Fix Hellenistic comprehensive Admin cache IDOR

[cursor]

What changed

• Closed Admin-SDK report-cache IDOR on POST /api/hellenistic/comprehensive: body userId is no longer trusted for users/{userId}/hellenistic-astrology/current reads/writes.
• Added shared decideUserScopedAccess helper: owned Firebase UID can read/write cache; missing token stays stateless (Stage B); invalid token → 401; UID mismatch → 403.
• Hellenistic on-demand client now sends Bearer via fetchWithFirebaseAuthRequired so owned cache access works.

Why this change is safe

• Root cause identified: unauthenticated callers could overwrite another user's Hellenistic cache after a birth-data cache miss.
• Scope is focused (auth gate + useCache option + tests; no unrelated refactors).
• Risk areas reviewed: Stage B / orchestrator still works via missing-token → stateless path (no Firestore cache R/W).

Verification

• pnpm exec eslint on touched files (0 errors; pre-existing warnings only)
• pnpm test — 64 suites / 331 tests passed
• pnpm run lint:security passed (pnpm run security audit still reports pre-existing high nanoid + extract-zip)
• Playwright smoke (not required for this API auth fix; no routing/E2E changes)

Regression prevention

• Added tests/unit/userScopedAccess.test.ts, tests/unit/hellenisticAstrologyCache.test.ts, and tests/integration/hellenistic-comprehensive-auth.test.ts (mismatch 403, missing-token skips cache, owned cache allowed, invalid token 401).
• Existing Stage B callers without Bearer remain able to generate (stateless).

Release checklist (solo-friendly)

• CI is green:
  • CI / Lint + Jest
  • CI / Playwright smoke
• Ready to merge to main.
• Post-merge: confirm unauthenticated POST /api/hellenistic/comprehensive with a victim userId does not write users/{victim}/hellenistic-astrology/current.

  

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
future-seer	Ready	Preview	Aug 21, 2026 8:04am