[EtanHey]

Summary

Restrict 36 operational, catalog and transcription functions to Convex internal access. Public clients can no longer invoke user deletion, catalog changes, maintenance tools or raw transcription job reads. Public catalog reads, signup and authenticated progress APIs keep their existing registrations.

Module	Public exports changed to internal
lyrics	create, createMany, updateTimestamps
migration	runUserIdMigration, verifyUserProgressData, updateLyricsTimestamps
oneTimeMigration	migrateVisitorToUser, checkVisitorData, deleteUserRecord, deleteTestUserByEmail, listAllAppUsers, fixAppUserRecord, checkUserData, migrateVisitorIdToUserId, migrateUserId, listAllVisitorIds
seed	seedBaraye, seedBarayeWords
songs	create, deleteSong, setVideoUrl, lockTimestamps, unlockTimestamps
testData	createTestPracticeData
transcription	createJob, updateJobStatus, getJobStatus, getJobsByVisitor, importTranscription
users	debugAuthUser
wordProgress	migrateAddPersian, deduplicateWordProgress, checkDuplicates
words	create, createMany, clearForvoAudioUrls

Caller verification covered 344 regular source, E2E, script and documentation files. No public-client callers reference the converted functions. The catalog modules have only four client read references: songs.list/getById, lyrics.getBySong and words.getByLine. The Python pipeline and README use authenticated npx convex run recipes; internal functions retain that operator access. No deployed function was invoked for verification.

The regression test checks exact public-export allow-lists for all ten changed modules, every registration’s visibility, and frontend references. New public exports in those modules fail by default. Handler bodies and validators are unchanged. The earlier ADMIN_USER_IDS follow-up is shelved because these administrative operations are now internal.

Validation

• RED evidence retained: initial 20 visibility failures; two additional review-scope failures; expanded allow-list run with 18 expected failures (14 registrations and four module API sets).
• Final targeted tests: 82 passed across three files; 68 are visibility/API boundary checks.
• One normal precommit hook: 272 tests passed across 18 files, TypeScript passed, docs guard passed.
• git diff --check passed. No hook bypass.
• Independent static re-scan PASS applies to the exact frozen source/test artifact committed here. This is source/test evidence; production deployment and post-deploy verification remain pending.

Review and remaining qualifications

Loop-record: implementer=codex/gpt-6.1-sol/high reviewer=claude/opus-5.5 rounds=2/2 defects=2 role=worker

Claude review: CHANGES → applied (destructive cleanup internalized). Codex security scan: BLOCKING → fixed (requester job disclosure and public job-ID path internalized). Round-2 Codex security re-scan: PASS on the unchanged frozen hashes. The scans are manual static reviews; plugin initialization was not a sealed completed scan. Reported aggregate scan token use: unavailable, not estimated.

Non-blocking residuals: users.checkEmailExists remains an unauthenticated guessed-email membership oracle used by signup. Leaderboard display names, ranks, scores/streaks and languages remain intentionally public projections; that is cross-user information, not private-record isolation. Existing account-linking/logging and auth-trigger wiring caveats remain outside this registration-only patch. The allow-list test covers ten modules, not future modules or HTTP routes.

Bot policy

Repository instructions read. The security lead routed the independent Claude review and Codex scan/re-scan; no worker-started reviewer or extra bot was invoked. Lead owns merge and deployment.

— songscript-convex-authz (worker) · codex/gpt-6.1-sol

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
songscript	Ready	Preview	Oct 27, 2026 4:43pm UTC

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing