can someone give suggestion on role-based route protection? say for example students may not go to teachers' dashboard., do I have to query the db everytime to check user's role from public.role table?

Yes this is how you would do it.