Fix unauthenticated Ogham generate-report AI cost abuse and readings IDOR

[cursor]

What changed

• POST /api/tools/ogham/generate-report now requires a Firebase Bearer token and rejects userId that is not the signed-in user, before any Groq call or Admin oghamReadings read/write.
• Stage B mystical generation calls oghamIntelligence.generateReading in-process instead of HTTP-looping the public route (so adding auth does not break catalog generation).
• Added integration coverage for missing auth, bad token, userId mismatch, missing userId, and owned success.

Why this change is safe

• Root cause: the route had no auth and no rate limit. Anyone could POST { userId, userProfile } and burn Groq (llama-3.3-70b-versatile, 2000 tokens, 2 attempts) plus read/overwrite users/{userId}/oghamReadings via the Admin SDK.
• Scope is this one route plus the Stage B Ogham case. Stored report shape remains { report, generatedAt }.
• The Ogham tool page already reads the mystical-profile report (useToolReport); it does not call this HTTP route.

Verification

• pnpm exec eslint on touched files (0 errors)
• pnpm test — 62 suites / 326 tests passed, including tests/integration/ogham-generate-report-auth.test.ts
• pnpm run lint:security passed
• Playwright smoke (not required: no UI/routing change; Ogham page does not call this route)

Regression prevention

• New auth/IDOR tests would fail on unauthenticated main.
• Stage B still produces the same { report, generatedAt } payload without depending on an open HTTP hole.

Release checklist (solo-friendly)

• CI is green
• Ready to merge to main
• Post-merge: confirm a signed-in Ogham generate-report still works and unauthenticated POSTs return 401

  

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
future-seer	Error		Aug 14, 2026 11:06am