Exercise 1: Confirming the Security Gap Is Real — Possible Solution
====================================================================

THE ACTION UNDER TEST
------------------------------
Per this chapter, app/actions.ts's updatePageTitle(pageId, newTitle)
runs a real prisma.page.update() with no auth check anywhere in the
function body, then calls updateTag() to invalidate the cache.

CALLING IT WITH NO AUTHENTICATION IN PLACE
------------------------------
Since Chapter 9 (Admin Authentication) hasn't happened yet in this
course, there is genuinely no login system, no session check, and no
middleware/proxy protecting this Server Action at all. Calling
updatePageTitle(somePageId, 'A New Title') - whether from a real form,
a test script, or the browser's own dev tools - succeeds immediately,
with the database row's own title column actually changing.

CONFIRMATION
------------------------------
Querying that same page afterward (e.g. via Prisma Studio, or by
re-visiting the page's own URL) shows the new title rendered - proving
the mutation genuinely took effect, not just that the function call
returned without error.

WHY THIS WORKS AS AN ANSWER
------------------------------
It correctly identifies that nothing in this course so far would block
the call - no session, no middleware, no permission check - and
verifies the mutation actually persisted by checking the database's own
state afterward, rather than just trusting the function didn't throw.
This is the exact demonstration this chapter's own warn-box is
describing: a real, currently-exploitable gap, not a hypothetical one.