# Nextjs Data Access Layer

> Secure, reusable data access patterns with DTOs and Taint checks. Use when building a data access layer with DTOs and server-side taint checking in Next.js. (triggers: **/lib/data.ts, **/services/*.ts, **/dal/**, DAL, Data Access Layer, server-only, DTO)

- Skill: `comeonoliver/nextjs-data-access-layer` (Agent Skill)
- Install (CLI): `npx skillmds@latest add comeonoliver/nextjs-data-access-layer`
- Raw SKILL.md: https://api.skillmd.com/api/skills/comeonoliver/nextjs-data-access-layer/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Web & Frontend
- Author: ComeOnOliver (https://skillmd.com/u/comeonoliver)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/comeonoliver/nextjs-data-access-layer

---


# Data Access Layer (DAL)

## **Priority: P1 (HIGH)**

Centralize all data access (Database & External APIs) to ensure consistent security, authorization, and caching.

## Implementation Guidelines

- **Architecture**: Create a **Data Access Layer (DAL)** in a **`services/`** or **`lib/data.ts`** file. Use **`import 'server-only'`** to prevent leaking backend logic to the client bundle.
- **DTOs**: Always transform raw DB/API data into **Data Transfer Objects (DTOs)** before returning to components. This prevents leaking sensitive fields (e.g., `passwordHash`).
- **Security**: Use **`taintObjectReference`** or **`taintUniqueValue`** from the **`experimental_taint`** API to ensure sensitive data never accidentally reaches Client Components.
- **Authorization**: **Colocate auth checks** inside every DAL function. Don't rely on the UI layer to enforce safety. Use **`await auth()`** to verify the user.
- **Caching**: Wrap DAL functions in **`cache()`** from React to deduplicate requests within a single render cycle, preventing redundant DB/API calls.
- **Error Handling**: Throw **standardized errors** (e.g., `NotFoundError`, `UnauthorizedError`) to be caught by **Next.js `error.tsx`** or **`notFound()`**.

## Limitations

- **Client Components**: Cannot import DAL files. Must use Server Actions or Route Handlers as bridges.

## Anti-Patterns

- **No auth checks outside DAL**: Auth verification must live inside DAL functions.
- **No raw ORM instances returned**: Transform to plain DTO objects before returning.
- **No `fetch('localhost/api')` in Server Components**: Call DAL functions directly.
- **No DAL imports in Client Components**: Use Server Actions or Route Handlers as bridges.