convex-security-audit

name	convex-security-audit
displayName	Convex Security Audit
description	Deep security review patterns for authorization logic, data access boundaries, action isolation, rate limiting, and protecting sensitive operations
version	1.0.0
author	Convex
tags	["convex","security","audit","authorization","rate-limiting","protection"]

Convex Security Audit

Comprehensive security review patterns for Convex applications including authorization logic, data access boundaries, action isolation, rate limiting, and protecting sensitive operations.

Documentation Sources

Before implementing, do not assume; fetch the latest documentation:

• Primary: https://docs.convex.dev/auth/functions-auth
• Production Security: https://docs.convex.dev/production
• For broader context: https://docs.convex.dev/llms.txt

Instructions

Security Audit Areas

1. Authorization Logic - Who can do what
2. Data Access Boundaries - What data users can see
3. Action Isolation - Protecting external API calls
4. Rate Limiting - Preventing abuse
5. Sensitive Operations - Protecting critical functions

Authorization Logic Audit

Role-Based Access Control (RBAC)

// convex/lib/auth.ts
import { QueryCtx, MutationCtx } from "./_generated/server";
import { ConvexError } from "convex/values";
import { Doc } from "./_generated/dataModel";

type UserRole = "user" | "moderator" | "admin" | "superadmin";

const roleHierarchy: Record<UserRole, number> = {
  user: 0,
  moderator: 1,
  admin: 2,
  superadmin: 3,
};

export async function getUser(ctx: QueryCtx | MutationCtx): Promise<Doc<"users"> | null> {
  const identity = await ctx.auth.getUserIdentity();
  if (!identity) return null;
  
  return await ctx.
    .()
    .(,  
      q.(, identity.)
    )
    .();
}

   (): <<>> {
   user =  (ctx);
  
   (!user) {
      ({
      : ,
      : ,
    });
  }
  
   userRoleLevel = roleHierarchy[user.  ] ?? ;
   requiredLevel = roleHierarchy[minRole];
  
   (userRoleLevel < requiredLevel) {
      ({
      : ,
      : ,
    });
  }
  
   user;
}


  =  |  |  | ;

 : <, []> = {
  : [],
  : [, ],
  : [, , ],
  : [, , , ],
};

   (): <<>> {
   user =  (ctx);
  
   (!user) {
      ({ : , :  });
  }
  
   userRole = user.  ;
   permissions = rolePermissions[userRole] ?? [];
  
   (!permissions.(permission)) {
      ({
      : ,
      : ,
    });
  }
  
   user;
}

Data Access Boundaries Audit

// convex/data.ts
import { query, mutation } from "./_generated/server";
import { v } from "convex/values";
import { getUser, requireRole } from "./lib/auth";
import { ConvexError } from "convex/values";

// Audit: Users can only see their own data
export const getMyData = query({
  args: {},
  returns: v.array(v.object({
    _id: v.id("userData"),
    content: v.string(),
  })),
  handler: async (ctx) => {
    const user = await getUser(ctx);
    if (!user) return [];
    
    // SECURITY: Filter by userId
    return await ctx.db
      .query("userData")
      .withIndex("by_user", (q) => q.eq("userId", user._id))
      .collect();
  },
});

// Audit: Verify ownership before returning sensitive data
export  getSensitiveItem = ({
  : { : v.() },
  : v.(v.({
    : v.(),
    : v.(),
  }), v.()),
  :  (ctx, args) => {
     user =  (ctx);
     (!user)  ;
    
     item =  ctx..(args.);
    
    
     (!item || item. !== user.) {
       ; 
    }
    
     item;
  },
});


  getSharedDocument = ({
  : { : v.() },
  : v.(v.({
    : v.(),
    : v.(),
    : v.(),
  }), v.()),
  :  (ctx, args) => {
     user =  (ctx);
     doc =  ctx..(args.);
    
     (!doc)  ;
    
    
     (doc. === ) {
       { ...doc, :  };
    }
    
    
     (!user)  ;
    
    
     (doc. === user.) {
       { ...doc, :  };
    }
    
    
     access =  ctx.
      .()
      .(,  
        q.(, args.).(, user.)
      )
      .();
    
     (!access)  ;
    
     { ...doc, : access. };
  },
});

Action Isolation Audit

// convex/actions.ts
"use node";

import { action, internalAction } from "./_generated/server";
import { v } from "convex/values";
import { api, internal } from "./_generated/api";
import { ConvexError } from "convex/values";

// SECURITY: Never expose API keys in responses
export const callExternalAPI = action({
  args: { query: v.string() },
  returns: v.object({ result: v.string() }),
  handler: async (ctx, args) => {
    // Verify user is authenticated
    const identity = await ctx.auth.getUserIdentity();
    if (!identity) {
      throw new ConvexError("Authentication required");
    }
    
    // Get API key from environment (not hardcoded)
    const apiKey = process.env.EXTERNAL_API_KEY;
    if (!apiKey) {
      throw new Error("API key not configured");
    }
    
    // Log usage for audit trail
     ctx.(internal.., {
      : identity.,
      : ,
      : .(),
    });
    
     response =  (, {
      : ,
      : {
        : ,
        : ,
      },
      : .({ : args. }),
    });
    
     (!response.) {
      
        ();
    }
    
     data =  response.();
    
    
     { : (data) };
  },
});


  _processPayment = ({
  : {
    : v.(),
    : v.(),
    : v.(),
  },
  : v.({ : v.(), : v.(v.()) }),
  :  (ctx, args) => {
     stripeKey = process..;
    
    
    
    
     { : , :  };
  },
});

Rate Limiting Audit

// convex/rateLimit.ts
import { mutation, query } from "./_generated/server";
import { v } from "convex/values";
import { ConvexError } from "convex/values";

const RATE_LIMITS = {
  message: { requests: 10, windowMs: 60000 }, // 10 per minute
  upload: { requests: 5, windowMs: 300000 },  // 5 per 5 minutes
  api: { requests: 100, windowMs: 3600000 },  // 100 per hour
};

export const checkRateLimit = mutation({
  args: {
    userId: v.string(),
    action: v.union(v.literal("message"), v.literal("upload"), v.literal("api")),
  },
  returns: v.object({ allowed: v.boolean(), retryAfter: v.optional(v.number()) }),
  :  (ctx, args) => {
     limit = [args.];
     now = .();
     windowStart = now - limit.;
    
    
     requests =  ctx.
      .()
      .(,  
        q.(, args.).(, args.)
      )
      .( q.(q.(), windowStart))
      .();
    
     (requests. >= limit.) {
       oldestRequest = requests[];
       retryAfter = oldestRequest. + limit. - now;
      
       { : , retryAfter };
    }
    
    
     ctx..(, {
      : args.,
      : args.,
      : now,
    });
    
     { :  };
  },
});


  sendMessage = ({
  : { : v.() },
  : v.(),
  :  (ctx, args) => {
     identity =  ctx..();
     (!identity)   ();
    
    
     rateCheck =  (ctx, {
      : identity.,
      : ,
    });
    
     (!rateCheck.) {
        ({
        : ,
        : ,
      });
    }
    
      ctx..(, {
      : args.,
      : identity.,
      : .(),
    });
  },
});

Sensitive Operations Protection

// convex/admin.ts
import { mutation, internalMutation } from "./_generated/server";
import { v } from "convex/values";
import { requireRole, requirePermission } from "./lib/auth";
import { internal } from "./_generated/api";

// Two-factor confirmation for dangerous operations
export const deleteAllUserData = mutation({
  args: {
    userId: v.id("users"),
    confirmationCode: v.string(),
  },
  returns: v.null(),
  handler: async (ctx, args) => {
    // Require superadmin
    const admin = await requireRole(ctx, "superadmin");
    
    // Verify confirmation code
    const confirmation = await ctx.db
      .query("confirmations")
      .withIndex("by_admin_and_code", (q) => 
        q.eq("adminId", admin._id).eq("code", args.confirmationCode)
      )
      .filter( q.(q.(), .()))
      .();
    
     (!confirmation || confirmation. !== ) {
        ();
    }
    
    
     ctx..(confirmation.);
    
    
     ctx..(, internal.., {
      : args.,
      : admin.,
    });
    
    
     ctx..(, {
      : ,
      : args.,
      : admin.,
      : .(),
    });
    
     ;
  },
});


  requestDeletionConfirmation = ({
  : { : v.() },
  : v.(),
  :  (ctx, args) => {
     admin =  (ctx, );
    
     code = ();
    
     ctx..(, {
      : admin.,
      code,
      : ,
      : args.,
      : .() +  *  * , 
    });
    
    
     code;
  },
});

Examples

Complete Audit Trail System

// convex/audit.ts
import { mutation, query, internalMutation } from "./_generated/server";
import { v } from "convex/values";
import { getUser, requireRole } from "./lib/auth";

const auditEventValidator = v.object({
  _id: v.id("auditLogs"),
  _creationTime: v.number(),
  action: v.string(),
  userId: v.optional(v.string()),
  resourceType: v.string(),
  resourceId: v.string(),
  details: v.optional(v.any()),
  ipAddress: v.optional(v.string()),
  timestamp: v.number(),
});

// Internal: Log audit event
export const logEvent = internalMutation({
  args: {
    action: v.string(),
    userId: v.optional(v.string()),
    resourceType: v.string(),
    resourceId: v.string(),
    details: v.(v.()),
  },
  : v.(),
  :  (ctx, args) => {
      ctx..(, {
      ...args,
      : .(),
    });
  },
});


  getAuditLogs = ({
  : {
    : v.(v.()),
    : v.(v.()),
    : v.(v.()),
  },
  : v.(auditEventValidator),
  :  (ctx, args) => {
     (ctx, );
    
     query = ctx..();
    
     (args.) {
      query = query.(,  
        q.(, args.)
      );
    }
    
      query
      .()
      .(args. ?? );
  },
});

Best Practices

• Never run bunx convex deploy unless explicitly instructed
• Never run any git commands unless explicitly instructed
• Implement defense in depth (multiple security layers)
• Log all sensitive operations for audit trails
• Use confirmation codes for destructive actions
• Rate limit all user-facing endpoints
• Never expose internal API keys or errors
• Review access patterns regularly

Common Pitfalls

1. Single point of failure - Implement multiple auth checks
2. Missing audit logs - Log all sensitive operations
3. Trusting client data - Always validate server-side
4. Exposing error details - Sanitize error messages
5. No rate limiting - Always implement rate limits

References

• Convex Documentation: https://docs.convex.dev/
• Convex LLMs.txt: https://docs.convex.dev/llms.txt
• Functions Auth: https://docs.convex.dev/auth/functions-auth
• Production Security: https://docs.convex.dev/production