convex-security-audit
installsforks
How to install convex-security-audit?
waynesutton/convexskills/convex-security-audit
$npx -y skills add waynesutton/convexskills --skill convex-security-auditDeep security review patterns for authorization logic, data access boundaries, action isolation, rate limiting, and protecting sensitive operations
SKILL.md
| 1 | # Convex Security Audit |
| 2 | |
| 3 | Comprehensive security review patterns for Convex applications including authorization logic, data access boundaries, action isolation, rate limiting, and protecting sensitive operations. |
| 4 | |
| 5 | ## Documentation Sources |
| 6 | |
| 7 | Before implementing, do not assume; fetch the latest documentation: |
| 8 | |
| 9 | - Primary: https://docs.convex.dev/auth/functions-auth |
| 10 | - Production Security: https://docs.convex.dev/production |
| 11 | - For broader context: https://docs.convex.dev/llms.txt |
| 12 | |
| 13 | ## Instructions |
| 14 | |
| 15 | ### Security Audit Areas |
| 16 | |
| 17 | 1. **Authorization Logic** - Who can do what |
| 18 | 2. **Data Access Boundaries** - What data users can see |
| 19 | 3. **Action Isolation** - Protecting external API calls |
| 20 | 4. **Rate Limiting** - Preventing abuse |
| 21 | 5. **Sensitive Operations** - Protecting critical functions |
| 22 | |
| 23 | ### Authorization Logic Audit |
| 24 | |
| 25 | #### Role-Based Access Control (RBAC) |
| 26 | |
| 27 | ```typescript |
| 28 | // convex/lib/auth.ts |
| 29 | import { QueryCtx, MutationCtx } from "./_generated/server"; |
| 30 | import { ConvexError } from "convex/values"; |
| 31 | import { Doc } from "./_generated/dataModel"; |
| 32 | |
| 33 | type UserRole = "user" | "moderator" | "admin" | "superadmin"; |
| 34 | |
| 35 | const roleHierarchy: Record<UserRole, number> = { |
| 36 | user: 0, |
| 37 | moderator: 1, |
| 38 | admin: 2, |
| 39 | superadmin: 3, |
| 40 | }; |
| 41 | |
| 42 | export async function getUser(ctx: QueryCtx | MutationCtx): Promise<Doc<"users"> | null> { |
| 43 | const identity = await ctx.auth.getUserIdentity(); |
| 44 | if (!identity) return null; |
| 45 | |
| 46 | return await ctx.db |
| 47 | .query("users") |
| 48 | .withIndex("by_tokenIdentifier", (q) => |
| 49 | q.eq("tokenIdentifier", identity.tokenIdentifier) |
| 50 | ) |
| 51 | .unique(); |
| 52 | } |
| 53 | |
| 54 | export async function requireRole( |
| 55 | ctx: QueryCtx | MutationCtx, |
| 56 | minRole: UserRole |
| 57 | ): Promise<Doc<"users">> { |
| 58 | const user = await getUser(ctx); |
| 59 | |
| 60 | if (!user) { |
| 61 | throw new ConvexError({ |
| 62 | code: "UNAUTHENTICATED", |
| 63 | message: "Authentication required", |
| 64 | }); |
| 65 | } |
| 66 | |
| 67 | const userRoleLevel = roleHierarchy[user.role as UserRole] ?? 0; |
| 68 | const requiredLevel = roleHierarchy[minRole]; |
| 69 | |
| 70 | if (userRoleLevel < requiredLevel) { |
| 71 | throw new ConvexError({ |
| 72 | code: "FORBIDDEN", |
| 73 | message: `Role '${minRole}' or higher required`, |
| 74 | }); |
| 75 | } |
| 76 | |
| 77 | return user; |
| 78 | } |
| 79 | |
| 80 | // Permission-based check |
| 81 | type Permission = "read:users" | "write:users" | "delete:users" | "admin:system"; |
| 82 | |
| 83 | const rolePermissions: Record<UserRole, Permission[]> = { |
| 84 | user: ["read:users"], |
| 85 | moderator: ["read:users", "write:users"], |
| 86 | admin: ["read:users", "write:users", "delete:users"], |
| 87 | superadmin: ["read:users", "write:users", "delete:users", "admin:system"], |
| 88 | }; |
| 89 | |
| 90 | export async function requirePermission( |
| 91 | ctx: QueryCtx | MutationCtx, |
| 92 | permission: Permission |
| 93 | ): Promise<Doc<"users">> { |
| 94 | const user = await getUser(ctx); |
| 95 | |
| 96 | if (!user) { |
| 97 | throw new ConvexError({ code: "UNAUTHENTICATED", message: "Authentication required" }); |
| 98 | } |
| 99 | |
| 100 | const userRole = user.role as UserRole; |
| 101 | const permissions = rolePermissions[userRole] ?? []; |
| 102 | |
| 103 | if (!permissions.includes(permission)) { |
| 104 | throw new ConvexError({ |
| 105 | code: "FORBIDDEN", |
| 106 | message: `Permission '${permission}' required`, |
| 107 | }); |
| 108 | } |
| 109 | |
| 110 | return user; |
| 111 | } |
| 112 | ``` |
| 113 | |
| 114 | ### Data Access Boundaries Audit |
| 115 | |
| 116 | ```typescript |
| 117 | // convex/data.ts |
| 118 | import { query, mutation } from "./_generated/server"; |
| 119 | import { v } from "convex/values"; |
| 120 | import { getUser, requireRole } from "./lib/auth"; |
| 121 | import { ConvexError } from "convex/values"; |
| 122 | |
| 123 | // Audit: Users can only see their own data |
| 124 | export const getMyData = query({ |
| 125 | args: {}, |
| 126 | returns: v.array(v.object({ |
| 127 | _id: v.id("userData"), |
| 128 | content: v.string(), |
| 129 | })), |
| 130 | handler: async (ctx) => { |
| 131 | const user = await getUser(ctx); |
| 132 | if (!user) return []; |
| 133 | |
| 134 | // SECURITY: Filter by userId |
| 135 | return await ctx.db |
| 136 | .query("userData") |
| 137 | .withIndex("by_user", (q) => q.eq("userId", user._id)) |
| 138 | .collect(); |
| 139 | }, |
| 140 | }); |
| 141 | |
| 142 | // Audit: Verify ownership before returning sensitive data |
| 143 | export const getSensitiveItem = query({ |
| 144 | args: { itemId: v.id("sensitiveItems") }, |
| 145 | returns: v.union(v.object({ |
| 146 | _id: v.id("sensitiveItems"), |
| 147 | secret: v.string(), |
| 148 | }), v.null()), |
| 149 | handler: async (ctx, args) => { |
| 150 | const user = await getUser(ctx); |
| 151 | if (!user) return null; |
| 152 | |
| 153 | const item = await ctx.db.get(args.itemId); |
| 154 | |
| 155 | // SECURITY: Verify ownership |
| 156 | if (!item || item.ownerId !== user._id) { |
| 157 | return null; // Don't reveal if item exists |
| 158 | } |
| 159 | |
| 160 | return item; |
| 161 | }, |
| 162 | }); |
| 163 | |
| 164 | // Audit: Shared resources with access list |
| 165 | export const getSharedDocument = query({ |
| 166 | args: { docId: v.id("documents") }, |
| 167 | returns: v.union(v.object({ |
| 168 | _id: v.id("documents"), |
| 169 | content: v.string(), |
| 170 | accessLevel: v.string(), |
| 171 | }), v.null()), |
| 172 | handler: async (ctx, args) => { |
| 173 | const user = await getUser(ct |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
