From 7a3397f97861a391877908ebce3e3762fc71e7ca Mon Sep 17 00:00:00 2001
From: cupcakearmy <hi@nicco.io>
Date: Mon, 3 May 2021 12:21:51 +0200
Subject: [PATCH] always encrypt content

---
 client/src/lib/api.ts                         |  3 +-
 client/src/lib/views/Create.svelte            | 33 ++++++-------------
 client/src/routes/about.svelte                |  2 +-
 .../{[id].svelte => [id]/[password].svelte}   | 32 +++++++-----------
 src/note/model.rs                             |  5 +--
 src/note/routes.rs                            |  6 +---
 6 files changed, 26 insertions(+), 55 deletions(-)
 rename client/src/routes/note/{[id].svelte => [id]/[password].svelte} (71%)

diff --git a/client/src/lib/api.ts b/client/src/lib/api.ts
index aa89a89..912383d 100644
--- a/client/src/lib/api.ts
+++ b/client/src/lib/api.ts
@@ -5,11 +5,10 @@ const base = axios.create({ baseURL: dev ? 'http://localhost:5000' : undefined }
 
 export type Note = {
 	contents: string
-	password: boolean
 	views?: number
 	expiration?: number
 }
-export type NoteInfo = Pick<Note, 'password'>
+export type NoteInfo = {}
 export type NotePublic = Pick<Note, 'contents'>
 
 export async function create(note: Note) {
diff --git a/client/src/lib/views/Create.svelte b/client/src/lib/views/Create.svelte
index ad0e7c3..06c8c3a 100644
--- a/client/src/lib/views/Create.svelte
+++ b/client/src/lib/views/Create.svelte
@@ -1,7 +1,7 @@
 <script lang="ts">
 	import type { Note } from '$lib/api'
 	import { create } from '$lib/api'
-	import { getKeyFromString, encrypt } from '$lib/crypto'
+	import { getKeyFromString, encrypt, Hex, getRandomBytes } from '$lib/crypto'
 
 	import Button from '$lib/ui/Button.svelte'
 	import Switch from '$lib/ui/Switch.svelte'
@@ -10,11 +10,9 @@
 
 	let note: Note = {
 		contents: '',
-		password: false,
 		views: 1,
 		expiration: 60,
 	}
-	let password: string = ''
 	let result: { password: string; id: string } | null = null
 	let advanced = false
 	let type = false
@@ -37,18 +35,15 @@
 		try {
 			error = null
 			loading = true
+			const password = Hex.encode(getRandomBytes(32))
+			const key = await getKeyFromString(password)
 			const data: Note = {
-				contents: note.contents,
-				password: !!password,
+				contents: await encrypt(note.contents, key),
 			}
 			// @ts-ignore
 			if (type) data.expiration = parseInt(note.expiration)
 			// @ts-ignore
 			else data.views = parseInt(note.views)
-			if (data.password) {
-				const key = await getKeyFromString(password)
-				data.contents = await encrypt(data.contents, key)
-			}
 
 			const response = await create(data)
 			result = {
@@ -68,11 +63,12 @@
 </script>
 
 {#if result}
-	{#if result.password}
-		<TextInput type="password" readonly value={result.password} copy />
-		<br />
-	{/if}
-	<TextInput type="text" readonly value="{window.location.origin}/note/{result.id}" copy />
+	<TextInput
+		type="text"
+		readonly
+		value="{window.location.origin}/note/{result.id}/{result.password}"
+		copy
+	/>
 	<br />
 	<Button on:click={reset}>new</Button>
 {:else}
@@ -112,15 +108,6 @@
 						max={360}
 					/>
 				</div>
-				<br />
-				<TextInput
-					type="password"
-					label="password"
-					placeholder="optional"
-					bind:value={password}
-					copy
-					random
-				/>
 			</div>
 
 			<style>
diff --git a/client/src/routes/about.svelte b/client/src/routes/about.svelte
index 93bb9b7..2e14e64 100644
--- a/client/src/routes/about.svelte
+++ b/client/src/routes/about.svelte
@@ -26,9 +26,9 @@
 
 	<b>▶ Features</b>
 	<ul>
+		<li>server cannot decrypt contents due to client side encryption</li>
 		<li>view and time constrains</li>
 		<li>in memory, no persistence</li>
-		<li>in browser encryption → server cannot decrypt contents</li>
 	</ul>
 
 	<p>
diff --git a/client/src/routes/note/[id].svelte b/client/src/routes/note/[id]/[password].svelte
similarity index 71%
rename from client/src/routes/note/[id].svelte
rename to client/src/routes/note/[id]/[password].svelte
index 734f7c8..85fe8ef 100644
--- a/client/src/routes/note/[id].svelte
+++ b/client/src/routes/note/[id]/[password].svelte
@@ -17,8 +17,8 @@
 	import { onMount } from 'svelte'
 
 	export let id: string
-	let needPassword = false
-	let password: string = ''
+	export let password: string
+
 	let note: NotePublic | null = null
 	let exists = false
 
@@ -29,8 +29,7 @@
 		try {
 			loading = true
 			error = null
-			const data = await info(id)
-			needPassword = data.password
+			await info(id)
 			exists = true
 		} catch {
 			exists = false
@@ -40,17 +39,15 @@
 	})
 
 	async function show() {
-		const data = note || (await get(id)) // Don't get the content twice on wrong password.
-		if (needPassword) {
-			try {
-				const key = await getKeyFromString(password)
-				data.contents = await decrypt(data.contents, key)
-				error = false
-			} catch {
-				error = true
-			}
+		try {
+			error = false
+			const data = note || (await get(id)) // Don't get the content twice on wrong password.
+			const key = await getKeyFromString(password)
+			data.contents = await decrypt(data.contents, key)
+			note = data
+		} catch {
+			error = true
 		}
-		note = data
 	}
 </script>
 
@@ -67,17 +64,12 @@
 	{:else}
 		<form on:submit|preventDefault={show}>
 			<p>click below to show and delete the note if the counter has reached it's limit</p>
-			{#if needPassword}
-				<TextInput type="password" label="password" bind:value={password} />
-				<br />
-			{/if}
 			<Button type="submit">show note</Button>
 			{#if error}
 				<br />
 				<p class="error-text">
-					wrong password. could not decipher.
+					wrong password. could not decipher. probably a broken link. note was destroyed.
 					<br />
-					note already destroyed. try again without reloading the page.
 				</p>
 			{/if}
 		</form>
diff --git a/src/note/model.rs b/src/note/model.rs
index ab48b59..069edf8 100644
--- a/src/note/model.rs
+++ b/src/note/model.rs
@@ -5,15 +5,12 @@ use serde::{Deserialize, Serialize};
 #[derive(Serialize, Deserialize, Clone)]
 pub struct Note {
   pub contents: String,
-  pub password: bool,
   pub views: Option<u8>,
   pub expiration: Option<u64>,
 }
 
 #[derive(Serialize, Deserialize, Clone)]
-pub struct NoteInfo {
-  pub password: bool,
-}
+pub struct NoteInfo {}
 
 #[derive(Serialize, Deserialize, Clone)]
 pub struct NotePublic {
diff --git a/src/note/routes.rs b/src/note/routes.rs
index 15658a8..95669d7 100644
--- a/src/note/routes.rs
+++ b/src/note/routes.rs
@@ -23,11 +23,7 @@ async fn one(path: web::Path<NotePath>) -> impl Responder {
   let note = store::get(&p.id);
   match note {
     None => return HttpResponse::NotFound().finish(),
-    Some(note) => {
-      return HttpResponse::Ok().json(NoteInfo {
-        password: note.password,
-      })
-    }
+    Some(_) => return HttpResponse::Ok().json(NoteInfo {}),
   }
 }