vercel/ai-chatbot

`getSuggestions({ documentId })` is an exported function in a `"use server"` module, imported by the client in `artifacts/text/client.tsx` (line 122), so its action ID ships to the browser. It calls `getSuggestionsByDocumentId` directly with no `auth()` call and no `userId` comparison. The sibling API route `app/(chat)/api/suggestions/route.ts` does check `suggestion.userId !== session.user.id`, but this action skips all of that.

Any user (including a throwaway guest) can call the action with any document UUID and receive every suggestion row for it, including `originalText` and `suggestedText`, which are verbatim sentences from another user's private document.

Add a session check and ownership check, mirroring the API route: ```ts export async function getSuggestions({ documentId }: { documentId: string }) { const session = await auth(); if (!session?.user?.id) throw new Error("Unauthorized"); const suggestions = await getSuggestionsByDocumentId({ documentId }); if (suggestions.length > 0 && suggestions[0].userId !== session.user.id) { throw new Error("Forbidden"); } return suggestions; } ``` Or better: have the client fetch `/api/suggestions?documentId=` (already authorized) and delete this action.

In artifacts/actions.ts, the exported server action `getSuggestions` has no authentication or authorization. Import `auth` from "@/app/(auth)/auth", call `const session = await auth()` at the top, throw `new Error("Unauthorized")` if `!session?.user?.id`, then after fetching suggestions, if `suggestions.length > 0 && suggestions[0].userId !== session.user.id` throw `new Error("Forbidden")`. Return an empty array if there are no suggestions. This mirrors the checks already in app/(chat)/api/suggestions/route.ts. Reason: exported functions in "use server" files are public endpoints and this one currently leaks another user's document text via suggestion rows.

`app/(chat)/actions.ts` starts with `"use server"`, so every exported async function is registered as a server action endpoint. `generateTitleFromUserMessage` (line 23) calls `generateText` with a client-controlled `message` and has no `auth()`, no rate limit, and no length cap on `getTextFromMessage(message)`. It is only meant to be called internally from `app/(chat)/api/chat/route.ts` line 132. Its action ID is not referenced from a client component, so an attacker must obtain the ID, but Next.js explicitly treats all exports of "use server" modules as public endpoints. `saveChatModelAsCookie` (line 18) is likewise public but harmless.

Anyone who obtains the action ID (leaked bundle, RSC payload, or future refactor that imports it client-side) can run unlimited AI Gateway requests with arbitrarily long prompts on your bill, bypassing the per-user message quota and BotID (which only protects POST /api/chat).

Move `generateTitleFromUserMessage` out of the "use server" module into a plain server-only file (e.g. `lib/ai/title.ts` with `import "server-only"`), and import it from the chat route. Keep only real client-callable actions (`deleteTrailingMessages`, `updateChatVisibility`) in `actions.ts`. Also cap the prompt: `getTextFromMessage(message).slice(0, 2000)`.

In app/(chat)/actions.ts, the function `generateTitleFromUserMessage` is exported from a "use server" module, which makes it a publicly callable server action that performs an LLM call with no auth or rate limit. Move `generateTitleFromUserMessage` (and its imports: generateText, titleModel, titlePrompt, getTitleModel, getTextFromMessage) to a new file lib/ai/title.ts that begins with `import "server-only";` and is NOT marked "use server". Update app/(chat)/api/chat/route.ts to import it from "@/lib/ai/title" instead of "../../actions". Also truncate the prompt with `.slice(0, 2000)` on the result of getTextFromMessage. Do the same for `saveChatModelAsCookie` if it is not used from a client component. Reason: every export of a "use server" file is an HTTP endpoint; paid LLM calls must never be exposed that way.