#Middleware

Protect Next.js routes with middleware - read the session, redirect unauthenticated users, scope with a matcher, and gate by role - plus where to enforce auth server-side.