feat: Disable levels of encryptions by default

- Add `allow_client_encryption_key` option to allow encryption key provided by
  the client on the web UI (false by default)
- Add `allow_no_encryption` option to allow notes without encryption (disabled
  by default)

Signed-off-by: Julien Riou <julien@riou.xyz>

src/server/handlers_api.go

@@ -16,9 +16,11 @@ func HealthHandler(w http.ResponseWriter, r *http.Request) {
 }
 
 type CreateNoteHandler struct {
-	logger        *slog.Logger
-	db            *Database
-	maxUploadSize int64
+	logger                   *slog.Logger
+	db                       *Database
+	maxUploadSize            int64
+	allowClientEncryptionKey bool
+	allowNoEncryption        bool
 }
 
 type CreateNotePayload struct {
@@ -47,6 +49,16 @@ func (h *CreateNoteHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if !h.allowNoEncryption && !body.Encrypted {
+		WriteError(w, "could not create note", fmt.Errorf("encryption is mandatory"))
+		return
+	}
+
+	if !h.allowClientEncryptionKey && body.EncryptionKey != "" {
+		WriteError(w, "could not create note", fmt.Errorf("client encryption key is not allowed"))
+		return
+	}
+
 	content, err := internal.Decode(body.Content)
 
 	if err != nil {