Back to Questions
Sign In
I am building a Q&A platform using Next.js 14 (App Router) and Prisma. Currently, any authenticated user can see the "Edit" and "Delete" buttons on every answer, and my Server Action allows deleting any answer if a valid answerId is provided. I want to restrict these actions so that only the original author of the answer can modify or remove it.
1
My Current Schema:
Code snippet
model Answer {
id String @id @default(uuid())
content String
codeSnippet String?
authorId String // Foreign key to User model
questionId String
createdAt DateTime @default(now())
}
My Current Server Action:
// app/actions.ts
export async function deleteAnswer(answerId: string) {
// Problem: This doesn't check WHO is making the request
await prisma.answer.delete({
where: { id: answerId }
});
revalidatePath('/question/[id]');
}
What I need:
How do I conditionally render the Edit/Delete buttons in the UI only for the owner?
How do I secure the Server Action so a malicious user can't trigger it via the console using someone else's answerId?
asked 8 days ago
Isuru Sandeepa
Question Author
0Answers
💭
No answers yet
Be the first to help!
Your Answer
Share your knowledge with the community
Sign in to answer
You need to be signed in to contribute an answer.