Next.js Data Access Layer

Priority: P1 (HIGH)

Centralize all data access (Database & External APIs) to ensure consistent security, authorization, and caching.

Principles

1. Server-Only: Must include import 'server-only' to prevent Client bundling.
2. Auth Co-location: Auth checks (session.role) must be inside the DAL function.
3. DTO Transformation: Return plain objects (DTOs), never raw ORM instances.
4. No Internal Fetch: Call DAL functions directly. Do not fetch('localhost/api').

Implementation

| Approach | When to use | Reference | | :-------------------- | :----------------------------------------------- | :---------------------------------- | | API Gateway (BFF) | Enterprise apps with separated Backend (NestJS). | Pattern A | | Direct DB | Fullstack apps or Admin Panels. | Pattern B |

Limitations

• Client Components: Cannot import DAL files. Must use Server Actions or Route Handlers as bridges.