Fix unauthenticated astro-numerology Groq cost abuse and cache IDOR

[cursor]

What changed

• Require a matching Firebase Bearer token on POST /api/astro-numerology/analysis and POST /api/vedic-astro-numerology/analysis. Unauthenticated callers can no longer burn Groq credits or read/write another user's Admin cache.
• Move generation into in-process helpers so profile/on-demand generation still works without HTTP-looping an unauthenticated public route.
• Send Authorization from the Western and Vedic astro-numerology tool tabs.

Why this change is safe

• Root cause: both routes accepted body userId with no auth, then called Groq and Admin-backed users/{userId}/...Reports/current.
• Scope is limited to these two routes, their generators, the orchestrator call sites, and the two tool tabs.
• Does not change billing, profile generate lock, or other comprehensive-cache PRs (Fix Vedic/Western comprehensive report cache IDOR #32–Fix remaining Admin comprehensive report-cache IDORs #34, Fix unauthenticated BaZi comprehensive AI cost abuse and cache IDOR #41–Fix Hellenistic comprehensive Admin cache IDOR #48).

Verification

• pnpm exec eslint on touched files (0 errors)
• pnpm test — 71 suites / 389 tests passed
• pnpm run security passed
• Playwright smoke (not required; no routing/landing/auth-page change)

Regression prevention

• Added tests/integration/astro-numerology-analysis-auth.test.ts and tests/integration/vedic-astro-numerology-analysis-auth.test.ts (401 missing/invalid token, 403 mismatched userId, 200 owned uid).
• Orchestrator still generates these tools in-process after the HTTP gate.

Release checklist (solo-friendly)

• CI is green:
  • CI / Lint + Jest
  • CI / Playwright smoke
• Ready to merge to main.
• Post-merge: confirm signed-in astro-numerology tabs still load, and unauthenticated POSTs return 401.

  

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
future-seer	Ready	Preview	Aug 23, 2026 11:15am