fix: address second re-review findings on bug_fix_2

- [P1] Add association-level row bound (MAX_ASSOC=2000) to SQL outer
  query, and 3-tuple cursor (pinned_at, sha256_hex, repo) for precise
  resumption when the bound is hit; all cursor advancement sites,
  opaque token, and sentinel updated to 3-tuple
- [P1] Drain git stderr concurrently in run_git and
  assert_all_refs_are_commits to prevent deadlock when stderr fills
- [P3] Move zero-limit fast path ahead of per-DID check so ?limit=0
  requests never consume the per-DID quota
- [P2] Short-circuit arweave anchor listing at limit=0 before repo
  enumeration, and add global rate-limit check
- [P3] Include ipfs_list_rate_limiter and ipfs_list_global_limiter
  in the periodic cleanup task

Author: Gravirei

crates/gitlawb-node/src/api/arweave.rs

@@ -87,6 +87,21 @@ pub async fn list_anchors(
         })));
     }
 
+    // Short-circuit for zero limit before any work or admission check (P2).
+    if limit == 0 {
+        return Ok(Json(serde_json::json!({
+            "anchors": [],
+            "count": 0,
+        })));
+    }
+
+    // Global rate limit: prevent DID-rotation enumeration (P2).
+    if !state.ipfs_list_global_limiter.check("global").await {
+        return Err(AppError::TooManyRequests(
+            "rate limit exceeded for anchor listing".into(),
+        ));
+    }
+
     // Authenticated caller without ?repo=: scope to readable repos (P1).
     // Use the deduped, quarantine-filtered view (same as the pin listing).
     let repos = state

crates/gitlawb-node/src/api/ipfs.rs

@@ -293,7 +293,7 @@ fn create_opaque_cursor(seed: &[u8; 32], cursor: &str) -> String {
 
 /// Decode and verify an opaque truncated cursor token.
 /// Returns the original cursor string if valid and not expired.
-fn decode_opaque_cursor(seed: &[u8; 32], token: &str) -> Option<(String, String)> {
+fn decode_opaque_cursor(seed: &[u8; 32], token: &str) -> Option<(String, String, String)> {
     let cursor_key = derive_cursor_key(seed);
     let cipher = XChaCha20Poly1305::new_from_slice(&cursor_key)
         .expect("32-byte key is valid for XChaCha20Poly1305");
@@ -322,9 +322,10 @@ fn decode_opaque_cursor(seed: &[u8; 32], token: &str) -> Option<(String, String)
 
     let cursor = std::str::from_utf8(&plaintext[8..]).ok()?;
 
-    let parts: Vec<&str> = cursor.splitn(2, '|').collect();
-    if parts.len() == 2 {
-        Some((parts[0].to_string(), parts[1].to_string()))
+    let parts: Vec<&str> = cursor.splitn(3, '|').collect();
+    if parts.len() >= 2 {
+        let repo = parts.get(2).map(|s| s.to_string()).unwrap_or_default();
+        Some((parts[0].to_string(), parts[1].to_string(), repo))
     } else {
         None
     }
@@ -437,15 +438,7 @@ pub async fn list_pins(
     let caller_str = caller.unwrap();
     let caller_owned = Some(caller_str.to_string());
 
-    // Per-DID rate limit: the listing performs expensive git walks and cat-file
-    // probes, so a throwaway DID with a valid signature can exhaust resources (P1).
-    if !state.ipfs_list_rate_limiter.check(caller_str).await {
-        return Err(AppError::TooManyRequests(
-            "rate limit exceeded for IPFS pin listing".into(),
-        ));
-    }
-
-    // Clamp/handle zero limit before any expensive work so short-lived
+    // Clamp/handle zero limit before any quota or expensive work so short-lived
     // requests do not drain rate-limit buckets or enumerate the node (P2).
     let max_visible = query.limit.clamp(0, 200);
 
@@ -456,6 +449,14 @@ pub async fn list_pins(
         })));
     }
 
+    // Per-DID rate limit: the listing performs expensive git walks and cat-file
+    // probes, so a throwaway DID with a valid signature can exhaust resources (P1).
+    if !state.ipfs_list_rate_limiter.check(caller_str).await {
+        return Err(AppError::TooManyRequests(
+            "rate limit exceeded for IPFS pin listing".into(),
+        ));
+    }
+
     // Global rate limit: keyed on a fixed value so DID rotation cannot
     // bypass the enumeration cost guard (P1).  Checked after the limit=0
     // fast path but before the whole-node reads so the bucket protects
@@ -497,8 +498,10 @@ pub async fn list_pins(
     }
 
     // Decode the optional keyset cursor from base64.
-    // Internal format: "pinned_at|sha256_hex" (2-tuple) for normal
-    // pagination, or just "pinned_at" (1-tuple) for the truncated resume.
+    // Wire format: "pinned_at|sha256_hex" (2-tuple).  On resume we widen it
+    // to (pinned_at, sha256_hex, "") so the SQL 3-tuple predicate skips
+    // already-emitted SHAs while still processing remaining associations
+    // of the batch's last SHA (P1).
     let decode_cursor = |s: &str| -> Option<(String, String)> {
         let bytes = URL_SAFE_NO_PAD.decode(s.as_bytes()).ok()?;
         let decoded = String::from_utf8(bytes).ok()?;
@@ -512,9 +515,9 @@ pub async fn list_pins(
     let encode_cursor =
         |pa: &str, sha: &str| -> String { URL_SAFE_NO_PAD.encode(format!("{pa}|{sha}")) };
 
-    let initial_cursor = match query.cursor.as_ref() {
+    let initial_cursor: Option<(String, String, String)> = match query.cursor.as_ref() {
         Some(c) => match decode_cursor(c) {
-            Some(cursor) => Some(cursor),
+            Some((pa, sha)) => Some((pa, sha, String::new())),
             None => {
                 return Err(AppError::BadRequest(
                     "invalid cursor: expected base64-encoded pinned_at|sha256_hex".into(),
@@ -525,15 +528,15 @@ pub async fn list_pins(
     };
 
     // Truncated resume cursor: XChaCha20Poly1305 AEAD token. Decrypts to the
-    // same (pinned_at, sha256_hex) cursor on the server side but the
+    // same (pinned_at, sha256_hex, repo) cursor on the server side but the
     // caller cannot decode hidden-row metadata from the wire format. If the
     // token is present but undecodable we return an explicit error so the
     // client does not silently restart at page 1.
-    let truncated_resume = match query.truncated_cursor.as_ref() {
+    let truncated_resume: Option<(String, String, String)> = match query.truncated_cursor.as_ref() {
         Some(t) => {
             let seed = state.node_keypair.to_seed();
             match decode_opaque_cursor(&seed, t) {
-                Some(c) => Some(c),
+                Some((pa, sha, repo)) => Some((pa, sha, repo)),
                 None => {
                     return Err(AppError::BadRequest(
                         "invalid or expired truncated_cursor".into(),
@@ -567,7 +570,8 @@ pub async fn list_pins(
     // next_cursor is derived from the last *accepted* (visible) pin, never
     // from the last scanned row, to avoid leaking withheld-blob metadata
     // or skipping rows the caller was never shown.
-    const BATCH_SIZE: i64 = 200;
+    const BATCH_SIZE: i64 = 200; // max unique SHAs per batch
+    const MAX_ASSOC: i64 = 2000; // max association rows per batch (SHA limit × 10)
     const MAX_BATCHES: usize = 10;
     const MAX_WALKS: usize = 50;
     const MAX_PROBES: usize = 200;
@@ -585,7 +589,7 @@ pub async fn list_pins(
     // repo associations.  Track seen SHAs so each object is emitted at most
     // once, after evaluating per-association visibility (P2).
     let mut seen_shas: HashSet<String> = HashSet::new();
-    let mut db_cursor: Option<(String, String)> = truncated_resume.or(initial_cursor);
+    let mut db_cursor: Option<(String, String, String)> = truncated_resume.or(initial_cursor);
     let mut response_cursor: Option<(String, String)> = None;
     let mut allowed_blobs_by_repo: HashMap<String, (HashSet<String>, PathBuf)> = HashMap::new();
     let mut page_truncated = false;
@@ -610,9 +614,10 @@ pub async fn list_pins(
                     &query_repos,
                     &query_owner_dids,
                     BATCH_SIZE,
+                    MAX_ASSOC,
                     db_cursor
                         .as_ref()
-                        .map(|(pa, sha)| (pa.as_str(), sha.as_str())),
+                        .map(|(pa, sha, repo)| (pa.as_str(), sha.as_str(), repo.as_str())),
                 )
                 .await
                 .map_err(AppError::Internal)?
@@ -635,13 +640,17 @@ pub async fn list_pins(
 
         for (i, pin) in batch.iter().enumerate() {
             if pin.repo.is_empty() {
-                db_cursor = Some((pin.pinned_at.clone(), pin.sha256_hex.clone()));
+                db_cursor = Some((pin.pinned_at.clone(), pin.sha256_hex.clone(), String::new()));
                 pin_outcome.push(None);
                 continue;
             }
             let Some((repo, rules)) = repos_by_slug.get(&pin.repo) else {
                 // Unknown slug — advance cursor past it, no visibility check.
-                db_cursor = Some((pin.pinned_at.clone(), pin.sha256_hex.clone()));
+                db_cursor = Some((
+                    pin.pinned_at.clone(),
+                    pin.sha256_hex.clone(),
+                    pin.repo.clone(),
+                ));
                 pin_outcome.push(None);
                 continue;
             };
@@ -777,7 +786,11 @@ pub async fn list_pins(
             // All pins had empty/unmatched repos — advance past the batch so
             // we don't loop forever on the same unprocessable rows (P1).
             if let Some(last) = batch.last() {
-                db_cursor = Some((last.pinned_at.clone(), last.sha256_hex.clone()));
+                db_cursor = Some((
+                    last.pinned_at.clone(),
+                    last.sha256_hex.clone(),
+                    last.repo.clone(),
+                ));
             }
         }
 
@@ -895,37 +908,47 @@ pub async fn list_pins(
                     if batch_cursor.is_some() {
                         db_cursor = batch_cursor;
                     }
-                } else if let Some(pin) = i.checked_sub(1).and_then(|prev| batch.get(prev)) {
-                    db_cursor = Some((pin.pinned_at.clone(), pin.sha256_hex.clone()));
+                } else if let Some(prev) = i.checked_sub(1).and_then(|prev| batch.get(prev)) {
+                    db_cursor = Some((
+                        prev.pinned_at.clone(),
+                        prev.sha256_hex.clone(),
+                        prev.repo.clone(),
+                    ));
                 }
                 break;
             }
 
             let pin = batch[i].clone();
             let Some((repo, rules)) = repos_by_slug.get(&pin.repo) else {
                 // Already advanced past in phase 1 — just maintain cursor.
-                db_cursor = Some((pin.pinned_at.clone(), pin.sha256_hex.clone()));
+                db_cursor = Some((
+                    pin.pinned_at.clone(),
+                    pin.sha256_hex.clone(),
+                    pin.repo.clone(),
+                ));
                 continue;
             };
 
             if !has_path_scoped_rule(rules) {
                 let pa = pin.pinned_at.clone();
                 let sha = pin.sha256_hex.clone();
+                let repo_slug = pin.repo.clone();
 
                 // Dedup by sha256_hex (P2): only skip if already *emitted* —
                 // do not suppress a visible association because a hidden one
                 // appeared first in the batch.
                 if !seen_shas.insert(sha.clone()) {
-                    db_cursor = Some((pa, sha));
+                    db_cursor = Some((pa, sha, repo_slug));
                     continue;
                 }
 
                 response_cursor = Some((pa.clone(), sha.clone()));
                 pins.push(pin);
-                db_cursor = Some((pa, sha));
+                db_cursor = Some((pa, sha, repo_slug));
             } else {
                 let pa = pin.pinned_at.clone();
                 let sha = pin.sha256_hex.clone();
+                let repo_slug = pin.repo.clone();
 
                 let visible = match pin_outcome[i] {
                     Some(v) => v,
@@ -943,13 +966,13 @@ pub async fn list_pins(
                 };
                 if visible {
                     if !seen_shas.insert(sha.clone()) {
-                        db_cursor = Some((pa, sha));
+                        db_cursor = Some((pa, sha, repo_slug));
                         continue;
                     }
                     response_cursor = Some((pa.clone(), sha.clone()));
                     pins.push(pin);
                 }
-                db_cursor = Some((pa, sha));
+                db_cursor = Some((pa, sha, repo_slug));
             }
 
             if pins.len() >= max_visible as usize {
@@ -966,10 +989,10 @@ pub async fn list_pins(
     // When page 1 is all-deferred (no walk permit available) neither
     // response_cursor nor db_cursor was set.  Emit a sentinel opaque cursor
     // so the client can retry; on the retry the sentinel decodes to
-    // ("\x7f", "\x7f") which the keyset WHERE < predicate treats
+    // ("\x7f", "\x7f", "\x7f") which the keyset WHERE < predicate treats
     // as "include every row" — effectively restarting from the beginning (P2).
     if page_truncated && response_cursor.is_none() && db_cursor.is_none() {
-        db_cursor = Some(("\x7f".to_string(), "\x7f".to_string()));
+        db_cursor = Some(("\x7f".to_string(), "\x7f".to_string(), "\x7f".to_string()));
     }
 
     let mut body = serde_json::json!({
@@ -991,8 +1014,8 @@ pub async fn list_pins(
         // when there are no visible rows to derive a keyset cursor from.
         if let Some((ref pa, ref sha)) = response_cursor {
             body["next_cursor"] = serde_json::json!(encode_cursor(pa, sha));
-        } else if let Some((ref pa, ref sha)) = db_cursor {
-            let cursor_str = format!("{pa}|{sha}");
+        } else if let Some((ref pa, ref sha, ref repo)) = db_cursor {
+            let cursor_str = format!("{pa}|{sha}|{repo}");
             let seed = state.node_keypair.to_seed();
             let token = create_opaque_cursor(&seed, &cursor_str);
             body["truncated_cursor"] = serde_json::json!(token);

crates/gitlawb-node/src/db/mod.rs

@@ -2473,21 +2473,23 @@ impl Db {
     }
 
     /// Bounded global pin query: returns pins for any of the given (repo, owner_did)
-    /// pairs, ordered by pinned_at DESC, capped at `limit` distinct objects.
-    /// Each batch returns up to `limit` unique SHAs (determined by DISTINCT ON)
-    /// and ALL repo associations for those SHAs, so the caller can evaluate
-    /// per-association visibility before deduplicating (P2).
-    /// Uses keyset pagination on (pinned_at, sha256_hex). Resume from a client
-    /// 2-tuple cursor uses the same (pinned_at, sha256_hex) directly; all
-    /// associations of the last SHA are guaranteed to be in the same batch.
+    /// pairs, ordered by (pinned_at DESC, sha256_hex DESC, repo DESC) and capped
+    /// by both distinct-object count and total-association row count.
+    /// The inner DISTINCT ON picks up to `sha_limit` unique SHAs; the outer query
+    /// then returns ALL repo associations for those SHAs, bounded by `assoc_limit`
+    /// rows.  When `cursor` is `Some((pinned_at, sha256_hex, repo))`, the inner
+    /// query skips rows whose keyset position is not strictly before the cursor,
+    /// so a partially-returned SHA (outer result hit `assoc_limit`) resumes
+    /// correctly on the next fetch.
     pub async fn list_pinned_cids_for_repos(
         &self,
         repos: &[String],
         owner_dids: &[String],
-        limit: i64,
-        cursor: Option<(&str, &str)>,
+        sha_limit: i64,
+        assoc_limit: i64,
+        cursor: Option<(&str, &str, &str)>,
     ) -> Result<Vec<PinnedCidRecord>> {
-        let rows = if let Some((pa, sha)) = cursor {
+        let rows = if let Some((pa, sha, repo)) = cursor {
             sqlx::query(
                 r#"WITH batch_shas AS (
                     SELECT sha256_hex
@@ -2499,11 +2501,12 @@ impl Db {
                              AS pairs(repo, owner_did)
                           ON (COALESCE(pr.repo, p.repo), COALESCE(pr.owner_did, p.owner_did))
                              = (pairs.repo, pairs.owner_did)
-                        WHERE (p.pinned_at, p.sha256_hex) < ($3::text, $4::text)
+                        WHERE (p.pinned_at, p.sha256_hex, COALESCE(pr.repo, p.repo))
+                              < ($3::text, $4::text, $5::text)
                         ORDER BY p.sha256_hex, p.pinned_at DESC
                     ) deduped
                     ORDER BY pinned_at DESC, sha256_hex DESC
-                    LIMIT $5
+                    LIMIT $6
                 )
                 SELECT p.sha256_hex, p.cid, p.pinned_at, p.pinata_cid,
                        COALESCE(pr.repo, p.repo) AS repo,
@@ -2516,13 +2519,16 @@ impl Db {
                   ON (COALESCE(pr.repo, p.repo), COALESCE(pr.owner_did, p.owner_did))
                      = (pairs.repo, pairs.owner_did)
                 ORDER BY p.pinned_at DESC, p.sha256_hex DESC,
-                         COALESCE(pr.repo, p.repo) DESC"#,
+                         COALESCE(pr.repo, p.repo) DESC
+                LIMIT $7"#,
             )
             .bind(repos)
             .bind(owner_dids)
             .bind(pa)
             .bind(sha)
-            .bind(limit)
+            .bind(repo)
+            .bind(sha_limit)
+            .bind(assoc_limit)
             .fetch_all(&self.pool)
             .await?
         } else {
@@ -2553,11 +2559,13 @@ impl Db {
                   ON (COALESCE(pr.repo, p.repo), COALESCE(pr.owner_did, p.owner_did))
                      = (pairs.repo, pairs.owner_did)
                 ORDER BY p.pinned_at DESC, p.sha256_hex DESC,
-                         COALESCE(pr.repo, p.repo) DESC"#,
+                         COALESCE(pr.repo, p.repo) DESC
+                LIMIT $4"#,
             )
             .bind(repos)
             .bind(owner_dids)
-            .bind(limit)
+            .bind(sha_limit)
+            .bind(assoc_limit)
             .fetch_all(&self.pool)
             .await?
         };