convex-security-audit

Create a role hierarchy mapping roles to numeric levels, then write a requireRole helper that fetches the authenticated user via ctx.auth.getUserIdentity and throws a ConvexError when their role level is insufficient. Permission-based checks can map roles to allowed actions for finer control.

Store request timestamps in a rateLimits table indexed by user and action, then count entries within the time window before executing the mutation. If the count exceeds the limit, throw a ConvexError with a retryAfter value so clients know when to retry.

Store keys in environment variables accessed via process.env, never hardcode them or return them in responses. Use internalAction for sensitive operations like payments so they cannot be called directly from clients, and sanitize external API errors before returning.

Yes, use an internalMutation to insert events into an auditLogs table recording the action, user, resource, and timestamp. Restrict log viewing to admin roles with requireRole, and log every destructive or privileged operation for accountability.

Confirmation codes prevent accidental or unauthorized destructive operations like deleting all user data. Generate a short-lived code, require it in the mutation, delete it after use to prevent replay, and schedule the actual deletion via the scheduler with an audit log entry.