Cursor rule

1---
2alwaysApply: false
3---
4 
5## Authenticate Server Actions Like API Routes
6 
7**Impact: CRITICAL (prevents unauthorized access to server mutations)**
8 
9Server Actions (functions with `"use server"`) are exposed as public endpoints, just like API routes. Always verify authentication and authorization **inside** each Server Action—do not rely solely on middleware, layout guards, or page-level checks, as Server Actions can be invoked directly.
10 
11Next.js documentation explicitly states: "Treat Server Actions with the same security considerations as public-facing API endpoints, and verify if the user is allowed to perform a mutation."
12 
13**Incorrect (no authentication check):**
14 
15```typescript
16'use server'
17 
18export async function deleteUser(userId: string) {
19  // Anyone can call this! No auth check
20  await db.user.delete({ where: { id: userId } })
21  return { success: true }
22}
23```
24 
25**Correct (authentication inside the action):**
26 
27```typescript
28'use server'
29 
30import { verifySession } from '@/lib/auth'
31import { unauthorized } from '@/lib/errors'
32 
33export async function deleteUser(userId: string) {
34  // Always check auth inside the action
35  const session = await verifySession()
36  
37  if (!session) {
38    throw unauthorized('Must be logged in')
39  }
40  
41  // Check authorization too
42  if (session.user.role !== 'admin' && session.user.id !== userId) {
43    throw unauthorized('Cannot delete other users')
44  }
45  
46  await db.user.delete({ where: { id: userId } })
47  return { success: true }
48}
49```
50 
51**With input validation:**
52 
53```typescript
54'use server'
55 
56import { verifySession } from '@/lib/auth'
57import { z } from 'zod'
58 
59const updateProfileSchema = z.object({
60  userId: z.string().uuid(),
61  name: z.string().min(1).max(100),
62  email: z.string().email()
63})
64 
65export async function updateProfile(data: unknown) {
66  // Validate input first
67  const validated = updateProfileSchema.parse(data)
68  
69  // Then authenticate
70  const session = await verifySession()
71  if (!session) {
72    throw new Error('Unauthorized')
73  }
74  
75  // Then authorize
76  if (session.user.id !== validated.userId) {
77    throw new Error('Can only update own profile')
78  }
79  
80  // Finally perform the mutation
81  await db.user.update({
82    where: { id: validated.userId },
83    data: {
84      name: validated.name,
85      email: validated.email
86    }
87  })
88  
89  return { success: true }
90}
91```
92 
93Reference: [https://nextjs.org/docs/app/guides/authentication](https://nextjs.org/docs/app/guides/authentication)
94