Auth checked only in the UI in Next.js

In every Route Handler and Server Action that reads or writes user data, load the session from cookies or from your auth library on the server, and stop when there is no user. Do the same for admin actions with an explicit role check stored somewhere the user cannot edit.

A layout guard is fine as a convenience so people do not see a flash of the wrong page. Keep the check next to the data.

export async function POST(request: Request) {
  const user = await getCurrentUser();
  if (!user) {
    return new Response("Unauthorized", { status: 401 });
  }
  // use user.id from the session, not from the JSON body
}

Review the middleware or proxy matcher. If it is the only check, a path it does not list is unprotected.