fix(#477): scope bounty aggregates to anonymously-listable repos

bounty_stats and agent_bounty_stats ran unfiltered aggregates over all
bounties, leaking private-repo bounty activity to anonymous callers.

Mirror the stats() pattern from server.rs (#104):

1. Batch-load all deduped repos + visibility rules (2 SQL round-trips)
2. Filter to listable_at_root(rules, is_public, owner_did, None)
3. Pass visible (owner, name) pairs into SQL aggregates via EXISTS/unnest

This avoids the N+1 per-row authorize_repo_read problem (PR #483) while
keeping aggregation in SQL for O(1) per status query after the initial
repo resolution.

Fail-closed: DB errors collapse the visible set to empty, so all counts
return 0 — an under-count never leaks existence.

Fixes #477

Author: Mystic

crates/gitlawb-node/src/api/bounties.rs

@@ -456,21 +456,67 @@ pub async fn dispute_bounty(
     Ok(Json(updated))
 }
 
+/// Resolve the set of `(owner_did, name)` pairs for repos an anonymous caller
+/// can list.  Mirrors the `stats()` pattern in `server.rs` (#104): batch-load
+/// all deduped repos, batch-load their visibility rules, keep only those that
+/// pass `listable_at_root`.  Pure I/O after the two DB round-trips — no
+/// per-repo authorization queries.
+///
+/// Both bounty stats handlers mount behind `optional_signature` (see
+/// `bounty_read_routes` in server.rs), so the caller is always `None` for
+/// anonymous access.  The auth extractor is accepted but currently unused;
+/// when authenticated-caller support is added the `caller` arg threads through.
+async fn visible_repo_pairs(state: &AppState) -> Vec<(String, String)> {
+    let result: std::result::Result<Vec<(String, String)>, anyhow::Error> = async {
+        let rows = state.db.list_all_repos_deduped().await?;
+        let ids: Vec<String> = rows.iter().map(|r| r.id.clone()).collect();
+        let rules_by_repo = state.db.list_visibility_rules_for_repos(&ids).await?;
+        let pairs = rows
+            .iter()
+            .filter(|r| {
+                let rules = rules_by_repo.get(&r.id).map(Vec::as_slice).unwrap_or(&[]);
+                crate::visibility::listable_at_root(rules, r.is_public, &r.owner_did, None)
+            })
+            .map(|r| (r.owner_did.clone(), r.name.clone()))
+            .collect();
+        Ok(pairs)
+    }
+    .await;
+    // Fail closed: DB error → empty set → all counts collapse to 0, never
+    // leaking existence of private repos.
+    result.unwrap_or_default()
+}
+
 /// GET /api/v1/bounties/stats
+///
+/// Aggregates are restricted to anonymously-listable repos so private-repo
+/// bounty activity is not exposed (#477).  The visible-repo set is resolved
+/// once per request via `visible_repo_pairs` (two SQL round-trips), then
+/// passed into the filtered aggregate queries.
 pub async fn bounty_stats(State(state): State<AppState>) -> Result<Json<BountyStatsResponse>> {
-    let open = state.db.count_bounties_by_status("open").await.unwrap_or(0);
+    let visible = visible_repo_pairs(&state).await;
+
+    let open = state
+        .db
+        .count_bounties_by_status_visible("open", &visible)
+        .await
+        .unwrap_or(0);
     let claimed = state
         .db
-        .count_bounties_by_status("claimed")
+        .count_bounties_by_status_visible("claimed", &visible)
         .await
         .unwrap_or(0);
     let completed = state
         .db
-        .count_bounties_by_status("completed")
+        .count_bounties_by_status_visible("completed", &visible)
         .await
         .unwrap_or(0);
 
-    let leaders = state.db.bounty_leaderboard(10).await.unwrap_or_default();
+    let leaders = state
+        .db
+        .bounty_leaderboard_visible(10, &visible)
+        .await
+        .unwrap_or_default();
     let leaderboard = leaders
         .into_iter()
         .map(|(did, cnt, total)| AgentBountyEntry {
@@ -489,14 +535,22 @@ pub async fn bounty_stats(State(state): State<AppState>) -> Result<Json<BountySt
 }
 
 /// GET /api/v1/agents/{did}/bounties
+///
+/// Per-agent earnings restricted to anonymously-listable repos (#477).
 pub async fn agent_bounty_stats(
     State(state): State<AppState>,
     Path(did): Path<String>,
 ) -> Result<Json<serde_json::Value>> {
-    let (count, total) = state.db.agent_bounty_stats(&did).await.unwrap_or((0, 0));
+    let visible = visible_repo_pairs(&state).await;
+    let (count, total) = state
+        .db
+        .agent_bounty_stats_visible(&did, &visible)
+        .await
+        .unwrap_or((0, 0));
     Ok(Json(serde_json::json!({
         "did": did,
         "completed_bounties": count,
         "total_earned": total,
     })))
 }
+

crates/gitlawb-node/src/db/mod.rs

@@ -4527,6 +4527,7 @@ impl Db {
         Ok(())
     }
 
+    /// Count total bounties matching a given status across all repositories.
     pub async fn count_bounties_by_status(&self, status: &str) -> Result<i64> {
         let row = sqlx::query("SELECT COUNT(*) as c FROM bounties WHERE status = $1")
             .bind(status)
@@ -4535,19 +4536,21 @@ impl Db {
         Ok(row.get::<i64, _>("c"))
     }
 
+    /// Calculate total completed bounties count and aggregate earnings for a specific agent.
     pub async fn agent_bounty_stats(&self, agent_did: &str) -> Result<(i64, i64)> {
         let row = sqlx::query(
-            "SELECT COUNT(*) as cnt, COALESCE(SUM(amount),0) as total FROM bounties WHERE claimant_did = $1 AND status = 'completed'",
+            "SELECT COUNT(*) as cnt, COALESCE(SUM(amount), 0)::BIGINT as total FROM bounties WHERE claimant_did = $1 AND status = 'completed'",
         )
         .bind(agent_did)
         .fetch_one(&self.pool)
         .await?;
         Ok((row.get::<i64, _>("cnt"), row.get::<i64, _>("total")))
     }
 
+    /// Retrieve the top bounty earners across the node ordered by total earnings descending.
     pub async fn bounty_leaderboard(&self, limit: i64) -> Result<Vec<(String, i64, i64)>> {
         let rows = sqlx::query(
-            "SELECT claimant_did, COUNT(*) as cnt, COALESCE(SUM(amount),0) as total FROM bounties WHERE status='completed' AND claimant_did IS NOT NULL GROUP BY claimant_did ORDER BY total DESC LIMIT $1",
+            "SELECT claimant_did, COUNT(*) as cnt, COALESCE(SUM(amount), 0)::BIGINT as total FROM bounties WHERE status='completed' AND claimant_did IS NOT NULL GROUP BY claimant_did ORDER BY total DESC LIMIT $1",
         )
         .bind(limit)
         .fetch_all(&self.pool)
@@ -4564,6 +4567,101 @@ impl Db {
             .collect())
     }
 
+    // ── Visibility-filtered bounty aggregates (#477) ─────────────────────
+
+    /// Count bounties by status, restricted to repos whose `(owner_did, name)`
+    /// pairs are in `visible`. An empty set returns 0.
+    pub async fn count_bounties_by_status_visible(
+        &self,
+        status: &str,
+        visible: &[(String, String)],
+    ) -> Result<i64> {
+        if visible.is_empty() {
+            return Ok(0);
+        }
+        let owners: Vec<String> = visible.iter().map(|(o, _)| o.clone()).collect();
+        let names: Vec<String> = visible.iter().map(|(_, n)| n.clone()).collect();
+        let row = sqlx::query(
+            "SELECT COUNT(*) as c FROM bounties b \
+             WHERE b.status = $1 \
+             AND EXISTS ( \
+                 SELECT 1 FROM unnest($2::text[], $3::text[]) AS v(o, n) \
+                 WHERE b.repo_owner = v.o AND b.repo_name = v.n \
+             )",
+        )
+        .bind(status)
+        .bind(&owners)
+        .bind(&names)
+        .fetch_one(&self.pool)
+        .await?;
+        Ok(row.get::<i64, _>("c"))
+    }
+
+    /// Per-agent bounty stats restricted to visible repos.
+    pub async fn agent_bounty_stats_visible(
+        &self,
+        agent_did: &str,
+        visible: &[(String, String)],
+    ) -> Result<(i64, i64)> {
+        if visible.is_empty() {
+            return Ok((0, 0));
+        }
+        let owners: Vec<String> = visible.iter().map(|(o, _)| o.clone()).collect();
+        let names: Vec<String> = visible.iter().map(|(_, n)| n.clone()).collect();
+        let row = sqlx::query(
+            "SELECT COUNT(*) as cnt, COALESCE(SUM(amount), 0)::BIGINT as total FROM bounties b \
+             WHERE b.claimant_did = $1 AND b.status = 'completed' \
+             AND EXISTS ( \
+                 SELECT 1 FROM unnest($2::text[], $3::text[]) AS v(o, n) \
+                 WHERE b.repo_owner = v.o AND b.repo_name = v.n \
+             )",
+        )
+        .bind(agent_did)
+        .bind(&owners)
+        .bind(&names)
+        .fetch_one(&self.pool)
+        .await?;
+        Ok((row.get::<i64, _>("cnt"), row.get::<i64, _>("total")))
+    }
+
+    /// Leaderboard restricted to visible repos.
+    pub async fn bounty_leaderboard_visible(
+        &self,
+        limit: i64,
+        visible: &[(String, String)],
+    ) -> Result<Vec<(String, i64, i64)>> {
+        if visible.is_empty() {
+            return Ok(Vec::new());
+        }
+        let owners: Vec<String> = visible.iter().map(|(o, _)| o.clone()).collect();
+        let names: Vec<String> = visible.iter().map(|(_, n)| n.clone()).collect();
+        let rows = sqlx::query(
+            "SELECT claimant_did, COUNT(*) as cnt, COALESCE(SUM(amount), 0)::BIGINT as total \
+             FROM bounties b \
+             WHERE b.status = 'completed' AND b.claimant_did IS NOT NULL \
+             AND EXISTS ( \
+                 SELECT 1 FROM unnest($1::text[], $2::text[]) AS v(o, n) \
+                 WHERE b.repo_owner = v.o AND b.repo_name = v.n \
+             ) \
+             GROUP BY claimant_did ORDER BY total DESC LIMIT $3",
+        )
+        .bind(&owners)
+        .bind(&names)
+        .bind(limit)
+        .fetch_all(&self.pool)
+        .await?;
+        Ok(rows
+            .iter()
+            .map(|r| {
+                (
+                    r.get::<String, _>("claimant_did"),
+                    r.get::<i64, _>("cnt"),
+                    r.get::<i64, _>("total"),
+                )
+            })
+            .collect())
+    }
+
     fn bounty_from_row(&self, r: &sqlx::postgres::PgRow) -> BountyRecord {
         BountyRecord {
             id: r.get("id"),