Middleware

Middleware = (request, next) => Promise<HttpResponse> | HttpResponse

Defined in: src/http/Route.ts:81

Per-request hook that runs around a handler. Receives the request and a next() thunk; either short-circuit by returning your own response, or call next() and pass its result through (optionally wrapped, decorated, or re-thrown).

next() optionally takes a replacement request — pass one to enrich what the handler (and any inner middleware) sees, e.g. to inject a generated request id or a verified CSRF token as a header. Omit the argument to forward the request unchanged; the two forms are otherwise identical, so existing next() call sites keep working.

Examples (all shipped in src/http/middleware/):

• BearerTokenAuth({ tokens }) — checks Authorization: Bearer, short-circuits with 401 on mismatch.
• IpAllowlist({ allow }) — checks remoteAddress (or a configured extractor) against a CIDR list, short-circuits with 403 if not allowed.

Throwing HttpError(status, message) is the idiomatic short-circuit: the global error handler catches it and emits the right response.

Parameters

request

HttpRequest

next

(request?) => Promise<HttpResponse>

Returns

Promise<HttpResponse> | HttpResponse