Security

// Accessing authenticated user in Convex
export const getData = query({
  handler: async (ctx) => {
    const identity = await ctx.auth.getUserIdentity();
    
    if (!identity) {
      throw new Error("Unauthenticated");
    }
    
    // Access user claims
    const userId = identity.subject;
    const orgId = identity.org_id;
    const email = identity.email;
    const role = identity.org_role;
    
    // Query with organization isolation
    return await ctx.db
      .query("customers")
      .withIndex("by_organization", q => q.eq("clerkOrganizationId", orgId))
      .collect();
  },
});

// Role-based permission helper
function hasPermission(identity: UserIdentity, permission: string): boolean {
  const rolePermissions: Record<string, string[]> = {
    'org:admin': ['*'],
    'org:manager': ['read', 'write', 'manage_location'],
    'org:staff': ['read', 'write'],
    'org:viewer': ['read'],
  };
  
  const role = identity.org_role || 'org:viewer';
  const permissions = rolePermissions[role] || [];
  
  return permissions.includes('*') || permissions.includes(permission);
}

// Usage in mutation
export const deleteCustomer = mutation({
  args: { customerId: v.id("customers") },
  handler: async (ctx, args) => {
    const identity = await ctx.auth.getUserIdentity();
    
    if (!hasPermission(identity, 'delete')) {
      throw new Error("Insufficient permissions");
    }
    
    await ctx.db.delete(args.customerId);
  },
});

// Webhook signature format
const signature = crypto
  .createHmac('sha256', webhookSecret)
  .update(JSON.stringify(payload) + timestamp)
  .digest('hex');

// Header format
headers['X-Tiquo-Signature'] = `t=${timestamp},v1=${signature}`;

function verifyWebhook(
  payload: string,
  header: string,
  secret: string
): boolean {
  const [timestampPart, signaturePart] = header.split(',');
  const timestamp = timestampPart.split('=')[1];
  const signature = signaturePart.split('=')[1];
  
  // Check timestamp is recent (5 minute window)
  const age = Date.now() - parseInt(timestamp) * 1000;
  if (age > 300000) return false;
  
  // Verify signature
  const expected = crypto
    .createHmac('sha256', secret)
    .update(payload + timestamp)
    .digest('hex');
  
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}