Fix unauthenticated Vedic interpretation AI cost abuse and cache IDOR

[cursor]

What changed

• Require Firebase Bearer auth + owned userId on all eight /api/vedic-interpretations/* routes before Groq generation or Admin cache R/W.
• Apply AI rate limiting; add integration coverage for 401/403 and owned success paths (including divisional profile ownership).
• Link: critical-bug automation hunt (cron); no separate issue ticket.

Why this change is safe

• Root cause: routes had no auth/rate limit; body userId drove VedicInterpretationEnhancer cache and (divisional) getUserProfile.
• Scope is focused (shared route guard + eight thin route wrappers + one test file); no Stage B/client callers existed for these endpoints.
• Risk areas reviewed: auth/ownership on AI + Admin Firestore paths; does not touch payments/onboarding.

Verification

• ESLint on touched files + pnpm run lint:security
• pnpm test (62 suites / 333 tests)
• Playwright smoke run (not required: no UI callers for these routes)

Regression prevention

• Added tests/integration/vedic-interpretations-auth.test.ts (fails without auth gate).
• Existing behavior outside this scope unchanged (no in-app HTTP callers to update).

Release checklist (solo-friendly)

• CI is green:
  • CI / Lint + Jest
  • CI / Playwright smoke
• Ready to merge to main.
• Post-merge production sanity checks planned.

Bug / impact

Unauthenticated callers could burn Groq via callTextAI and read/write users/{userId}/vedicInterpretations (plus profile personalization IDOR on divisional).

Root cause

Public App Router handlers accepted any userId with no Bearer check.

Fix

authorizeVedicInterpretationRequest + withRateLimit(rateLimiters.ai) on all eight routes.

  

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
future-seer	Ready	Preview	Aug 11, 2026 11:12am