Problem
try_unlock catches Exception together with InvalidToken, so corrupt vault files and operational failures are reported as an invalid access key. Unlock attempts also have no audit trail.
Proposed fix
- Treat only Fernet authentication failures as invalid keys.
- Surface vault loading failures as a controlled server error.
- Record unlock outcomes without logging access keys or player names.
Validation
- Python compilation check
- Invalid-key path check
Problem
try_unlockcatchesExceptiontogether withInvalidToken, so corrupt vault files and operational failures are reported as an invalid access key. Unlock attempts also have no audit trail.Proposed fix
Validation