fix(node): filter global anchors before limit and use deduped repo visibility

Author: Gravirei

crates/gitlawb-node/src/api/arweave.rs

@@ -9,6 +9,7 @@ use serde::Deserialize;
 use crate::auth::AuthenticatedDid;
 use crate::error::{AppError, Result};
 use crate::state::AppState;
+use crate::visibility::{visibility_check, Decision};
 
 #[derive(Debug, Deserialize)]
 pub struct ListAnchorsQuery {
@@ -67,33 +68,54 @@ pub async fn list_anchors(
     };
 
     let limit = q.limit.clamp(0, 200);
-    let raw_anchors = state
-        .db
-        .list_arweave_anchors(normalized_repo.as_deref(), limit)
-        .await
-        .map_err(AppError::Internal)?;
 
-    // For global listings (no ?repo=), filter each anchor on current visibility.
-    let anchors = if normalized_repo.is_none() {
-        let mut filtered = Vec::new();
-        for anchor in raw_anchors {
-            // Parse repo slug to resolve current visibility.
-            let parts: Vec<&str> = anchor.repo.splitn(2, '/').collect();
-            if parts.len() != 2 {
-                continue;
-            }
-            let (owner, name) = (parts[0], parts[1]);
-            // Skip anchors for repos the caller cannot currently read.
-            if crate::api::authorize_repo_read(&state, owner, name, caller, "/")
-                .await
-                .is_ok()
-            {
-                filtered.push(anchor);
-            }
-        }
-        filtered
+    let anchors = if let Some(ref slug) = normalized_repo {
+        // Per-repo: filter at the DB level and return directly.
+        state
+            .db
+            .list_arweave_anchors(Some(slug), limit)
+            .await
+            .map_err(AppError::Internal)?
     } else {
-        raw_anchors
+        // Global listing: fetch all anchors, filter by current visibility
+        // against the deduped repo view (so mirror rows never bypass canonical
+        // visibility), then take limit.
+        let all_anchors = state
+            .db
+            .list_arweave_anchors(None, i64::MAX)
+            .await
+            .map_err(AppError::Internal)?;
+
+        // Build a set of readable repo short-form slugs from the deduped list.
+        let repos = state
+            .db
+            .list_all_repos_deduped()
+            .await
+            .map_err(AppError::Internal)?;
+        let repo_ids: Vec<String> = repos.iter().map(|r| r.id.clone()).collect();
+        let rules_by_repo = state
+            .db
+            .list_visibility_rules_for_repos(&repo_ids)
+            .await
+            .map_err(AppError::Internal)?;
+
+        let readable: std::collections::HashSet<String> = repos
+            .iter()
+            .filter(|r| {
+                let rules = rules_by_repo.get(&r.id).map(Vec::as_slice).unwrap_or(&[]);
+                visibility_check(rules, r.is_public, &r.owner_did, caller, "/") != Decision::Deny
+            })
+            .map(|r| {
+                let short = r.owner_did.split(':').next_back().unwrap_or(&r.owner_did);
+                format!("{}/{}", short, r.name)
+            })
+            .collect();
+
+        all_anchors
+            .into_iter()
+            .filter(|a| readable.contains(&a.repo))
+            .take(limit as usize)
+            .collect()
     };
 
     Ok(Json(serde_json::json!({

crates/gitlawb-node/src/api/ipfs.rs

@@ -246,9 +246,11 @@ pub async fn list_pins(
         .map_err(AppError::Internal)?;
 
     // Build a set of sha256_hex values from repos the caller can read.
+    // Use the deduped repo list so mirror rows never bypass the canonical
+    // repo's visibility rules (#136).
     let repos = state
         .db
-        .list_all_repos()
+        .list_all_repos_deduped()
         .await
         .map_err(AppError::Internal)?;
 
@@ -262,18 +264,6 @@ pub async fn list_pins(
     let mut allowed_sha256s = std::collections::HashSet::new();
 
     for repo in &repos {
-        // Preserve the quarantine gate from authorize_repo_read: a quarantined
-        // mirror is treated as nonexistent on every read surface, so its objects
-        // must not contribute to the allowed SHA-256 set (#P2).
-        if state
-            .db
-            .is_repo_quarantined(&repo.id)
-            .await
-            .map_err(AppError::Internal)?
-        {
-            continue;
-        }
-
         let rules: &[crate::db::VisibilityRule] = rules_by_repo
             .get(&repo.id)
             .map(Vec::as_slice)

crates/gitlawb-node/src/test_support.rs

@@ -2372,4 +2372,22 @@ mod tests {
             .unwrap();
         assert_eq!(resp.status(), StatusCode::NOT_FOUND);
     }
+
+    /// #121: negative limit is clamped to 0 and returns a bounded response (no 500).
+    #[sqlx::test]
+    async fn anchors_global_negative_limit_is_clamped(pool: PgPool) {
+        let state = test_state(pool).await;
+        let fx = setup_anchor_test(&state, "neg-limit-repo", true).await;
+
+        let resp = anchors_router(&state)
+            .oneshot(signed_get(&fx.owner, "/api/v1/arweave/anchors?limit=-1"))
+            .await
+            .unwrap();
+        assert_eq!(resp.status(), StatusCode::OK);
+        let body = json_body(resp).await;
+        assert_eq!(
+            body["count"], 0,
+            "negative limit clamps to 0, returning empty result"
+        );
+    }
 }