How do I protect a route?

Routes are public by default. To require a signed-in caller, read the current user at the top of the handler and refuse when there is not one.

1import { getCurrentUser, res, res_401 } from "apiker";
2 
3const myAccount = async () => {
4  const user = await getCurrentUser();
5  if (!user) return res_401();
6 
7  return res({ email: user.email });
8};

For several routes, write it once as a middleware and chain it:

1import { forwardToMiddleware, getCurrentUser, isCurrentUserAdmin, res_401 } from "apiker";
2 
3const requireUser = async () => (await getCurrentUser()) ? undefined : res_401();
4const requireAdmin = async () => (await isCurrentUserAdmin()) ? undefined : res_401();
5 
6const routes = {
7  "/me": params => forwardToMiddleware(params, [requireUser, myAccount]),
8  "/admin/report": params => forwardToMiddleware(params, [requireUser, requireAdmin, report])
9};

getCurrentUserId is cheaper when you only need to know who is calling — it reads the token without loading the stored record.