🔐 Auth Multi-tenant + Deploy

🧬 Mapeamento Clerk Org → InboxAI orgId

🧰 O que Clerk entrega out-of-the-box

export default {
  providers: [
    {
      domain: process.env.CLERK_JWT_ISSUER_DOMAIN,
      applicationID: "convex",
    },
  ],
};

// convex/http.ts
http.route({
  path: "/webhooks/clerk", method: "POST",
  handler: httpAction(async (ctx, req) => {
    const sig = req.headers.get("svix-signature");
    const payload = await req.text();
    if (!verifyClerkSignature(payload, sig, process.env.CLERK_WEBHOOK_SECRET!))
      return new Response("invalid", { status: 401 });

    const event = JSON.parse(payload);

    if (event.type === "organization.created") {
      await ctx.runMutation(internal.orgs.create, {
        clerkOrgId: event.data.id,
        name: event.data.name,
        plan: "free",
      });
    }

    if (event.type === "organizationMembership.created") {
      await ctx.runMutation(internal.users.create, {
        clerkOrgId: event.data.organization.id,
        clerkUserId: event.data.public_user_data.user_id,
        email: event.data.public_user_data.identifier,
        role: event.data.role.replace("org:", ""),
      });
    }

    return new Response("ok");
  }),
});

import { QueryCtx, MutationCtx } from "../_generated/server";

export async function requireOrgId(
  ctx: QueryCtx | MutationCtx
): Promise<Id<"organizations">> {
  const identity = await ctx.auth.getUserIdentity();
  if (!identity) throw new Error("unauthenticated");

  const user = await ctx.db
    .query("users")
    .withIndex("by_clerk", q => q.eq("clerkId", identity.subject))
    .unique();

  if (!user) throw new Error("user not found");
  return user.orgId;
}

export async function requireRole(
  ctx: MutationCtx,
  allowed: ("owner" | "admin" | "agent")[]
) {
  const orgId = await requireOrgId(ctx);
  const identity = await ctx.auth.getUserIdentity();
  const user = await ctx.db.query("users")
    .withIndex("by_clerk", q => q.eq("clerkId", identity!.subject)).unique();
  if (!allowed.includes(user!.role)) throw new Error("forbidden");
  return { orgId, user };
}

// convex/conversations.ts
export const list = query({
  args: { status: v.string() },
  handler: async (ctx, { status }) => {
    const orgId = await requireOrgId(ctx);  // ← BLINDA
    return await ctx.db
      .query("conversations")
      .withIndex("by_org_status", q => q.eq("orgId", orgId).eq("status", status))
      .order("desc")
      .take(50);
  },
});

export const close = mutation({
  args: { conversationId: v.id("conversations") },
  handler: async (ctx, { conversationId }) => {
    const { orgId } = await requireRole(ctx, ["owner", "admin", "agent"]);
    const conv = await ctx.db.get(conversationId);
    if (!conv || conv.orgId !== orgId) throw new Error("not found");  // ← double check
    await ctx.db.patch(conversationId, { status: "closed" });
  },
});

📊 Equivalente em Supabase (SQL policy)

-- habilita RLS na tabela
alter table contacts enable row level security;

-- política: usuário só vê linhas da sua org
create policy "tenant_isolation" on contacts
  for all
  using (org_id = (auth.jwt() ->> 'org_id')::uuid)
  with check (org_id = (auth.jwt() ->> 'org_id')::uuid);

📋 Checklist de secret hygiene

# Convex Cloud — setar secret em produção
npx convex env set ANTHROPIC_API_KEY sk-ant-...

# listar todos
npx convex env list

# Vercel — setar pra prod
vercel env add CLERK_SECRET_KEY production

# scan local antes de commit
gitleaks detect --source . --verbose

# verificar se .env está realmente ignorado
git check-ignore -v .env

# se vazou: revogue IMEDIATAMENTE no painel do provedor,
# rode git filter-repo pra limpar do histórico,
# rotacione TODOS os secrets do mesmo .env (assuma que vazaram juntos)
git filter-repo --path .env --invert-paths

🛤️ Pipeline completa

# 1. logar nos serviços
vercel login
npx convex login

# 2. linkar repo
vercel link

# 3. deploy do Convex pra produção (cria URL prod)
npx convex deploy

# 4. exportar URL pro Next consumir
vercel env add NEXT_PUBLIC_CONVEX_URL production
# (cola a URL https://serious-fox-123.convex.cloud)

# 5. primeiro deploy
vercel --prod

# Daqui pra frente: git push main → CI/CD automático

🔄 Rollback

# Vercel — rollback do frontend (1 clique no painel ou):
vercel rollback <deployment-id>

# Convex — rollback de funções (mantém dado)
npx convex deployments
npx convex deploy --rollback <deploy-id>

🛍️ Onde comprar (Brasil)

🔧 Apontar domínio externo pra Vercel

🏷️ Subdomínio por cliente (white-label)

# Wildcard CNAME no DNS
*.app.com.br  CNAME  cname.vercel-dns.com

# Vercel: Add wildcard domain
# *.app.com.br

# Next middleware lê hostname e passa pra app
// middleware.ts
export function middleware(req) {
  const host = req.headers.get("host"); // clinica-vita.app.com.br
  const subdomain = host.split(".")[0]; // clinica-vita
  req.headers.set("x-tenant", subdomain);
}