fix(node): gate /ipfs/pins and /arweave/anchors behind authentication (#121)

Cargo.toml

@@ -55,6 +55,10 @@ uuid = { version = "1", features = ["v4"] }
 reqwest = { version = "0.12", features = ["blocking", "json", "multipart", "rustls-tls"], default-features = false }
 # HMAC
 hmac = "0.12"
+# AEAD
+chacha20poly1305 = "0.10"
+# Key derivation
+hkdf = "0.12"
 
 [profile.release]
 lto = "thin"

crates/gitlawb-node/Cargo.toml

@@ -37,6 +37,8 @@ cid = { workspace = true }
 hex = { workspace = true }
 sha2 = { workspace = true }
 hmac = { workspace = true }
+chacha20poly1305 = { workspace = true }
+hkdf = { workspace = true }
 http-body-util = "0.1"
 tokio-util = { version = "0.7", features = ["io"] }
 dirs-next = "2"

crates/gitlawb-node/src/api/arweave.rs

@@ -2,12 +2,14 @@
 
 use axum::{
     extract::{Query, State},
-    Json,
+    Extension, Json,
 };
 use serde::Deserialize;
 
-use crate::error::Result;
+use crate::auth::AuthenticatedDid;
+use crate::error::{AppError, Result};
 use crate::state::AppState;
+use crate::visibility::{visibility_check, Decision};
 
 #[derive(Debug, Deserialize)]
 pub struct ListAnchorsQuery {
@@ -21,16 +23,118 @@ fn default_limit() -> i64 {
 }
 
 /// GET /api/v1/arweave/anchors
+///
+/// Returns Arweave ref-update anchors. When `?repo=<owner>/<name>` is provided,
+/// the response is gated on the caller's read visibility for that repo (deny ->
+/// 404). Without a `?repo=` filter, the global listing filters each row on
+/// current visibility to prevent metadata disclosure when repos are made private
+/// after push (#136).
+///
+/// Both paths resolve visibility against the deduped repo view so mirror rows
+/// never bypass the canonical repo's rules.
 pub async fn list_anchors(
     State(state): State<AppState>,
+    auth: Option<Extension<AuthenticatedDid>>,
     Query(q): Query<ListAnchorsQuery>,
 ) -> Result<Json<serde_json::Value>> {
-    let limit = q.limit.min(200);
-    let anchors = state
-        .db
-        .list_arweave_anchors(q.repo.as_deref(), limit)
-        .await
-        .map_err(crate::error::AppError::Internal)?;
+    let caller = auth.as_ref().map(|e| e.0 .0.as_str());
+    let limit = q.limit.clamp(0, 200);
+
+    // Global listings (no ?repo=) are restricted to authenticated callers.
+    if q.repo.is_none() && caller.is_none() {
+        return Err(AppError::Unauthorized(
+            "authentication required for global anchor listing".into(),
+        ));
+    }
+
+    let anchors = if let Some(ref repo) = q.repo {
+        // ── Per-repo path ──
+        // Resolve against the deduped repo view so mirror rows never bypass
+        // the canonical repo's visibility rules. Use did_matches to handle
+        // both full DID and bare short-form owner in the URL.
+        let parts: Vec<&str> = repo.splitn(2, '/').collect();
+        if parts.len() != 2 {
+            return Err(AppError::RepoNotFound(repo.clone()));
+        }
+        let (owner, name) = (parts[0], parts[1]);
+
+        // Fetch the deduped list (mirror rows collapsed, quarantined excluded).
+        let repos = state
+            .db
+            .list_all_repos_deduped()
+            .await
+            .map_err(AppError::Internal)?;
+
+        let record = repos
+            .into_iter()
+            .find(|r| crate::api::did_matches(owner, &r.owner_did) && r.name == name)
+            .ok_or_else(|| AppError::RepoNotFound(format!("{owner}/{name}")))?;
+
+        // Quarantine gate (belt-and-suspenders — deduped already filters).
+        if state.db.is_repo_quarantined(&record.id).await? {
+            return Err(AppError::RepoNotFound(format!("{owner}/{name}")));
+        }
+
+        // Visibility gate against the canonical survivor's rules.
+        let rules = state.db.list_visibility_rules(&record.id).await?;
+        if visibility_check(&rules, record.is_public, &record.owner_did, caller, "/")
+            == Decision::Deny
+        {
+            return Err(AppError::RepoNotFound(format!("{owner}/{name}")));
+        }
+
+        // Normalize owner exactly like anchor writes do.
+        let owner_short = crate::db::normalize_owner_key(&record.owner_did);
+        let slug = Some(format!("{}/{}", owner_short, record.name));
+
+        state
+            .db
+            .list_arweave_anchors(slug.as_deref(), Some(&record.owner_did), limit)
+            .await
+            .map_err(AppError::Internal)?
+    } else {
+        // ── Global listing ──
+        // Build the set of readable repo slugs and owner DIDs from the deduped repo view
+        // (mirror rows already collapsed, quarantined excluded), then query
+        // anchors bounded in SQL.
+        let repos = state
+            .db
+            .list_all_repos_deduped()
+            .await
+            .map_err(AppError::Internal)?;
+        let repo_ids: Vec<String> = repos.iter().map(|r| r.id.clone()).collect();
+        let rules_by_repo = state
+            .db
+            .list_visibility_rules_for_repos(&repo_ids)
+            .await
+            .map_err(AppError::Internal)?;
+
+        // Build parallel vectors of readable (slug, owner_did) pairs to query in SQL.
+        // This avoids filter-before-limit leaks or loss of pages.
+        let mut query_repos = Vec::new();
+        let mut query_owner_dids = Vec::new();
+
+        for r in &repos {
+            let rules = rules_by_repo.get(&r.id).map(Vec::as_slice).unwrap_or(&[]);
+            if visibility_check(rules, r.is_public, &r.owner_did, caller, "/") == Decision::Deny {
+                continue;
+            }
+            let short = crate::db::normalize_owner_key(&r.owner_did);
+            let slug = format!("{}/{}", short, r.name);
+            query_repos.push(slug);
+            query_owner_dids.push(r.owner_did.clone());
+        }
+
+        if query_repos.is_empty() {
+            Vec::new()
+        } else {
+            state
+                .db
+                .list_arweave_anchors_for_repos(&query_repos, &query_owner_dids, limit)
+                .await
+                .map_err(AppError::Internal)?
+        }
+    };
 
     Ok(Json(serde_json::json!({
         "anchors": anchors,