fix(reputation): the reads are public, not self-view-only + recompute throttle

src/escrow/escrow.service.ts

@@ -584,20 +584,14 @@ export class EscrowService {
     recipients: Array<[string, number]>,
     manager?: EntityManager,
   ): Promise<ContractInvocationResult> {
-    return this.invokeOnLockedEscrow(escrow, operation, () =>
-      this.soroban.invoke(
-        'release',
-        // `release(issue_id: u64, recipients)` — u64-typed on-chain (#301).
-        [u64(this.onChainKeyFor(escrow)), recipients],
-        this.contractOpts(escrow),
-      ),
     return this.invokeOnLockedEscrow(
       escrow,
       operation,
       () =>
         this.soroban.invoke(
           'release',
-          [this.onChainKeyFor(escrow), recipients],
+          // `release(issue_id: u64, recipients)` — u64-typed on-chain (#301).
+          [u64(this.onChainKeyFor(escrow)), recipients],
           this.contractOpts(escrow),
         ),
       manager,

src/github/github-webhooks.service.spec.ts

@@ -869,6 +869,9 @@ describe('GithubWebhooksService', () => {
 
       expect(bountiesService.markInReview).not.toHaveBeenCalled();
       expect(bountiesService.markMergedAndRelease).not.toHaveBeenCalled();
+    });
+  });
+
   // #308: a redelivered X-GitHub-Delivery used to hit the unique constraint
   // on webhook_events.deliveryId and escape handleEvent as a 500, so every
   // redelivery of that event failed forever.

src/reputation/reputation.controller.ts

@@ -9,6 +9,7 @@ import {
   UseGuards,
 } from '@nestjs/common';
 import { ApiBearerAuth, ApiQuery, ApiTags } from '@nestjs/swagger';
+import { Throttle } from '@nestjs/throttler';
 import { ReputationService } from './reputation.service';
 import { JwtAuthGuard } from '../auth/guards/jwt-auth.guard';
 import { CurrentUser } from '../common/decorators/current-user.decorator';
@@ -35,6 +36,10 @@ export class ReputationController {
 
   @ApiBearerAuth()
   @UseGuards(JwtAuthGuard)
+  // Unthrottled, every call ran the multi-join stats SQL AND inserted a row —
+  // ~170k snapshots/day from one user (#584). Tight limit + the service skips
+  // the insert when nothing changed.
+  @Throttle({ long: { limit: 10, ttl: 3_600_000 } })
   @Post(':userId/recompute')
   recompute(
     @Param('userId', new ParseUUIDPipe()) userId: string,
@@ -47,11 +52,10 @@ export class ReputationController {
   @ApiBearerAuth()
   @UseGuards(JwtAuthGuard)
   @Get(':userId')
-  latest(
-    @Param('userId', new ParseUUIDPipe()) userId: string,
-    @CurrentUser() user: AuthenticatedUser,
-  ) {
-    this.assertOwner(user, userId);
+  latest(@Param('userId', new ParseUUIDPipe()) userId: string) {
+    // Reputation is a contributor's public track record — a sponsor or
+    // maintainer needs to read it before assigning a bounty/team (#583).
+    // Any authenticated user may read; only recompute stays owner-gated.
     return this.reputationService.getLatest(userId);
   }
 
@@ -66,11 +70,11 @@ export class ReputationController {
   @ApiQuery({ name: 'offset', required: false })
   history(
     @Param('userId', new ParseUUIDPipe()) userId: string,
-    @CurrentUser() user: AuthenticatedUser,
     @Query('limit') limit?: string,
     @Query('offset') offset?: string,
   ) {
-    this.assertOwner(user, userId);
+    // Public read — sponsors/maintainers see a contributor's track record
+    // before assigning work (#583). Only recompute is owner-gated.
     return this.reputationService.history(userId, {
       limit: parseOptionalInt(limit),
       offset: parseOptionalInt(offset),

src/sponsors/sponsors.controller.ts

@@ -26,25 +26,6 @@ function validatePage(limit?: number, offset?: number) {
     throw new BadRequestException('offset must be >= 0');
   }
   return { limit, offset };
-/**
- * Parse optional limit/offset query params, rejecting NaN, negatives,
- * non-integers, and limits above MAX_PAGE_LIMIT with a 400 (#280).
- */
-function parsePagination(limit?: string, offset?: string) {
-  const parse = (name: string, raw: string | undefined, min: number, max: number) => {
-    if (raw === undefined || raw === '') return undefined;
-    const n = Number(raw);
-    if (!Number.isInteger(n) || n < min || n > max) {
-      throw new BadRequestException(
-        `${name} must be an integer between ${min} and ${max}`,
-      );
-    }
-    return n;
-  };
-  return {
-    limit: parse('limit', limit, 1, MAX_PAGE_LIMIT),
-    offset: parse('offset', offset, 0, Number.MAX_SAFE_INTEGER),
-  };
 }
 
 @ApiTags('sponsors')
@@ -73,7 +54,6 @@ export class SponsorsController {
   ) {
     this.assertOwnsSponsor(user, id);
     return this.sponsorsService.dashboard(id, validatePage(limit, offset));
-    return this.sponsorsService.dashboard(id, parsePagination(limit, offset));
   }
 
   @ApiBearerAuth()
@@ -91,6 +71,5 @@ export class SponsorsController {
       id,
       validatePage(limit, offset),
     );
-    return this.sponsorsService.milestoneProgress(id, parsePagination(limit, offset));
   }
 }