Next.js Data Access Layer
Secure, reusable data access patterns with DTOs and Taint checks.
SKILL.md
Full skill instructions
Data Access Layer (DAL)
Priority: P1 (HIGH)
Centralize all data access (Database & External APIs) to ensure consistent security, authorization, and caching.
Principles
- Server-Only: Must include
import 'server-only'to prevent Client bundling. - Auth Co-location: Auth checks (
session.role) must be inside the DAL function. - DTO Transformation: Return plain objects (DTOs), never raw ORM instances.
- No Internal Fetch: Call DAL functions directly. Do not
fetch('localhost/api').
Implementation
| Approach | When to use | Reference |
|---|---|---|
| API Gateway (BFF) | Enterprise apps with separated Backend (NestJS). | Pattern A |
| Direct DB | Fullstack apps or Admin Panels. | Pattern B |
Limitations
- Client Components: Cannot import DAL files. Must use Server Actions or Route Handlers as bridges.