Fix unauthenticated Vedic interpretation AI cost abuse and cache IDOR

app/api/vedic-interpretations/dasha/route.ts

@@ -1,25 +1,31 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { devLog } from '@/lib/devLogger';
 import { VedicInterpretationEnhancer } from '@/lib/vedicInterpretationEnhancer';
+import { authorizeVedicInterpretationRequest } from '@/lib/vedicInterpretationsRouteGuard';
+import { withRateLimit, rateLimiters } from '@/lib/rateLimit';
 
-export async function POST(request: NextRequest) {
+async function handleDasha(request: NextRequest) {
   try {
-    const { dashaData, chartData, userId } = await request.json();
-
-    if (!userId || !chartData || !dashaData) {
+    const gate = await authorizeVedicInterpretationRequest(request, 'vedic-interpretations-dasha');
+    if (!gate.ok) return gate.response;
+
+    const { dashaData, chartData } = gate.body;
+    const userId = gate.userId;
+
+    if (!chartData || !dashaData) {
       return NextResponse.json(
         { error: 'Missing required fields' },
         { status: 400 }
       );
     }
-    
+
     const enhancer = new VedicInterpretationEnhancer();
     const interpretation = await enhancer.generateDashaInterpretation(
       dashaData,
       chartData,
       userId
     );
-    
+
     return NextResponse.json({ interpretation });
   } catch (error) {
     devLog.error('Dasha interpretation error:', error, 'route');
@@ -29,3 +35,5 @@ export async function POST(request: NextRequest) {
     );
   }
 }
+
+export const POST = withRateLimit(handleDasha, rateLimiters.ai, 'vedic_interpretations_dasha_post');

app/api/vedic-interpretations/divisional/route.ts

@@ -2,19 +2,25 @@ import { NextRequest, NextResponse } from 'next/server';
 import { devLog } from '@/lib/devLogger';
 import { VedicInterpretationEnhancer } from '@/lib/vedicInterpretationEnhancer';
 import { getUserProfile } from '@/lib/firebase';
+import { authorizeVedicInterpretationRequest } from '@/lib/vedicInterpretationsRouteGuard';
+import { withRateLimit, rateLimiters } from '@/lib/rateLimit';
 
-export async function POST(request: NextRequest) {
+async function handleDivisional(request: NextRequest) {
   try {
-    const { chartType, chartData, userId } = await request.json();
-
-    if (!chartType || !chartData || !userId) {
+    const gate = await authorizeVedicInterpretationRequest(request, 'vedic-interpretations-divisional');
+    if (!gate.ok) return gate.response;
+
+    const { chartType, chartData } = gate.body;
+    const userId = gate.userId;
+
+    if (!chartType || !chartData) {
       return NextResponse.json(
         { error: 'Missing required parameters' },
         { status: 400 }
       );
     }
-    
-    // Fetch user profile to get displayName/firstName
+
+    // Owned userId only — never load another user's profile for personalization.
     let userName: string | undefined;
     try {
       const userProfile = await getUserProfile(userId);
@@ -23,12 +29,11 @@ export async function POST(request: NextRequest) {
       devLog.warn('Could not fetch user profile for personalization:', error, 'route');
       // Continue without userName - will use "you" instead
     }
-    
+
     const enhancer = new VedicInterpretationEnhancer();
-
-    // Generate interpretations based on chart type
-    let interpretations: any = {};
-
+
+    let interpretations: Record<string, string> = {};
+
     if (chartType === 'D9') {
       interpretations = {
         marriageIndicators: await enhancer.generateDivisionalInsight(
@@ -54,7 +59,7 @@ export async function POST(request: NextRequest) {
         )
       };
     }
-    
+
     return NextResponse.json({ interpretations });
   } catch (error) {
     devLog.error('Error generating divisional interpretations:', error, 'route');
@@ -64,3 +69,5 @@ export async function POST(request: NextRequest) {
     );
   }
 }
+
+export const POST = withRateLimit(handleDivisional, rateLimiters.ai, 'vedic_interpretations_divisional_post');

app/api/vedic-interpretations/houses/route.ts

@@ -1,25 +1,31 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { devLog } from '@/lib/devLogger';
 import { VedicInterpretationEnhancer } from '@/lib/vedicInterpretationEnhancer';
+import { authorizeVedicInterpretationRequest } from '@/lib/vedicInterpretationsRouteGuard';
+import { withRateLimit, rateLimiters } from '@/lib/rateLimit';
 
-export async function POST(request: NextRequest) {
+async function handleHouses(request: NextRequest) {
   try {
-    const { houseNumber, chartData, userId } = await request.json();
-
-    if (!userId || !chartData || houseNumber === undefined) {
+    const gate = await authorizeVedicInterpretationRequest(request, 'vedic-interpretations-houses');
+    if (!gate.ok) return gate.response;
+
+    const { houseNumber, chartData } = gate.body;
+    const userId = gate.userId;
+
+    if (!chartData || houseNumber === undefined) {
       return NextResponse.json(
         { error: 'Missing required fields' },
         { status: 400 }
       );
     }
-    
+
     const enhancer = new VedicInterpretationEnhancer();
     const interpretation = await enhancer.generateHouseInterpretation(
-      houseNumber,
+      Number(houseNumber),
       chartData,
       userId
     );
-    
+
     return NextResponse.json({ interpretation });
   } catch (error) {
     devLog.error('House interpretation error:', error, 'route');
@@ -29,3 +35,5 @@ export async function POST(request: NextRequest) {
     );
   }
 }
+
+export const POST = withRateLimit(handleHouses, rateLimiters.ai, 'vedic_interpretations_houses_post');

app/api/vedic-interpretations/overview/route.ts

@@ -1,21 +1,31 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { devLog } from '@/lib/devLogger';
 import { VedicInterpretationEnhancer } from '@/lib/vedicInterpretationEnhancer';
+import { authorizeVedicInterpretationRequest } from '@/lib/vedicInterpretationsRouteGuard';
+import { withRateLimit, rateLimiters } from '@/lib/rateLimit';
 
-export async function POST(request: NextRequest) {
+/**
+ * Vedic overview interpretations: must not be an unauthenticated paid proxy
+ * or allow Admin cache IDOR via body userId.
+ */
+async function handleOverview(request: NextRequest) {
   try {
-    const { chartData, userId } = await request.json();
-
-    if (!userId || !chartData) {
+    const gate = await authorizeVedicInterpretationRequest(request, 'vedic-interpretations-overview');
+    if (!gate.ok) return gate.response;
+
+    const { chartData } = gate.body;
+    const userId = gate.userId;
+
+    if (!chartData) {
       return NextResponse.json(
         { error: 'Missing required fields' },
         { status: 400 }
       );
     }
-    
+
     const enhancer = new VedicInterpretationEnhancer();
     const interpretation = await enhancer.generateEnhancedOverview(chartData, userId);
-    
+
     return NextResponse.json({ interpretation });
   } catch (error) {
     devLog.error('Overview interpretation error:', error, 'route');
@@ -25,3 +35,5 @@ export async function POST(request: NextRequest) {
     );
   }
 }
+
+export const POST = withRateLimit(handleOverview, rateLimiters.ai, 'vedic_interpretations_overview_post');

app/api/vedic-interpretations/panchanga/route.ts

@@ -1,25 +1,31 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { devLog } from '@/lib/devLogger';
 import { VedicInterpretationEnhancer } from '@/lib/vedicInterpretationEnhancer';
+import { authorizeVedicInterpretationRequest } from '@/lib/vedicInterpretationsRouteGuard';
+import { withRateLimit, rateLimiters } from '@/lib/rateLimit';
 
-export async function POST(request: NextRequest) {
+async function handlePanchanga(request: NextRequest) {
   try {
-    const { panchangaData, chartData, userId } = await request.json();
-
-    if (!userId || !chartData || !panchangaData) {
+    const gate = await authorizeVedicInterpretationRequest(request, 'vedic-interpretations-panchanga');
+    if (!gate.ok) return gate.response;
+
+    const { panchangaData, chartData } = gate.body;
+    const userId = gate.userId;
+
+    if (!chartData || !panchangaData) {
       return NextResponse.json(
         { error: 'Missing required fields' },
         { status: 400 }
       );
     }
-    
+
     const enhancer = new VedicInterpretationEnhancer();
     const interpretation = await enhancer.generatePanchangaInsight(
       panchangaData,
       chartData,
       userId
     );
-    
+
     return NextResponse.json({ interpretation });
   } catch (error) {
     devLog.error('Panchanga interpretation error:', error, 'route');
@@ -29,3 +35,5 @@ export async function POST(request: NextRequest) {
     );
   }
 }
+
+export const POST = withRateLimit(handlePanchanga, rateLimiters.ai, 'vedic_interpretations_panchanga_post');

app/api/vedic-interpretations/planets/route.ts

@@ -1,25 +1,31 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { devLog } from '@/lib/devLogger';
 import { VedicInterpretationEnhancer } from '@/lib/vedicInterpretationEnhancer';
+import { authorizeVedicInterpretationRequest } from '@/lib/vedicInterpretationsRouteGuard';
+import { withRateLimit, rateLimiters } from '@/lib/rateLimit';
 
-export async function POST(request: NextRequest) {
+async function handlePlanets(request: NextRequest) {
   try {
-    const { planet, chartData, userId } = await request.json();
-
-    if (!userId || !chartData || !planet) {
+    const gate = await authorizeVedicInterpretationRequest(request, 'vedic-interpretations-planets');
+    if (!gate.ok) return gate.response;
+
+    const { planet, chartData } = gate.body;
+    const userId = gate.userId;
+
+    if (!chartData || !planet) {
       return NextResponse.json(
         { error: 'Missing required fields' },
         { status: 400 }
       );
     }
-    
+
     const enhancer = new VedicInterpretationEnhancer();
     const interpretation = await enhancer.generatePlanetaryInterpretation(
-      planet,
+      String(planet),
       chartData,
       userId
     );
-    
+
     return NextResponse.json({ interpretation });
   } catch (error) {
     devLog.error('Planetary interpretation error:', error, 'route');
@@ -29,3 +35,5 @@ export async function POST(request: NextRequest) {
     );
   }
 }
+
+export const POST = withRateLimit(handlePlanets, rateLimiters.ai, 'vedic_interpretations_planets_post');

app/api/vedic-interpretations/remedies/route.ts

@@ -1,26 +1,32 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { devLog } from '@/lib/devLogger';
 import { VedicInterpretationEnhancer } from '@/lib/vedicInterpretationEnhancer';
+import { authorizeVedicInterpretationRequest } from '@/lib/vedicInterpretationsRouteGuard';
+import { withRateLimit, rateLimiters } from '@/lib/rateLimit';
 
-export async function POST(request: NextRequest) {
+async function handleRemedies(request: NextRequest) {
   try {
-    const { planet, remedy, chartData, userId } = await request.json();
-
-    if (!userId || !chartData || !planet || !remedy) {
+    const gate = await authorizeVedicInterpretationRequest(request, 'vedic-interpretations-remedies');
+    if (!gate.ok) return gate.response;
+
+    const { planet, remedy, chartData } = gate.body;
+    const userId = gate.userId;
+
+    if (!chartData || !planet || !remedy) {
       return NextResponse.json(
         { error: 'Missing required fields' },
         { status: 400 }
       );
     }
-    
+
     const enhancer = new VedicInterpretationEnhancer();
     const interpretation = await enhancer.generateRemedyInterpretation(
-      planet,
+      String(planet),
       remedy,
       chartData,
       userId
     );
-    
+
     return NextResponse.json({ interpretation });
   } catch (error) {
     devLog.error('Remedy interpretation error:', error, 'route');
@@ -30,3 +36,5 @@ export async function POST(request: NextRequest) {
     );
   }
 }
+
+export const POST = withRateLimit(handleRemedies, rateLimiters.ai, 'vedic_interpretations_remedies_post');

app/api/vedic-interpretations/transits/route.ts

@@ -1,25 +1,31 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { devLog } from '@/lib/devLogger';
 import { VedicInterpretationEnhancer } from '@/lib/vedicInterpretationEnhancer';
+import { authorizeVedicInterpretationRequest } from '@/lib/vedicInterpretationsRouteGuard';
+import { withRateLimit, rateLimiters } from '@/lib/rateLimit';
 
-export async function POST(request: NextRequest) {
+async function handleTransits(request: NextRequest) {
   try {
-    const { transitData, chartData, userId } = await request.json();
-
-    if (!userId || !chartData || !transitData) {
+    const gate = await authorizeVedicInterpretationRequest(request, 'vedic-interpretations-transits');
+    if (!gate.ok) return gate.response;
+
+    const { transitData, chartData } = gate.body;
+    const userId = gate.userId;
+
+    if (!chartData || !transitData) {
       return NextResponse.json(
         { error: 'Missing required fields' },
         { status: 400 }
       );
     }
-    
+
     const enhancer = new VedicInterpretationEnhancer();
     const interpretation = await enhancer.generateTransitInterpretation(
       transitData,
       chartData,
       userId
     );
-    
+
     return NextResponse.json({ interpretation });
   } catch (error) {
     devLog.error('Transit interpretation error:', error, 'route');
@@ -29,3 +35,5 @@ export async function POST(request: NextRequest) {
     );
   }
 }
+
+export const POST = withRateLimit(handleTransits, rateLimiters.ai, 'vedic_interpretations_transits_post');