fix: enforce encrypted data validation to prevent plaintext exposure

Author: rui-typelets

src/lib/validation.ts

@@ -35,8 +35,14 @@ export const reorderFolderSchema = z.object({
 });
 
 export const createNoteSchema = z.object({
-  title: z.string().min(1).max(200).optional(),
-  content: z.string().optional(),
+  title: z.string().refine(
+    (value) => value === "[ENCRYPTED]",
+    "Title must be '[ENCRYPTED]'"
+  ).optional(),
+  content: z.string().refine(
+    (value) => value === "[ENCRYPTED]",
+    "Content must be '[ENCRYPTED]'"
+  ).optional(),
   folderId: z.string().uuid().nullable().optional(),
   starred: z.boolean().optional(),
   tags: z.array(z.string().max(50)).max(20).optional(),
@@ -48,8 +54,14 @@ export const createNoteSchema = z.object({
 });
 
 export const updateNoteSchema = z.object({
-  title: z.string().min(1).max(200).optional(),
-  content: z.string().optional(),
+  title: z.string().refine(
+    (value) => value === "[ENCRYPTED]",
+    "Title must be '[ENCRYPTED]'"
+  ).optional(),
+  content: z.string().refine(
+    (value) => value === "[ENCRYPTED]",
+    "Content must be '[ENCRYPTED]'"
+  ).optional(),
   folderId: z.string().uuid().nullable().optional(),
   starred: z.boolean().optional(),
   archived: z.boolean().optional(),

src/websocket/handlers/notes.ts

@@ -97,7 +97,15 @@ export class NoteHandler extends BaseResourceHandler {
 
         Object.keys(message.changes).forEach(key => {
           if (allowedFields.includes(key)) {
-            filteredChanges[key] = (message.changes as Record<string, unknown>)[key];
+            const value = (message.changes as Record<string, unknown>)[key];
+
+            // Validate title and content fields must be [ENCRYPTED]
+            if ((key === 'title' || key === 'content') && typeof value === 'string' && value !== '[ENCRYPTED]') {
+              console.warn(`Note update: rejected plaintext ${key} for note ${message.noteId} - must be [ENCRYPTED]`);
+              return;
+            }
+
+            filteredChanges[key] = value;
           } else {
             console.warn(`Note update: filtered out disallowed field '${key}' for note ${message.noteId}`);
           }