Re-applied review fixes on top of the live folder-sharing implementation:
- PATCH/DELETE /notes/:id now do an id-only lookup and return an explicit
403 when the caller is not the owner (previously returned an ambiguous
404). This makes the read-only contract for shared-folder recipients
precise instead of silently masquerading as "not found".
- PUT /note-folders/:id/shares rejects self-share with 400
"Cannot share folder with yourself" instead of silently filtering the
caller's id out of the recipient set.
- GET /note-folders/shared-with-me now includes a `noteCount` (live count
of the owner's non-archived notes in the folder) computed via SQL
subquery; SharedFolder TS type updated; folders rail renders the count
next to each shared folder.
- SharedFolderView accepts the page's `search` value and filters the
read-only list client-side over title + content + checklist item text,
matching the owner's search experience. Empty state distinguishes
"no notes" from "no matches".
- Added GET /notes?sharedFolderId=:id as a spec-aligned alias that
returns the owner's live notes inside a folder shared with the caller
(gated by an active row in note_folder_shares).
- Updated the stale comment block above the share routes that claimed
recipient writes "just 404"; documents the new 403 contract.
Deviations / out of scope:
- Project uses `drizzle-kit push` (no migrations directory); no SQL
migration file was added.
- Pre-existing TS errors in artifacts/api-server/src/routes/executive-meetings.ts
remain; unrelated to Task #445.
- "Strict reject for nonexistent recipient ids in share PUT" left as
optional follow-up (currently silently dropped per existing behavior).
riyadhafraa
7384711705