fix(node): bound list_ref_certificates with LIMIT and add upsert to prevent unbounded growth (#147) (#149)

* fix(node): bound list_ref_certificates with LIMIT and add upsert to prevent unbounded growth (#147)

* test: add INV-7 v10 upgrade-path dedup test

* fix INV-7 test: correct id-DESC tiebreaker ids and fix fmt

* fix: insert_ref_certificate returns persisted id via RETURNING; issue_ref_certificate uses it

* fix: guard cert upsert on issued_at so older certs cannot regress newer ones

* fix: .max(0) in events limit parsing, re-add lost cert tests after rebase

* address reviewer findings: return full persisted row, add monotonic clock comment, note test drift risk

* fix: add ?prefix= server-side cert lookup for CLI short-ID resolution

---------

Co-authored-by: Gravirei <gravirei@users.noreply.github.com>

Author: Gravirei

crates/gitlawb-node/src/api/certs.rs

@@ -1,23 +1,44 @@
 //! API handlers for ref certificates.
 
-use axum::extract::{Extension, Path, State};
+use std::collections::HashMap;
+
+use axum::extract::{Extension, Path, Query, State};
 use axum::Json;
 
 use crate::auth::AuthenticatedDid;
 use crate::error::{AppError, Result};
 use crate::state::AppState;
 
-/// GET /api/v1/repos/{owner}/{repo}/certs
+/// GET /api/v1/repos/{owner}/{repo}/certs?limit=50
 pub async fn list_certs(
     State(state): State<AppState>,
     Path((owner, name)): Path<(String, String)>,
+    Query(params): Query<HashMap<String, String>>,
     auth: Option<Extension<AuthenticatedDid>>,
 ) -> Result<Json<serde_json::Value>> {
+    let limit = params
+        .get("limit")
+        .and_then(|v| v.parse::<i64>().ok())
+        .map(|v| v.max(1))
+        .unwrap_or(50)
+        .min(200);
+
     let caller = auth.as_ref().map(|e| e.0 .0.as_str());
     let (record, _rules) =
         crate::api::authorize_repo_read(&state, &owner, &name, caller, "/").await?;
 
-    let certs = state.db.list_ref_certificates(&record.id).await?;
+    // When a prefix is given (short-ID resolution from the CLI) use a
+    // generous limit and delegate to the prefix-matched query so the
+    // caller can resolve IDs regardless of how many certs exist.
+    let prefix = params.get("prefix").filter(|p| !p.is_empty());
+    let certs = if let Some(prefix) = prefix {
+        state
+            .db
+            .list_ref_certificates_by_prefix(&record.id, prefix, 200)
+            .await?
+    } else {
+        state.db.list_ref_certificates(&record.id, limit).await?
+    };
     let certs_json: Vec<serde_json::Value> = certs
         .iter()
         .map(|c| {
@@ -35,7 +56,10 @@ pub async fn list_certs(
         })
         .collect();
 
-    Ok(Json(serde_json::json!({ "certificates": certs_json })))
+    let count = certs_json.len();
+    Ok(Json(
+        serde_json::json!({ "certificates": certs_json, "count": count }),
+    ))
 }
 
 /// GET /api/v1/repos/{owner}/{repo}/certs/{id}

crates/gitlawb-node/src/api/events.rs

@@ -129,6 +129,7 @@ pub async fn list_ref_updates(
     let limit = params
         .get("limit")
         .and_then(|v| v.parse::<i64>().ok())
+        .map(|v| v.max(0))
         .unwrap_or(50)
         .clamp(0, MAX_VISIBLE_REF_UPDATES);
 
@@ -177,6 +178,7 @@ pub async fn list_repo_events(
     let limit = params
         .get("limit")
         .and_then(|v| v.parse::<i64>().ok())
+        .map(|v| v.max(0))
         .unwrap_or(50)
         .clamp(0, MAX_VISIBLE_REF_UPDATES);
 
@@ -209,7 +211,7 @@ pub async fn list_repo_events(
     // into an empty 200, matching the gossip half below.
     let cert_events: Vec<serde_json::Value> = state
         .db
-        .list_ref_certificates(&record.id)
+        .list_ref_certificates(&record.id, limit)
         .await?
         .iter()
         .map(|c| {

crates/gitlawb-node/src/cert.rs

@@ -52,6 +52,7 @@ pub async fn issue_ref_certificate(
         issued_at,
     };
 
-    state.db.insert_ref_certificate(&cert).await?;
-    Ok(cert)
+    // Persist and return the row as it exists in the database (on a
+    // conflict the existing row survives when it is newer).
+    state.db.insert_ref_certificate(&cert).await
 }