convex-security-check

Check ctx.auth.getUserIdentity() at the start of every sensitive query or mutation and throw a ConvexError if no identity exists. Wrap this in a reusable requireAuth helper so all protected functions enforce authentication consistently.

Public functions declared with query, mutation, or action are callable directly from clients, while internalQuery, internalMutation, and internalAction can only be invoked from other Convex functions. Sensitive operations like role changes should always use internal variants.

Fetch the document by ID, compare its owner field against the authenticated user's identity, and throw a ConvexError if they do not match. Apply this ownership check before every update and delete operation.

v.any() accepts arbitrary client-supplied data, allowing attackers to inject unexpected fields into database inserts. Use explicit validators like v.string(), v.id("table"), and v.union() so only intended shapes pass validation.

Store API keys in Convex environment variables and access them via process.env only inside actions, never in queries or mutations. Use different keys for development and production deployments and never commit secrets to code.