convex-authz
Audit and harden a Convex app's authorization: identity-from-arg impersonation
by get-convexFree
Description
convex-authz is an agent skill for auditing and hardening the authorization of a Convex app. It is a focused specialist for four shapes of defect: functions that take a user or actor ID as an argument and trust it, missing per-document ownership checks, public queries that leak data through an argument, and the parent-reference variant of the ownership problem on writes. The skill first runs a deterministic regex-based scan over the convex/ files, then applies the requireIdentity and requireOwner hardening pattern from the convex-expert documentation to each finding, and verifies the result with the TypeScript compiler. It does not invent a new pattern. Before adding any checks, the skill requires that the app already has an auth foundation: an auth.config.ts with a provider and a users table keyed to the auth subject. If either is missing, adding checks would not work, so the skill instead converts privileged public functions to internal ones and tells the user to set up authentication first. The skill is part of the get-convex agent-skills repository and is added to a compatible agent with the skills command. Its audits passed with Gen Agent Trust Hub, Socket and Snyk.…
Highlights
- Scans for identity-from-argument impersonation
- Finds missing per-document ownership checks
- Applies requireIdentity and requireOwner hardening
- Checks the auth foundation first
Ratings & Reviews
No ratings yet
Be the first to rate convex-authz.
People also visit
convex-authz FAQ
What does convex-authz do?
It audits a Convex app for authorization defects and hardens them with ownership and identity checks.
What defects does it look for?
Identity taken from an argument, missing ownership checks, public queries that leak data through arguments, and the parent-reference variant on writes.
When will it not add checks?
When the app has no auth foundation, meaning no auth.config.ts with a provider and no users table keyed to the auth subject. Then it moves privileged functions to internal ones and asks you to set up auth first.
How does it verify the changes?
It runs the TypeScript compiler after the hardening.
How do I install it?
Run: npx skills add https://github.com/get-convex/agent-skills --skill convex-authz
What security audits has it passed?
Gen Agent Trust Hub, Socket and Snyk all passed.
What are the best convex-authz alternatives?
Popular alternatives to convex-authz include convex-verify, access and convex-auth. See all convex-authz alternatives