convex-security-check

Secure Convex functions by calling ctx.auth.getUserIdentity() at the start of every handler and throwing a ConvexError when the identity is null. Then verify the requesting user owns the target document before any update or delete operation.

Public functions declared with query, mutation, or action are callable directly from clients, while internalQuery, internalMutation, and internalAction can only be invoked from other Convex functions. Sensitive operations like role changes or credit updates should always use internal variants.

v.any() accepts arbitrary client-supplied data without structure checks, allowing attackers to inject unexpected fields into database inserts. Replace it with explicit validators like v.string(), v.id("table"), or v.union of literals for every argument.

Fetch the target document with ctx.db.get, then compare its userId field against the authenticated identity's tokenIdentifier before patching or deleting. Throw a ConvexError when ownership does not match so unauthorized requests are rejected.

Store API keys in Convex environment variables and access them via process.env only inside actions, never in queries or mutations. Use different keys for development and production deployments and never hardcode secrets in source code.