fix(node): make the repo dedup key did:key-aware so distinct DID methods don't collapse

The dedup grouping key took the last ':' segment of owner_did
(split_part / rsplit), so two repos owned by did:key:X and
did:gitlawb:X with the same name collapsed into one logical repo on
the list, paged, count, stats, and GraphQL surfaces. That is the exact
cross-method collision the codebase already guards against in
did_matches.

Replace it with a did:key-aware key that strips a did:key: prefix only
when the remainder is a bare id (no ':'), otherwise keeps the full DID,
reproducing did_matches/key_id as an equivalence relation: did:key:X
and a bare mirror X still collapse, while distinct methods never merge.
Applied byte-identically across DEDUP_CTE (DISTINCT ON / PARTITION BY /
ORDER BY), count_repos_deduped, the empty-page count fallback, and the
in-memory dedupe_canonical_repos, so the SQL and Rust paths agree.

The backing index lived in the already-released migration v1, so v1 is
left untouched and a new migration v7 drops idx_repos_owner_short_name
and builds idx_repos_owner_key_name on the matching expression; the
CASE must stay byte-identical to the queries or Postgres stops using it.

Tests cover both the in-memory and SQL paths: distinct methods stay
separate, bare-id and did:key forms collapse, and the residual-colon
guard keeps a malformed did:key:did:gitlawb:X distinct from the bare
method DID. 216 pass.

Author: beardthelion

crates/gitlawb-node/src/api/repos.rs

@@ -1422,13 +1422,20 @@ fn dedupe_canonical_repos(rows: Vec<(RepoRecord, i64)>) -> Vec<(RepoRecord, i64)
     let mut latest: HashMap<(String, String), DateTime<Utc>> = HashMap::new();
 
     for (rec, stars) in rows {
-        let short = rec
+        // did:key-aware owner key: strip a `did:key:` prefix so the bare mirror id
+        // and its `did:key:` canonical collapse, but leave any other DID method
+        // whole so `did:key:X` and `did:gitlawb:X` never merge. The `!contains(':')`
+        // guard mirrors did_matches' `key_id` check: a stripped value that still
+        // holds a `:` is a non-key full DID (e.g. malformed `did:key:did:gitlawb:X`)
+        // and must keep its full form, not collapse onto the bare method DID. Stays
+        // byte-equivalent to the SQL CASE in Db::DEDUP_CTE / count_repos_deduped.
+        let owner_key = rec
             .owner_did
-            .rsplit(':')
-            .next()
+            .strip_prefix("did:key:")
+            .filter(|rest| !rest.contains(':'))
             .unwrap_or(&rec.owner_did)
             .to_string();
-        let key = (short, rec.name.clone());
+        let key = (owner_key, rec.name.clone());
 
         latest
             .entry(key.clone())
@@ -1649,6 +1656,137 @@ mod tests {
         );
     }
 
+    #[test]
+    fn distinct_did_methods_sharing_a_base58_id_do_not_collapse() {
+        // `did:key` and `did:gitlawb` share the base58 id space, so a trailing
+        // segment key would treat these as one repo. The did:key-aware key keeps
+        // them apart, matching crate::api::did_matches.
+        let keyed = record(
+            "id-keyed",
+            "did:key:z6Mkwbud",
+            "nipmod",
+            "owned via did:key",
+            "2026-01-01T00:00:00Z",
+        );
+        let gitlawb = record(
+            "id-gitlawb",
+            "did:gitlawb:z6Mkwbud",
+            "nipmod",
+            "owned via did:gitlawb",
+            "2026-01-01T00:00:00Z",
+        );
+
+        let out = dedupe_canonical_repos(vec![(keyed, 1), (gitlawb, 2)]);
+
+        assert_eq!(
+            out.len(),
+            2,
+            "same name and base58 id under different DID methods are distinct repos"
+        );
+    }
+
+    #[test]
+    fn bare_id_and_did_key_form_of_same_owner_collapse() {
+        // A bare mirror id and its did:key canonical are the same owner and must
+        // collapse, the mirror-vs-canonical case stated in owner-key terms.
+        let mirror = record(
+            "z6Mkwbud/nipmod",
+            "z6Mkwbud",
+            "nipmod",
+            "mirrored from peer",
+            "2026-02-01T00:00:00Z",
+        );
+        let canonical = record(
+            "canon-id",
+            "did:key:z6Mkwbud",
+            "nipmod",
+            "real",
+            "2026-01-15T00:00:00Z",
+        );
+
+        let out = dedupe_canonical_repos(vec![(mirror, 0), (canonical, 5)]);
+
+        assert_eq!(out.len(), 1, "bare id and its did:key form are one owner");
+        assert_eq!(out[0].0.owner_did, "did:key:z6Mkwbud", "canonical row wins");
+    }
+
+    #[test]
+    fn did_key_wrapping_a_full_did_does_not_collapse_onto_the_bare_method_did() {
+        // Residual-colon guard, mirroring did_matches' `!key_id().contains(':')`:
+        // a malformed `did:key:did:gitlawb:X` strips to `did:gitlawb:X`, which still
+        // holds a `:`, so it must keep its full form and NOT collapse with a real
+        // `did:gitlawb:X` repo of the same name.
+        let wrapped = record(
+            "id-wrapped",
+            "did:key:did:gitlawb:z6Mkwbud",
+            "nipmod",
+            "malformed nested DID",
+            "2026-01-01T00:00:00Z",
+        );
+        let method = record(
+            "id-method",
+            "did:gitlawb:z6Mkwbud",
+            "nipmod",
+            "real method DID",
+            "2026-01-02T00:00:00Z",
+        );
+
+        let out = dedupe_canonical_repos(vec![(wrapped, 1), (method, 2)]);
+
+        assert_eq!(
+            out.len(),
+            2,
+            "a did:key-wrapped full DID stays distinct from the bare method DID"
+        );
+        // Assert identity, not just count: each owner survives unmerged, so a
+        // regression that kept two rows but mis-keyed the survivor is also caught.
+        let mut owners: Vec<&str> = out.iter().map(|(r, _)| r.owner_did.as_str()).collect();
+        owners.sort_unstable();
+        assert_eq!(
+            owners,
+            vec!["did:gitlawb:z6Mkwbud", "did:key:did:gitlawb:z6Mkwbud"],
+            "both owner DIDs survive in their full form"
+        );
+    }
+
+    #[test]
+    fn empty_did_key_residual_keys_to_empty_string_consistently() {
+        // Degenerate boundary the reviewers flagged: `did:key:` with no id strips to
+        // an empty residual (no colon), so the key is "". A bare empty owner also
+        // keys to "", so the two collapse — proving the Rust strip path maps the
+        // empty residual exactly like the SQL `substr(owner_did, 9)` / `position`
+        // path (mirrored in the db-level test). A real did:key id keys separately.
+        let empty_did_key = record(
+            "id-empty-didkey",
+            "did:key:",
+            "nipmod",
+            "empty residual",
+            "2026-01-01T00:00:00Z",
+        );
+        let empty_bare = record(
+            "id-empty-bare",
+            "",
+            "nipmod",
+            "empty owner",
+            "2026-01-02T00:00:00Z",
+        );
+        let real = record(
+            "id-real",
+            "did:key:z6Mkwbud",
+            "nipmod",
+            "real id",
+            "2026-01-03T00:00:00Z",
+        );
+
+        let out = dedupe_canonical_repos(vec![(empty_did_key, 0), (empty_bare, 0), (real, 0)]);
+
+        assert_eq!(
+            out.len(),
+            2,
+            "`did:key:` and the empty owner share the empty key and collapse; the real id stays separate"
+        );
+    }
+
     #[test]
     fn two_mirror_rows_break_tie_by_earliest_created_at() {
         // Both are mirror rows (slash-form ids); earliest created_at wins.

crates/gitlawb-node/src/db/mod.rs

@@ -767,6 +767,20 @@ const MIGRATIONS: &[Migration] = &[
             "ALTER TABLE agents ADD COLUMN IF NOT EXISTS deactivated_at TEXT",
         ],
     },
+    Migration {
+        version: 7,
+        name: "repo_owner_dedup_key_didkey_aware",
+        stmts: &[
+            // The dedup grouping key moved from the last `:` segment to a
+            // did:key-aware key (strip `did:key:`, leave any other DID method
+            // whole) so `did:key:X` and `did:gitlawb:X` no longer collapse. Swap
+            // the index that backs it: drop the last-segment one from v1 and build
+            // the matching expression index. The CASE must stay byte-for-byte in
+            // sync with DEDUP_CTE / count_repos_deduped or Postgres won't use it.
+            "DROP INDEX IF EXISTS idx_repos_owner_short_name",
+            "CREATE INDEX IF NOT EXISTS idx_repos_owner_key_name ON repos ((CASE WHEN owner_did LIKE 'did:key:%' AND position(':' in substr(owner_did, 9)) = 0 THEN substr(owner_did, 9) ELSE owner_did END), name)",
+        ],
+    },
 ];
 
 // ── Repos ─────────────────────────────────────────────────────────────────────
@@ -896,26 +910,32 @@ impl Db {
 
     /// Shared dedup CTE: collapses the mirror row and the canonical row of one
     /// logical repo into a single survivor. `$1` is an optional owner filter
-    /// (NULL = all rows). Grouping is `(split_part(owner_did,':',-1), name)`; the
-    /// canonical row wins (mirror rows carry a slash-form `id` written only by
+    /// (NULL = all rows). Grouping collapses on a did:key-aware owner key: strip a
+    /// `did:key:` prefix (8 chars, so `substr(owner_did, 9)`) only when the
+    /// remainder is a bare id with no `:`, otherwise keep the full DID. That is the
+    /// exact normalization in `crate::api::did_matches`, so `did:key:X` and a bare
+    /// `X` collapse while distinct DID methods (`did:gitlawb:X`) never merge. The
+    /// CASE is repeated verbatim in `count_repos_deduped` and the v7 index and must
+    /// stay byte-identical or Postgres stops using the index.
+    /// The canonical row wins (mirror rows carry a slash-form `id` written only by
     /// `upsert_mirror_repo`), ties broken by earliest `created_at` then `id` so a
     /// full tie still picks a deterministic survivor. `list_all_repos_paged`,
     /// `list_all_repos_deduped`, and the marker logic in
     /// `crate::api::repos::dedupe_canonical_repos` must stay in sync.
     const DEDUP_CTE: &'static str = "WITH deduped AS (
-                 SELECT DISTINCT ON (split_part(owner_did, ':', -1), name)
+                 SELECT DISTINCT ON (CASE WHEN owner_did LIKE 'did:key:%' AND position(':' in substr(owner_did, 9)) = 0 THEN substr(owner_did, 9) ELSE owner_did END, name)
                      id, name, owner_did, description, is_public, default_branch,
                      created_at,
                      -- group MAX, not the canonical row's own value: pushes that
                      -- arrive via gossip touch only the mirror row, so the
                      -- canonical updated_at goes stale
                      MAX(updated_at) OVER (
-                         PARTITION BY split_part(owner_did, ':', -1), name
+                         PARTITION BY CASE WHEN owner_did LIKE 'did:key:%' AND position(':' in substr(owner_did, 9)) = 0 THEN substr(owner_did, 9) ELSE owner_did END, name
                      ) AS updated_at,
                      disk_path, forked_from, machine_id
                  FROM repos
                  WHERE ($1::text IS NULL OR owner_did = $1 OR owner_did LIKE '%:' || $1)
-                 ORDER BY split_part(owner_did, ':', -1), name,
+                 ORDER BY CASE WHEN owner_did LIKE 'did:key:%' AND position(':' in substr(owner_did, 9)) = 0 THEN substr(owner_did, 9) ELSE owner_did END, name,
                      -- mirror rows carry a slash-form id (\"{owner_short}/{name}\"),
                      -- written only by upsert_mirror_repo; canonical ids are UUIDs.
                      -- Rank canonical (no slash) ahead of the mirror in each group,
@@ -967,7 +987,7 @@ impl Db {
 
         let total = if out.is_empty() {
             let row = sqlx::query(
-                "SELECT COUNT(DISTINCT (split_part(owner_did, ':', -1), name)) AS cnt
+                "SELECT COUNT(DISTINCT (CASE WHEN owner_did LIKE 'did:key:%' AND position(':' in substr(owner_did, 9)) = 0 THEN substr(owner_did, 9) ELSE owner_did END, name)) AS cnt
                  FROM repos
                  WHERE ($1::text IS NULL OR owner_did = $1 OR owner_did LIKE '%:' || $1)",
             )
@@ -1005,12 +1025,12 @@ impl Db {
     }
 
     /// Count of distinct logical repos (mirror + canonical collapsed), for
-    /// `/api/v1/stats`. Uses the same `(split_part(owner_did,':',-1), name)`
-    /// grouping as `DEDUP_CTE`; the marker/tiebreak only decide which row would
-    /// survive, not the group count, so they are not needed here.
+    /// `/api/v1/stats`. Uses the same did:key-aware owner-key grouping as
+    /// `DEDUP_CTE` (the CASE must stay byte-identical); the marker/tiebreak only
+    /// decide which row would survive, not the group count, so they are not needed here.
     pub async fn count_repos_deduped(&self) -> Result<i64> {
         let row = sqlx::query(
-            "SELECT COUNT(DISTINCT (split_part(owner_did, ':', -1), name)) AS cnt FROM repos",
+            "SELECT COUNT(DISTINCT (CASE WHEN owner_did LIKE 'did:key:%' AND position(':' in substr(owner_did, 9)) = 0 THEN substr(owner_did, 9) ELSE owner_did END, name)) AS cnt FROM repos",
         )
         .fetch_one(&self.pool)
         .await?;
@@ -3162,6 +3182,136 @@ mod dedup_db_tests {
         assert_eq!(out[0].owner_did, "did:key:z6Mkwbud", "canonical row wins");
     }
 
+    /// Same name and base58 id but different DID methods (`did:key` vs
+    /// `did:gitlawb`) must NOT collapse: the grouping key strips only `did:key:`
+    /// and leaves other methods whole, matching crate::api::did_matches. Both the
+    /// list (DEDUP_CTE) and count (count_repos_deduped) paths must agree.
+    #[sqlx::test]
+    async fn deduped_keeps_distinct_did_methods_apart(pool: PgPool) {
+        let db = db(pool).await;
+        db.create_repo(&rec(
+            "id-keyed",
+            "did:key:z6Mkwbud",
+            "nipmod",
+            "via did:key",
+            "2026-01-01T00:00:00Z",
+            "2026-01-01T00:00:00Z",
+        ))
+        .await
+        .unwrap();
+        db.create_repo(&rec(
+            "id-gitlawb",
+            "did:gitlawb:z6Mkwbud",
+            "nipmod",
+            "via did:gitlawb",
+            "2026-01-02T00:00:00Z",
+            "2026-01-02T00:00:00Z",
+        ))
+        .await
+        .unwrap();
+
+        let out = db.list_all_repos_deduped().await.unwrap();
+        assert_eq!(out.len(), 2, "distinct DID methods are distinct owners");
+        assert_eq!(
+            db.count_repos_deduped().await.unwrap(),
+            2,
+            "count path agrees with the list path",
+        );
+    }
+
+    /// SQL residual-colon guard: a malformed `did:key:did:gitlawb:X` strips to a
+    /// value that still holds a `:`, so the CASE keeps it whole and it does NOT
+    /// collapse with a real `did:gitlawb:X`. Proves the SQL key matches the Rust
+    /// `strip_prefix(...).filter(|r| !r.contains(':'))` and did_matches.
+    #[sqlx::test]
+    async fn deduped_did_key_wrapping_a_full_did_stays_distinct(pool: PgPool) {
+        let db = db(pool).await;
+        db.create_repo(&rec(
+            "id-wrapped",
+            "did:key:did:gitlawb:z6Mkwbud",
+            "nipmod",
+            "malformed nested DID",
+            "2026-01-01T00:00:00Z",
+            "2026-01-01T00:00:00Z",
+        ))
+        .await
+        .unwrap();
+        db.create_repo(&rec(
+            "id-method",
+            "did:gitlawb:z6Mkwbud",
+            "nipmod",
+            "real method DID",
+            "2026-01-02T00:00:00Z",
+            "2026-01-02T00:00:00Z",
+        ))
+        .await
+        .unwrap();
+
+        let out = db.list_all_repos_deduped().await.unwrap();
+        assert_eq!(
+            out.len(),
+            2,
+            "wrapped full DID stays distinct from the method DID"
+        );
+        assert_eq!(
+            db.count_repos_deduped().await.unwrap(),
+            2,
+            "count path agrees with the list path",
+        );
+    }
+
+    /// Empty-residual boundary: `did:key:` matches `LIKE 'did:key:%'`,
+    /// `substr(owner_did, 9)` is '', and `position(':' in '')` is 0, so the CASE
+    /// keys it to '' just like a bare empty owner, while a real `did:key:z…` keys
+    /// separately. Pins that the SQL empty-residual handling matches the Rust
+    /// `strip_prefix(...).filter(...)` path (mirrored in the api-level test).
+    #[sqlx::test]
+    async fn deduped_empty_did_key_residual_keys_to_empty_string(pool: PgPool) {
+        let db = db(pool).await;
+        db.create_repo(&rec(
+            "id-empty-didkey",
+            "did:key:",
+            "nipmod",
+            "empty residual",
+            "2026-01-01T00:00:00Z",
+            "2026-01-01T00:00:00Z",
+        ))
+        .await
+        .unwrap();
+        db.create_repo(&rec(
+            "id-empty-bare",
+            "",
+            "nipmod",
+            "empty owner",
+            "2026-01-02T00:00:00Z",
+            "2026-01-02T00:00:00Z",
+        ))
+        .await
+        .unwrap();
+        db.create_repo(&rec(
+            "id-real",
+            "did:key:z6Mkwbud",
+            "nipmod",
+            "real id",
+            "2026-01-03T00:00:00Z",
+            "2026-01-03T00:00:00Z",
+        ))
+        .await
+        .unwrap();
+
+        let out = db.list_all_repos_deduped().await.unwrap();
+        assert_eq!(
+            out.len(),
+            2,
+            "`did:key:` and the empty owner collapse on the empty key; the real id is separate"
+        );
+        assert_eq!(
+            db.count_repos_deduped().await.unwrap(),
+            2,
+            "count path agrees with the list path",
+        );
+    }
+
     /// Distinct repos are preserved and ordered by most recent activity.
     #[sqlx::test]
     async fn deduped_preserves_distinct_repos_ordered_by_updated(pool: PgPool) {