nextjs-app-structure-guard

Next.js App Router rendering boundaries keep server-only modules out of client components by placing 'use client' only on smallest leaf nodes. This prevents importing database clients or secret managers into client bundles, reducing bloat and avoiding leaked secrets.

The best way to structure Next.js App Router route handlers and middleware is to keep route handlers thin by delegating business logic to services, and narrow middleware to lightweight tasks like auth checks and redirects without database access.

To validate input in Next.js server actions, use schema validation for incoming data and re-verify user authorization at the top of the action. This ensures secure, testable services while maintaining proper server/client boundary enforcement.

Next.js App Router code needs explicit caching directives for data fetches to avoid serving stale data to users. Enforcing explicit cache policies on fetches and cache handlers ensures data freshness and aligns with the framework's rendering model.

You should not use business logic or database access inside Next.js middleware. Middleware should be narrowed to lightweight tasks such as authentication checks, redirects, and header manipulation to maintain performance and proper App Router boundaries.

To keep Next.js generateMetadata and generateStaticParams functions pure, avoid side effects and secret access within them. Enforcing pure functions in these App Router segments ensures testable, secure server-side rendering without unexpected state mutations.