fix(security): remove unauthorized /api/pg/pods router + close the PG backfill access bypass

[lilyshen0722]

Second of the security cluster (first is #765). Both holes here were confirmed by live execution as a plain, non-admin account.

1. /api/pg/pods — an unauthorized shadow copy of the pod API

GET /api/pg/pods                    -> HTTP 200, 229 pods
  sample: ['BioMed QAgent v1', 'YC F26 — Competitive Analysis',
           'Dev Team', 'First 10 Users — War Room', ...]
POST /api/pg/pods/<private>/join    -> HTTP 200
  {"id":"...","name":"Context Layer — GTM & Big Picture", ...}

No membership filter on the listing; no join-policy check at all on the join. It duplicated the pod API without its authorization.

Removed, not patched. It has zero callers anywhere in the repo — frontend v1+v2, cli, mcp, examples, e2e and scripts all use /api/pods; only /api/pg/messages and /api/pg/status are live (ChatRoom, SocketContext). An unused, unguarded duplicate of a guarded API is a liability.

2. The backfill manufactured the membership it then checked

PGPod.create inserts its created_by into pod_members as a side effect. syncPodFromMongo passed the requesting user as created_by, and getMessages ran the backfill before its membership check — so a non-member requesting a pod not yet mirrored into PG caused the server to insert them, and the next line read that row back and let them through.

Worse than a single-request bypass: the row persists, and PG pod_members is trusted as a positive access signal by isMemberWithFallback and reactionController.callerHasPodAccess on every later request.

Fix: created_by mirrors Mongo's real owner, and the order becomes existence (read-only) → authorize → backfill. The 404-for-missing / 401-for-non-member contract is preserved exactly — I initially collapsed it to 401 and an existing test caught it.

Test

4 new tests pinning attribution and that the requester is never added to the member list. Proven load-bearing: reverting the one-line attribution fix fails 2 of them.

Net test delta vs origin/main: zero regressions. The 9 remaining server.test.js failures are pre-existing and identical on main.

Still open

getPodsByType/getPodById apply their membership filter only to the three personal pod types, so chat/team pods stay enumerable instance-wide. Code-confirmed, not executed. Filed separately because the fix needs a publicRead carve-out — Community nav and showcase links depend on non-member reads — plus a real-browser check after deploy.

🤖 Generated with Claude Code