From 9e645fe06c62469aaef0118ba61f7b55bd4e6420 Mon Sep 17 00:00:00 2001
From: Roy Dumblauskas <roydumblauskas@gmail.com>
Date: Sat, 23 May 2026 18:03:46 -0500
Subject: [PATCH] auth middleware

---
 backend/src/index.ts           |  1 +
 backend/src/middleware/auth.ts | 21 +++++++++++++++++++++
 backend/src/routes/users.ts    |  3 ++-
 3 files changed, 24 insertions(+), 1 deletion(-)
 create mode 100644 backend/src/middleware/auth.ts

diff --git a/backend/src/index.ts b/backend/src/index.ts
index 4f64b62..0f41afd 100644
--- a/backend/src/index.ts
+++ b/backend/src/index.ts
@@ -5,6 +5,7 @@ import { blocksRouter } from './routes/blocks.ts';
 import { imagesRouter } from './routes/images.ts';
 import { authRouter } from './routes/auth.ts';
 import { usersRouter } from './routes/users.ts';
+import { auth } from './middleware/auth.ts';
 
 const app = express();
 app.use(express.json());
diff --git a/backend/src/middleware/auth.ts b/backend/src/middleware/auth.ts
new file mode 100644
index 0000000..9a1a5cd
--- /dev/null
+++ b/backend/src/middleware/auth.ts
@@ -0,0 +1,21 @@
+import { Request, Response, NextFunction } from "express";
+import { users } from "../db/schema.ts";
+
+export async function auth(
+  req: Request,
+  res: Response,
+  next: NextFunction
+) {
+  // Either get the user profile of the logged in user, 
+  // or default to anonymous permissions 
+
+  const token = req.header("Authentication");
+
+  if (!token) {
+    return res.status(401).json({
+      error: "Missing Token",
+    });
+  };
+
+  next();
+};
diff --git a/backend/src/routes/users.ts b/backend/src/routes/users.ts
index 7cb6368..cb8a1aa 100644
--- a/backend/src/routes/users.ts
+++ b/backend/src/routes/users.ts
@@ -2,11 +2,12 @@ import { drizzle } from 'drizzle-orm/node-postgres';
 import { eq } from 'drizzle-orm';
 import { users } from '../db/schema.ts';
 import express, { Request, Response } from "express";
+import { auth } from '../middleware/auth.ts';
 
 const db = drizzle(process.env.DATABASE_URL!);
 export const usersRouter = express.Router();
 
-usersRouter.get("/getUser/:userId", async (req: Request, res: Response) => {
+usersRouter.get("/getUser/:userId", auth, async (req: Request, res: Response) => {
   const { userId } = req.params;
 
   const resp = await db.select()