new category flow

out/main/index.js

@@ -114,7 +114,9 @@ class NotesAPI {
     }
     const key = Buffer.from(this.encryptionKey, "hex");
     if (key.length !== 32) {
-      throw new Error("Encryption key must be 64 hex characters (32 bytes)");
+      throw new Error(
+        "Encryption key must be 64 hex characters (32 bytes)"
+      );
     }
     const nonce = sodium.randombytes_buf(sodium.crypto_secretbox_NONCEBYTES);
     const message = JSON.stringify(note);
@@ -132,17 +134,42 @@ class NotesAPI {
     }
     const key = Buffer.from(this.encryptionKey, "hex");
     if (key.length !== 32) {
-      throw new Error("Encryption key must be 64 hex characters (32 bytes)");
+      throw new Error(
+        "Encryption key must be 64 hex characters (32 bytes)"
+      );
+    }
+    let combined;
+    try {
+      combined = Buffer.from(encryptedData, "base64");
+    } catch (e) {
+      throw new Error("Invalid encrypted data: not valid base64");
+    }
+    if (combined.length < sodium.crypto_secretbox_NONCEBYTES + sodium.crypto_secretbox_MACBYTES) {
+      throw new Error("Invalid encrypted data: too short");
     }
-    const combined = Buffer.from(encryptedData, "base64");
     const nonce = combined.slice(0, sodium.crypto_secretbox_NONCEBYTES);
     const ciphertext = combined.slice(sodium.crypto_secretbox_NONCEBYTES);
-    const decrypted = sodium.crypto_secretbox_open_easy(
-      ciphertext,
-      nonce,
-      key
-    );
-    return JSON.parse(decrypted.toString());
+    let decrypted;
+    try {
+      decrypted = sodium.crypto_secretbox_open_easy(
+        ciphertext,
+        nonce,
+        key
+      );
+    } catch (e) {
+      throw new Error("Decryption failed: wrong key or corrupted data");
+    }
+    if (!decrypted) {
+      throw new Error("Decryption failed: no data returned");
+    }
+    const decryptedStr = Buffer.from(decrypted).toString("utf8");
+    try {
+      return JSON.parse(decryptedStr);
+    } catch (e) {
+      throw new Error(
+        `Decryption succeeded but invalid JSON: ${decryptedStr}`
+      );
+    }
   }
   async init() {
     await this._initSodium();