Compose middleware

Before choosing a tool or writing more code, make the requirement concrete. A request id and logger run globally, while note ownership checks live only on the notes router.

Middleware is powerful because it can observe, change, stop, or forward a request; that power makes scope and order critical. The useful target is not encyclopedic coverage. Make one deliberate choice, observe its consequences, and know which requirement would make you revise it.

A common failure is to make every helper global and let unrelated routes pay its cost or inherit its assumptions. The happy path may still work, which makes the mistake easy to miss. mount middleware at the narrowest useful scope and document whether it reads, changes, stops, or forwards. Keep the first version small enough that every important input and output remains visible.

This supports the module goal: Accept useful input while keeping parsing, validation, state, and privilege boundaries visible. Capture the request, command, trace, screenshot, test result, or other evidence that proves the result.

Write an order diagram for parsing, authentication, rate limiting, authorization, handler, and error processing. Change one condition on purpose, predict the result, and compare the prediction with what actually happened.