Data access control

Per-user, per-workspace, per-team scoping patterns. Defending against data leaks.

The most common security bug in multi-user apps is IDOR — Insecure Direct Object Reference. User A passes a URL with user B’s resource ID; the server returns it without checking. Don’t let this happen.

The rule

Every query and mutation that returns or modifies data must verify the caller has access.

Patterns

Per-user

const u = await ctx.auth.getUserIdentity();
if (!u) throw new Error("Not signed in");

const item = await ctx.db.get(itemId);
if (!item) throw new Error("Not found");
if (item.ownerId !== u.subject) throw new Error("Permission denied");

Per-workspace

const u = await ctx.auth.getUserIdentity();
if (!u) throw new Error("Not signed in");

const item = await ctx.db.get(itemId);
const membership = await ctx.db
  .query("memberships")
  .withIndex("by_workspace_and_user",
    q => q.eq("workspaceId", item.workspaceId).eq("userId", u.subject))
  .unique();
if (!membership) throw new Error("Permission denied");

Per-role

if (!["admin", "owner"].includes(membership.role)) {
  throw new Error("Admin only");
}

Common mistakes

Filtering only on the client

“I only show the user their own tasks in the UI” — but the API endpoint returns everything. Anyone who sniffs the network can see all tasks.

Trusting URL params

/tasks/123 — server should verify the user has access to task 123, not just trust the URL.

Forgetting the membership check on workspace queries

Filtering by workspaceId is necessary but not sufficient. Verify the user is a member of that workspace too.

Returning related data without scoping

A query for “task with author” might return the author’s full record. Scope what you return.

Tips

Write a “permission helper” once and reuse. A requireMembership(ctx, workspaceId) function called from every mutation prevents copy-paste drift.

Test by signing in as different users. Don’t trust that vly generated the right checks — verify by trying to access other users’ data.

Related

Roles & permissions

Role model.

Multi-tenancy

Per-tenant patterns.

Auth integration

The ctx.auth API.