signaldesk-enable-auth

# Enable auth in SignalDesk SignalDesk ships with auth off so it runs with zero config. Use this skill to add Convex Auth. The default path uses the Password provider so no OAuth keys are needed. Follow `docs/AUTH.md` in the repo as the source of truth and keep changes minimal. ## Before you start Confirm with the user: 1. Provider: Password (default, no keys) or an OAuth provider like GitHub or Google (needs client id and secret). 2. Whether all functions should require sign in, or only some. ## Steps 1. Install packages: ```bash npm install @convex-dev/auth @auth/core ``` 2. Run the auth setup helper to generate keys and env vars: ```bash npx @convex-dev/auth ``` 3. Create `convex/auth.ts` exporting `convexAuth` with the chosen provider. 4. Spread `authTables` into `convex/schema.ts`. 5. Add `auth.addHttpRoutes(http)` in `convex/http.ts`, keeping the existing `registerStaticRoutes` call. 6. Swap `ConvexProvider` for `ConvexAuthProvider` in `src/main.tsx`. 7. Add a sign in form gated by `<Authenticated>` and `<Unauthenticated>`. 8. Protect Convex functions with `getAuthUserId(ctx)` where needed. 9. Set `VITE_AUTH_ENABLED=true` in `.env.local`. ## Rules - Keep argument and return validators on every Convex function. - Do not store secrets in the database or in frontend env files. OAuth secrets go in Convex env vars via `npx convex env set`. - Run `npm run typecheck` and `npm run lint` after wiring it up. - Verify: sign up, sign out, sign in, and confirm a protected function rejects an unauthenticated call. ## References - docs/AUTH.md in this repo - https://labs.convex.dev/auth - https://labs.convex.dev/auth/setup - https://docs.convex.dev/auth/functions-auth