diff --git a/backend/src/middleware/auth.ts b/backend/src/middleware/auth.ts
index 9a1a5cd..36c7cb3 100644
--- a/backend/src/middleware/auth.ts
+++ b/backend/src/middleware/auth.ts
@@ -1,21 +1,26 @@
 import { Request, Response, NextFunction } from "express";
+import { drizzle } from 'drizzle-orm/node-postgres';
 import { users } from "../db/schema.ts";
+import { eq } from 'drizzle-orm';
+
+const db = drizzle(process.env.DATABASE_URL!);
 
 export async function auth(
   req: Request,
   res: Response,
   next: NextFunction
 ) {
-  // Either get the user profile of the logged in user, 
-  // or default to anonymous permissions 
+  // read/decode jwt
 
-  const token = req.header("Authentication");
-
-  if (!token) {
-    return res.status(401).json({
-      error: "Missing Token",
-    });
-  };
 
   next();
 };
+
+async function getUserPermissions(userId: string) {
+  const resp = await db
+    .select({ perms: users.permissions })
+    .from(users)
+    .where(eq(users.id, userId));
+
+  return resp;
+}
diff --git a/backend/src/routes/users.ts b/backend/src/routes/users.ts
index cb8a1aa..ea361dd 100644
--- a/backend/src/routes/users.ts
+++ b/backend/src/routes/users.ts
@@ -7,7 +7,7 @@ import { auth } from '../middleware/auth.ts';
 const db = drizzle(process.env.DATABASE_URL!);
 export const usersRouter = express.Router();
 
-usersRouter.get("/getUser/:userId", auth, async (req: Request, res: Response) => {
+usersRouter.get("/getUser/:userId", async (req: Request, res: Response) => {
   const { userId } = req.params;
 
   const resp = await db.select()