Is it legal for the Document Source to fill in size, hash, URI attributes?
Yes. A Document Repository must fill in these 3 attributes. If they are included in a Provide and Register transaction then the Document Repository must replace their values with ones it computes. This may not make much sense thinking about only XDS. But when you consider XDR and XDM it does. The Document Source may not actually be the author of the metadata. It may have been received from another actor/system and the n forwarded to you as Repository. Even if those values are incorrect, the Document Repository must replace them with correct values.