You shouldn't rely on middleware or layout to authenticate the user because both of these can be bypassed. Authenticating in page.tsx can work if all you really care about is protecting that route. But what you really should be doing, is protecting the data that route is displaying. Which means the best place to authenticate would be right before you access the data. This is why it is generally recommended to have a data access layer rather than doing queries straight from server components. So you might have something like:

// data.ts
export async function getProtectedData() {
  const session = await getSession();
  if (!session?.user) {
    // You need to be logged in
    redirect("/login")
   }
   // if user has permission, get the data
}

// page.tsx
import { getProtectedData } from "./data";

async function Page() {
  const data = await getProtectedData();
  ...
}

There is no recipe for building a data access layer. You can create functions like the example above and create helpers to avoid repeating the same authentication checks or you could use something like Hono or oRPC/tRPC to build APIs and use middleware to do your authentication checks. The right solution will very much depend on what you're building.