fix(convex): add type safety and security improvements

[salimmohamed]

Summary

• Convert destructive operations (deleteAll, removeDuplicates, deleteByAddress, seedInsiderCases) to internal mutations (except markets.deleteAll which is used by API routes)
• Add returns validators to all Convex functions for better API contracts
• Replace v.any() with typed validators in schema and functions:
  • evidence.metrics now has typed fields
  • toolCalls.input/output now have typed fields
  • activityFeed.payload now has typed fields
• Fix deprecated crons.daily() helper → use crons.cron() with cron expression
• Add empty args object {} to all crons.interval() calls for consistency

Security Improvements

• Destructive operations now require internal access (can only be called from other Convex functions, not directly from clients)
• Added TODO comment on markets.deleteAll for future auth implementation

Test plan

• Verify build passes
• Test that queries still work correctly on the frontend
• Verify cron jobs execute as expected
• Check that alerts can still be created with the new typed evidence

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
colorstackwinterhack2025-argus	Ready	Preview, Comment	Jan 22, 2026 6:23am

[greptile-apps]

Greptile Overview

Greptile Summary

Improved type safety across Convex functions by replacing v.any() with typed validators and adding return type validators to all functions. Most destructive operations were properly secured by converting to internal mutations.

• Replaced v.any() with typed validators in schema and functions for evidence.metrics, toolCalls.input/output, and activityFeed.payload
• Added returns validators to all Convex functions for better API contracts
• Converted destructive operations (deleteAll, removeDuplicates, deleteByAddress, seedInsiderCases) to internal mutations
• Fixed deprecated crons.daily() helper by using crons.cron() with cron expression
• Added empty args object {} to all crons.interval() calls for consistency

Security concern: markets.deleteAll remains a regular mutation (not internal) to support the API route at src/app/api/markets/sync/route.ts, but this API route has no authentication, leaving the delete functionality publicly exposed.

Confidence Score: 3/5

• Mostly safe with one security gap: the markets delete endpoint remains publicly exposed
• Type safety improvements are excellent and thorough. Converting destructive operations to internal mutations significantly improves security for accounts, alerts, and seed functions. The cron fix addresses a deprecation issue properly. However, markets.deleteAll remains exposed as a public mutation callable by any client through an unauthenticated API route, which contradicts the PR's security goals.
• convex/markets.ts needs authentication on the deleteAll mutation or the API route needs to be secured

Important Files Changed

Filename	Overview
convex/accounts.ts	Converted destructive operations (deleteAll, removeDuplicates, deleteByAddress) to internal mutations and added comprehensive return type validators for all functions
convex/alerts.ts	Replaced v.any() with typed evidenceValidator, converted destructive operations to internal mutations, and added return type validators
convex/markets.ts	Added return type validators and TODO comment for auth on deleteAll, but function remains exposed as regular mutation without authentication
convex/schema.ts	Replaced all v.any() validators with properly typed objects for evidence metrics, tool call input/output, and activity feed payload

Sequence Diagram

sequenceDiagram
    participant Client
    participant ConvexAPI
    participant InternalMutations
    participant Database
    
    Note over Client,Database: Type-Safe Query Flow
    Client->>ConvexAPI: query with typed args
    ConvexAPI->>ConvexAPI: Validate args with v.object()
    ConvexAPI->>Database: Query data
    Database->>ConvexAPI: Return raw data
    ConvexAPI->>ConvexAPI: Validate return with validator
    ConvexAPI->>Client: Return typed response
    
    Note over Client,Database: Secure Destructive Operations
    Client->>ConvexAPI: ❌ Cannot call deleteAll directly
    Note over ConvexAPI: Internal mutations only
    
    Client->>ConvexAPI: mutation api.markets.upsert
    ConvexAPI->>ConvexAPI: Validate typed evidence.metrics
    ConvexAPI->>Database: Insert with typed payload
    Database->>ConvexAPI: Success
    ConvexAPI->>Client: Return typed ID
    
    Note over Client,Database: Admin Operations via Internal
    ConvexAPI->>InternalMutations: internal.accounts.deleteAll
    InternalMutations->>Database: Delete all records
    Database->>InternalMutations: Return { deleted: number }
    InternalMutations->>ConvexAPI: Typed return value

Loading

[greptile-apps]

_{1 file reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

[greptile-apps]

deleteAll still exposed as regular mutation allowing any client to delete all markets. The API route at src/app/api/markets/sync/route.ts:140 is already public, so this doesn't add auth protection.

Prompt To Fix With AI

This is a comment left during a code review.
Path: convex/markets.ts
Line: 52:52

Comment:
`deleteAll` still exposed as regular `mutation` allowing any client to delete all markets. The API route at `src/app/api/markets/sync/route.ts:140` is already public, so this doesn't add auth protection.

How can I resolve this? If you propose a fix, please make it concise.

[Copilot]

Pull request overview

This PR tightens Convex API contracts by adding return validators, replacing v.any() with structured validators in the schema, and restricting destructive operations to internal-only mutations (with one exception).

Changes:

• Converted multiple destructive mutations to internalMutation and added explicit returns validators across Convex functions.
• Replaced v.any() with typed validators for alerts.evidence.metrics, agentRuns.toolCalls.input/output, and activityFeed.payload.
• Updated cron scheduling to use crons.cron() and added {} args to all scheduled calls for consistency.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
convex/seed.ts	Makes seeding internal-only and adds a typed return contract.
convex/schema.ts	Replaces v.any() fields with typed schema validators for stronger runtime guarantees.
convex/markets.ts	Adds typed return validators; keeps deleteAll public with a TODO for auth.
convex/crons.ts	Migrates from deprecated crons.daily() to crons.cron() and standardizes cron args.
convex/alerts.ts	Adds typed validators and converts destructive ops to internalMutation.
convex/agentRuns.ts	Adds typed validators/returns and internalizes scheduled trigger mutation.
convex/activityFeed.ts	Adds typed validators and explicit null return for cleanup mutation.
convex/accounts.ts	Adds typed return validators and converts destructive ops to internalMutation.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

triggerScheduledRun declares returns: v.null(), but inside the handler there is a return; (undefined) path when there are no active markets. This will violate the return validator at runtime; return null consistently in that branch.

[Copilot]

markets.deleteAll is still a public mutation with no authorization check, which means any client with access to the Convex deployment can delete all markets. If this must remain callable from a Next.js API route, add an explicit auth/secret check in the mutation (or gate it behind an admin-only identity) rather than leaving it as an open operation.

Suggested change

	args: {},
	returns: v.object({ deleted: v.number() }),
	handler: async (ctx) => {
	args: { adminSecret: v.string() },
	returns: v.object({ deleted: v.number() }),
	handler: async (ctx, { adminSecret }) => {
	const expectedSecret = process.env.ADMIN_SECRET;
	if (!expectedSecret || adminSecret !== expectedSecret) {
	throw new Error("Unauthorized: invalid admin secret");
	}