How to detect programmatically if content under org-mode headline is encrypted or not before a save or commit?

Question

org-mode allows users to encrypt the contents under a headline by adding the crypt tag with C-c C-q crypt and then calling M-x org-encrypt-entry.

Below is an example using this feature:

* Headline                  :crypt:
-----BEGIN PGP MESSAGE-----

jA0EBwMCtfdtKCPGXBdg0oQBDW4GlaBGCoAZNwNkQiP1+7oesTJkIHVbrHNV0StK
CDyLI8FADGlEY26dr7J1Ojo7HNy+aWGMBGTpBKDWZ0/ChB0JS39SKDL5DMEvYZuZ
c0Y6IuCnJ971nnM9rt+WHAs5i+LirGCPcTjrGLAasYEtrNwSPH2O9X+9PT1ze+r1
IOLfKZ0=
=9sC6
-----END PGP MESSAGE-----

I would like to prevent users from saving the file and committing changes to a git repository if the content under a headline should be encrypted but is not.

The goal is to prevent unintentional leaks to local file system and stop unencrypted text from being added to the git repository.

How to detect programmatically if content under org-mode headline is not encrypted before a save or commit?

I'm looking for an answer that could be called from the command-line for use in a on commit hook.

Thank you of your help!

---

emacs version: 24.3 or greater
org mode version: 9.1.2 or greater
git version: 2.12.3 or greater
gpg version: 1.4.21 or greater

Answer 1

From the commentary at the beginning of org-crypt.el:

;; 4. To automatically encrypt all necessary entries when saving a
;;    file, call `org-crypt-use-before-save-magic' after loading
;;    org-crypt.el.

So add to your init.el something like:

(with-eval-after-load 'org
  (require 'org-crypt)
  (add-hook 'before-save-hook #'org-crypt-use-before-save-magic))

Encrypting from a commit hook seems like the wrong time to do it. Perhaps your commit hook could more usefully test against the absence of -----BEGIN PGP MESSAGE----- immediately following each :crypt: tag instead.