Add optional encrypted Vault Mode for private storage

README.md

@@ -22,9 +22,22 @@ Telegram Drive leverages the Telegram API to allow you to upload, organize, and
 *   **Drag & Drop**: Intuitive drag-and-drop upload and file management.
 *   **Thumbnail Previews**: Inline thumbnails for images and media files.
 *   **Folder Management**: Create "Folders" (private Telegram Channels) to organize content.
+*   **Optional Encrypted Vault**: Store files in an end-to-end encrypted vault backed by a private Telegram channel.
 *   **Privacy Focused**: API keys and data stay local. No third-party servers.
 *   **Cross-Platform**: Native apps for macOS (Intel/ARM), Windows, and Linux.
 
+###  Encrypted Vault Mode
+
+Telegram Drive can also run in **Encrypted Vault** mode. After logging in, you can choose between the normal Saved Messages drive and a local-password-protected vault.
+
+Vault files are encrypted on your device before upload using a key derived from your vault password. Telegram only receives encrypted vault blobs and encrypted manifest snapshots, stored in a private channel named `TelegramVault`. File names, folder records, and file contents are kept inside the encrypted vault manifest instead of being stored as normal Telegram channel folders.
+
+Normal Drive remains the default path and keeps the existing Saved Messages/channel behavior unchanged. The first Vault Mode version stores vault configuration locally on the device where the vault was created, so fresh-device vault restore/import is not yet included. Keep your vault password safe; it is required to unlock encrypted files and cannot be recovered by the app.
+
+| Storage Mode Selection | Vault Unlock |
+|------------------------|--------------|
+| ![Storage Mode Selection](screenshots/ModeSelection.png) | ![Vault Unlock](screenshots/VaultUnlock.png) |
+
 ##  Screenshots
 
 | Dashboard | File Preview |

app/src-tauri/Cargo.toml

@@ -37,10 +37,15 @@ log = "0.4"
 env_logger = "0.11"
 tauri-plugin-updater = "2.9.0"
 actix-web = "4"
+actix-files = "0.6"
 actix-cors = "0.7"
 futures = "0.3"
 async-stream = "0.3"
 actix-rt = "2"
 tauri-plugin-process = "2.3.1"
 rand = "0.8"
-
+argon2 = "0.5"
+chacha20poly1305 = "0.10"
+zeroize = "1"
+uuid = { version = "1", features = ["v4"] }
+tempfile = "3"

app/src-tauri/src/commands/mod.rs

@@ -1,10 +1,10 @@
+use grammers_client::types::{LoginToken, PasswordToken};
+use grammers_client::Client;
 use std::sync::Arc;
 use tokio::sync::Mutex;
-use grammers_client::{Client};
-use grammers_client::types::{LoginToken, PasswordToken};
 
 /// Tracks the lifecycle of the Telegram connection
-/// 
+///
 /// IMPORTANT: The `runner_shutdown` field is critical for preventing stack overflow.
 /// When reconnecting, we MUST shutdown the old runner before spawning a new one.
 /// Without this, runner tasks accumulate and exhaust the thread stack.
@@ -24,14 +24,16 @@ pub struct TelegramState {
 
 pub mod auth;
 pub mod fs;
-pub mod preview;
-pub mod utils;
 pub mod network;
+pub mod preview;
 pub mod streaming;
+pub mod utils;
+pub mod vault;
 
 pub use auth::*;
 pub use fs::*;
-pub use preview::*;
-pub use utils::*;
 pub use network::*;
+pub use preview::*;
 pub use streaming::*;
+pub use utils::*;
+pub use vault::*;

app/src-tauri/src/commands/preview.rs

@@ -162,13 +162,15 @@ pub async fn cmd_get_preview(
 pub async fn cmd_clean_cache(
     app_handle: tauri::AppHandle,
 ) -> Result<(), String> {
-    let cache_dir = app_handle
+    let base_cache_dir = app_handle
         .path()
         .app_cache_dir()
-        .map_err(|e: tauri::Error| e.to_string())?
-        .join("previews");
-    if cache_dir.exists() {
-        let _ = std::fs::remove_dir_all(cache_dir);
+        .map_err(|e: tauri::Error| e.to_string())?;
+    for child in ["previews", "vault"] {
+        let cache_dir = base_cache_dir.join(child);
+        if cache_dir.exists() {
+            let _ = std::fs::remove_dir_all(cache_dir);
+        }
     }
     Ok(())
 }
@@ -271,4 +273,4 @@ pub async fn cmd_get_thumbnail(
     }
 
     Ok("".to_string())
-}
+}