fix(node): address beardthelion P3 findings on name bound and input messages

- Assert each rejection's own message in the reposPage invalid-inputs
  loop: the loop no longer accepts either message for every query, so a
  misattributed message (limit arm returning the cursor message) goes red.
- Pin the create/fork name-bound wiring through the handler: new test
  drives create_repo with an overlong name via test_state_lazy and asserts
  the 400; deleting the validate_repo_name call site would proceed to the
  lazy DB pool and fail with a connection error instead.
- Document the API-side vs disk-side validate_repo_name divergence on the
  new function, and tie the store's literal 100 to MAX_REPO_NAME_LEN so
  the two validators cannot drift apart on length.

Author: cairn-intern

crates/gitlawb-node/src/api/repos.rs

@@ -221,6 +221,16 @@ pub struct InfoRefsQuery {
 /// restricted, and the length is bounded so every cursor the server emits
 /// parses back: `repo_cursor` embeds the name in a base64(JSON) cursor that
 /// `parse_repo_cursor` rejects over 4096 bytes (#465 4th round).
+///
+/// This is the API-side validator, and it deliberately differs from the
+/// stricter disk-side `validate_repo_name` in `git/repo_store.rs`: this one
+/// admits names the store rejects (empty, leading `-`, non-ASCII
+/// alphanumeric) and rejects `.`, which the store allows. The divergence
+/// predates this bound (#412 owns the fork half), so a store-rejected name
+/// still fails later at `repo_store.init` after the proof is spent. Do not
+/// "fix" the divergence here; the length bound below is the one that keeps
+/// emitted cursors parseable, and it is shared via `MAX_REPO_NAME_LEN` so the
+/// two validators cannot drift apart on length.
 fn validate_repo_name(name: &str) -> Result<()> {
     // Sanitize name: alphanumeric, hyphens, underscores only
     if !name
@@ -3367,6 +3377,33 @@ mod tests {
         assert!(validate_repo_name("").is_ok());
     }
 
+    #[tokio::test]
+    async fn create_repo_rejects_overlong_name_through_handler() {
+        // Pins the wiring: `create_repo` must call `validate_repo_name`
+        // before any database access. The lazy state never connects, so
+        // deleting the call site would let the handler proceed to `get_repo`
+        // and fail with a connection error instead of BadRequest.
+        let state = crate::test_support::test_state_lazy();
+        let overlong = "a".repeat(crate::db::MAX_REPO_NAME_LEN + 1);
+        let err = create_repo(
+            State(state),
+            Extension(AuthenticatedDid(OWNER_DID.to_owned())),
+            axum::http::HeaderMap::new(),
+            Json(CreateRepoRequest {
+                name: overlong,
+                description: None,
+                is_public: true,
+                default_branch: "main".into(),
+            }),
+        )
+        .await
+        .unwrap_err();
+        assert!(
+            matches!(err, AppError::BadRequest(ref msg) if msg.contains("at most")),
+            "overlong name through create_repo must be a 400, got: {err:?}"
+        );
+    }
+
     #[test]
     fn upload_pack_request_finalizes_only_with_done_pktline() {
         let want = "0032want 1111111111111111111111111111111111111111\n";

crates/gitlawb-node/src/git/repo_store.rs

@@ -625,8 +625,11 @@ fn validate_repo_name(repo_name: &str) -> Result<()> {
     if repo_name.is_empty() {
         anyhow::bail!("repo_name is empty");
     }
-    if repo_name.len() > 100 {
-        anyhow::bail!("repo_name exceeds 100 chars");
+    // Byte bound shared with the API-side validator via `MAX_REPO_NAME_LEN`:
+    // the two validators differ on charset by design, but must not drift on
+    // length, or an API-admitted name fails here after the proof is spent.
+    if repo_name.len() > crate::db::MAX_REPO_NAME_LEN {
+        anyhow::bail!("repo_name exceeds {} chars", crate::db::MAX_REPO_NAME_LEN);
     }
     // Repo names are `[A-Za-z0-9._-]+` minus path-traversal traps.
     if repo_name.contains("..") {

crates/gitlawb-node/src/graphql/query.rs

@@ -742,24 +742,39 @@ mod tests {
             .unwrap();
         let schema = schema(Arc::new(Db::for_testing(pool)));
         let over_max = crate::db::MAX_VISIBLE_REPO_PAGE_SIZE + 1;
-        for query in [
-            "{ reposPage(limit: 0) { hasNextPage } }".to_owned(),
-            "{ reposPage(limit: -1) { hasNextPage } }".to_owned(),
-            format!("{{ reposPage(limit: {over_max}) {{ hasNextPage }} }}"),
-            "{ reposPage(after: \"invalid!\") { hasNextPage } }".to_owned(),
+        let expected_limit_message = format!(
+            "limit must be between 1 and {}",
+            crate::db::MAX_VISIBLE_REPO_PAGE_SIZE
+        );
+        // Each input pins its own rejection message: the loop must not accept
+        // either message for every query, or a misattributed message (e.g. the
+        // limit arm returning "invalid repository cursor") stays invisible.
+        for (query, expected_message) in [
+            (
+                "{ reposPage(limit: 0) { hasNextPage } }".to_owned(),
+                expected_limit_message.clone(),
+            ),
+            (
+                "{ reposPage(limit: -1) { hasNextPage } }".to_owned(),
+                expected_limit_message.clone(),
+            ),
+            (
+                format!("{{ reposPage(limit: {over_max}) {{ hasNextPage }} }}"),
+                expected_limit_message.clone(),
+            ),
+            (
+                "{ reposPage(after: \"invalid!\") { hasNextPage } }".to_owned(),
+                "invalid repository cursor".to_owned(),
+            ),
         ] {
             let response =
                 tokio::time::timeout(std::time::Duration::from_secs(1), anon(&schema, &query))
                     .await
                     .unwrap();
             assert_eq!(response.errors.len(), 1);
-            let expected_limit_message = format!(
-                "limit must be between 1 and {}",
-                crate::db::MAX_VISIBLE_REPO_PAGE_SIZE
-            );
-            assert!(
-                response.errors[0].message == expected_limit_message
-                    || response.errors[0].message == "invalid repository cursor"
+            assert_eq!(
+                response.errors[0].message, expected_message,
+                "wrong rejection message for query: {query}"
             );
         }
         // Valid base64 and valid cursor JSON: only the length guard rejects it.