Data Access Layer (DAL)

Priority: P1 (HIGH)

Centralize all data access (Database & External APIs) to ensure consistent security, authorization, and caching.

Implementation Guidelines

• Architecture: Create a Data Access Layer (DAL) in a services/ or lib/data.ts file. Use import 'server-only' to prevent leaking backend logic to the client bundle.
• DTOs: Always transform raw DB/API data into Data Transfer Objects (DTOs) before returning to components. This prevents leaking sensitive fields (e.g., passwordHash).
• Security: Use taintObjectReference or taintUniqueValue from the experimental_taint API to ensure sensitive data never accidentally reaches Client Components.
• Authorization: Colocate auth checks inside every DAL function. Don't rely on the UI layer to enforce safety. Use await auth() to verify the user.
• Caching: Wrap DAL functions in cache() from React to deduplicate requests within a single render cycle, preventing redundant DB/API calls.
• Error Handling: Throw standardized errors (e.g., NotFoundError, UnauthorizedError) to be caught by Next.js error.tsx or notFound().

Limitations

• Client Components: Cannot import DAL files. Must use Server Actions or Route Handlers as bridges.