Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Custom Functions for Data Protection · kunanonj | DecimalAI

kunanonj/cursor-plugin-convex-rule-custom-functions-for-auth

SkillScore100Maintained

Use custom functions for data protection - this is Convex's alternative to Row Level Security (RLS)

codingby kunanonj

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Coding pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/kunanonj-cursor-plugin-convex-rule-custom-functions-for-auth/SKILL.md

decimalai skills pull kunanonj-cursor-plugin-convex-rule-custom-functions-for-auth --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/kunanonj-cursor-plugin-convex-rule-custom-functions-for-auth/SKILL.md https://app.decimal.ai/s/kunanonj-cursor-plugin-convex-rule-custom-functions-for-auth/SKILL.md

Raw file: /s/kunanonj-cursor-plugin-convex-rule-custom-functions-for-auth/SKILL.md ↗ · machine-readable summary at /s/kunanonj-cursor-plugin-convex-rule-custom-functions-for-auth.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 51d ago

Yes — +39% lift · at higher cost+125% tokens0% turns100% of whole cases pass with skill (23/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-02	✗→✓	▲ Improved	62%	0%
case-06	✗→✓	▲ Improved	123%	0%
case-08	✗→✓	▲ Improved	115%	0%
case-10	✗→✓	▲ Improved	124%	0%
case-13	✗→✓	▲ Improved	161%	0%

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/2/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

kunanonj / ai-skills-hub

skills/cursor-plugin-convex-rule-custom-functions-for-auth/SKILL.md

View on GitHub ↗

License MITImported 8/2/2026Version v1

Skill contents

SKILL.md

Custom Functions for Data Protection

Convex's approach to data protection: Instead of Row Level Security (RLS) like PostgreSQL, use custom functions to wrap all queries and mutations with automatic auth and access control.

Why Custom Functions, Not RLS?

Traditional databases (PostgreSQL):

Use Row Level Security policies
SQL-based access rules
Runs at database layer
Complex policy syntax

Convex approach:

Use custom function wrappers
TypeScript-based access logic
Runs at application layer
Full type safety and flexibility

The Pattern

Instead of writing auth checks in every function:

❌ Bad: Repeating Auth Everywhere

typescript
export const getTasks = query({
  handler: async (ctx) => {
    // Repeated in every function!
    const identity = await ctx.auth.getUserIdentity();
    if (!identity) throw new Error("Not authenticated");
    const user = await getUser(ctx, identity);

    return await ctx.db.query("tasks")
      .withIndex("by_user", q => q.eq("userId", user._id))
      .collect();
  },
});

export const getProjects = query({
  handler: async (ctx) => {
    // Same auth code again!
    const identity = await ctx.auth.getUserIdentity();
    if (!identity) throw new Error("Not authenticated");
    const user = await getUser(ctx, identity);

    return await ctx.db.query("projects")
      .withIndex("by_user", q => q.eq("userId", user._id))
      .collect();
  },
});

✅ Good: Custom Function Wrapper

typescript
// convex/lib/authFunctions.ts
import { customQuery, customMutation } from "convex-helpers/server/customFunctions";
import { query, mutation } from "../_generated/server";
import { getCurrentUser } from "./auth";

// Authenticated query - user automatically in ctx
export const authedQuery = customQuery(query, {
  args: {},
  input: async (ctx, args) => {
    const user = await getCurrentUser(ctx);
    return { ctx: { ...ctx, user }, args };
  },
});

// Authenticated mutation - user automatically in ctx
export const authedMutation = customMutation(mutation, {
  args: {},
  input: async (ctx, args) => {
    const user = await getCurrentUser(ctx);
    return { ctx: { ...ctx, user }, args };
  },
});

// Now use everywhere:
export const getTasks = authedQuery({
  handler: async (ctx) => {
    // ctx.user automatically available and typed!
    return await ctx.db.query("tasks")
      .withIndex("by_user", q => q.eq("userId", ctx.user._id))
      .collect();
  },
});

export const getProjects = authedQuery({
  handler: async (ctx) => {
    // Same pattern, no repeated code
    return await ctx.db.query("projects")
      .withIndex("by_user", q => q.eq("userId", ctx.user._id))
      .collect();
  },
});

Common Data Protection Patterns

1. Basic Authentication

typescript
export const authedQuery = customQuery(query, {
  args: {},
  input: async (ctx, args) => {
    const identity = await ctx.auth.getUserIdentity();
    if (!identity) throw new Error("Not authenticated");

    const user = await ctx.db
      .query("users")
      .withIndex("by_token", q =>
        q.eq("tokenIdentifier", identity.tokenIdentifier)
      )
      .unique();

    if (!user) throw new Error("User not found");

    return { ctx: { ...ctx, user }, args };
  },
});

2. Role-Based Access Control (RBAC)

typescript
// Admin-only functions
export const adminQuery = customQuery(query, {
  args: {},
  input: async (ctx, args) => {
    const user = await getCurrentUser(ctx);

    if (user.role !== "admin") {
      throw new Error("Admin access required");
    }

    return { ctx: { ...ctx, user }, args };
  },
});

// Usage
export const getAllUsers = adminQuery({
  handler: async (ctx) => {
    // Only admins can call this
    return await ctx.db.query("users").collect();
  },
});

3. Multi-Tenant Access Control

typescript
export const tenantQuery = customQuery(query, {
  args: { organizationId: v.id("organizations") },
  input: async (ctx, args) => {
    const user = await getCurrentUser(ctx);

    // Verify user belongs to this organization
    const membership = await ctx.db
      .query("organizationMembers")
      .withIndex("by_org_and_user", q =>
        q.eq("organizationId", args.organizationId)
         .eq("userId", user._id)
      )
      .unique();

    if (!membership) {
      throw new Error("Not a member of this organization");
    }

    return {
      ctx: {
        ...ctx,
        user,
        organizationId: args.organizationId,
        role: membership.role
      },
      args
    };
  },
});

// Usage - automatically scoped to organization
export const getOrgProjects = tenantQuery({
  args: { organizationId: v.id("organizations") },
  handler: async (ctx, args) => {
    // Only returns projects for this org
    return await ctx.db
      .query("projects")
      .withIndex("by_organization", q =>
        q.eq("organizationId", ctx.organizationId)
      )
      .collect();
  },
});

4. Resource Ownership

typescript
export const ownerQuery = customQuery(query, {
  args: { resourceId: v.id("resources") },
  input: async (ctx, args) => {
    const user = await getCurrentUser(ctx);

    const resource = await ctx.db.get(args.resourceId);
    if (!resource) throw new Error("Resource not found");

    if (resource.ownerId !== user._id) {
      throw new Error("You don't own this resource");
    }

    return {
      ctx: { ...ctx, user, resource },
      args
    };
  },
});

// Usage
export const getResourceDetails = ownerQuery({
  args: { resourceId: v.id("resources") },
  handler: async (ctx, args) => {
    // ctx.resource already verified as owned by user
    return ctx.resource;
  },
});

5. Team/Group Based Access

typescript
export const teamQuery = customQuery(query, {
  args: { teamId: v.id("teams") },
  input: async (ctx, args) => {
    const user = await getCurrentUser(ctx);

    const membership = await ctx.db
      .query("teamMembers")
      .withIndex("by_team_and_user", q =>
        q.eq("teamId", args.teamId)
         .eq("userId", user._id)
      )
      .unique();

    if (!membership) {
      throw new Error("Not a member of this team");
    }

    return {
      ctx: {
        ...ctx,
        user,
        teamId: args.teamId,
        permissions: membership.permissions
      },
      args
    };
  },
});

// Usage
export const getTeamData = teamQuery({
  args: { teamId: v.id("teams") },
  handler: async (ctx) => {
    // Automatically scoped to team
    // ctx.permissions available for fine-grained checks
    return await ctx.db
      .query("teamData")
      .withIndex("by_team", q => q.eq("teamId", ctx.teamId))
      .collect();
  },
});

6. Read/Write Separation

typescript
// Read operations - more permissive
export const viewerQuery = customQuery(query, {
  args: { teamId: v.id("teams") },
  input: async (ctx, args) => {
    const user = await getCurrentUser(ctx);

    const member = await ctx.db
      .query("teamMembers")
      .withIndex("by_team_and_user", q =>
        q.eq("teamId", args.teamId).eq("userId", user._id)
      )
      .unique();

    // Any team member can read
    if (!member) throw new Error("Not a team member");

    return { ctx: { ...ctx, user, teamId: args.teamId }, args };
  },
});

// Write operations - require specific role
export const editorMutation = customMutation(mutation, {
  args: { teamId: v.id("teams") },
  input: async (ctx, args) => {
    const user = await getCurrentUser(ctx);

    const member = await ctx.db
      .query("teamMembers")
      .withIndex("by_team_and_user", q =>
        q.eq("teamId", args.teamId).eq("userId", user._id)
      )
      .unique();

    // Must be editor or admin to write
    if (!member || (member.role !== "editor" && member.role !== "admin")) {
      throw new Error("Editor access required");
    }

    return { ctx: { ...ctx, user, teamId: args.teamId }, args };
  },
});

7. Public vs Private Data

typescript
// Public query - no auth required
export const publicQuery = query;

// Private query - requires auth
export const privateQuery = authedQuery;

// Example: Blog posts
export const listPublicPosts = publicQuery({
  handler: async (ctx) => {
    return await ctx.db
      .query("posts")
      .withIndex("by_published", q => q.eq("published", true))
      .collect();
  },
});

export const listMyDrafts = privateQuery({
  handler: async (ctx) => {
    return await ctx.db
      .query("posts")
      .withIndex("by_author", q => q.eq("authorId", ctx.user._id))
      .filter(q => q.eq(q.field("published"), false))
      .collect();
  },
});

File Organization

Recommended structure:

convex/
├── lib/
│   ├── auth.ts              # getCurrentUser helper
│   └── customFunctions.ts   # All custom wrappers
├── users.ts                 # Public functions
├── tasks.ts                 # Use authedQuery/authedMutation
├── admin.ts                 # Use adminQuery/adminMutation
└── organizations.ts         # Use tenantQuery/tenantMutation

Benefits vs RLS

| Aspect | Custom Functions (Convex) | Row Level Security (PostgreSQL) | |--------|---------------------------|----------------------------------| | Language | TypeScript | SQL | | Type Safety | Full | Limited | | Complexity | Medium | High | | Flexibility | Very High | Medium | | Testing | Easy (unit tests) | Hard (DB-level) | | Debugging | Standard debugging | DB logs | | Reusability | High (compose wrappers) | Medium |

Installation

bash
npm install convex-helpers

Complete Example: Multi-Tenant SaaS

typescript
// convex/lib/customFunctions.ts
import { customQuery, customMutation } from "convex-helpers/server/customFunctions";
import { query, mutation } from "../_generated/server";
import { getCurrentUser } from "./auth";

// Base: Authenticated
export const authedQuery = customQuery(query, {
  args: {},
  input: async (ctx, args) => {
    const user = await getCurrentUser(ctx);
    return { ctx: { ...ctx, user }, args };
  },
});

export const authedMutation = customMutation(mutation, {
  args: {},
  input: async (ctx, args) => {
    const user = await getCurrentUser(ctx);
    return { ctx: { ...ctx, user }, args };
  },
});

// Org-scoped
export const orgQuery = customQuery(authedQuery, {
  args: { orgId: v.id("organizations") },
  input: async (ctx, args) => {
    const member = await ctx.db
      .query("members")
      .withIndex("by_org_and_user", q =>
        q.eq("orgId", args.orgId).eq("userId", ctx.user._id)
      )
      .unique();

    if (!member) throw new Error("Not a member");

    return {
      ctx: { ...ctx, orgId: args.orgId, role: member.role },
      args
    };
  },
});

export const orgMutation = customMutation(authedMutation, {
  args: { orgId: v.id("organizations") },
  input: async (ctx, args) => {
    const member = await ctx.db
      .query("members")
      .withIndex("by_org_and_user", q =>
        q.eq("orgId", args.orgId).eq("userId", ctx.user._id)
      )
      .unique();

    if (!member) throw new Error("Not a member");

    return {
      ctx: { ...ctx, orgId: args.orgId, role: member.role },
      args
    };
  },
});

// Admin-only (within org)
export const orgAdminMutation = customMutation(orgMutation, {
  args: { orgId: v.id("organizations") },
  input: async (ctx, args) => {
    if (ctx.role !== "admin") {
      throw new Error("Admin access required");
    }
    return { ctx, args };
  },
});

Key Takeaways

Custom functions ARE Convex's RLS — This is the recommended pattern
Define once, use everywhere — Create wrappers for your access patterns
Compose wrappers — Build complex access control by layering
Type-safe — Full TypeScript support, unlike SQL policies
Testable — Easy to unit test your auth logic
Flexible — Can implement any access control pattern

Checklist

] Install convex-helpers: npm install convex-helpers
] Create convex/lib/customFunctions.ts
] Define authedQuery and authedMutation
] Replace query with authedQuery in functions needing auth
] Replace mutation with authedMutation in functions needing auth
] Add role-based or tenant-based wrappers as needed
] Remove repeated auth code from function bodies
] Test access control logic

Learn More

Illustrative Want to see what kunanonj/cursor-plugin-convex-rule-custom-functions-for-auth would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/8/2026, 08:23 UTC · 23 cases

Lift

+39%

100% vs 61%

Agent turns

0%

1.0 vs 1.0

Tokens

+125%

5,317.65 vs 2,359.17

fail → pass · 9pass → pass · 14

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 I'm refactoring my Convex backend because I currently call `ctx.auth.getUserIdentity()` and look up the user record manually inside every single query and mutation handler. Can you show me how to set up reusable custom function wrappers using `convex-helpers` so that my handlers automatically receive the user in `ctx`? Please output the wrapper definitions in a helper module and demonstrate how to rewrite a basic task query with the new pattern.	pass→pass	10,493	7,329	-30%	1	1	0%	2,750	5,585	+103%	0	0	—
case-02 I need an access control setup for our Convex project that separates read permissions from write permissions for team data. Any member of the team should be able to run queries, but modifying data requires an editor or admin role on the team membership record. Please provide TypeScript code using Convex custom function helpers that implements both a viewer query wrapper and an editor mutation wrapper, including their usage in sample handlers.	fail→pass	15,527	12,015	-23%	1	1	0%	4,155	6,724	+62%	0	0	—
case-03 In a Convex project using convex-helpers, how do I build a wrapper function `authedQuery` that converts a missing or invalid auth token identifier into an explicit runtime error before reaching the handler?	pass→pass	9,888	7,100	-28%	1	1	0%	2,082	5,223	+151%	0	0	—
case-04 I want an admin-only query wrapper in my Convex app using `convex-helpers`. Show me how to define `adminQuery` that verifies user roles and rejects non-admin users.	pass→pass	11,840	6,142	-48%	1	1	0%	2,446	5,101	+109%	0	0	—
case-05 In a Convex multi-tenant backend with an `organizations` table and `organizationMembers` table, write a tenant custom query wrapper using convex-helpers that accepts `organizationId` and scopes the request context.	pass→pass	11,237	8,614	-23%	1	1	0%	2,687	5,688	+112%	0	0	—
case-06 Write a Convex custom wrapper `ownerQuery` using `convex-helpers` that accepts a `resourceId` parameter, fetches the resource, and confirms the authenticated user owns it.	fail→pass	9,899	6,174	-38%	1	1	0%	2,298	5,129	+123%	0	0	—
case-07 Create a Convex custom function wrapper `teamQuery` using convex-helpers that validates membership in a `teams` table via `teamMembers` index before executing the query handler.	pass→pass	14,649	7,657	-48%	1	1	0%	3,134	5,467	+74%	0	0	—
case-08 How can I compose custom functions in Convex using `convex-helpers` so that `orgAdminMutation` builds directly on top of an existing `orgMutation` wrapper instead of re-verifying organization membership from scratch?	fail→pass	10,942	7,835	-28%	1	1	0%	2,487	5,344	+115%	0	0	—
case-09 In Convex, how should public blog posts and private user drafts be structured when applying data protection best practices with custom function wrappers?	pass→pass	13,153	11,348	-14%	1	1	0%	3,085	6,276	+103%	0	0	—
case-10 A developer moving from PostgreSQL to Convex asks how to implement Row Level Security (RLS) policies in Convex. Explain the standard architecture Convex uses for database protection and compare it with PostgreSQL RLS.	fail→pass	13,190	11,484	-13%	1	1	0%	2,737	6,141	+124%	0	0	—
case-11 Which NPM package provides `customQuery` and `customMutation` primitives for building Convex auth wrappers?	pass→pass	3,318	1,700	-49%	1	1	0%	571	3,865	+577%	0	0	—
case-12 What is the recommended directory and file layout in a standard Convex project for storing custom function wrappers and auth helper logic?	pass→pass	11,313	7,461	-34%	1	1	0%	2,534	5,160	+104%	0	0	—
case-13 Show how to define a function `getOrgProjects` in `convex/projects.ts` using a pre-defined `tenantQuery` wrapper so that organization scope is automatically enforced.	fail→pass	7,765	4,634	-40%	1	1	0%	1,757	4,591	+161%	0	0	—
case-14 Show how the function body of `getResourceDetails` looks when invoked via an `ownerQuery` custom wrapper that pre-fetches and validates resource ownership.	fail→pass	7,832	7,139	-9%	1	1	0%	1,808	5,298	+193%	0	0	—
case-15 Write two Convex query functions for a publishing app: `listPublicPosts` (open to anyone) and `listMyDrafts` (open only to the post author), following Convex data protection best practices.	fail→pass	8,143	6,749	-17%	1	1	0%	1,929	5,332	+176%	0	0	—
case-16 Provide the complete `convex/lib/customFunctions.ts` implementation for a SaaS backend needing `authedQuery`, `authedMutation`, `orgQuery`, `orgMutation`, and `orgAdminMutation` using `convex-helpers`.	fail→pass	23,890	13,099	-45%	1	1	0%	5,597	7,185	+28%	0	0	—
case-17 When writing a Convex basic auth wrapper with `convex-helpers`, what two checks should be performed before returning the context with the user object?	pass→pass	5,591	3,675	-34%	1	1	0%	1,103	4,416	+300%	0	0	—
case-18 Write a custom mutation helper `editorMutation` using `convex-helpers` that checks if the authenticated user has an 'editor' or 'admin' role in `teamMembers` before allowing mutation execution.	pass→pass	12,948	9,286	-28%	1	1	0%	2,974	5,686	+91%	0	0	—
case-19 When implementing a `tenantQuery` wrapper that looks up organization membership for user `ctx.user._id` and `args.organizationId`, what database index should be queried?	fail→pass	7,491	5,132	-31%	1	1	0%	1,470	4,533	+208%	0	0	—
case-20 I have a Convex project with 20 query functions repeating manual auth checks. What step-by-step checklist should I follow to refactor them using custom functions?	pass→pass	11,837	9,135	-23%	1	1	0%	2,501	5,631	+125%	0	0	—
case-21 I am writing raw SQL migrations for a PostgreSQL database on Supabase. How do I enable Row Level Security and write an SQL policy restricting `SELECT` queries on `documents` table to matching `auth.uid()`?	pass→pass	6,507	5,554	-15%	1	1	0%	1,475	4,530	+207%	0	0	—
case-22 How do I define a Convex database schema in `convex/schema.ts` with a `tasks` table containing `userId` and an index `by_user`?	pass→pass	4,976	3,975	-20%	1	1	0%	1,145	4,442	+288%	0	0	—
case-23 How do I configure Clerk authentication provider in `convex/auth.config.js` for a Convex backend?	pass→pass	6,729	6,068	-10%	1	1	0%	1,536	4,959	+223%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of +39 percentage points is the difference between those two pass rates over the 23 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 60.9%
Pass rate with the skill: 100%
Cases attempted: 23
Cases counted toward lift: 23
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/8/2026, 08:23 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-02

Prompt

I need an access control setup for our Convex project that separates read permissions from write permissions for team data. Any member of the team should be able to run queries, but modifying data requires an editor or admin role on the team membership record. Please provide TypeScript code using Convex custom function helpers that implements both a viewer query wrapper and an editor mutation wrapper, including their usage in sample handlers.

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run100

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+140% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 50 days ago

Other measured skills in the registry, with their headline benchmark lift.