Fix unauthenticated community comment and discussion write IDOR

[cursor]

What changed

• Require a Firebase ID token for signed-in comment POST and for comment/discussion PATCH and DELETE so callers cannot impersonate another member.
• Bind body/query userId to the authenticated uid (resolveOwnedUserId); mismatch returns 403. Guest comment posting (guestPost: true) is unchanged.
• Send Authorization: Bearer from the community page when posting a signed-in reply.

Why this change is safe

• Root cause: /api/community/comments, /api/community/comments/[id], and PATCH/DELETE /api/community/discussions/[id] used the Admin SDK and trusted body/query userId with no auth. Member userIds are public from GET /api/community/members.
• Trigger: unauthenticated POST /api/community/comments with a victim userId posted as that member and updated their karma/display name; PATCH/DELETE with the author’s userId edited or deleted their comment or entire thread.
• Scope is those write APIs plus the one client that posts signed-in comments. Guest discussion/comment captcha flows are unchanged. Votes and discussion POST already used verifyUserRequest (open Fix unauthenticated community connections IDOR #61 is connections).
• Not a duplicate of open Fix mystical regeneration billing bypass #24–Fix unauthenticated community connections IDOR #61.

Verification

• ESLint on touched files (0 errors; pre-existing warnings only)
• pnpm test — 71 suites / 396 tests, including 15 new comment/discussion write auth tests
• pnpm run security passed
• Live curl against localhost:3000: unauthenticated comment POST/PATCH/DELETE and discussion PATCH/DELETE all return 401 {"error":"Unauthorized"}
• Playwright smoke not run: no unauthenticated E2E covers signed-in community comments

Regression prevention

• tests/integration/community-comments-auth.test.ts and tests/integration/community-discussion-write-auth.test.ts fail before this change (401 missing token, 403 uid mismatch, 200 owner path)
• Guest comment POST still skips member auth; public discussion GET is unchanged

Release checklist (solo-friendly)

• CI is green (CI / Lint + Jest, CI / Playwright smoke)
• Ready to merge to main
• Post-merge: signed-in user can still post a reply on /community; guests can still comment via the captcha path

  

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
future-seer	Ready	Preview	Aug 29, 2026 11:31am