api(replicas): Enforce read visibility on replica registration and removal #435

Summary

Replica registration and removal do not apply the repository read-visibility decision that protects replica listing. An authenticated non-reader can therefore change their own replica metadata for a private repository and receive repository metadata through the mutation response.

Source reviewed at ebafeae909364359466a8438a7cc9acec9970a2c:

• crates/gitlawb-node/src/api/replicas.rs:34: register_replica() looks up the repository directly and binds the replica identity to the signer, but does not call authorize_repo_read().
• crates/gitlawb-node/src/api/replicas.rs:91: unregister_replica() has the same missing visibility decision.
• crates/gitlawb-node/src/db/mod.rs:4362: registration updates metadata scoped to the repository and the caller's replica DID; removal is likewise scoped to that DID.
• Both mutation responses include the repository's replica count. The corresponding listing handler already applies the read-visibility gate.

Impact and limits

This is a private-repository metadata confidentiality and integrity gap: visibility-denied callers can receive existence/count information and register their own advisory replica entry. Source inspection does not establish repository-content access, alteration of another replica's entry, or a downstream fetch caused by registration.

Replica self-registration is intentional. Requiring repository ownership would break that model; the missing requirement is repository read permission while preserving the caller-bound replica identity.

The handler and database paths are source-confirmed. No runtime reproduction or production testing was performed for this report. Provisional severity: Medium, subject to maintainer assessment.

Relationship to existing reports

#120 and its referenced #113 work cover visibility on read surfaces, including replica listing. This report concerns the remaining replica mutation paths. #341 concerns authorization ordering on bounty actions and is a separate surface. Owner-only mutations with the documented lookup-before-owner-check behavior are outside this report.

Remediation and acceptance criteria

• Apply authorize_repo_read() at the repository root before replica mutation or count disclosure, preserving the existing signer-to-replica binding.
• Preserve legitimate self-registration and removal for authorized readers; do not add an owner-only gate.
• Add regression coverage showing that visibility-denied callers receive the same denial as for a missing repository, with no metadata change or count disclosure.
• Cover authorized readers, revoked readers, and the existing owner/self-registration rule.