convex-authz

Convex Authz Auditor/Hardener

Audit and harden a Convex app's authorization against the single largest real-defect cluster measured against generated Convex backends (44 of 214 confirmed defects): identity trusted from a client-supplied argument instead of ctx.auth, missing per-document ownership checks, and public queries that leak PII/financial data by a client-supplied id. SKIP if there's no convex/ directory.

Steps

1. Scan every convex/**/*.ts (skip _generated/ and .d.ts) for the 3 shapes:
   • Identity-from-arg: a public query(/mutation( whose args declares userId/actorId/ownerId/authorId/accountId typed v.id(...), with zero ctx.auth reference anywhere in the function block.
   • Missing ownership check: a handler that loads a doc via ctx.db.get(args.xId) and then patches/deletes/replaces it (or returns its fields) with no comparison against an authenticated identity.
   • PII-leaking query: a public query returning sensitive fields (email, revenue, audit logs, dashboards) parameterized by a client-supplied id with no ctx.auth gating. Report every hit with file:line before touching anything.
2. Harden each hit using the canonical pattern (do not invent a new one):

   // convex/model/auth.ts
   export async function requireIdentity(ctx) {
     const identity = await ctx.auth.getUserIdentity();
     if (!identity) throw new Error("401: not signed in");
     return identity;
   }
   export async function requireOwner(ctx, doc) {
     if (!doc) throw new Error("404: not found");
     const identity = await requireIdentity(ctx);
     if (doc.ownerId !== identity.subject) throw new Error("403: forbidden");
     return doc;
   }
   

   Replace client-supplied identity args with requireIdentity(ctx); wrap every _id-keyed read/mutate with requireOwner(ctx, await ctx.db.get(args.xId)); scope PII-returning queries the same way. Leave genuinely internal/admin functions as internalQuery/internalMutation and unflagged.
3. Verify with npx tsc --noEmit (or the project's typecheck script), then re-run the scan to confirm 0 remaining hits.
4. Report findings grouped by shape, with file:line, why each is exploitable, and the concrete diff applied.