fix(auth): don't treat infra outages as "not authenticated"

[felirami]

Problem

isAuthenticated() wrapped token verification and the Privy/DB user lookup in one try/catch that returned { authenticated: false } on any error. So a transient Railway Postgres or Privy blip made every data route report "not authenticated":

• the timeline goes empty, and
• worse, /api/user/state returns a 200 guest payload on !authenticated, so the client successfully receives a "you're a guest" response and silently demotes a signed-in user into guest / connect-account onboarding — which, on shared dev == prod data, can write duplicate records to production.

This was the #1 item on the hardening roadmap (root cause of the 2026-05-30 "timeline not showing" incident).

Fix

Split the check into two stages with a shared error classifier ('auth' | 'infra' | 'unknown'):

• Stage 1 — token verification: a bad/expired/missing token still returns { authenticated: false } → real 401, unchanged. A recognised infra error (network / JWKS-timeout / 5xx while the SDK fetches the signing key on a cold instance) is surfaced instead.
• Stage 2 — Privy getUser + DB lookup: an outage throws a typed AuthInfrastructureError (HTTP 503) instead of masquerading as "not authenticated". Only a Privy 4xx rejection returns { authenticated: false }.

Per-stage defaults match each stage's common failure (bad token vs. dependency down), so genuine auth failures are never turned into 503s and vice-versa.

Surfacing it

• New AuthInfrastructureError + authInfraResponse() helper + a reusable withAuthInfra() wrapper.
• The timeline-critical read routes — user/state, feed, notifications — now return a retryable 503 (Retry-After) on infra failure instead of a false 401 / silent guest.
• The remaining ~110 callers need no edit: a transient outage now surfaces as an honest 500 (retryable, never a false 401). A shared wrapper is in place to widen 503 coverage later.
• New auth_infra_error PostHog event to separate outages from token failures.
• .gitignore hardened against accidental credential-file commits.

Verification

• npm run typecheck ✅ and npm run build ✅ (both CI hard gates).
• Adversarial review across all 114 isAuthenticated callers: 0 routes re-mask the new throw as a 401/guest-200 (user/state was the only guest-emitter and is fixed); every other catch returns an error status.

Known follow-ups (not in this PR)

• user/state's second Prisma query (the include lookup) is outside the auth gate, so a DB blip there → 500 not 503. Honest and non-demoting.
• Optional: a client-side degraded/retry state in SupercastUserStateProvider, and an axios Retry-After interceptor, to fully exploit the 503s.
• The infra-failure path can't be safely exercised on shared prod data, so this relies on the type/build gates + review rather than a live E2E.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
castora	Ready	Preview, Comment	Jun 22, 2026 10:18am