Fix unauthenticated community auto-join impersonation

[cursor]

What changed

• Unauthenticated POST /api/community/members/auto-join can no longer create or overwrite communityMembers/{userId} using a body-supplied uid, name, email, or photo.
• Founder / Grandmaster status is derived from the verified ID token (uid/email), not from a client-supplied email that previously matched FOUNDER_EMAIL.
• The community page now sends a Bearer token on auto-join so legitimate signed-in users still join.

Why this change is safe

• Root cause identified (for bugfixes).
• Scope is focused (no unrelated refactors).
• Risk areas reviewed (auth/profile/onboarding/payments if touched).

Root cause: the route used Firebase Admin with no verifyUserRequest. GET /api/community/members already returns member userIds, so an attacker can overwrite another member's display identity or mint a Founder row by posting email: <FOUNDER_EMAIL>.

This is not a duplicate of open #24–#48 / #53 / #56–#59 (billing, report caches, Stage B, Seer empty-question billing, on-demand persist).

Verification

• pnpm exec eslint on touched files (0 errors; pre-existing warnings only)
• pnpm test — 70 suites / 385 tests passed, including new tests/integration/community-auto-join-auth.test.ts
• pnpm run security passed (audit + security lint)
• Playwright smoke run (required for high-risk flows):
  • onboarding/profile/auth
  • special-user quota behavior (if relevant)

Playwright smoke is unchanged: this is an API ownership fix plus a Bearer header on an existing community fetch. E2E in CI still covers unauthenticated landing/tools smoke only.

Regression prevention

• Added/updated at least one test that would fail before this change.
• Confirmed existing behavior outside this scope is unchanged.

New tests lock in: missing token → 401 (no write); mismatched userId → 403 (no overwrite); spoofed founder email on own uid → no Founder karma grant; matching token still updates the member.

Release checklist (solo-friendly)

• CI is green:
  • CI / Lint + Jest
  • CI / Playwright smoke
• Ready to merge to main.
• Post-merge production sanity checks planned.

  

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
future-seer	Ready	Preview	Aug 27, 2026 11:17am