# safe-action-middleware

A skill that walks your agent through writing next-safe-action middleware: auth, authorization, logging, rate limits and context extension.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 1200 installs · ★ 1
- Author: next-safe-action
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/next-safe-action/skills/tree/HEAD/skills/safe-action-middleware/SKILL.md
- Updated: 2026-09-03
- HTML: https://affpapa.org/en/nevibecode/skills/safe-action-middleware

## What it does

The skill covers both middleware types in next-safe-action. `.use()` runs before input validation, so it fits session checks, logging and rate limiting. `.useValidated()` runs after schema parsing and hands you a typed `parsedInput`, which is what you want when the check depends on the payload — confirming a user owns a record, for instance.

Each `.use()` call returns a fresh client, and context accumulates through `next({ ctx })` with a deep merge. Execution goes top-to-bottom through the pre-validation stack, then schema parsing, then the post-validation stack, and finally your `.action()` code. Forget the `return` before `next()` and the action hangs.

Order matters for schemas too. Define `.inputSchema()` or `.bindArgsSchemas()` before `.useValidated()`; calling them afterwards, or adding `.use()` after `.useValidated()`, won't compile. Context added by `.use()` is always present in `onError` and `onSettled` callbacks. Context from `.useValidated()` may be missing, because that middleware never runs when validation fails.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add next-safe-action/skills --skill safe-action-middleware -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/safe-action-middleware/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/safe-action-middleware/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add next-safe-action/skills --skill safe-action-middleware -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/safe-action-middleware/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add next-safe-action/skills --skill safe-action-middleware -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/safe-action-middleware/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install next-safe-action/skills safe-action-middleware
```

2. **Manually: put the files in place**
- File: `.github/skills/safe-action-middleware/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add next-safe-action/skills --skill safe-action-middleware -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/next-safe-action/skills --path skills/safe-action-middleware
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/safe-action-middleware/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add next-safe-action/skills --skill safe-action-middleware -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/next-safe-action/skills/tree/HEAD/skills/safe-action-middleware/SKILL.md

## When to use it
- Check the session before an action body executes
- Cap how often a server action can be called
- Attach the current user's id to the action context
- Verify a record belongs to the signed-in user
- Log the parsed input rather than the raw payload

## Example prompts
- Add a `.use()` middleware that checks the session on my action client
- Write a `.useValidated()` middleware that confirms the post belongs to the user in context
- Chain logging and rate-limit middleware in the right order

## Similar
- [mcp-builder](https://affpapa.org/en/nevibecode/skills/mcp-builder.md) — skill · 130949 installs
- [claude-api](https://affpapa.org/en/nevibecode/skills/claude-api.md) — skill · 74198 installs
- [lark-im](https://affpapa.org/en/nevibecode/skills/lark-im.md) — skill · 472900 installs
- [lark-event](https://affpapa.org/en/nevibecode/skills/lark-event.md) — skill · 466800 installs
- [caveman-discover](https://affpapa.org/en/nevibecode/skills/caveman-discover.md) — skill · 104400 installs
- [migration](https://affpapa.org/en/nevibecode/skills/migration.md) — skill · 103900 installs

From the same set: [next-safe-action/skills](https://affpapa.org/en/nevibecode/by/next-safe-action/skills.md) — 6 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md