Business logic in isomorphic ReactJS webapp?

Question

Node.js

Webapp on reactJS, flux, nodejs+express
The user clicks on the button, the server part receives information from the database (read-only for the user), modifies it, and saves it to where it came from.
The bottom line is that I need to do part of the manipulation with the database so that the user who knows JS cannot influence it.
1. How is it implemented correctly?
2. If you know some examples from github - give a link, please