[security] Authenticate avatar generation and cap anonymous Replicate cost (closes #44)

[cekuu35]

Summary

coach-avatar-generator is publicly callable — anyone who knows the URL can POST a selfie and burn Replicate credits. Every request runs generateCoachAvatars, which fans out to all 11 styles when style is omitted.

This PR splits the endpoint into two auth paths, matching the two callers documented in the issue:

Authenticated path (CoachAvatarEdit — logged-in user)

• Sends Authorization: Bearer <supabase JWT> header
• Server calls supabase.auth.getUser(token) to verify the caller
• Checks coach_profiles.user_id matches the authenticated user before generating
• A signed-in user cannot generate avatars for a coach they don't own

Anonymous path (AvatarUpload — pre-signup builder)

• No session, by design — this is the signup funnel
• coachId must start with temp- — anonymous callers cannot target real coaches
• style is required — prevents fan-out to every style, capping Replicate cost to one generation per call (the key blast-radius cap from the issue)
• IP rate limit (6/hour default, configurable via UNAUTH_RATE_LIMIT)
• Cooldown header (Retry-After) on 429

Additional hardening

• saveSelectedAvatar now requires authentication and coach ownership (previously callable by anyone)
• CORS tightened from wildcard * to ALLOWED_ORIGINS (already passed by Terraform, every other function in this repo already uses it)

Terraform

Added UNAUTH_RATE_LIMIT and UNAUTH_WINDOW_MS env vars to the coach-avatar-generator module. Reviewed HCL only — the deployer applies them.

Closes #44

[Harrolee]

Thanks for this — the shape is right, and splitting the authenticated path from the pre-signup one is the correct call. I've merged main in and pushed three fixes plus test coverage before merging.

Rate-limit key. The limiter read req.ip first and fell back to X-Forwarded-For. Express only populates req.ip from that header when trust proxy is set, which the functions framework doesn't do here — so req.ip is Cloud Run's front end, the same value for every caller. The per-IP ceiling would have been a global one, and /coach-builder/avatar would have started returning 429 to everybody after a handful of builds. That's the funnel this endpoint exists to serve, so it would have been a bad failure. Now keyed on the left-most X-Forwarded-For entry.

saveSelectedAvatar stays deleted. It was removed in #45, just before this landed. Restoring it behind resolveCaller() and isCoachOwner() does fix the IDOR, but Terraform gives this directory one entry_point and it isn't that one — so it's unreachable code on a write path, one Terraform line from being live. Both helpers stay, so bringing saving back is small: give it an entry_point and a caller in the same PR.

AVATAR_STYLES moved to the top-level require instead of a lazy one inside the 400 branch.

Added mobile/e2e/avatar-auth-probe.mjs — 25 checks over the authorization matrix, which #44 asked for. It loads the real index.js with ./avatar-generation replaced by a recording stub (the technique crisis-probe.mjs uses on openai), so it spends no Replicate credits and can assert the load-bearing part: a rejected call reaches generation zero times. A 403 that still burned a credit looks identical from the outside. Supabase is deliberately not stubbed — token verification and the ownership lookup run against a real stack.

I checked the probe can actually fail: disabling isCoachOwner() and the temp- prefix check turns 25/0 into 18/7, including an anonymous caller generating against a real coach id.

Two of your choices I verified rather than assumed: style defaults to 'Realistic' in AvatarUpload.jsx, so requiring it doesn't break the builder; and user_id is the right ownership column — it's what CoachDashboard already filters on. The RLS policy also honours a user_email match, but both save paths set user_id, so the narrower check is correct in practice.

Unrelated but found while verifying this: function-gateway.js was reading replicate_api_key unconditionally, so every local viz-realtime-probe.mjs run was making real billed predictions. Gated behind USE_REAL_REPLICATE=1 in the last commit.

Verified: 403 checks green across eight probe suites, plus crisis-probe 143.