Fix signed-in community discussions and votes failing with 401

[cursor]

What changed

• Signed-in community discussion create and votes now send a Firebase Bearer token via fetchWithFirebaseAuthRequired.
• The votes API route is force-dynamic so Authorization headers are available instead of being stripped by static rendering.
• Guest discussion POST (guestPost: true) is unchanged and stays captcha-gated.

Why this change is safe

• Root cause: POST /api/community/discussions (signed-in path) and GET/POST /api/community/votes already call verifyUserRequest. The community page used plain fetch() with no Bearer token, so every signed-in user received 401. Votes was also force-static.
• Trigger: Sign in → /community/attribution → create a discussion or upvote a thread → 401 toast; optimistic vote UI rolls back.
• Scope is focused (community page + votes dynamic + a source-lock unit test).
• Does not change comments (open PR Fix unauthenticated community comment and discussion write IDOR #62) or guest posting.

Verification

• pnpm exec eslint on touched files (0 errors; pre-existing warnings only)
• pnpm test — 70 suites / 384 tests passed
• pnpm run lint:security passed
• Playwright smoke (signed-in community is not covered by unauthenticated E2E)

Regression prevention

• Added tests/unit/community-signed-in-writes-auth.test.ts (fails if signed-in discussion/vote fetches drop Bearer, or votes revert to force-static).
• Guest discussion path still uses unauthenticated fetch with guestPost: true.

Release checklist (solo-friendly)

• CI is green:
  • CI / Lint + Jest
  • CI / Playwright smoke
• Ready to merge to main.
• Post-merge: sign in, create a discussion, upvote a thread, confirm both succeed.

  

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
future-seer	Ready	Preview	Aug 30, 2026 11:11am