Server actions replaced every API route in the portal

The client portal and admin panel do not use a single REST endpoint. Every form submission — adding session notes, creating milestones, toggling action items, posting comments, creating deliverables — goes through React server actions. The admin side has seven server actions in one file. Each one starts with a requireAdmin call that checks the Clerk session, fetches the user, and reads publicMetadata.role. If the role is not admin, the function throws before any database write happens. The client side has three server actions — addComment, toggleGoal, and toggleActionItem. Each one authenticates with auth from Clerk, looks up the client by clerkId, and verifies ownership before touching the database. The toggleActionItem action goes one step further — it checks that the action item is assigned to client before allowing the toggle. A client cannot mark my tasks as done. Every server action follows the same shape. It receives the previous state and a FormData object. It validates, writes, and returns either a success flag or an error string. The component calls useActionState with the action and renders the result. No fetch call, no JSON.parse, no try-catch around a network request. The form posts directly to the server function and the page revalidates automatically. Seven admin actions and three client actions handle every write operation across fifteen portal routes. The entire portal has zero custom API endpoints.