How Middleware Works — The Chain Pattern

import express, { Request, Response, NextFunction } from 'express';

// Middleware type: (req, res, next) => void
// Call next() to continue the chain
// Call next(err) to jump to ERROR middleware
// Call res.send/json/end to terminate the chain

const app = express();

// ━━ Regular middleware (called for every request) ━━
app.use((req: Request, res: Response, next: NextFunction) => {
  console.log(`[${req.method}] ${req.path}`); // logs every request
  next(); // MUST call next() or the request hangs forever
});

// ━━ Route-specific middleware ━━
function requireAuth(req: Request, res: Response, next: NextFunction): void {
  const token = req.headers.authorization?.split(' ')[1];
  if (!token) {
    res.status(401).json({ error: 'No token' });
    return; // ← return after sending, or next() will be called twice
  }
  // Attach user to req for downstream handlers
  (req as any).user = verifyToken(token);
  next();
}

// ━━ Multiple middleware on a single route ━━
app.get('/admin',
  requireAuth,       // middleware 1: verify token
  requireRole('admin'), // middleware 2: check role
  async (req, res) => {  // handler: actual business logic
    res.json({ message: 'Admin area' });
  }
);

// ━━ Router-level middleware ━━
import { Router } from 'express';
const protectedRouter = Router();
protectedRouter.use(requireAuth); // applies to ALL routes on this router
protectedRouter.get('/profile', (req, res) => res.json({ profile: {} }));
protectedRouter.get('/settings', (req, res) => res.json({ settings: {} }));

app.use('/api/v1', protectedRouter);

function verifyToken(token: string) { return { id: '1', role: 'user' }; }
function requireRole(role: string) {
  return (req: Request, res: Response, next: NextFunction) => { next(); };
}