Card · Server Actions

1. Read session/permissions.
2. Validate input; authorize.
3. Call entity action; revalidatePath.

"use server";

export async function createProjectAction(formData) {

  const session = await getSession();

  if (!session) throw new Error("Unauthorized");

  await createProject(formData, session.user.id);

  revalidatePath("/projects");

  revalidateTag("projects");

}

• Every Server Action is auto-exposed as a POST endpoint — always authorize at the top.
• Use session + role checks on every action, not just UI guards.
• Webhooks → Route Handlers with signature verification; not Server Actions.
• Prefer revalidateTag for data-dependent routes over broad revalidatePath.