Signaldesk Enable Auth

Enable auth in SignalDesk

SignalDesk ships with auth off so it runs with zero config. Use this skill to add Convex Auth. The default path uses the Password provider so no OAuth keys are needed. Follow docs/AUTH.md in the repo as the source of truth and keep changes minimal.

Before you start

Confirm with the user:

1. Provider: Password (default, no keys) or an OAuth provider like GitHub or Google (needs client id and secret).
2. Whether all functions should require sign in, or only some.

Steps

1. Install packages:

   npm install @convex-dev/auth @auth/core
   

2. Run the auth setup helper to generate keys and env vars:

   npx @convex-dev/auth
   

3. Create convex/auth.ts exporting convexAuth with the chosen provider.

4. Spread authTables into convex/schema.ts.

5. Add auth.addHttpRoutes(http) in convex/http.ts, keeping the existing registerStaticRoutes call.

6. Swap ConvexProvider for ConvexAuthProvider in src/main.tsx.

7. Add a sign in form gated by <Authenticated> and <Unauthenticated>.

8. Protect Convex functions with getAuthUserId(ctx) where needed.

9. Set VITE_AUTH_ENABLED=true in .env.local.

Rules

• Keep argument and return validators on every Convex function.
• Do not store secrets in the database or in frontend env files. OAuth secrets go in Convex env vars via npx convex env set.
• Run npm run typecheck and npm run lint after wiring it up.
• Verify: sign up, sign out, sign in, and confirm a protected function rejects an unauthenticated call.

References

• docs/AUTH.md in this repo
• https://labs.convex.dev/auth
• https://labs.convex.dev/auth/setup
• https://docs.convex.dev/auth/functions-auth