Is publicProcedure safe to use with this kind of approach ?

// user.ts
export const userRouter = createTRPCRouter({
  getById: publicProcedure
    .input(z.object({ id: z.string() }))
    .query(async ({ ctx, input }) => {

      const user = await ctx.db.query.users.findFirst({
        where: (model, { eq }) => eq(model.id, input.id),
      });

      if (!user) {
        throw new Error("User not found");
      }

      return user;
    }),
});

// authorization.ts
export const authorizationRouter = createTRPCRouter({
  canAccess: publicProcedure
    .input(z.object({ key: z.string() }))
    .query(async ({ ctx, input }) => {

      // TODO: Implement a real API_KEY check & update the user model to have an API_KEY field
      const user = await ctx.db.query.users.findFirst({
        where: (model, { eq }) => eq(model.id, input.key),
      });

      return user;
    }),
});

// user/[id]/route.ts
const userByIdHandler = async (
  req: NextRequest,
  { params: { id } }: { params: { id: string } },
) => {
  try {
    // Check for ID
    if (!id || typeof id !== "string") {
      return NextResponse.json({ message: "Invalid ID" }, { status: 400 });
    }

    // Get the key from req header and check key
    const key = req.headers.get("Authorization");
    if (!key) {
      return NextResponse.json({ message: "Invalid key" }, { status: 400 });
    }

    // Create context and caller
    const ctx = await createTRPCContext({ req });
    const caller = createCaller(ctx);

    const access = await caller.authorization.canAccess({ key: key });

    if (!access) {
      return NextResponse.json({ message: "Unauthorized" }, { status: 401 });
    }

    const user = await caller.user.getById({ id });

    return NextResponse.json(user, { status: 200 });
  } catch (cause) {
    if (cause instanceof TRPCError) {
      // An error from tRPC occurred
      const httpCode = getHTTPStatusCodeFromError(cause);
      return NextResponse.json(cause, { status: httpCode });
    }
    // Another error occurred
    console.error(cause);
    return NextResponse.json(
      { message: "Internal server error" },
      { status: 500 },
    );
  }
};

export const GET = userByIdHandler;