{"record":{"id":"a5acbfc212f83af6","repo":"affaan-m/ECC","slug":"forbidden","errorCode":null,"errorMessage":"Forbidden","messagePattern":"Forbidden","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"skills/react-performance/SKILL.md","lineNumber":198,"sourceCode":"\n### Preload on hover/focus\n\nTrigger `<link rel=\"preload\">` or `import()` on hover so the bundle is in cache by the time the user clicks.\n\n## 3. Server-Side Performance (HIGH)\n\n### Authenticate Server Actions like API routes\n\nEvery `\"use server\"` function is a public endpoint. Authenticate AND authorize inside the action — never rely on the calling Client Component's gating.\n\n```ts\n\"use server\";\nexport async function deleteUser(formData: FormData) {\n  const session = await getSession();\n  if (!session?.user) throw new Error(\"Unauthorized\");\n  const targetId = String(formData.get(\"id\"));\n  if (session.user.role !== \"admin\" && session.user.id !== targetId) {\n    throw new Error(\"Forbidden\");\n  }\n  await db.user.delete({ where: { id: targetId } });\n}\n```\n\n### `React.cache()` for per-request deduplication\n\n```ts\nimport { cache } from \"react\";\n\nexport const getUser = cache(async (id: string) => {\n  return db.user.findUnique({ where: { id } });\n});\n```\n\n`React.cache` dedupes within a single request. Calling `getUser(\"1\")` from three Server Components in the same render = one DB query.\n\n### LRU cache for cross-request data","sourceCodeStart":180,"sourceCodeEnd":216,"githubUrl":"https://github.com/affaan-m/ECC/blob/d8409a4b0813771235555e32e3d8046a73988bfa/skills/react-performance/SKILL.md#L180-L216","documentation":"Illustrative pattern from the react-performance skill: after confirming a session exists, the server action verifies the actor is authorized for the target user (e.g. self or admin) and throws 'Forbidden' when the ownership/role check fails. It marks an authenticated but unauthorized caller.","triggerScenarios":"Thrown at skills/react-performance/SKILL.md:198 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Add role-based checks (admin/moderator) alongside the ownership check","Return a structured 403-style error the client can render without crashing","Audit every 'use server' action for missing authorization checks"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"d8409a4b0813771235555e32e3d8046a73988bfa","analyzedAt":"2026-08-26T12:15:34.022Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}