Fix unauthenticated community connections IDOR

[cursor]

What changed

• Require a Firebase ID token for community connection GET, POST, and PATCH so callers cannot read or mutate another user’s connection graph.
• Bind userId / fromUserId to the authenticated uid (resolveOwnedUserId); mismatch returns 403.
• Send Authorization: Bearer from the community page via fetchWithFirebaseAuthRequired.

Why this change is safe

• Root cause: /api/community/connections and /api/community/connections/[id] used the Admin SDK and trusted body/query userId with no auth. Member userIds are public from GET /api/community/members.
• Trigger: unauthenticated GET ?userId=<victim> leaked private request messages; POST sent requests as the victim; PATCH { action: "accept", userId: <victim> } accepted inbound requests as the victim.
• Scope is the connections API plus the one client that calls it. Guest discussion/comment flows are unchanged.
• Not a duplicate of open Fix unauthenticated community auto-join impersonation #60 (auto-join) or Fix mystical regeneration billing bypass #24–Fix Seer billing for empty questions #59.

Verification

• ESLint on touched files (0 errors; pre-existing warnings only)
• pnpm test — 70 suites / 390 tests, including 9 new connections auth tests
• pnpm run security passed
• Live curl against localhost:3000: unauthenticated GET/POST/PATCH all return 401 {"error":"Unauthorized"}
• Playwright smoke not run: no unauthenticated E2E covers signed-in community connections

Regression prevention

• tests/integration/community-connections-auth.test.ts fails before this change (401 missing token, 403 uid mismatch, 200 owner path for GET/POST/PATCH)
• Community members/discussions list fetches remain public; only connections require a matching token

Release checklist (solo-friendly)

• CI is green (CI / Lint + Jest, CI / Playwright smoke)
• Ready to merge to main
• Post-merge: signed-in user can still list, send, accept, and decline their own connection requests on /community

  

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
future-seer	Ready	Preview	Aug 28, 2026 11:26am