Server Actions with no auth check in Next.js

"use server";

export async function renameProject(projectId: string, name: string) {
  const user = await getCurrentUser();
  if (!user) throw new Error("Unauthorized");

  const project = await db.project.findFirst({
    where: { id: projectId, userId: user.id },
  });
  if (!project) throw new Error("Not found");

  await db.project.update({ where: { id: project.id }, data: { name } });
}

Validate name for length and type. Do not spread the form object into data. That is how role sneaks in. See the client sets the price or role.

Middleware or proxy can be an extra filter. Keep the check in the action anyway.