fix(security): require auth for mundane comprehensive Groq

[cursor]

What changed

• POST /api/mundane-astrology/comprehensive now requires a Firebase Bearer token and AI rate limiting. Unauthenticated callers can no longer burn Groq credits.
• Stage B generates mundane reports in-process via generateMundaneComprehensive so profile generation does not depend on an unauthenticated HTTP loopback.
• The mundane tool on-demand fetch sends Authorization through fetchWithFirebaseAuthRequired.

Why this change is safe

• Root cause: the public route called callStructuredAI (llama-3.3-70b-versatile, 2400 tokens, 3 attempts) with no auth and no rate limit. Stage B and the tool page both hit that route without a Bearer token.
• Scope is focused on this one Groq path. Existing report shape (data.comprehensiveAnalysis) is unchanged.
• Risk areas reviewed: auth on the public route; Stage B still generates without HTTP; client fetch now includes the signed-in user token. Mismatched userId returns 403.

Verification

• Targeted auth tests: tests/integration/mundane-comprehensive-auth.test.ts (401 missing/invalid, 403 mismatch, 200 owner)
• pnpm test — 62 suites / 325 tests passed
• ESLint on touched files — 0 errors (2 pre-existing warnings on the mundane page effect)
• pnpm run lint:security passed
• pnpm run lint (full-repo not required by inner-loop plans)
• Playwright smoke: not required (no onboarding/auth routing change; unauthenticated E2E does not cover this signed-in Groq route)

pnpm run security still fails on pre-existing high nanoid / extract-zip advisories unrelated to this fix.

Regression prevention

• Added tests/integration/mundane-comprehensive-auth.test.ts — would fail on main because the route generated without auth.
• Stage B stored payload remains { comprehensiveAnalysis } so mystical-profile / tool report consumers are unchanged.

Release checklist (solo-friendly)

• CI is green:
  • CI / Lint + Jest
  • CI / Playwright smoke
• Ready to merge to main.
• Post-merge: confirm a signed-in mundane on-demand generate still works, and an unauthenticated POST returns 401.

  

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
future-seer	Ready	Preview	Aug 21, 2026 7:57am