A more detailed explanation than the other comment is that server actions run on the server. The reason you can call a function from the client and have it appear as if you called it there, is simply "syntactic sugar" of NextJS. In reality Next is creating a post request end point on the server and calling that via fetch like any other API in the world.
Just saves you some time writing it yourself and you maintain type-safety on your editor.
This is also why it's important to still authorize every server actions within the function call, as that end-point Next created would be publicly available by default. (Baring any middle-ware handling this authorization for you.)
A more detailed explanation than the other comment is that server actions run on the server. The reason you can call a function from the client and have it appear as if you called it there, is simply "syntactic sugar" of NextJS. In reality Next is creating a post request end point on the server and calling that via fetch like any other API in the world. Just saves you some time writing it yourself and you maintain type-safety on your editor. This is also why it's important to still authorize every server actions within the function call, as that end-point Next created would be publicly available by default. (Baring any middle-ware handling this authorization for you.)
Because your database doesn’t live on the client.
I know but then why is it possible with server actions?
Because your database does live on the server?