React 19 Security: Server Action Taint APIs

1// server-only data access layer (runs strictly on the server)
2import 'server-only';
3import {
4  experimental_taintObjectReference,
5  experimental_taintUniqueValue,
6} from 'react';
7
8export interface UserRecord {
9  id: string;
10  name: string;
11  email: string;
12  passwordHash: string;
13  stripeCustomerId: string;
14  role: 'admin' | 'user';
15}
16
17export async function getUserAccount(userId: string): Promise<UserRecord> {
18  const user = await db.users.findUnique({ where: { id: userId } });
19
20  // 1. Taint the entire database entity object
21  // If ANY component accidentally passes `user` to a Client Component,
22  // React throws: "Do not pass raw user records to client components!"
23  experimental_taintObjectReference(
24    'Do not pass raw user records to client components! Select only public fields.',
25    user
26  );
27
28  // 2. Taint individual secret primitives
29  // Even if user spreads or extracts `passwordHash`, passing it to the client is blocked!
30  experimental_taintUniqueValue(
31    'Do not pass password hashes to the client!',
32    user,
33    user.passwordHash
34  );
35
36  return user;
37}
38
39// 3. Safe Public DTO pattern for Client Components
40export async function getPublicUserProfile(userId: string) {
41  const user = await getUserAccount(userId);
42
43  // Explicitly return ONLY safe, public fields to the client boundary
44  return {
45    id: user.id,
46    name: user.name,
47  };
48}