Fix unauthenticated Vedic career/relationships AI cost abuse and cache IDOR

[cursor]

What changed

• POST /api/vedic/career and POST /api/vedic/relationships now require a Firebase Bearer token whose UID matches body.userId before any Admin Firestore read/write or Groq generation.
• Both routes are wrapped with the AI rate limiter.
• Vedic career and relationships panels send Authorization via fetchWithFirebaseAuthRequired.

Why this change is safe

• Root cause: These routes trusted unauthenticated body.userId for Admin SDK access to users/{userId} and users/{userId}/mysticalProfile/{comprehensiveVedicCareer|comprehensiveVedicRelationships}, then called Groq (llama-3.3-70b-versatile, up to 3 attempts, 4500 tokens).
• Trigger: POST /api/vedic/career with {"userId":"<victim>","userProfile":{"birthDate":"1990-01-01","birthTime":"12:00:00","birthPlace":"Mumbai"}} and no Authorization → returns victim persisted career analysis when present, can overwrite victim cache, and burns Groq credits.
• Scope is focused: shared ownership guard, two API routes, two client callers, and an integration test. Stage B does not call these routes, so fail-closed auth is safe.
• Complements open PRs Fix Vedic/Western comprehensive report cache IDOR #32–Fix remaining Admin comprehensive report-cache IDORs #34 (other comprehensive cache IDORs) and Fix unauthenticated Vedic interpretation AI cost abuse and cache IDOR #42 (Vedic interpretations). Does not duplicate those routes.

Verification

• pnpm exec eslint on touched files (0 errors)
• pnpm test — 62 suites / 329 tests passed, including tests/integration/vedic-focused-report-auth.test.ts (8 cases)
• pnpm run lint:security passed
• Playwright smoke — not required; no routing/landing/auth E2E change. Logged-in Vedic career/relationships tabs should still load for the signed-in owner.

pnpm run security still reports pre-existing high nanoid and extract-zip advisories unrelated to this fix.

Regression prevention

• Added tests/integration/vedic-focused-report-auth.test.ts covering missing token (401), invalid token (401), UID mismatch (403), owned inline success, and owned profile-doc read scoped to the authenticated UID.
• Generation and cache behavior for owned users is unchanged.

Release checklist (solo-friendly)

• CI is green:
  • CI / Lint + Jest
  • CI / Playwright smoke
• Ready to merge to main.
• Post-merge: open Vedic Career and Relationships tabs as a signed-in user and confirm reports still load.

  

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
future-seer	Ready	Preview	Aug 21, 2026 8:01am