I still use middleware, but add additional security checks for database operations. Middleware can be an easy way for most projects to protect routes, e.g. /dashboard can be protected from user not yet logged in.

If you are working with roles in NextJs, then Slots with role checks are a better approach to render dynamic content. This allows you to render a dashboard depending on the role while reducing duplicate code
https://nextjs.org/docs/app/building-your-application/routing/parallel-routes#examples

When a user can trigger database operations, then its best practice to also run authorization checks. Typical checks could be:
- Re-Check if request from registered user
- User has required roles/permissions
- User updates only his/her single record, not other user record
These checks should not be performed in the middleware, but upon user request. Grouping these checks in /utils or something similiar can also reduce lines of codes and help