When a user logs in, I generate a session in my database and I create a cookie with the session.id. When a user attempts to use a protected Server Action, I SELECT the session in my database with a LEFTJOIN with the user.id and check permissions. This works live, but when running testing, I'm using the Next.js cookieStore and the server actions are not generating the actual cookies. When I was using API Routes, I could grab the cookie from the header and toss into the next API route, but I'm more interested in using server actions for type saftey and lack of need for an external API. I could rremove the auth features from these server actions, and instead handle where necessary, this might be smart because then I don't need to check permissions if I'm running mulitple functions at once, then I can just get the permission at the top-level of the server action and toss into multipe actions, but uncertain of best practice.