@homenshum/convex-mcp-nodebench 0.9.5 → 0.9.7

package/dist/index.js

@@ -79,7 +79,7 @@ for (const tool of ALL_TOOLS) {
 // ── Server setup ────────────────────────────────────────────────────
 const server = new Server({
     name: "convex-mcp-nodebench",
-    version: "0.9.5",
+    version: "0.9.7",
 }, {
     capabilities: {
         tools: {},

package/dist/tools/authorizationTools.js

@@ -41,6 +41,27 @@ function auditAuthorization(convexDir) {
         const content = readFileSync(filePath, "utf-8");
         const relativePath = filePath.replace(convexDir, "").replace(/^[\\/]/, "");
         const lines = content.split("\n");
+        // Pre-scan: detect local helper functions that wrap getAuthUserId/getUserIdentity
+        // Pattern: function getSafeUserId(ctx) { ... getAuthUserId(ctx) ... }
+        const authHelperNames = [];
+        const helperFuncPattern = /(?:async\s+)?function\s+(\w+)\s*\(/g;
+        let hm;
+        while ((hm = helperFuncPattern.exec(content)) !== null) {
+            const hStart = content.slice(0, hm.index).split("\n").length - 1;
+            const hBody = lines.slice(hStart, Math.min(hStart + 30, lines.length)).join("\n");
+            if (/getAuthUserId|getUserIdentity|getAuthSessionId/.test(hBody)) {
+                authHelperNames.push(hm[1]);
+            }
+        }
+        // Also check arrow function helpers: const getUserId = async (ctx) => { ... }
+        const arrowHelperPattern = /(?:const|let)\s+(\w+)\s*=\s*(?:async\s*)?\([^)]*\)\s*(?::\s*[^=]+)?\s*=>/g;
+        while ((hm = arrowHelperPattern.exec(content)) !== null) {
+            const hStart = content.slice(0, hm.index).split("\n").length - 1;
+            const hBody = lines.slice(hStart, Math.min(hStart + 20, lines.length)).join("\n");
+            if (/getAuthUserId|getUserIdentity|getAuthSessionId/.test(hBody)) {
+                authHelperNames.push(hm[1]);
+            }
+        }
         for (let i = 0; i < lines.length; i++) {
             const line = lines[i];
             for (const ft of funcTypes) {
@@ -69,10 +90,14 @@ function auditAuthorization(convexDir) {
                     }
                 }
                 const body = lines.slice(i, endLine).join("\n");
-                const hasAuthCheck = /ctx\.auth\.getUserIdentity\s*\(\s*\)/.test(body) ||
+                // Check for direct auth calls OR calls to local auth helper wrappers
+                const hasDirectAuth = /ctx\.auth\.getUserIdentity\s*\(\s*\)/.test(body) ||
                     /getUserIdentity/.test(body) ||
                     /getAuthUserId/.test(body) ||
                     /getAuthSessionId/.test(body);
+                const callsAuthHelper = authHelperNames.length > 0 &&
+                    authHelperNames.some(h => new RegExp(`\\b${h}\\s*\\(`).test(body));
+                const hasAuthCheck = hasDirectAuth || callsAuthHelper;
                 const hasDbWrite = dbWriteOps.test(body);
                 const isSensitiveName = writeSensitive.test(funcName);
                 if (hasAuthCheck) {
@@ -81,12 +106,13 @@ function auditAuthorization(convexDir) {
                     const identityAssign = body.match(/(?:const|let)\s+(\w+)\s*=\s*await\s+ctx\.auth\.getUserIdentity\s*\(\s*\)/);
                     if (identityAssign) {
                         const varName = identityAssign[1];
-                        // Recognize: if (!var), if (var === null), if (var), var &&, var ?, throw on !var
-                        const hasNullCheck = new RegExp(`if\\s*\\(\\s*!${varName}\\b|if\\s*\\(\\s*${varName}\\s*===?\\s*null|if\\s*\\(\\s*${varName}\\s*\\)|${varName}\\s*&&|${varName}\\s*\\?|throw.*!${varName}|${varName}\\s*!==?\\s*null`).test(body);
+                        // Recognize: if (!var), if (var === null), if (var), var &&, var ?, throw on !var, comparisons
+                        const hasNullCheck = new RegExp(`if\\s*\\(\\s*!${varName}\\b|if\\s*\\(\\s*${varName}\\s*===?\\s*null|if\\s*\\(\\s*${varName}\\s*\\)|${varName}\\s*&&|${varName}\\s*\\?|throw.*!${varName}|${varName}\\s*!==?\\s*null|===\\s*${varName}|!==\\s*${varName}`).test(body);
                         if (!hasNullCheck) {
                             uncheckedIdentity++;
+                            // Queries can intentionally return different data for auth/unauth — warning not critical
                             issues.push({
-                                severity: "critical",
+                                severity: ft === "query" ? "warning" : "critical",
                                 location: `${relativePath}:${i + 1}`,
                                 functionName: funcName,
                                 message: `${ft} "${funcName}" calls getUserIdentity() but doesn't check for null. Unauthenticated users will get undefined identity.`,
@@ -98,12 +124,13 @@ function auditAuthorization(convexDir) {
                     const authUserAssign = body.match(/(?:const|let)\s+(\w+)\s*=\s*await\s+getAuthUserId\s*\(/);
                     if (authUserAssign) {
                         const varName = authUserAssign[1];
-                        // Recognize: if (!var), if (var === null), if (var), var &&, var ?, throw on !var
-                        const hasNullCheck = new RegExp(`if\\s*\\(\\s*!${varName}\\b|if\\s*\\(\\s*${varName}\\s*===?\\s*null|if\\s*\\(\\s*${varName}\\s*\\)|${varName}\\s*&&|${varName}\\s*\\?|throw.*!${varName}|${varName}\\s*!==?\\s*null`).test(body);
+                        // Recognize: if (!var), if (var === null), if (var), var &&, var ?, throw on !var, comparisons
+                        const hasNullCheck = new RegExp(`if\\s*\\(\\s*!${varName}\\b|if\\s*\\(\\s*${varName}\\s*===?\\s*null|if\\s*\\(\\s*${varName}\\s*\\)|${varName}\\s*&&|${varName}\\s*\\?|throw.*!${varName}|${varName}\\s*!==?\\s*null|===\\s*${varName}|!==\\s*${varName}`).test(body);
                         if (!hasNullCheck) {
                             uncheckedIdentity++;
+                            // Queries can intentionally return different data for auth/unauth — warning not critical
                             issues.push({
-                                severity: "critical",
+                                severity: ft === "query" ? "warning" : "critical",
                                 location: `${relativePath}:${i + 1}`,
                                 functionName: funcName,
                                 message: `${ft} "${funcName}" calls getAuthUserId() but doesn't check for null. Unauthenticated users will get null userId.`,

package/dist/tools/functionTools.js

@@ -76,8 +76,11 @@ function auditFunctions(convexDir) {
         if (fn.type === "httpAction")
             continue; // httpActions don't have args/returns validators
         if (!fn.hasArgs) {
+            // Public mutations/actions without args validators are a security concern (unvalidated client input)
+            // Queries and internal functions: just a best-practice recommendation
+            const isSecurity = !fn.isInternal && (fn.type === "mutation" || fn.type === "action");
             issues.push({
-                severity: "critical",
+                severity: isSecurity ? "critical" : "warning",
                 location: `${fn.relativePath}:${fn.line}`,
                 functionName: fn.name,
                 message: `${fn.type} "${fn.name}" is missing args validator`,
@@ -94,8 +97,9 @@ function auditFunctions(convexDir) {
             });
         }
         if (!fn.hasHandler) {
+            // Old shorthand syntax (query(async (ctx) => {})) works fine — just a style recommendation
             issues.push({
-                severity: "critical",
+                severity: "warning",
                 location: `${fn.relativePath}:${fn.line}`,
                 functionName: fn.name,
                 message: `${fn.type} "${fn.name}" is missing handler property (may be using old syntax)`,
@@ -284,7 +288,7 @@ export const functionTools = [
             const functions = extractFunctions(convexDir);
             // Store audit result
             const db = getDb();
-            db.prepare("INSERT INTO audit_results (id, project_dir, audit_type, issues_json, issue_count) VALUES (?, ?, ?, ?, ?)").run(genId("audit"), projectDir, "function_audit", JSON.stringify(issues), issues.length);
+            db.prepare("INSERT INTO audit_results (id, project_dir, audit_type, issues_json, issue_count) VALUES (?, ?, ?, ?, ?)").run(genId("audit"), projectDir, "functions", JSON.stringify(issues), issues.length);
             const critical = issues.filter((i) => i.severity === "critical");
             const warnings = issues.filter((i) => i.severity === "warning");
             // Aggregate issues by category for cleaner output

package/dist/tools/reportingTools.js

@@ -75,7 +75,7 @@ function buildSarif(projectDir, auditTypes, limit) {
                 tool: {
                     driver: {
                         name: "convex-mcp-nodebench",
-                        version: "0.9.5",
+                        version: "0.9.7",
                         informationUri: "https://www.npmjs.com/package/@homenshum/convex-mcp-nodebench",
                         rules: [...rulesMap.values()],
                     },

package/dist/tools/storageAuditTools.js

@@ -133,7 +133,7 @@ export const storageAuditTools = [
             }
             const { issues, stats } = auditStorageUsage(convexDir);
             const db = getDb();
-            db.prepare("INSERT INTO audit_results (id, project_dir, audit_type, issues_json, issue_count) VALUES (?, ?, ?, ?, ?)").run(genId("audit"), projectDir, "storage_usage", JSON.stringify(issues), issues.length);
+            db.prepare("INSERT INTO audit_results (id, project_dir, audit_type, issues_json, issue_count) VALUES (?, ?, ?, ?, ?)").run(genId("audit"), projectDir, "storage", JSON.stringify(issues), issues.length);
             return {
                 summary: {
                     ...stats,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homenshum/convex-mcp-nodebench",
-  "version": "0.9.5",
+  "version": "0.9.7",
   "description": "Convex-specific MCP server applying NodeBench self-instruct diligence patterns to Convex development. Schema audit, function compliance, deployment gates, persistent gotcha DB, and methodology guidance. Complements Context7 (raw docs) and official Convex MCP (deployment introspection) with structured verification workflows.",
   "type": "module",
   "bin": {