin
+  Result := ARequest.RemoteIP;
+  if Result = '' then Result := '127.0.0.1';
+end;
+
+// Ownership check: returns True iff the entry exists and belongs to LUserId.
+function EntryBelongsToUser(LEntryId, LUserId: Integer): Boolean;
+var
+  LQ: TFDQuery;
+begin
+  LQ := TFDQuery.Create(nil);
+  try
+    LQ.Connection := DB.Connection;
+    LQ.SQL.Text :=
+      'SELECT 1 FROM vault_entries WHERE id = :id AND user_id = :uid';
+    LQ.ParamByName('id').AsInteger  := LEntryId;
+    LQ.ParamByName('uid').AsInteger := LUserId;
+    LQ.Open;
+    Result := not LQ.Eof;
+  finally
+    LQ.Free;
+  end;
+end;
+
+// ===== GET /entries/{id}/attachments =========================================
+
+procedure HandleListAttachments(ARequest: TIdHTTPRequestInfo;
+  AResponse: TIdHTTPResponseInfo; const AParams: TArray<string>);
+var
+  LUserId, LEntryId: Integer;
+  LQ: TFDQuery;
+  LArr: TJSONArray;
+  LObj: TJSONObject;
+begin
+  try
+    LUserId := Authenticate(ARequest, AResponse);
+  except
+    on ESessionRejected do Exit;
+  end;
+
+  LEntryId := StrToIntDef(AParams[0], 0);
+  if LEntryId = 0 then
+  begin
+    TJSONHelper.SendError(AResponse, 400, 'Invalid entry id');
+    Exit;
+  end;
+
+  LArr := TJSONArray.Create;
+  DB.Lock;
+  try
+    if not EntryBelongsToUser(LEntryId, LUserId) then
+    begin
+      TJSONHelper.SendError(AResponse, 404, 'Entry not found');
+      LArr.Free;
+      Exit;
+    end;
+    LQ := TFDQuery.Create(nil);
+    try
+      LQ.Connection := DB.Connection;
+      LQ.SQL.Text :=
+        'SELECT id, filename, mime, size_bytes, created_at ' +
+        'FROM entry_attachments WHERE entry_id = :eid AND user_id = :uid ' +
+        'ORDER BY created_at DESC';
+      LQ.ParamByName('eid').AsInteger := LEntryId;
+      LQ.ParamByName('uid').AsInteger := LUserId;
+      LQ.Open;
+      while not LQ.Eof do
+      begin
+        LObj := TJSONObject.Create;
+        LObj.AddPair('id',         TJSONNumber.Create(LQ.FieldByName('id').AsInteger));
+        LObj.AddPair('filename',   LQ.FieldByName('filename').AsString);
+        LObj.AddPair('mime',       LQ.FieldByName('mime').AsString);
+        LObj.AddPair('size_bytes', TJSONNumber.Create(LQ.FieldByName('size_bytes').AsInteger));
+        LObj.AddPair('created_at',
+          FormatDateTime('yyyy-mm-dd"T"hh:nn:ss', LQ.FieldByName('created_at').AsDateTime));
+        LArr.Add(LObj);
+        LQ.Next;
+      end;
+    finally
+      LQ.Free;
+    end;
+  finally
+    DB.Unlock;
+  end;
+  TJSONHelper.SendJSON(AResponse, LArr);
+end;
+
+// ===== POST /entries/{id}/attachments ========================================
+
+procedure HandleCreateAttachment(ARequest: TIdHTTPRequestInfo;
+  AResponse: TIdHTTPResponseInfo; const AParams: TArray<string>);
+var
+  LUserId, LEntryId, LNewId: Integer;
+  LBody: TJSONObject;
+  LFilename, LMime, LBlob, LIv: string;
+  LSize: Integer;
+  LQ: TFDQuery;
+  LObj: TJSONObject;
+begin
+  try
+    LUserId := Authenticate(ARequest, AResponse);
+    RequireCSRF(ARequest, AResponse, LUserId);
+  except
+    on ESessionRejected do Exit;
+  end;
+
+  LEntryId := StrToIntDef(AParams[0], 0);
+  if LEntryId = 0 then
+  begin
+    TJSONHelper.SendError(AResponse, 400, 'Invalid entry id');
+    Exit;
+  end;
+
+  LBody := TJSONHelper.ReadBody(ARequest);
+  try
+    LFilename := Trim(LBody.GetValue<string>('filename',       ''));
+    LMime     :=      LBody.GetValue<string>('mime',           '');
+    LBlob     :=      LBody.GetValue<string>('encrypted_blob', '');
+    LIv       :=      LBody.GetValue<string>('iv',             '');
+    LSize     :=      LBody.GetValue<Integer>('size_bytes',    0);
+  finally
+    LBody.Free;
+  end;
+
+  if (LFilename = '') or (LBlob = '') or (LIv = '') then
+  begin
+    TJSONHelper.SendError(AResponse, 400, 'Missing required fields');
+    Exit;
+  end;
+  if Length(LBlob) > MAX_ATTACHMENT_B64 then
+  begin
+    TJSONHelper.SendError(AResponse, 413, 'Attachment too large (max ~7.5 MB raw)');
+    Exit;
+  end;
+
+  DB.Lock;
+  try
+    if not EntryBelongsToUser(LEntryId, LUserId) then
+    begin
+      TJSONHelper.SendError(AResponse, 404, 'Entry not found');
+      Exit;
+    end;
+    LQ := TFDQuery.Create(nil);
+    try
+      LQ.Connection := DB.Connection;
+      LQ.SQL.Text :=
+        'INSERT INTO entry_attachments ' +
+        '(user_id, entry_id, filename, mime, size_bytes, encrypted_blob, iv) ' +
+        'VALUES (:uid, :eid, :name, :mime, :sz, :blob, :iv)';
+      LQ.ParamByName('uid').AsInteger    := LUserId;
+      LQ.ParamByName('eid').AsInteger    := LEntryId;
+      LQ.ParamByName('name').AsString    := LFilename;
+      LQ.ParamByName('mime').AsString    := LMime;
+      LQ.ParamByName('sz').AsInteger     := LSize;
+      LQ.ParamByName('blob').AsString    := LBlob;
+      LQ.ParamByName('iv').AsString      := LIv;
+      LQ.ExecSQL;
+      LNewId := DB.Connection.GetLastAutoGenValue('entry_attachments');
+    finally
+      LQ.Free;
+    end;
+  finally
+    DB.Unlock;
+  end;
+
+  LogAudit(LUserId, 'add_attachment', GetClientIP(ARequest));
+  LObj := TJSONObject.Create;
+  LObj.AddPair('id',         TJSONNumber.Create(LNewId));
+  LObj.AddPair('filename',   LFilename);
+  LObj.AddPair('mime',       LMime);
+  LObj.AddPair('size_bytes', TJSONNumber.Create(LSize));
+  LObj.AddPair('created_at', FormatDateTime('yyyy-mm-dd"T"hh:nn:ss', Now));
+  TJSONHelper.SendJSON(AResponse, LObj);
+end;
+
+// ===== GET /attachments/{id} =================================================
+
+procedure HandleGetAttachment(ARequest: TIdHTTPRequestInfo;
+  AResponse: TIdHTTPResponseInfo; const AParams: TArray<string>);
+var
+  LUserId, LId: Integer;
+  LQ: TFDQuery;
+  LObj: TJSONObject;
+begin
+  try
+    LUserId := Authenticate(ARequest, AResponse);
+  except
+    on ESessionRejected do Exit;
+  end;
+
+  LId := StrToIntDef(AParams[0], 0);
+  if LId = 0 then
+  begin
+    TJSONHelper.SendError(AResponse, 400, 'Invalid id');
+    Exit;
+  end;
+
+  DB.Lock;
+  try
+    LQ := TFDQuery.Create(nil);
+    try
+      LQ.Connection := DB.Connection;
+      LQ.SQL.Text :=
+        'SELECT id, filename, mime, size_bytes, encrypted_blob, iv ' +
+        'FROM entry_attachments WHERE id = :id AND user_id = :uid';
+      LQ.ParamByName('id').AsInteger  := LId;
+      LQ.ParamByName('uid').AsInteger := LUserId;
+      LQ.Open;
+      if LQ.Eof then
+      begin
+        TJSONHelper.SendError(AResponse, 404, 'Not found');
+        Exit;
+      end;
+      LObj := TJSONObject.Create;
+      LObj.AddPair('id',             TJSONNumber.Create(LQ.FieldByName('id').AsInteger));
+      LObj.AddPair('filename',       LQ.FieldByName('filename').AsString);
+      LObj.AddPair('mime',           LQ.FieldByName('mime').AsString);
+      LObj.AddPair('size_bytes',     TJSONNumber.Create(LQ.FieldByName('size_bytes').AsInteger));
+      LObj.AddPair('encrypted_blob', LQ.FieldByName('encrypted_blob').AsString);
+      LObj.AddPair('iv',             LQ.FieldByName('iv').AsString);
+      TJSONHelper.SendJSON(AResponse, LObj);
+    finally
+      LQ.Free;
+    end;
+  finally
+    DB.Unlock;
+  end;
+end;
+
+// ===== DELETE /attachments/{id} ==============================================
+
+procedure HandleDeleteAttachment(ARequest: TIdHTTPRequestInfo;
+  AResponse: TIdHTTPResponseInfo; const AParams: TArray<string>);
+var
+  LUserId, LId: Integer;
+  LQ: TFDQuery;
+begin
+  try
+    LUserId := Authenticate(ARequest, AResponse);
+    RequireCSRF(ARequest, AResponse, LUserId);
+  except
+    on ESessionRejected do Exit;
+  end;
+
+  LId := StrToIntDef(AParams[0], 0);
+  if LId = 0 then
+  begin
+    TJSONHelper.SendError(AResponse, 400, 'Invalid id');
+    Exit;
+  end;
+
+  DB.Lock;
+  try
+    LQ := TFDQuery.Create(nil);
+    try
+      LQ.Connection := DB.Connection;
+      LQ.SQL.Text :=
+        'DELETE FROM entry_attachments WHERE id = :id AND user_id = :uid';
+      LQ.ParamByName('id').AsInteger  := LId;
+      LQ.ParamByName('uid').AsInteger := LUserId;
+      LQ.ExecSQL;
+      if LQ.RowsAffected = 0 then
+      begin
+        TJSONHelper.SendError(AResponse, 404, 'Not found');
+        Exit;
+      end;
+    finally
+      LQ.Free;
+    end;
+  finally
+    DB.Unlock;
+  end;
+
+  LogAudit(LUserId, 'delete_attachment', GetClientIP(ARequest));
+  TJSONHelper.SendOK(AResponse, 'Deleted');
+end;
+
+initialization
+  Router.Register('GET',    '/entries/(\d+)/attachments', HandleListAttachments);
+  Router.Register('POST',   '/entries/(\d+)/attachments', HandleCreateAttachment);
+  Router.Register('GET',    '/attachments/(\d+)',          HandleGetAttachment);
+  Router.Register('DELETE', '/attachments/(\d+)',          HandleDeleteAttachment);
+
+end.
@@ -1,13 +1,11 @@
 unit PM.Handler.Audit;

 (*
-  POST /audit    body {action, site}   -> {ok:true}
+  POST /audit    body {action, site}            -> {ok:true}
+  GET  /audit?limit=N&before=<id>               -> [{id, action, ip, created_at}, ...]

-  Light-weight endpoint that lets the JS layer append an entry to audit_log
-  without going through the full entries pipeline. Used by the autofill
-  feature to record which site was filled (action = "autofill:<site>").
-  The bearer token identifies the user — no data beyond the action string
-  is stored.
+  audit_log is auto-purged after 30 days by Database init. The viewer
+  reads page-by-page via the `before` cursor (id < before).
 *)

 interface
@@ -17,7 +15,8 @@ implementation
 uses
  System.SysUtils, System.JSON,
  IdCustomHTTPServer,
-  PM.Router, PM.JSON, PM.Session, PM.Audit;
+  Data.DB, FireDAC.Comp.Client, FireDAC.Stan.Param,
+  PM.Router, PM.JSON, PM.Session, PM.Audit, PM.Database;

 function GetClientIP(ARequest: TIdHTTPRequestInfo): string;
 begin
@@ -59,7 +58,67 @@ begin
  TJSONHelper.SendOK(AResponse);
 end;

+// GET /audit — return up to `limit` log entries for the current user,
+// optionally newer-than-cursor (`before` = id). Most-recent first.
+procedure HandleGetAudit(ARequest: TIdHTTPRequestInfo;
+  AResponse: TIdHTTPResponseInfo; const AParams: TArray<string>);
+var
+  LUserId, LLimit, LBefore: Integer;
+  LQ: TFDQuery;
+  LArr: TJSONArray;
+  LObj: TJSONObject;
+begin
+  LUserId := Authenticate(ARequest, AResponse);
+
+  LLimit  := StrToIntDef(ARequest.Params.Values['limit'], 100);
+  if LLimit <= 0 then LLimit := 100;
+  if LLimit > 500 then LLimit := 500;
+  LBefore := StrToIntDef(ARequest.Params.Values['before'], 0);
+
+  LArr := TJSONArray.Create;
+  DB.Lock;
+  try
+    LQ := TFDQuery.Create(nil);
+    try
+      LQ.Connection := DB.Connection;
+      if LBefore > 0 then
+        LQ.SQL.Text :=
+          'SELECT id, action, ip, created_at FROM audit_log ' +
+          'WHERE user_id = :uid AND id < :b ' +
+          'ORDER BY id DESC LIMIT :l'
+      else
+        LQ.SQL.Text :=
+          'SELECT id, action, ip, created_at FROM audit_log ' +
+          'WHERE user_id = :uid ' +
+          'ORDER BY id DESC LIMIT :l';
+      LQ.ParamByName('uid').AsInteger := LUserId;
+      LQ.ParamByName('l').AsInteger   := LLimit;
+      if LBefore > 0 then
+        LQ.ParamByName('b').AsInteger := LBefore;
+      LQ.Open;
+      while not LQ.Eof do
+      begin
+        LObj := TJSONObject.Create;
+        LObj.AddPair('id', TJSONNumber.Create(LQ.FieldByName('id').AsInteger));
+        LObj.AddPair('action', LQ.FieldByName('action').AsString);
+        LObj.AddPair('ip', LQ.FieldByName('ip').AsString);
+        LObj.AddPair('created_at',
+          FormatDateTime('yyyy-mm-dd hh:nn:ss',
+            LQ.FieldByName('created_at').AsDateTime));
+        LArr.Add(LObj);
+        LQ.Next;
+      end;
+    finally
+      LQ.Free;
+    end;
+  finally
+    DB.Unlock;
+  end;
+  TJSONHelper.SendJSON(AResponse, LArr);
+end;
+
 initialization
  Router.Register('POST', '/audit', HandlePostAudit);
+  Router.Register('GET',  '/audit', HandleGetAudit);

 end.
@@ -139,6 +139,14 @@ begin
          LObj.AddPair('custom_fields_iv', LQ.FieldByName('custom_fields_iv').AsString);
        LObj.AddPair('created_at', ISODateTimeField(LQ.FieldByName('created_at')));
        LObj.AddPair('updated_at', ISODateTimeField(LQ.FieldByName('updated_at')));
+        if LQ.FieldByName('accessed_at').IsNull then
+          LObj.AddPair('accessed_at', TJSONNull.Create)
+        else
+          LObj.AddPair('accessed_at', ISODateTimeField(LQ.FieldByName('accessed_at')));
+        if LQ.FieldByName('password_changed_at').IsNull then
+          LObj.AddPair('password_changed_at', TJSONNull.Create)
+        else
+          LObj.AddPair('password_changed_at', ISODateTimeField(LQ.FieldByName('password_changed_at')));
        LArr.Add(LObj);
        LQ.Next;
      end;
@@ -213,9 +221,9 @@ begin
        'INSERT INTO vault_entries ' +
        '(user_id, site, title, username, encrypted_password, iv, encryption_method, ' +
        ' folder, tags, totp_secret, totp_iv, kind, custom_fields, custom_fields_iv,' +
-        ' created_at, updated_at) ' +
+        ' created_at, updated_at, password_changed_at) ' +
        'VALUES (:uid, :s, :tt, :u, :e, :i, ''client'', :f, :t, :ts, :tiv, :k, ' +
-        ' :cf, :cfiv, :c, :c2)';
+        ' :cf, :cfiv, :c, :c2, :c)';
      LQ.ParamByName('uid').AsInteger := LUserId;
      LQ.ParamByName('s').AsString  := LSite;
      LQ.ParamByName('tt').AsString := LTitle;
@@ -355,12 +363,16 @@ begin
      LQ.ParamByName('id').AsInteger := LId;
      LQ.ExecSQL;

+      // password_changed_at fires only when the ciphertext actually
+      // changes — same conditional used above for history insertion.
      LQ.SQL.Text :=
        'UPDATE vault_entries ' +
        'SET site=:s, title=:tt, username=:u, encrypted_password=:e, iv=:i, ' +
        '    folder=:f, tags=:t, totp_secret=:ts, totp_iv=:tiv, kind=:k, ' +
        '    custom_fields=:cf, custom_fields_iv=:cfiv, ' +
-        '    updated_at=:c ' +
+        '    updated_at=:c, ' +
+        '    password_changed_at = CASE WHEN encrypted_password <> :e ' +
+        '                          THEN :c ELSE password_changed_at END ' +
        'WHERE id=:id AND user_id=:uid';
      LQ.ParamByName('s').AsString    := LSite;
      LQ.ParamByName('tt').AsString   := LTitle;
@@ -546,6 +558,51 @@ begin
  TJSONHelper.SendOK(AResponse, 'Toggled');
 end;

+// ===== POST /entries/{id}/touch ==============================================
+// Bumps accessed_at. Called from JS on copy / slideover-open so the sidebar
+// "Recent" view can show what the user actually uses. Auth-only (no CSRF
+// requirement — this is a write but harmless to forge across sessions, and
+// the call is fire-and-forget from clipboard handlers where blocking on
+// CSRF would be visibly laggy).
+procedure HandleTouchEntry(ARequest: TIdHTTPRequestInfo;
+  AResponse: TIdHTTPResponseInfo; const AParams: TArray<string>);
+var
+  LUserId, LId: Integer;
+  LQ: TFDQuery;
+begin
+  try
+    LUserId := Authenticate(ARequest, AResponse);
+  except
+    on ESessionRejected do Exit;
+  end;
+
+  LId := StrToIntDef(AParams[0], 0);
+  if LId = 0 then
+  begin
+    TJSONHelper.SendError(AResponse, 400, 'Invalid id');
+    Exit;
+  end;
+
+  DB.Lock;
+  try
+    LQ := TFDQuery.Create(nil);
+    try
+      LQ.Connection := DB.Connection;
+      LQ.SQL.Text :=
+        'UPDATE vault_entries SET accessed_at = CURRENT_TIMESTAMP ' +
+        'WHERE id = :id AND user_id = :uid AND deleted = 0';
+      LQ.ParamByName('id').AsInteger  := LId;
+      LQ.ParamByName('uid').AsInteger := LUserId;
+      LQ.ExecSQL;
+    finally
+      LQ.Free;
+    end;
+  finally
+    DB.Unlock;
+  end;
+  TJSONHelper.SendOK(AResponse);
+end;
+
 // ===== POST /entries/{id}/icon ===============================================
 // Stores (or clears) a cached favicon for one entry. Separate endpoint so the
 // client can save the icon without re-PUT-ing the full entry (which would
@@ -968,6 +1025,7 @@ initialization
  Router.Register('POST',   '/entries/bulk-import',    HandleBulkImport);
  Router.Register('POST',   '/entries/(\d+)/restore',  HandleRestoreEntry);
  Router.Register('POST',   '/entries/(\d+)/favorite', HandleToggleFavorite);
+  Router.Register('POST',   '/entries/(\d+)/touch',    HandleTouchEntry);
  Router.Register('POST',   '/entries/(\d+)/icon',     HandleSetEntryIcon);
  Router.Register('GET',    '/entries/(\d+)/history',  HandleGetEntryHistory);
  Router.Register('GET',    '/entries/count',          HandleEntriesCount);
@@ -1,9 +1,10 @@
 unit PM.Handler.Folders;

 (*
-  GET    /folders             -> JSON array of folder names
-  POST   /folders             body {name}     -> {message,name}
-  DELETE /folders/{name}                       -> {message}
+  GET    /folders             -> [{name, color, icon}, ...]
+  POST   /folders             body {name, color?, icon?}  -> {message, name}
+  PUT    /folders/{name}      body {color?, icon?}        -> {message}
+  DELETE /folders/{name}                                  -> {message}
 *)

 interface
@@ -12,6 +13,7 @@ implementation

 uses
  System.SysUtils, System.JSON, System.NetEncoding,
+  System.Generics.Collections,
  FireDAC.Comp.Client, FireDAC.Stan.Param,
  IdCustomHTTPServer,
  PM.Router, PM.JSON, PM.Database, PM.Session, PM.Audit, PM.RateLimit;
@@ -24,6 +26,7 @@ var
  LUserId: Integer;
  LQ: TFDQuery;
  LArr: TJSONArray;
+  LObj: TJSONObject;
 begin
  try
    LUserId := Authenticate(ARequest, AResponse);
@@ -37,12 +40,18 @@ begin
    LQ := TFDQuery.Create(nil);
    try
      LQ.Connection := DB.Connection;
-      LQ.SQL.Text := 'SELECT name FROM folders WHERE user_id = :uid ORDER BY name';
+      LQ.SQL.Text :=
+        'SELECT name, color, icon FROM folders ' +
+        'WHERE user_id = :uid ORDER BY sort_order, name';
      LQ.ParamByName('uid').AsInteger := LUserId;
      LQ.Open;
      while not LQ.Eof do
      begin
-        LArr.Add(LQ.FieldByName('name').AsString);
+        LObj := TJSONObject.Create;
+        LObj.AddPair('name',  LQ.FieldByName('name').AsString);
+        LObj.AddPair('color', LQ.FieldByName('color').AsString);
+        LObj.AddPair('icon',  LQ.FieldByName('icon').AsString);
+        LArr.Add(LObj);
        LQ.Next;
      end;
    finally
@@ -61,7 +70,7 @@ procedure HandleCreateFolder(ARequest: TIdHTTPRequestInfo;
 var
  LUserId: Integer;
  LBody: TJSONObject;
-  LName: string;
+  LName, LColor, LIcon: string;
  LQ: TFDQuery;
  LObj: TJSONObject;
 begin
@@ -74,7 +83,9 @@ begin

  LBody := TJSONHelper.ReadBody(ARequest);
  try
-    LName := Trim(LBody.GetValue<string>('name', ''));
+    LName  := Trim(LBody.GetValue<string>('name',  ''));
+    LColor := Trim(LBody.GetValue<string>('color', ''));
+    LIcon  := Trim(LBody.GetValue<string>('icon',  ''));
  finally
    LBody.Free;
  end;
@@ -95,9 +106,15 @@ begin
    LQ := TFDQuery.Create(nil);
    try
      LQ.Connection := DB.Connection;
-      LQ.SQL.Text := 'INSERT INTO folders (user_id, name) VALUES (:uid, :name)';
-      LQ.ParamByName('uid').AsInteger := LUserId;
-      LQ.ParamByName('name').AsString := LName;
+      LQ.SQL.Text :=
+        'INSERT INTO folders (user_id, name, color, icon) ' +
+        'VALUES (:uid, :name, :color, :icon)';
+      LQ.ParamByName('uid').AsInteger  := LUserId;
+      LQ.ParamByName('name').AsString  := LName;
+      if LColor = '' then LQ.ParamByName('color').Clear
+      else                LQ.ParamByName('color').AsString := LColor;
+      if LIcon = '' then  LQ.ParamByName('icon').Clear
+      else                LQ.ParamByName('icon').AsString  := LIcon;
      try
        LQ.ExecSQL;
      except
@@ -121,6 +138,156 @@ begin
  TJSONHelper.SendJSON(AResponse, LObj);
 end;

+// ===== PUT /folders/{name} ===================================================
+// Body: {color?, icon?} — pass empty string to clear.
+
+procedure HandleUpdateFolder(ARequest: TIdHTTPRequestInfo;
+  AResponse: TIdHTTPResponseInfo; const AParams: TArray<string>);
+var
+  LUserId: Integer;
+  LBody: TJSONObject;
+  LName, LColor, LIcon: string;
+  LHasColor, LHasIcon: Boolean;
+  LQ: TFDQuery;
+begin
+  try
+    LUserId := Authenticate(ARequest, AResponse);
+    RequireCSRF(ARequest, AResponse, LUserId);
+  except
+    on ESessionRejected do Exit;
+  end;
+
+  if Length(AParams) < 1 then
+  begin
+    TJSONHelper.SendError(AResponse, 400, 'Folder name required');
+    Exit;
+  end;
+  LName := TNetEncoding.URL.Decode(AParams[0]);
+  if SameText(LName, 'All') then
+  begin
+    TJSONHelper.SendError(AResponse, 400, 'Cannot customise All');
+    Exit;
+  end;
+
+  LBody := TJSONHelper.ReadBody(ARequest);
+  try
+    LHasColor := LBody.GetValue('color') <> nil;
+    LHasIcon  := LBody.GetValue('icon')  <> nil;
+    LColor    := LBody.GetValue<string>('color', '');
+    LIcon     := LBody.GetValue<string>('icon',  '');
+  finally
+    LBody.Free;
+  end;
+
+  if not (LHasColor or LHasIcon) then
+  begin
+    TJSONHelper.SendOK(AResponse, 'No change');
+    Exit;
+  end;
+
+  DB.Lock;
+  try
+    LQ := TFDQuery.Create(nil);
+    try
+      LQ.Connection := DB.Connection;
+      // Build SET clause dynamically based on which fields the caller sent.
+      var LSet := '';
+      if LHasColor then LSet := 'color = :color';
+      if LHasIcon then
+      begin
+        if LSet <> '' then LSet := LSet + ', ';
+        LSet := LSet + 'icon = :icon';
+      end;
+      LQ.SQL.Text :=
+        'UPDATE folders SET ' + LSet +
+        ' WHERE user_id = :uid AND name = :name';
+      LQ.ParamByName('uid').AsInteger := LUserId;
+      LQ.ParamByName('name').AsString := LName;
+      if LHasColor then
+      begin
+        if LColor = '' then LQ.ParamByName('color').Clear
+        else                LQ.ParamByName('color').AsString := LColor;
+      end;
+      if LHasIcon then
+      begin
+        if LIcon = '' then LQ.ParamByName('icon').Clear
+        else               LQ.ParamByName('icon').AsString := LIcon;
+      end;
+      LQ.ExecSQL;
+      if LQ.RowsAffected = 0 then
+      begin
+        TJSONHelper.SendError(AResponse, 404, 'Not found');
+        Exit;
+      end;
+    finally
+      LQ.Free;
+    end;
+  finally
+    DB.Unlock;
+  end;
+
+  LogAudit(LUserId, 'update_folder', GetClientIP(ARequest));
+  TJSONHelper.SendOK(AResponse, 'Updated');
+end;
+
+// ===== POST /folders/reorder =================================================
+// Body: {names: ["Work", "Personal", "Misc"]} — write sort_order = index+1
+// for each. Names not in the list keep their previous sort_order (so a
+// partial reorder still works after another tab created a folder).
+
+procedure HandleReorderFolders(ARequest: TIdHTTPRequestInfo;
+  AResponse: TIdHTTPResponseInfo; const AParams: TArray<string>);
+var
+  LUserId: Integer;
+  LBody: TJSONObject;
+  LArr: TJSONArray;
+  LQ: TFDQuery;
+  I: Integer;
+begin
+  try
+    LUserId := Authenticate(ARequest, AResponse);
+    RequireCSRF(ARequest, AResponse, LUserId);
+  except
+    on ESessionRejected do Exit;
+  end;
+
+  LBody := TJSONHelper.ReadBody(ARequest);
+  try
+    LArr := LBody.GetValue<TJSONArray>('names');
+    if (LArr = nil) or (LArr.Count = 0) then
+    begin
+      TJSONHelper.SendError(AResponse, 400, 'names array required');
+      Exit;
+    end;
+    DB.Lock;
+    try
+      LQ := TFDQuery.Create(nil);
+      try
+        LQ.Connection := DB.Connection;
+        LQ.SQL.Text :=
+          'UPDATE folders SET sort_order = :ord ' +
+          'WHERE user_id = :uid AND name = :name';
+        for I := 0 to LArr.Count - 1 do
+        begin
+          LQ.ParamByName('uid').AsInteger  := LUserId;
+          LQ.ParamByName('ord').AsInteger  := I + 1;
+          LQ.ParamByName('name').AsString  := LArr.Items[I].Value;
+          LQ.ExecSQL;
+        end;
+      finally
+        LQ.Free;
+      end;
+    finally
+      DB.Unlock;
+    end;
+  finally
+    LBody.Free;
+  end;
+
+  LogAudit(LUserId, 'reorder_folders', GetClientIP(ARequest));
+  TJSONHelper.SendOK(AResponse, 'Reordered');
+end;
+
 // ===== DELETE /folders/{name} ================================================

 procedure HandleDeleteFolder(ARequest: TIdHTTPRequestInfo;
@@ -194,7 +361,9 @@ end;

 initialization
  Router.Register('GET',    '/folders',       HandleGetFolders);
-  Router.Register('POST',   '/folders',       HandleCreateFolder);
+  Router.Register('POST',   '/folders',         HandleCreateFolder);
+  Router.Register('POST',   '/folders/reorder', HandleReorderFolders);
+  Router.Register('PUT',    '/folders/(.+)',    HandleUpdateFolder);
  Router.Register('DELETE', '/folders/(.+)',  HandleDeleteFolder);

 end.