feat: App-Lock + Dateinamen-Verschleierung für Bibliotheken (v0.5.2)

Optionaler Passwortschutz pro Bibliothek, einstellbar unter
Einstellungen → Bibliotheks-Schutz.

App-Lock:
- lock.json in .mediashelf/ speichert Salt + AES-256-GCM-Verifier
  (Passwort wird nie gespeichert, gleiche Crypto-Infrastruktur wie Vault)
- Beim Öffnen einer geschützten Bibliothek erscheint ein Passwort-Dialog
- Passwort ändern / Schutz deaktivieren jederzeit in den Einstellungen
- Funktioniert ideal in Kombination mit VeraCrypt-Containern

Dateinamen-Verschleierung (erfordert aktiven App-Lock):
- Neue Imports erhalten UUID-basierte Dateinamen auf der Festplatte
- Der Bibliotheksordner verrät keine Dateinamen an Außenstehende

Vault-Crypto:
- generateSalt(), deriveKeyFromSalt(), encryptRaw(), decryptRaw()
  als public aliases für externe Nutzung durch LibraryLock

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Fenron

lib/core/library_lock.dart

@@ -0,0 +1,110 @@
+import 'dart:convert';
+import 'dart:io';
+
+import 'package:path/path.dart' as p;
+
+import 'constants.dart';
+import 'vault_crypto.dart';
+
+/// Manages the optional App-Lock for a library.
+///
+/// When enabled, a `lock.json` file is written to `.mediashelf/`.
+/// It contains a salt and an AES-256-GCM verifier blob (same scheme as
+/// VaultCrypto) — the password is never stored.
+///
+/// On disk the file looks like:
+/// ```json
+/// { "salt": "<base64>", "verifier": "<base64>", "obfuscate_filenames": false }
+/// ```
+class LibraryLock {
+  const LibraryLock._();
+
+  static String _lockPath(String libraryPath) =>
+      p.join(libraryPath, kMediashelfDir, 'lock.json');
+
+  // ── Query ───────────────────────────────────────────────────────────────────
+
+  /// Returns true when the given library has an App-Lock configured.
+  static bool isLocked(String libraryPath) =>
+      File(_lockPath(libraryPath)).existsSync();
+
+  /// Reads the `obfuscate_filenames` setting from the lock file.
+  /// Returns false if no lock file exists.
+  static bool filenamesObfuscated(String libraryPath) {
+    final f = File(_lockPath(libraryPath));
+    if (!f.existsSync()) return false;
+    try {
+      final data = jsonDecode(f.readAsStringSync()) as Map<String, dynamic>;
+      return data['obfuscate_filenames'] as bool? ?? false;
+    } catch (_) {
+      return false;
+    }
+  }
+
+  // ── Setup / change password ─────────────────────────────────────────────────
+
+  /// Enables the App-Lock for [libraryPath] with [password].
+  /// Overwrites any existing lock file.
+  static Future<void> enable(
+    String libraryPath,
+    String password, {
+    bool obfuscateFilenames = false,
+  }) async {
+    // Derive key + verifier using the same crypto as VaultCrypto, but with a
+    // library-scoped prefs key so it doesn't collide with the Vault key.
+    final salt = VaultCrypto.generateSalt();
+    final key = await VaultCrypto.deriveKeyFromSalt(password, salt);
+    final verifier = await VaultCrypto.encryptRaw(
+      key,
+      utf8.encode('mediashelf-lock-v1-ok'),
+    );
+
+    final lockFile = File(_lockPath(libraryPath));
+    await lockFile.writeAsString(
+      jsonEncode({
+        'salt': base64.encode(salt),
+        'verifier': base64.encode(verifier),
+        'obfuscate_filenames': obfuscateFilenames,
+      }),
+      flush: true,
+    );
+  }
+
+  /// Disables the App-Lock by deleting the lock file.
+  static Future<void> disable(String libraryPath) async {
+    final f = File(_lockPath(libraryPath));
+    if (f.existsSync()) await f.delete();
+  }
+
+  /// Updates only the `obfuscate_filenames` flag without changing the password.
+  static Future<void> setObfuscateFilenames(
+    String libraryPath,
+    bool value,
+  ) async {
+    final f = File(_lockPath(libraryPath));
+    if (!f.existsSync()) return;
+    final data = jsonDecode(f.readAsStringSync()) as Map<String, dynamic>;
+    data['obfuscate_filenames'] = value;
+    await f.writeAsString(jsonEncode(data), flush: true);
+  }
+
+  // ── Verification ────────────────────────────────────────────────────────────
+
+  /// Returns true if [password] is correct for this library.
+  static Future<bool> verify(String libraryPath, String password) async {
+    final f = File(_lockPath(libraryPath));
+    if (!f.existsSync()) return true; // no lock → always ok
+
+    try {
+      final data = jsonDecode(f.readAsStringSync()) as Map<String, dynamic>;
+      final salt = base64.decode(data['salt'] as String);
+      final verifier = base64.decode(data['verifier'] as String);
+
+      final key = await VaultCrypto.deriveKeyFromSalt(password, salt);
+      await VaultCrypto.decryptRaw(key, verifier); // throws if wrong
+      return true;
+    } catch (_) {
+      return false;
+    }
+  }
+}

lib/core/vault_crypto.dart

@@ -38,12 +38,28 @@ class VaultCrypto {
     );
   }
 
+  /// Public alias for external callers (e.g. LibraryLock).
+  static Future<SecretKey> deriveKeyFromSalt(
+          String password, List<int> salt) =>
+      _deriveKey(password, salt);
+
   /// Generates 16 cryptographically random bytes.
   static List<int> _randomSalt() {
     final rng = Random.secure();
     return List.generate(16, (_) => rng.nextInt(256));
   }
 
+  /// Public alias for external callers.
+  static List<int> generateSalt() => _randomSalt();
+
+  /// Public alias for [encrypt] — same format, usable without the Vault context.
+  static Future<Uint8List> encryptRaw(SecretKey key, List<int> plaintext) =>
+      encrypt(key, plaintext);
+
+  /// Public alias for [decrypt].
+  static Future<Uint8List> decryptRaw(SecretKey key, Uint8List data) =>
+      decrypt(key, data);
+
   // ── Encryption / Decryption ─────────────────────────────────────────────────
 
   /// Encrypts [plaintext] with [key].

lib/providers/library_lock_provider.dart

@@ -0,0 +1,18 @@
+import 'package:flutter_riverpod/flutter_riverpod.dart';
+
+import '../core/library_lock.dart';
+import 'library_provider.dart';
+
+/// Whether the current library has an App-Lock configured.
+final libraryLockedProvider = Provider<bool>((ref) {
+  final path = ref.watch(libraryPathProvider);
+  if (path == null) return false;
+  return LibraryLock.isLocked(path);
+});
+
+/// Whether the current library has filename obfuscation enabled.
+final filenamesObfuscatedProvider = Provider<bool>((ref) {
+  final path = ref.watch(libraryPathProvider);
+  if (path == null) return false;
+  return LibraryLock.filenamesObfuscated(path);
+});