Receiving a tableId as input in a mutation

Hello, I'm using convex with nextjs, I have a question about the code in the two screenshots, don't focus on the context of the app it doesn't matter. I want to define a mutation that modifies a field in a given document of the table. previously I would pass something that uniquely identifies the document and then do a query to retrieve it and then modify the field, but now I discovered I can have the id validator in the input of the mutation, that allows me to force the frontend to provide a valid id and not anything thanks to typesafety, but my question is: if I use the code where I don't manually validate the id, meaning I directly pass the id to patch, and if the user opens the dev tools and tries to call the mutation with an invalid id, what would happen? will the mutation validate the id on runtime and throw an error or will it trust the issuer of the call and skip validation, and if it skips the validation, what will patch do? N.B: I know this is probably a very rare case because usually I have to verify if the user has the right to modify that document so the id validation will happen implicitly, currently I'm making a tool just for me and for a few people who I trust so I'm not making a full-blown app.
No description
No description
2 Replies
lee
lee8mo ago
Argument validation happens at runtime on the server, so it will happen even if someone calls the mutation from the browser console
yassine safraoui
yassine safraouiOP8mo ago
okay that's perfect! thanks

Did you find this page helpful?