fix(gl): sign gl ipfs get when an identity is available (#173, F5)

The /ipfs/{cid} resolver now serves path-scoped objects to authorized readers,
but `gl ipfs get` built NodeClient with None and always sent an unsigned request,
so an owner or listed reader received the opaque anonymous 404 for content they
can read. Add a --dir identity arg (like `list`), load the keypair best-effort,
and use get_authed (signs iff a keypair is present, unsigned fallback keeps public
reads working).

RED->GREEN: test_cmd_get_signs_when_identity_present drives a signature-matching
mock — 501 (unmatched) while unsigned, 200 once signed. test_cmd_get_anonymous_
denial_is_error guards the must-not: a 404 surfaces as an error, not masked success.

Author: t

crates/gl/src/ipfs_cmd.rs

@@ -33,13 +33,16 @@ pub enum IpfsCmd {
         cid: String,
         #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
+        /// Identity directory (default: ~/.gitlawb)
+        #[arg(long)]
+        dir: Option<PathBuf>,
     },
 }
 
 pub async fn run(args: IpfsArgs) -> Result<()> {
     match args.cmd {
         IpfsCmd::List { node, dir } => cmd_list(node, dir).await,
-        IpfsCmd::Get { cid, node } => cmd_get(cid, node).await,
+        IpfsCmd::Get { cid, node, dir } => cmd_get(cid, node, dir).await,
     }
 }
 
@@ -86,11 +89,17 @@ async fn cmd_list(node: String, dir: Option<PathBuf>) -> Result<()> {
     Ok(())
 }
 
-async fn cmd_get(cid: String, node: String) -> Result<()> {
-    let client = NodeClient::new(&node, None);
+async fn cmd_get(cid: String, node: String, dir: Option<PathBuf>) -> Result<()> {
+    // #173 (F5): the resolver now serves path-scoped objects to authorized readers,
+    // so sign with an available identity like `gl ipfs list` — otherwise an owner or
+    // listed reader gets the opaque anonymous 404 for content they can read. Load
+    // best-effort (unlike `list`, `get` stays usable for genuinely public content):
+    // `get_authed` signs when a keypair is present and falls back to unsigned.
+    let keypair = crate::identity::load_keypair_from_dir(dir.as_deref()).ok();
+    let client = NodeClient::new(&node, keypair);
     let path = format!("/ipfs/{cid}");
     let resp = client
-        .get(&path)
+        .get_authed(&path)
         .await
         .with_context(|| format!("failed to fetch CID {cid} from {node}"))?;
 
@@ -235,4 +244,63 @@ mod tests {
 
         m.assert_async().await;
     }
+
+    /// #173 (F5): `gl ipfs get` must SIGN with an available identity, like
+    /// `gl ipfs list`, so an owner/reader can retrieve a path-scoped object the node
+    /// now resolves by CID. RED before the fix: cmd_get ignores the identity dir and
+    /// sends an unsigned request, so the signature-matching mock is never hit
+    /// (cmd_get errors on the unmatched 501, and m.assert fails). GREEN after: the
+    /// signed request carries the RFC 9421 headers and is served 200.
+    #[tokio::test]
+    async fn test_cmd_get_signs_when_identity_present() {
+        let mut server = mockito::Server::new_async().await;
+        let keystore = seed_keystore();
+
+        let m = server
+            .mock("GET", "/ipfs/bafkreitestcid")
+            .match_header("signature", mockito::Matcher::Any)
+            .match_header("signature-input", mockito::Matcher::Any)
+            .with_status(200)
+            .with_header("content-type", "application/octet-stream")
+            .with_header("x-git-hash", "abc123")
+            .with_body("object bytes")
+            .create_async()
+            .await;
+
+        cmd_get(
+            "bafkreitestcid".to_string(),
+            server.url(),
+            Some(keystore.path().to_path_buf()),
+        )
+        .await
+        .expect("signed get of a resolvable object should succeed");
+
+        m.assert_async().await;
+    }
+
+    /// #173 (F5) must-not: a genuine anonymous denial must surface as an error, not
+    /// be masked as success. With no identity dir the request is unsigned; a 404
+    /// from the node must produce an Err mentioning the status.
+    #[tokio::test]
+    async fn test_cmd_get_anonymous_denial_is_error() {
+        let mut server = mockito::Server::new_async().await;
+
+        let m = server
+            .mock("GET", "/ipfs/bafkreidenied")
+            .with_status(404)
+            .with_header("content-type", "text/plain")
+            .with_body("no git object found")
+            .create_async()
+            .await;
+
+        let err = cmd_get("bafkreidenied".to_string(), server.url(), None)
+            .await
+            .expect_err("a 404 denial must be an error, not masked success");
+        assert!(
+            err.to_string().contains("404"),
+            "error should mention the status, got: {err}"
+        );
+
+        m.assert_async().await;
+    }
 }