```ruby
# frozen_string_literal: true

module V1
  class ChallengePostsController < ApiController
    USER_AUTH = { except: %i[index] }.freeze
    include UserAuth

    def index
      authenticate_user if request.headers.include? 'Authorization'

      posts = Challenge
              .eager_load(
                posts: [
                  :creator,
                  { upvotes: [:user] }
                ]
              )
              .find(params[:challenge_id])
              .posts

      render_success posts
    end

    def create
      post = ChallengePost.new(post_params)
      post.challenge = Challenge.find(params[:challenge_id])
      post.creator = current_user

      if post.save
        render_success post, 201
      else
        render_field_errors post.errors
      end
    end

    private

    def post_params
      params.permit(:name, :url, :description)
    end
  end
end
```

Make sure we don't double render if auth fails
user
```ruby
# frozen_string_literal: true

module V1
  class ChallengePostsController < ApiController
    USER_AUTH = { except: %i[index] }.freeze
    include UserAuth

    def index
      authenticate_user if request.headers.include? 'Authorization'
      return if performed? # make sure we don't double render if auth failed

      posts = Challenge
              .eager_load(
                posts: [
                  :creator,
                  { upvotes: [:user] }
                ]
              )
              .find(params[:challenge_id])
              .posts

      render_success posts
    end

    def create
      post = ChallengePost.new(post_params)
      post.challenge = Challenge.find(params[:challenge_id])
      post.creator = current_user

      if post.save
        render_success post, 201
      else
        render_field_errors post.errors
      end
    end

    private

    def post_params
      params.permit(:name, :url, :description)
    end
  end
end
```
assistant