Notez

Notez is a desktop note-taking application — Windows, macOS, Linux — that treats your notes the way a filesystem treats your files. Every note lives in a hierarchical project tree of unlimited depth. Drag to rearrange, fold to focus, search across everything. It's a place to put the things you want to find again.

The editor is rich without being heavy: tables, code blocks, formatting, attachments, inline images. Open any PDF or Word document straight in a tab with proper zoom and page navigation — no external app, no download. Tabs work the way a browser's do: pinned, preview, drag to reorder, split a pane to compare two notes side by side.

A finished project can be shared with anyone as a public read-only link — no account needed to read, every change reflected immediately, revoke at any time. Teams can also collaborate with proper per-project, per-user permissions. Everything is soft-deleted until you choose to purge, so nothing is ever truly gone by accident.

npm workspaces monorepo with four packages: @notez/client (Electron desktop), @notez/server (Express API), @notez/client-web (web sharing SPA), and @notez/shared (the source of truth for API routes and DTO types). Both clients import the same shared constants so a renamed endpoint or DTO cannot drift between renderer and server.

Layered server, no ORM. Requests flow routes → controllers → services → repositories → raw SQL. Zod validates every body, query and route param at the controller boundary. Repositories use parameterised queries through the mssql driver and map rows into typed objects. Soft deletes are first-class: every major table carries a deleted_at column and every query filters it.

Permissions in the JWT. Each user's per-project CRUD rights are encoded in their token, so the requirePermission() middleware authorises without a database round-trip. Tokens reissue on permission changes; share-link revocation hits the database on every request to guarantee instant revocation.

Electron security model. Context isolation is on, node integration is off, and the preload bridge exposes only the API surface the renderer actually needs. File uploads are validated by magic byte, not just by extension. DOMPurify runs on both client and server so any malicious paste-in cannot survive the round-trip.