Server actions

Launch Now uses next-safe-action for mutations and most data fetching. Every action file starts with "use server" and exports actions built from one of the clients in lib/safe-action.ts. Inputs are validated with Zod before your code runs.

Action clients

lib/safe-action.ts defines three clients. Some action files add a local admin client on top of authAction.

Many admin actions in lib/admin-actions.ts and lib/feedback-actions.ts use authAction and check ctx.user.role !== "admin" inside the handler instead.

export const action = createSafeActionClient({
  handleServerError(error) {
    if (error instanceof ActionError) {
      return error.message
    }
    console.error("Unexpected error:", error)
    return "Unexpected error occured"
  },
})
 
export const authAction = action.use(async ({ next }) => {
  const user = await getUser()
  if (!user) {
    throw new ActionError("You need to be connected !")
  }
  return next({ ctx: { user } })
})

Errors

Throw ActionError from lib/safe-action.ts to send a message to the client. Its message is returned as result.serverError. Any other error is logged on the server and replaced with a generic message, so internal details never leak.

Calling an action

From a Client Component, use the useAction hook from next-safe-action/hooks:

import { useAction } from "next-safe-action/hooks"
import { createFeedback } from "@/lib/feedback-actions"
 
// ...
const { execute, status } = useAction(createFeedback, {
  onSuccess: () => {
    toast.add({ title: "Thanks for your feedback!", type: "success" })
  },
  onError: () => {
    toast.add({ title: "Failed to submit feedback", type: "error" })
  },
})

From a Server Component, await the action directly and read result.data.

Organization checks

Organization actions call requireMembership(organizationId, userId, allowedRoles?) from lib/organization-server.ts. It throws You are not a member of this organization when the user has no membership row, and You don't have permission to do this when their role is not in allowedRoles. In the tables below, "Roles" lists the allowedRoles passed; "any member" means no role restriction.

lib/actions.ts

lib/account-actions.ts

Account settings for the signed-in user. These actions call Better Auth's server API (auth.api) with the request headers.

lib/onboarding-actions.ts

completeOnboarding is a plain async function that forwards to the inner safe action, so the form can call completeOnboarding() with no argument.

lib/demo-actions.ts

lib/feedback-actions.ts

Feedback submitted from the in-app feedback dialog. See Admin.

lib/admin-actions.ts

Platform administration. Every action requires ctx.user.role === "admin" and throws Not authorized otherwise. Actions marked "not self" also throw when userId is the caller's own ID. See Admin.

Users

Uploads are capped by MAX_IMAGE_UPLOAD_BYTES from lib/storage.ts. The file type comes from the file's magic bytes, not from fileName or fileType.

Organizations

Slugs are validated by slugSchema in lib/slug.ts: 2–48 characters, lowercase letters, numbers and single hyphens, and not a reserved word.

lib/organization-actions.ts

Actions for organization members. Membership and roles are checked with requireMembership. Most mutations call revalidateOrganization, which revalidates every page under /orgs/[slug].

Better Auth API errors are converted to ActionError, so their message reaches the client.

lib/notification-actions.ts

In-app notifications, preferences and announcements. category values come from NOTIFICATION_CATEGORIES in lib/notifications/events.ts: organization, billing, security, admin and announcements. See Notifications.

lib/newsletter-actions.ts

Newsletter subscriptions and sends, backed by Resend. The newsletter is disabled when newsletterEnabled() returns false. See Newsletter.

The file also exports the NewsletterBroadcast type.

Example resources

These actions back the example CRUD pages. pnpm reset-project moves all three files to examples/. See Scripts.

lib/categories-actions.ts

User-scoped. Every action only touches the caller's own rows.

lib/projects-actions.ts

User-scoped. Rows are always filtered by userId.

lib/org-project-actions.ts

Organization-scoped, generated by the resource-kit (pnpm resource:generate). The insert and update schemas are built from the fields in lib/org-project-config.ts: name (required), description, status (planned, active, paused or done) and dueDate.

Resources you generate with pnpm resource:generate get a lib/<name>-actions.ts file with the same shape.

Adding an action

Create or extend a file in lib/, start it with "use server", and pick the narrowest client:

"use server"
 
import { ActionError, authAction } from "@/lib/safe-action"
import { z } from "zod"
 
const renameThing = authAction
  .inputSchema(z.object({ id: z.string(), name: z.string().min(1) }))
  .action(async ({ parsedInput: { id, name }, ctx: { user } }) => {
    // ... check that `user` owns `id`, then update it
    if (!id) throw new ActionError("Not found")
    return { id, name }
  })
 
export { renameThing }

Use nonDemoAction for destructive actions that the shared demo account must not run, and check ctx.user.role === "admin" for platform-admin actions.