fix(cipher): clear omitted notes on full update (#363)

Treat omitted nullable cipher fields as cleared during full updates so stale encrypted notes are not restored by merge fallback.

Fixes #362

src/handlers/ciphers.ts

@@ -27,6 +27,7 @@ import { deleteAllAttachmentsForCipher, deleteAllAttachmentsForCiphers } from '.
 import { parsePagination, encodeContinuationToken } from '../utils/pagination';
 import { readActingDeviceIdentifier } from '../utils/device';
 import { auditRequestMetadata, writeAuditEvent } from '../services/audit-events';
+import { readNullableFullUpdateField } from './cipher-full-update';
 
 // CONTRACT:
 // Cipher JSON is the highest-risk Bitwarden compatibility surface. Preserve
@@ -1100,16 +1101,10 @@ export async function handleUpdateCipher(request: Request, env: Env, userId: str
     cipher.passwordHistory = incomingPasswordHistory.value ?? null;
   }
 
-  // Custom fields deletion compatibility:
-  // - Accept both camelCase "fields" and PascalCase "Fields".
-  // - For full update (PUT/POST on this endpoint), missing fields means cleared fields.
-  //   This prevents stale custom fields from being resurrected by merge fallback.
-  const incomingFields = getAliasedProp(cipherData, ['fields', 'Fields']);
-  if (incomingFields.present) {
-    cipher.fields = incomingFields.value ?? null;
-  } else if (request.method === 'PUT' || request.method === 'POST') {
-    cipher.fields = null;
-  }
+  // Nullable fields use replacement semantics on this full-update endpoint.
+  // Some clients omit cleared values, so merge fallback must not resurrect them.
+  cipher.notes = readNullableFullUpdateField<string>(cipherData, ['notes', 'Notes']);
+  cipher.fields = readNullableFullUpdateField<Cipher['fields']>(cipherData, ['fields', 'Fields']);
   normalizeCipherForStorage(cipher);
   const compatibilityError = validateCipherEncryptedFieldsForCompatibility(cipher);
   if (compatibilityError) return errorResponse(compatibilityError, 400);