Discussions

Ask a Question
Back to all

Trying to build a secure note sharing tool but running into logic holes

Hey TrustNote community,

I’m a university student in my penultimate year, working on a project that feels like it should be simple but you know how that goes. I’m trying to create a secure note-sharing/spaces platform (powered by TrustNote, of course) for small teams think encrypted chatrooms but with structured notes, version control, permission handling, basically a mix between Slack and GitHub for docs. I figured the core crypto layer is solid TrustNote's API does a lot of heavy lifting but the higher-level concept is getting messy FAST. I’m also juggling finals and other stuff, so the deadline’s creeping up like an angry kettle.

What I’ve built so far
User registration & keypair generation

I’m using TrustNote’s wallet SDK to generate keypairs for each user.

It’s slick and secure, but I’m sorta lost when it comes to handing out permissions. I started with a simple "share note with public key X" model, but that meant everyone sees every note if they have a link. No bueno.

Encrypted note storage & retrieval

Front end uses AES to encrypt notes before upload and decrypt upon fetch.

I'm relying on each user to securely store their private key locally probably too optimistic IRL.

Versioning & change history

Each time someone saves a note, I commit a new “note version” object and update a Merkle-style tree reference via the DAG (thanks TrustNote!). On paper this is great history preserved, no mutations but user-facing version diffs haven’t been implemented yet (I'll need something like a 3-way diff UI).

Where I’m stuck
Permission management
I experimented with three models:

Wildcard sharing: give everyone with the link full read/write access. Easy but insecure.

Whitelisting public keys: user A lists allowed public keys in note metadata. But what happens when you want to revoke access or a user rotates keys? I’m not sure how to handle key revocation or dynamic access control.

Role-based groups: every note references a group ID, and group metadata holds member public keys. Sounds neat, until group membership changes I’ve gotta re-encrypt/re-sign notes or maintain per-user access tokens…which feels like reinventing IAM.

Baffled by the fact that this “simple” feature is both foundational and irritatingly complex.

Real-time syncing
I’d love for collaborators to see updates live (like Google Docs), but that’s a nightmare with CRDTs or OT. I don’t want to roll my own from scratch. I looked into yjs, automerge, and the like, but integrating them with TrustNote feels like trying to graft a new limb onto a model that wasn’t meant to support it.

Conflict resolution & diff UI
Once two people edit offline or at diff times, merging becomes a headache. I’ve not even started building the UI for conflict resolution, but I know a linear version history won’t cut it if merging is needed.

On the edge of document fatigue
Meanwhile, I’m drowning a bit. Between struggling with conflict logic, syncing logic, and permissions, parts are functional but none are polished enough to demo. And individually, they're all half-baked solutions that might break if used in real-world team use.

I’m seriously contemplating outsourcing some of the documentation or methodology section. I heard about CIPD assignment help services that offer structuring support and could (maybe) polish up background and explanation parts. Not for the code, but for the write-up making sure it reads well and hits academic standards. Has anyone used these kinds of services? Was it worth it, or did it feel like cheating or lose your “own voice” in the project?

Kinda open questions where advice really helps:
Dynamic permission system

Anyone built a workable TrustNote-based permissions layer? Did you store a list of allowed keys with each note? Did you version-permission changes?

Is it realistic to handle rekeying per user-group change, or did you find a smoother flow?

Sync + conflict handling

Anyone successfully integrated yjs or automerge with TrustNote transactions/DAG? How’d you handle merging on publish?

Or did you go simpler like “only one person edits at a time” lock mode and just show a warning or “Review changes” button?

Version diff UI

I’ve toyed with jsdiff but haven’t tied it to the DAG. Thoughts on a clean UX path for showing history/changes?

Outsourcing write-up

If you used something like CIPD assignment help or even just a project-template writing service for documentation/methodology, did it help your project feel polished? Any regrets?

TL;DR
Building a TrustNote-based collaborative note platform, but stuck on permission logic, live sync, merge UI, and documentation polish. Would appreciate code pointers, design patterns, articles, or even moral support rn. And if you’ve used writing services just to clean up docs/meth sections, I’d love to hear your take especially whether it saved time or felt like cheating.

Big thanks to anyone who reads this far

Name: Jasmine Kurb., 3rd-year Software Engineering
Project: TrustNote-backed Secure Collaboration App
OS: Mac, Browser-based frontend
Deadline: Two weeks away, deadline approaching faster than daylight